Cannabis IRS Audit Risk: Why the Industry Gets Extra Scrutiny

Cannabis businesses get audited more than almost any other industry. The IRS has said as much publicly through its enforcement priorities, and the numbers confirm it: the combination of cash-intensive operations, the IRC 280E deduction limitation, and restricted banking access creates a profile that practically invites examination. As of this writing, marijuana remains a Schedule I controlled substance under federal law, 280E still applies in full, and no rescheduling or legalization bill has been enacted. That means every cannabis operator is filing returns under a tax regime that treats their business as fundamentally different from every other legal enterprise, and the IRS knows exactly where to look for mistakes.

Why does the IRS focus on cannabis businesses?

Because the industry checks every box that the IRS uses to identify high-risk audit targets.

The first is cash volume. Despite growing access to banking in some states, a large share of cannabis transactions still settle in cash. Many dispensaries, cultivators, and processors operate partially or entirely outside the traditional banking system because federally chartered banks remain reluctant to serve businesses that traffic in a Schedule I substance. When a business handles hundreds of thousands (or millions) of dollars in cash annually, the IRS treats it as inherently higher risk for underreporting. This is not speculation on the IRS’s part. It is a statistical reality that cash-heavy businesses have higher rates of unreported income across every industry, and the IRS allocates examination resources accordingly.

The second is the 280E problem. Under IRC 280E, a business that traffics in a controlled substance listed in Schedule I or II of the Controlled Substances Act cannot deduct or credit any amount paid or incurred in carrying on the trade or business. The only offset the business gets against gross receipts is cost of goods sold (COGS), because COGS is a component of gross income, not a deduction. This distinction, explained in detail in our 280E deduction limitation guide, means that the line between COGS and operating expenses is worth tens or hundreds of thousands of dollars in tax. The IRS knows that cannabis operators have a powerful incentive to classify as much as possible as COGS rather than as a disallowed operating expense, and auditors are trained to scrutinize that classification aggressively.

The third is the IRS’s Cash Intensive Business (CIB) program. This is a dedicated enforcement initiative within the IRS Small Business/Self-Employed Division that targets industries where cash is the primary medium of exchange. Cannabis, along with restaurants, car washes, laundromats, and similar businesses, falls squarely within CIB’s scope. The CIB program uses indirect methods of income verification (bank deposit analysis, source and application of funds, net worth analysis) to test whether reported income matches the taxpayer’s economic activity. If your dispensary reports $1.2 million in gross receipts but your bank deposits, inventory purchases, and lifestyle suggest $1.8 million in economic activity, the CIB examiner will reconstruct your income and assess the difference.

What does a cannabis audit actually look at?

The IRS is checking two things: whether you reported all your income, and whether you correctly applied 280E to your deductions.

On the income side, the examiner will request your point-of-sale records, bank statements, cash logs, inventory records, and third-party data (state seed-to-sale tracking systems, if available). They will compare your reported gross receipts to the volume of product you purchased or produced, multiplied by your average selling price, adjusted for inventory changes. If the math does not reconcile, you have a problem. The examiner will also look for unreported income from ancillary sources: accessories, branded merchandise, consulting fees, management fees from related entities, and any other revenue streams that may not flow through the primary POS system.

On the deduction side, the examiner will work through every expense you deducted or included in COGS and test it against the 280E framework. The core question is whether each cost is properly characterized as cost of goods sold (allowed), a deduction of a separate non-trafficking trade or business (allowed, if you have one), or a disallowed expense of the trafficking business (not deductible). Our COGS calculation guide covers the mechanics in detail, but the audit context is this: the examiner is looking for operating expenses that have been reclassified as COGS to circumvent 280E. Common targets include management salaries allocated to production, facility costs allocated entirely to cultivation or manufacturing when the facility also houses retail or administrative functions, and marketing or compliance costs included in inventory overhead.

The examiner will also look at your accounting method. If you use the full absorption method under IRC 263A to capitalize indirect production costs into inventory, the allocations need to be supportable. If you use the reseller’s method under the simplified production method, the categories need to be consistent with the regulations. A method that shifts year to year, or that uses different allocation percentages without a change in underlying facts, will draw scrutiny.

How does limited banking access increase audit risk?

It creates documentation gaps that the IRS can exploit.

A business that runs through a bank account has an independent, third-party record of every deposit and every payment. The IRS can subpoena bank records and match them against the return line by line. A business that operates primarily in cash does not have that automatic verification layer. Cash receipts depend on internal controls (POS system logs, daily cash counts, safe logs, armored car receipts) that the IRS trusts less than bank records because they are generated by the taxpayer, not by an independent institution.

This does not mean cash-intensive businesses are presumed to be cheating. It means they carry a heavier burden of proof on the income side, and the IRS has wider latitude to use indirect methods to reconstruct income. If your cash handling procedures have gaps (missing daily count sheets, periods where POS data does not reconcile with cash deposits, inventory shrinkage that is not documented and explained), the examiner will fill those gaps with assumptions that favor the government.

The practical solution is to build documentation that replaces the verification function a bank would normally provide. That means a POS system that timestamps every transaction, daily reconciliation procedures that compare POS totals to physical cash counts, armored car or safe deposit records for every cash movement, and a trail that connects the cash from the point of sale to its ultimate disposition (bank deposit, vendor payment, payroll, or owner distribution). The better your internal cash controls, the less room the examiner has to reconstruct income using methods that will almost always produce a higher number than what you reported.

What penalties apply when the IRS finds problems?

The standard penalty framework applies, but the dollar amounts are larger because 280E inflates the tax base.

The accuracy-related penalty under IRC 6662 is 20% of the underpayment attributable to negligence, disregard of rules, or a substantial understatement of income tax. A substantial understatement exists when the understatement exceeds the greater of 10% of the correct tax or $5,000. For cannabis businesses with high effective tax rates (often 50% to 70% of pre-280E taxable income), even a modest reclassification of expenses from COGS to disallowed deductions can produce an understatement that crosses the substantial threshold.

The fraud penalty under IRC 6663 is 75% of the underpayment attributable to fraud. Unreported cash income is one of the most common bases for a fraud finding, and cash-intensive businesses are disproportionately exposed to this risk. The burden of proof shifts to the government for fraud, but the IRS’s indirect methods of income reconstruction are well-established and routinely upheld by courts.

The failure-to-pay penalty under IRC 6651(a)(2) is 0.5% of the unpaid tax per month, up to 25%. Interest accrues on top of the penalty from the original due date of the return. For cannabis businesses that owe large balances because of 280E (which is common, given the high effective tax rates), the failure-to-pay penalty and interest compound quickly.

Why do estimated tax payments matter so much for cannabis?

Because 280E produces effective tax rates that most business owners do not expect, and the quarterly payment obligations are correspondingly large.

A non-cannabis business with $2,000,000 in gross receipts might have $1,600,000 in total deductions (COGS plus operating expenses), producing $400,000 in taxable income. A cannabis business with the same gross receipts might have $1,200,000 in COGS and $400,000 in disallowed operating expenses, producing $800,000 in taxable income, double the non-cannabis result, on the same economic profit. The quarterly estimated tax payments need to reflect this inflated tax liability, not the intuitive estimate based on how much cash the business actually has left after paying its bills.

The estimated tax penalty under IRC 6654 (for individuals) and IRC 6655 (for corporations) applies when a taxpayer fails to make required quarterly payments. The safe harbor for individuals is 100% of the prior year’s tax (110% if AGI exceeds $150,000) or 90% of the current year’s tax, whichever is smaller. For corporations, the safe harbor is 100% of the prior year’s tax. Missing even one quarterly payment can trigger the penalty, and because cannabis tax liabilities are large relative to cash flow, the temptation to defer a $60,000 or $80,000 quarterly payment is real. The penalty is essentially interest on the underpayment, computed at the federal short-term rate plus 3 percentage points, and it is not discretionary. The IRS assesses it automatically.

The right approach is to project the full-year tax liability under 280E at the start of the year, divide by four, and make the payments on time. If the business is growing and current-year income will exceed the prior year, use the annualized income installment method to avoid underpayment. The worst outcome is an April surprise where the business owes a six-figure balance plus penalties and interest, on top of the cash flow pressure that 280E already creates.

What can I do to reduce audit risk right now?

You cannot eliminate the risk. Cannabis businesses will be audited at higher rates than other industries as long as 280E and the cash-intensive business profile exist. But you can make the audit go well instead of badly, and the gap between those two outcomes is enormous.

• Use a POS system that integrates with your accounting software. Manual sales tracking, spreadsheet-based inventory, and end-of-day cash counts without a POS trail are the single largest audit vulnerability for dispensaries. The POS system creates a timestamped, transaction-level record that an examiner can reconcile against your general ledger. If you are still running on spreadsheets, fix this first.
• Adopt a 280E-specific accounting method and apply it consistently. Choose a COGS methodology (full absorption under 263A for cultivators and manufacturers, the reseller’s method for dispensaries that only purchase and sell finished product) and document it in a written accounting policy. Apply the same allocations year over year unless the underlying facts change. Inconsistency in method is one of the first things an examiner flags.
• Separate cannabis operations from non-cannabis operations. If your business has both cannabis and non-cannabis revenue streams (accessories, consulting, management fees, real estate), segregate them in your chart of accounts, your entity structure, or both. Expenses attributable to the non-cannabis activity are deductible, but only if you can prove they belong to a separate trade or business. Commingling the two in one set of books makes the separation nearly impossible to defend. Our entity structure guide covers how different entity choices affect this separation.
• Document your COGS calculations in detail. Keep contemporaneous records of every cost included in COGS: purchase invoices for product, direct labor records (hours, rates, allocation between production and non-production), facility cost allocations (square footage used for cultivation/manufacturing versus retail/admin), and any indirect costs capitalized under 263A. An examiner who sees a clean, well-documented COGS schedule with supporting workpapers is less likely to reclassify aggressively than one who sees a single number on the return with no backup. The COGS calculation guide walks through the allocation mechanics.
• Reconcile cash daily and keep the records permanently. Daily cash counts, POS-to-cash reconciliations, safe logs, armored car manifests, and bank deposit slips should be retained for at least seven years (the IRS’s general audit statute is three years under IRC 6501, but extends to six years for substantial omissions and has no limit for fraud). Do not discard cash handling records after filing the return. They are your primary defense against an income reconstruction.
• Make estimated tax payments on time and in the right amounts. Calculate the payments based on 280E-adjusted taxable income, not on the cash profit the business generates after paying operating expenses. Underpaying estimates triggers automatic penalties and signals to the IRS that the taxpayer may not understand (or is not complying with) the 280E rules.
• Pay attention to state compliance. Cannabis tax obligations vary dramatically by state, from gross receipts taxes to per-unit excise taxes to income taxes that may or may not conform to 280E. A state audit can trigger a federal audit and vice versa, so compliance failures in one jurisdiction increase risk in the other. Our multistate tax guide covers the state-level landscape.

Is the audit environment going to change?

Various proposals to reschedule marijuana, repeal 280E, or legalize cannabis at the federal level have been introduced in Congress. None has been enacted into law as of this writing. Until one is, the current framework applies in full: marijuana is Schedule I, 280E applies, and the IRS’s cash-intensive business enforcement program treats cannabis operators as high-priority targets.

Planning around a potential change in the law is reasonable. Filing your returns as if the law has already changed is not. Every cannabis return filed today should comply with 280E as it currently exists, apply COGS using a defensible method, and report all income (including cash). If the law changes in the future, returns can be amended. If the law does not change and your returns assumed it would, you are exposed to deficiency assessments, penalties, and interest going back to the filing date.

Related guides:

• Cannabis Ancillary Business Tax Planning
• Cannabis Cost Of Goods Sold Cogs Calculation
• Cannabis Entity Structure Llc Scorp C Corp
• Cannabis Payroll Employment Tax 280E
• Cannabis Real Estate Leasing Tax Treatment

Related guides:

• Beneficial Ownership Information (BOI) Reporting: FinCEN Requirements for Small Businesses

This guide is general information, not tax advice for your specific situation. Which points apply, and how, depends on your facts.