IRS Audit Triggers: The Red Flags That Increase Your Audit Risk and How to Prevent Them
The IRS audits approximately 0.4% of individual returns overall, but the audit rate varies dramatically based on specific factors. Returns reporting income over $1 million face a 1.1% audit rate (historically up to 8%+ before budget cuts). Schedule C filers with high income and large deductions are audited at 2-3x the average rate. Certain deductions and activities act as “red flags” that increase the statistical likelihood of an audit. The IRS uses the Discriminant Information Function (DIF) score, a computer-generated score that compares each line item on a return against statistical norms for that income level and occupation. Returns with high DIF scores (meaning the numbers deviate significantly from the norm) are flagged for potential examination. Understanding what triggers a high DIF score allows business owners to prepare accurate, well-documented returns that reduce audit risk, and to have proper documentation ready if an audit does occur.
Known audit triggers (by risk level):
| Trigger | Risk Level | Why It Flags |
|---|---|---|
| High Schedule C income with low reported tax | Very high | DIF score flags high-income self-employed with aggressive deductions |
| Cash-intensive business (restaurant, salon, retail) | High | IRS assumes underreported income |
| Unreported income (missing 1099s) | Very high | Automatic matching program catches mismatches |
| 100% business use of a vehicle | High | IRS considers this unlikely unless a second personal vehicle exists |
| Home office deduction | Moderate | Historically abused, but legitimate claims are fine |
| Large charitable deductions (>5% of AGI) | Moderate | DIF flags deductions exceeding norms for the income level |
| Net losses on Schedule C for 3+ years | High | Triggers hobby loss inquiry (IRC 183) |
| High meals and travel deductions relative to income | Moderate | DIF comparison against industry norms |
| Cryptocurrency transactions (and failure to report) | High | IRS has compliance campaigns targeting crypto |
| Round-number entries ($10,000, $5,000, etc.) | Low-moderate | Suggests estimation rather than actual records |
| Claiming the Earned Income Credit (higher-income range) | High | High historical error/fraud rate |
| Large deductions for bad debts | Moderate | Often abused or misclassified |
What the IRS actually looks at in an audit:
| Area | Documents Requested |
|---|---|
| Business income | Bank statements, 1099s, sales records, QuickBooks reports |
| Business expenses | Receipts, invoices, canceled checks, credit card statements |
| Vehicle deduction | Mileage log (contemporaneous), insurance declaration showing business use |
| Home office | Square footage calculation, photos, utility bills, mortgage/rent documents |
| Meals | Receipts with business purpose, attendee names, date, amount |
| Charitable contributions | Acknowledgment letters, Form 8283 for non-cash over $500, appraisals for $5,000+ |
| Cash transactions | Bank deposits analysis, cash register tapes, third-party payment records |
| Employee vs. contractor classification | Contracts, invoices, Form W-9s, behavioral control analysis |
Audit defense strength by documentation level:
| Documentation Level | Audit Outcome |
|---|---|
| Complete records (receipts, logs, bank statements) | Most deductions sustained |
| Partial records (some receipts, reconstructed log) | Mixed results, some deductions disallowed |
| No records (estimates only) | Most deductions disallowed, penalties likely |
How do you reduce audit risk on deductions?
How far back can the IRS audit my business returns?
The general statute of limitations for an IRS audit is 3 years from the date you filed the return (or the due date, whichever is later). This extends to 6 years if you omit more than 25% of your gross income from the return. There is no statute of limitations for fraud or for returns that were never filed. The IRS can also extend the assessment period if you agree to it (Form 872), which sometimes happens during an ongoing audit. Keeping organized records for at least 7 years covers both the standard and extended windows.
What are the most common IRS audit triggers for small businesses?
Schedule C filers with high gross receipts and significant deductions relative to income are audited at higher rates. Specific triggers include: claiming 100% business use of a vehicle, large home office deductions relative to income, cash-intensive businesses with round-number reporting, significant charitable deductions relative to income, and repeated business losses (hobby loss rule after 3-5 years). Inconsistencies between information returns (1099s, W-2s) and your reported income generate automatic notices. High deduction-to-income ratios compared to industry averages from the IRS’s DIF (Discriminant Information Function) scoring are a primary selection criterion. An audit does not mean you did anything wrong; it means your return was statistically unusual.
How long does the IRS have to audit your tax return?
The standard statute of limitations for an IRS audit is three years from the date you filed your return or the due date, whichever is later, under IRC 6501(a). This extends to six years if you omit more than 25% of gross income from your return, which the IRS interprets broadly to include overstatements of basis in some circumstances after the Supreme Court’s Home Concrete decision. There is no statute of limitations for fraudulent returns or for returns that were never filed, meaning the IRS can audit these at any time. Signing a Form 872 (Consent to Extend the Time to Assess Tax) extends the deadline, and the IRS often requests this near the end of the three-year window to continue an open examination without rushing to closure.
Start with a Diagnostic: a CPA licensed in the US and Canada reads your file and tells you in writing what's wrong and how to fix it, three to four business days after you finish the questions. The report is $250. If you hire us for any work after that, you get the $250 back as a discount on that work. Or send us your return or your letter and get a fixed price, free.
One or two plain-English guides a week on US-Canada tax. No spam, unsubscribe anytime.
Done. The next guide will land in your inbox.
Yarik Yarosh, CPA. "IRS Audit Triggers: The Red Flags That Increase Your Audit Risk and How to Prevent Them." Blue Cloud CPA, September 5, 2026. https://bluecloudcpa.com/guides/small-business-audit-risk-factors-dif-score-documentation
This guide is general information, not tax advice for your specific situation. Which points apply, and how, depends on your facts.