A Montgomery County business owner is three months into an IRS examination. The revenue agent has been professional and responsive. They have exchanged documents, held two meetings, and scheduled a third. Then the agent cancels the meeting. A week passes with no reply to a voicemail. Then two more. The owner’s accountant says not to worry, that the IRS is slow.

That silence may be the most important thing that has happened in the case.

The Internal Revenue Manual instructs an examiner to suspend examination activity once firm indications of fraud or willfulness are established and criminal criteria are met, without disclosing to the taxpayer or representative the reason for the suspension. The IRS is not required to affirmatively disclose that fraud is being developed or that a referral to Criminal Investigation is under consideration. If the taxpayer specifically asks, however, the examiner may decline to answer but may not give a false or deceitful response. From the taxpayer’s side, the practical result may therefore be that an active civil examination abruptly goes quiet.

This guide explains what an eggshell audit is, what examiners are trained to look for, exactly how a civil examination becomes a criminal referral, the signals that suggest it has happened, why the professionals you may already have talked to cannot protect those conversations, what is actually at stake, and what to do. It is written for a business owner who is worried, not for a practitioner audience.

One thing to say plainly at the outset: if you are reading this because your audit has gone quiet, or because someone has identified themselves to you as an IRS special agent, the most useful action you can take today is to stop communicating with the IRS and speak with a criminal tax defense attorney before you say or produce anything else.

Eggshell audit is a practitioner term, not an IRS designation. It describes a civil examination in which the taxpayer, the representative, or both have reason to believe that material elements of the return or the facts underneath it could support civil fraud penalties or criminal prosecution if the IRS develops them.

The defining feature is asymmetry of knowledge in the taxpayer’s favor, at least at the start. The examiner is asking ordinary questions. The taxpayer knows there is unreported income, or that a deduction was fabricated, or that the books shown to the accountant were not the real books. Nothing about the audit looks unusual, which is exactly what makes it dangerous.

Why it matters so much is the evidentiary posture. In an ordinary audit, the worst realistic outcome is additional tax, interest, and penalties. In an eggshell audit, every document produced and every answer given may become evidence in a criminal case. There is no Miranda warning in a civil examination. There is no moment where an agent announces that the standard has shifted. And statements made to a revenue agent do not carry the protections most taxpayers assume they do.

Two common situations create this posture. The first is a taxpayer who knew the return was wrong when it was signed. The second, and more common in practice, is a taxpayer who did not focus on a problem at the time but who now, looking at the file with an examiner’s questions in mind, realizes how a pattern is going to look. The second taxpayer often has a genuine defense on willfulness. That defense is far easier to preserve with counsel involved early than to reconstruct after months of unguarded answers.

The Internal Revenue Manual draws a distinction that governs everything that follows. Indicators of fraud, commonly called badges of fraud, are signs or symptoms suggesting that actions may have been taken for the purpose of deceit or concealment. Affirmative acts, also called firm indications of fraud, are actions establishing that the taxpayer deliberately acted with the purpose of deceit, subterfuge, camouflage, concealment, or to make things seem other than what they are.

Badges open a fraud inquiry. Affirmative acts are what turn it into a referral.

Badges that recur across IRS guidance and case law include:

• Omitting entire sources of income, or omitting specific items where similar items are reported
• An inability to explain substantial increases in net worth
• Inadequately explained dealings in large amounts of currency, or a pattern of cash transactions
• Substantially overstated deductions, or deductions that are fictitious
• Maintaining two sets of books and records
• False, altered, or backdated documents and invoices
• Concealing assets, bank accounts, or sources of income
• Failing to file returns for several years despite evidence of substantial taxable income
• Implausible, inconsistent, or shifting explanations of behavior
• A history of examination adjustments for the same issue

Understanding the mechanics explains the silence. The Internal Revenue Manual lays out the sequence:

1. The examiner spots indicators. When badges of fraud are uncovered, the compliance employee must clearly document the potential indicators and raise them with the group manager. The examiner does not confront the taxpayer.
2. A fraud enforcement advisor is brought in. If the group manager agrees that the indicators warrant fraud development, the examiner contacts a fraud enforcement advisor, an IRS specialist whose role is to serve as a resource and liaison to compliance employees on fraud matters. The Office of Fraud Enforcement sets the policy governing this work.
3. The case goes into fraud development. The examiner, manager, and advisor agree on a plan of action to establish and document affirmative acts. The audit continues, and to the taxpayer it looks like a normal audit. It is not. Its purpose has changed from computing tax to building a fraud record.
4. The examination is suspended. When firm indications of fraud or willfulness are established and criminal criteria are met, the Manual directs the examiner to suspend examination activity without disclosing to the taxpayer or representative the reason for the suspension. If specifically asked whether a fraud referral is being considered or Criminal Investigation is involved, the examiner may decline to answer but may not give a false or deceitful response.
5. Form 2797 goes to Criminal Investigation. If affirmative acts exist and criminal criteria are met, the examiner prepares Form 2797, Referral Report of Potential Criminal Fraud Cases, and the case is referred through the fraud enforcement advisor to IRS Criminal Investigation for evaluation. CI can accept or decline the referral.

Step three is the part that deserves emphasis. There is a window during which the audit continues normally in appearance while its actual purpose is to develop evidence of fraud. During that window the taxpayer is typically still answering questions, still producing records, and still being cooperative, because nobody has told them anything has changed. Everything produced in that window is available to the government.

Since no one will tell you, these are the patterns that experienced practitioners treat as meaningful. None is conclusive on its own. Several together warrant immediate attention.

• Sudden, unexplained silence. The most cited signal. An active agent cancels a scheduled appointment and then does not respond to calls or emails for weeks. The IRS is sometimes genuinely slow, but an abrupt stop after momentum is different from ordinary delay.
• The agent loses interest in resolving the civil issues. An examiner who was negotiating adjustments stops trying to close the case.
• The questions change character. Questioning moves away from numbers and documents toward what you knew, when you knew it, who prepared the return, what you told the preparer, and why you did something. Those are willfulness questions.
• Requests for originals rather than copies. Original documents matter for forensic examination and for authentication at trial.
• Third-party contacts. The agent begins contacting your bank, your employees, your customers, your vendors, or your accountant.
• More people in the room. A second agent, the group manager, an attorney from Chief Counsel, or anyone taking a formal record of an interview.
• Interest in years outside the audit, particularly a pattern of similar conduct across multiple years, which is how willfulness gets proven.
• Contact from a special agent. The strongest sign of all. IRS-CI special agents are federal criminal investigators, not civil revenue agents, so their involvement means Criminal Investigation is conducting a criminal investigation connected to the contact. Their contact does not by itself establish that you are a target or that your own audit was referred, because special agents also interview witnesses and third parties. If a special agent seeks to interview you about your own tax conduct, however, treat the contact as a criminal-investigation matter and speak with counsel before answering substantive questions.

The eggshell audit assumes the taxpayer knows something the IRS has not yet found. The reverse eggshell audit inverts that assumption, and it is more dangerous precisely because the taxpayer does not know it is happening.

In a reverse eggshell audit, IRS Criminal Investigation is already involved, or the examiner already holds damaging information, but the contact with the taxpayer is conducted as an apparently routine civil examination. The taxpayer answers questions without knowing that the government already has bank records, third-party statements, a cooperating witness, or documents obtained from a vendor or former employee.

The specific danger is that a denial or an incomplete explanation, offered in good faith or out of embarrassment, becomes independent evidence of willfulness the moment the government matches it against what it already holds. A taxpayer who says something inaccurate to an agent has not merely failed to help. That statement can become part of the proof that the underlying conduct was intentional, and in some circumstances can support separate charges.

The practical consequence for anyone with real exposure is that you cannot calibrate your answers on an assumption about what the IRS knows. That assumption is not verifiable from your side of the table, and being wrong about it is costly.

Most business owners assume that what they tell their accountant is confidential in the way that what they tell their lawyer is confidential. In a criminal tax matter, that assumption is wrong, and it causes more damage in this area than almost anything else.

There is no general accountant-client privilege under federal law. Some states have confidentiality rules, and professional standards impose duties of confidentiality, but those are not the same as an evidentiary privilege in a federal criminal proceeding.

Section 7525 does not fill the gap. Internal Revenue Code Section 7525 created a limited confidentiality privilege for tax advice between a taxpayer and a federally authorized tax practitioner, extending common law protections that would apply to an attorney. But the privilege is expressly limited: it may be asserted only in noncriminal tax matters before the IRS and noncriminal tax proceedings in federal court. It also does not apply to specified written communications made in connection with the promotion of a person’s direct or indirect participation in a tax shelter. Most importantly here, Section 7525 provides no privilege in a criminal tax matter or criminal proceeding, which is exactly when it would matter most.

The consequences are concrete. In a criminal tax investigation your accountant can be subpoenaed and compelled to testify about what you said. The accountant’s workpapers, notes, engagement records, and emails can be obtained. And your accountant may become a witness for the government, sometimes a central one, since the accountant can testify about what information you provided and what you withheld. In some situations the accountant will need separate counsel of their own.

The practical takeaway is simple and consequential: in a matter with criminal exposure, the first professional you speak with should be an attorney, and the accounting work should be arranged through that attorney rather than around them.

Civil fraud and criminal prosecution are separate consequences arising from the same conduct, with different burdens of proof.

The civil fraud penalty. Under Internal Revenue Code Section 6663, if any part of an underpayment is attributable to fraud, a penalty of 75 percent of the portion attributable to fraud applies. It is a money penalty, and the government must prove fraud by clear and convincing evidence in the civil forum. There is no criminal record and no imprisonment, but the financial consequence is severe, and the fraud exception also removes the ordinary limitations protection on assessment.

Criminal charges. The principal Title 26 offenses:

Two additional points. First, the fine amounts stated above are the figures in Title 26; other federal sentencing provisions can permit higher fines, and restitution, supervised release, and the collateral consequences of a felony conviction sit alongside any sentence. Second, a conviction for tax evasion can collaterally estop the taxpayer from contesting the civil fraud penalty for the same taxpayer, year, and type of tax, meaning the criminal case effectively decides the civil one.

Timing. Section 6531 sets a general three-year period for criminal prosecutions arising under the internal revenue laws, but provides a six-year period for specified offenses, including tax evasion under Section 7201, false-return offenses under Section 7206(1), and certain willful failures to file or pay under Section 7203. When the limitations period begins depends on the particular offense and facts. For a Section 7206(1) false-return charge, the period generally runs from the filing of the return, subject to the timing rules incorporated through Section 6531. For Section 7201 tax evasion, later affirmative acts of evasion can affect when the offense is complete and when the limitations period begins to run.

1. Stop communicating with the IRS directly. Not by ignoring them, which is discussed below, but by routing all contact through counsel. Having a representative take over communications is an ordinary and unremarkable event in an examination.
2. Engage an attorney before anything else. The privilege analysis above is the reason this ordering matters. A conversation with an attorney is protected in a way that a conversation with an accountant is not.
3. Preserve everything. Institute a hold on documents, emails, accounting files, and backups. Do not clean anything up. This point is important enough that it is repeated in the next section.
4. Do not discuss the matter with employees, family, business partners, or your accountant. Those conversations are generally not privileged, and every person you talk to is a potential witness.
5. Let counsel assess the exposure before producing anything further. That assessment includes what the government likely already has, what the records actually show, and whether the willfulness element is genuinely contestable.
6. Engage accounting help through counsel under a Kovel arrangement where forensic or reconstructive work is needed.
7. Ask about corrective paths, honestly and early. Depending on the facts and, critically, on whether the IRS has already made contact, options may exist. They narrow considerably once an investigation is underway, which is why the assessment should happen immediately rather than after further developments.

• Never alter, destroy, backdate, or create documents. This is the most important sentence in this post. Obstruction and false-document conduct can constitute new, independent offenses that are frequently easier for the government to prove than the underlying tax charge, because they occur after the fact and are often well documented. Taxpayers with a viable defense to the original conduct have converted their cases into convictions this way.
• Never lie to an agent. Declining to answer and giving a false answer are entirely different acts with entirely different consequences. False statements to federal investigators carry their own exposure.
• Never simply go silent on your own. Abruptly ceasing to respond after months of cooperation is conspicuous and can accelerate the very scrutiny you are trying to avoid. The correct step is to have counsel enter and take over the communication, which changes who is talking rather than stopping the conversation.
• Never assume your accountant can protect the conversation. Section 7525 does not apply in criminal matters, and your accountant can be compelled to testify.
• Never have your longtime preparer handle a fraud problem. The preparer is potentially a witness, is potentially exposed themselves, and cannot cloak the conversation.
• Never file an amended return without counsel. An amended return can be treated as an admission, and it does not undo a completed offense. Whether and how to correct a filing is a legal judgment in this posture.
• Never move or retitle assets. This looks like concealment and can create additional exposure.
• Never improperly influence or coordinate testimony with potential witnesses. Do not pressure, threaten, mislead, corruptly persuade, or attempt to induce an employee, bookkeeper, family member, or other potential witness to withhold information, alter testimony or evidence, or give a false account to investigators. Conduct intended to improperly influence a witness or interfere with communications to federal investigators can constitute witness tampering or obstruction.

Federal criminal tax cases arising in Maryland are prosecuted in the United States District Court for the District of Maryland, which has a Northern Division sitting in Baltimore and a Southern Division sitting in Greenbelt. Montgomery and Prince George’s Counties are in the Southern Division, while Frederick County is in the Northern Division. Prosecution is ordinarily handled by the United States Attorney’s Office for the District of Maryland. The Department of Justice Tax Division oversees federal criminal tax enforcement and, subject to limited delegated and direct-referral exceptions, generally must authorize criminal tax charges arising under the internal revenue laws.

Several Maryland-specific practicalities are worth flagging:

• State exposure runs in parallel. The Comptroller of Maryland has its own enforcement authority, and a federal matter can have Maryland consequences. Federal and state resolutions do not automatically travel together.
• Professional licensing consequences. For physicians, attorneys, accountants, contractors, real estate professionals, and others holding Maryland licenses, a tax conviction, and in some cases a charge, carries licensing implications separate from the sentence.
• Business and immigration consequences. A conviction can affect government contracting eligibility, professional certifications, lending relationships, and, for non-citizens, immigration status. These collateral consequences frequently matter more to a client’s life than the sentence itself and should be part of the analysis from the beginning.

Certain fact patterns also carry elevated risk of the civil-to-criminal transition, and several of them are areas this firm writes about regularly: unfiled returns across multiple years, discussed in our guide on unfiled tax returns and back taxes; unpaid payroll taxes, covered in our post on the Trust Fund Recovery Penalty; unreported foreign accounts and entities, including the reporting obligations we cover in our guide on Form 5472 for foreign-owned LLCs; and cash-intensive businesses. Our guide on what triggers an IRS audit covers the return characteristics that draw attention in the first place.

An eggshell audit is a term tax controversy practitioners use, not an official IRS designation. It describes a civil IRS examination in which the taxpayer, the representative, or both have reason to believe that material elements of the return or the underlying facts could support civil fraud penalties or criminal prosecution if the IRS develops them. The audit looks ordinary from the outside. What makes it an eggshell audit is that the taxpayer knows something the examiner has not yet found. The danger is that ordinary audit conduct, answering questions, producing documents, explaining discrepancies, can supply the government with the evidence it needs, because nothing said to a revenue agent in a civil examination carries the protection people assume it does.

The Internal Revenue Manual distinguishes indicators of fraud, commonly called badges of fraud, from affirmative acts of fraud, which are firm indications that establish deliberate deceit. Recurring badges include omitting entire sources of income, omitting specific items when similar items are reported, an inability to explain substantial increases in net worth, inadequately explained dealings in large amounts of currency, substantially overstated or fictitious deductions, maintaining two sets of books, false or altered documents, concealing assets or accounts, failing to file returns for several years despite substantial income, and providing an implausible or inconsistent explanation of behavior. No single item is decisive. What moves a case toward a criminal referral is a pattern of them combined with a meaningful tax liability, and above all evidence that the conduct was willful rather than careless.

The Internal Revenue Manual sets out the path. When an examiner uncovers indicators of fraud, the examiner documents them and raises the matter with a group manager. If the manager agrees fraud development is warranted, the examiner contacts a fraud enforcement advisor, and the case can be placed in fraud development status while the examiner works to establish affirmative acts of fraud. If affirmative acts are established and criminal criteria are met, the examiner prepares Form 2797, Referral Report of Potential Criminal Fraud Cases, and the case is referred through the fraud enforcement advisor to IRS Criminal Investigation. Critically, the Manual instructs the examiner to suspend the examination when an affirmative act of fraud is established and not to discuss consideration of fraud or criminal investigation with the taxpayer. That is why the audit simply stops rather than announcing what has happened.

Because the IRS does not notify you, you have to read the signals. The most common is sudden and unexplained silence: an agent who was actively working the case cancels a scheduled appointment, stops returning calls, and goes quiet for weeks. Other signals include an agent who abruptly loses interest in resolving the civil issues, a sudden shift in questioning from numbers toward your intent, knowledge, and who prepared what, requests for original documents rather than copies, contact with your bank, employees, customers, or accountant, or the appearance of additional personnel at a meeting such as a second agent, a manager, or counsel. The strongest sign is contact from a person identifying as an IRS special agent. IRS-CI special agents are federal criminal investigators, not civil revenue agents, so their involvement means Criminal Investigation is conducting a criminal investigation connected to the contact. Their contact does not by itself establish that you are a target or that your own audit was referred, because special agents also interview witnesses and third parties. If a special agent seeks to interview you about your own tax conduct, however, you should treat the contact as a criminal-investigation matter and speak with counsel before answering substantive questions.

A reverse eggshell audit is the scenario in which IRS Criminal Investigation is already involved, or the examiner already possesses damaging information, but the contact with the taxpayer is presented as a routine civil examination. The taxpayer is answering questions without knowing the government already holds documents, third-party records, or witness statements that contradict what is being said. That asymmetry is the danger. A denial or an incomplete explanation offered in good faith can itself become evidence of willfulness once the government matches it against what it already has. The practical implication is that a taxpayer with real exposure cannot safely assume the examiner knows less than the taxpayer does, and should not calibrate answers on that assumption.

In a criminal matter, generally no, and this is one of the most important distinctions in this area. There is no general accountant-client privilege under federal law. Internal Revenue Code Section 7525 creates a limited confidentiality privilege for qualifying tax advice communications with a federally authorized tax practitioner, but it may be asserted only in noncriminal tax matters before the IRS and noncriminal tax proceedings in federal court. It also excludes specified written communications made in connection with the promotion of participation in a tax shelter. Section 7525 therefore provides no privilege in a criminal tax matter. An accountant may be subpoenaed and required to testify about nonprivileged communications, and nonprivileged workpapers, notes, and emails may be obtainable. Attorney-client privilege is different and can protect qualifying confidential communications made for the purpose of obtaining legal advice, including in criminal matters.

A Kovel arrangement, named for United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), is the mechanism by which an attorney engages an accountant to assist the attorney in providing legal advice, so that communications with the accountant may fall within the attorney-client privilege rather than waiving it. It exists because accounting analysis is often necessary for a lawyer to give competent tax advice. It has real limits. The protection holds only where the accountant genuinely assists the attorney in rendering legal advice rather than performing independent accounting work; as the court put it, if what is sought is accounting service rather than legal advice, no privilege exists. It does not retroactively protect communications or workpapers that predate the arrangement, which is why using your longtime preparer as the Kovel accountant is often unworkable. And return preparation within the engagement can waive protection.

They are separate consequences and both can follow the same conduct. The civil fraud penalty under Internal Revenue Code Section 6663 is 75 percent of the portion of an underpayment attributable to fraud, and it is a money penalty proven by the government to a clear and convincing standard in civil proceedings. Criminal charges are prosecutions requiring proof beyond a reasonable doubt. Attempting to evade or defeat tax under Section 7201 is a felony carrying imprisonment of not more than five years and a fine of not more than $100,000, or $500,000 for a corporation, together with the costs of prosecution. Making or subscribing a false return under Section 7206(1) is a felony carrying up to three years. Willful failure to file or pay under Section 7203 is generally a misdemeanor carrying up to one year. A tax evasion conviction can also collaterally estop a taxpayer from disputing the civil fraud penalty for the same year and tax.

No, and this is a place where instinct leads people wrong in both directions. Abruptly going silent on an examiner is itself conspicuous and can accelerate scrutiny rather than reduce it. But continuing to answer questions and hand over documents while criminal exposure exists is worse. The correct move is neither: it is to stop communicating with the IRS directly and have counsel take over the communication, which is a normal and unremarkable event in an examination. Above all, do not lie, alter or destroy documents, or backdate anything. Those acts can create new and independent crimes that are often easier for the government to prove than the underlying tax offense, and they convert a defensible case into an indefensible one.

If there is genuine criminal exposure, you need an attorney, and you generally need one before any further contact with the IRS. The reasons are structural rather than a reflection on your accountant. Communications with an attorney are privileged in criminal matters; communications with an accountant generally are not, and your accountant can be compelled to testify against you. Your accountant may also become a witness in the case, and in some situations may need separate counsel. An attorney can take over communications with the examiner, evaluate the exposure before anything further is produced, engage an accountant under a Kovel arrangement where analysis is needed, and assess whether any corrective path remains available. The cost of early counsel is almost always smaller than the cost of the statement that cannot be taken back.