When an Audit Turns Criminal: Inside the IRS Fraud Referral

A civil audit does not become a criminal case by accident. The IRS has a defined process for it, written into the Internal Revenue Manual. Knowing that process will not change what happened on your returns. It can help you recognize where your case is, and why the next decisions belong with a lawyer.

This guide walks through the steps in IRM 25.1.2 (Recognizing and Developing Fraud) and IRM 25.1.3 (Criminal Referrals), the two chapters that govern the handoff from a civil examiner or revenue officer to IRS Criminal Investigation.

Step one: indicators of fraud

Everything starts with what the manual calls indicators, or badges, of fraud. IRM 25.1.1.4 explains that indicators are signs or symptoms suggesting that actions may have been taken to deceive or conceal, but that "indications, in and of themselves, do not establish that a particular action was taken."

Examples in the manual include substantial unexplained increases in net worth, personal spending that exceeds available resources, bank deposits from unexplained sources that substantially exceed reported income, and documents that appear altered or false. The full catalog is in IRM 25.1.2.3, covered in badges of fraud.

When an examiner sees these, IRM 25.1.2.2 requires the examiner to document them and discuss them with the group manager.

Step two: the Fraud Enforcement Advisor

If the group manager agrees there are indicators warranting fraud development, the examiner contacts a Fraud Enforcement Advisor through the Specialist Referral System. The FEA is a specialist in the IRS Office of Fraud Enforcement who serves as a resource and liaison to compliance employees. See the Fraud Enforcement Advisor.

One detail is worth knowing. The manual cautions that the compliance employee or the employee's group manager "must never seek advice from CI for a specific case under examination/collection activity." The civil side develops the case through the FEA. CI comes in only through a formal referral.

Step three: fraud development status

If the examiner, the group manager, and the FEA agree that the potential for fraud exists, the examiner prepares Form 11661, Fraud Development Recommendation - Examination (or Form 11661-A for collection). Under IRM 25.1.2.2, that form documents the FEA's involvement and places the case in fraud development status. For examinations, the case moves to AIMS status code 17.

A written plan of action follows. The manual says it must outline the steps required to establish affirmative acts, also called firm indications, of fraud; it must be a joint effort of the examiner, the manager, and the FEA; and it needs a follow-up date within 60 days of the initial plan and each later plan.

During this stage, the examiner is told to secure the original returns. The manual also includes protections that sound technical but matter: a revenue agent's report is not to be sent to the taxpayer or representative unless and until that step has been discussed with the FEA, and in a nonfiler case where fraud is suspected, the employee must not demand a return from the taxpayer.

Step four: affirmative acts of fraud

Indicators are suspicions. Affirmative acts are proof. IRM 25.1.1.4 defines affirmative acts as actions that establish something was done deliberately "for the purpose of deceit, subterfuge, camouflage, concealment, some attempt to color or obscure events, or make things seem other than what they are." The manual is categorical: "Fraud cannot be established without affirmative acts of fraud."

Its examples include deliberate omission of specific items where similar items are included, concealment of bank accounts or other assets, willful failure to deposit receipts to business accounts, and covering up sources of receipts.

If affirmative acts are established, IRM 25.1.2.2 says the compliance employee must suspend the examination or collection activity and immediately notify the group manager and the FEA. The FEA then recommends a referral to Criminal Investigation if criminal criteria are met.

Step five: the quiet suspension

This is the step taxpayers feel without seeing. Under IRM 25.1.3.3, once the FEA consultation determines that a case has firm indications of fraud or willfulness and meets criminal criteria, the examiner "will suspend the examination/collection activity without disclosing to the taxpayer or representative the reason for the suspension."

The same section sets the guardrails. Compliance employees may decline to answer questions about criminal potential and are not required to volunteer information about a potential referral. But they "may not deceive taxpayers when asked specifically about the character or nature of an investigation."

An audit that was moving and then stops for no stated reason is a signal a lawyer will want to hear about.

Step six: Form 2797

The referral itself is Form 2797, Referral Report of Potential Criminal Fraud Cases. IRM 25.1.3.3 describes what it must contain: a description of the firm indications of fraud or willfulness, the taxpayer's explanation of them, the estimated criminal tax liability, and the method of proof used for income verification.

That second item deserves attention. Your explanation, whatever you told the examiner, goes into the referral. If it was false, that becomes part of the case. If it was never given because you had counsel and declined to speculate, that is a different record.

The form moves up a chain: examiner, group manager, FEA, FEA group manager, and then the appropriate CI field office.

Step seven: the 10-day and 30-day conferences

IRM 25.1.3.4 sets CI's timeline. Within 10 workdays of receiving the referral, the special agent assigned to evaluate it identifies the subject as a primary investigation and sets an initial conference. The referring examiner, group manager, special agent, supervisory special agent, and FEA discuss the returns, the evidence, and the criminal tax computations.

The manual lists topics for that meeting, including verification of income and assets, explanations offered by the taxpayer, the representative, or the preparer, and observations about the taxpayer's age, health, education, and occupation. It also notes additional factors: additional tax due to fraud, flagrancy, significance, public interest, and deterrent effect.

Within 30 workdays, the same group meets again for a disposition conference to discuss CI's decision to accept or decline.

Step eight: accepted or declined

If CI accepts, IRM 25.1.3.5 says the primary investigation is elevated to a subject criminal investigation. The examination case moves to AIMS status code 18, and CI places controls on the taxpayer's account. A revenue agent may continue as a cooperating agent in a joint investigation. From here, the case is criminal, and the path leads toward a special agent's report and, potentially, Justice Department review.

If CI declines, IRM 25.1.3.6 says the examiner resumes the examination once notified. That does not mean fraud is off the table. The civil side then considers the civil fraud penalty under IRC 6663 or the fraudulent failure to file penalty under IRC 6651(f).

Joint investigations and quarterly conferences

An accepted referral does not end the civil employee's role. IRM 25.1.3.5 describes two types of joint investigation: administrative investigations, which CI refers to as "Prosecution Recommendation" cases, and grand jury investigations, which CI refers to as "Further Investigation" cases. In both, the special agent and the cooperating examiner meet in mandatory quarterly conferences documented on Form 6084 to review progress, obstacles, defenses, and civil steps such as statute extensions.

The civil and criminal sides keep talking. Your case does not split cleanly in two, and neither should your strategy.

What this means if you are in an audit now

Most audits never get near this process. But if you recognize your situation in the indicators above, three points follow:

1. What you say to the examiner can end up in Form 2797 as "the taxpayer's explanation."
2. The examiner does not have to tell you that the case is being developed for fraud.
3. A voluntary disclosure is generally no longer timely once a civil examination has begun, under IRM 9.5.11.9.

That is the profile of an eggshell audit. The right response is not to stop cooperating or to start explaining. It is to get a lawyer involved before the next contact with the IRS.

General information only, not legal advice. Reading this page does not create an attorney-client relationship. Laws and IRS procedures change; the sources cited were reviewed on the date shown above.