How to Get a Business Audited: IRS Whistleblower or Private Hire

To get a business audited, you take one of two routes depending on your goal. If you suspect a business of tax fraud and want the government to investigate, you file a referral with the IRS using either Form 3949-A (anonymous, no reward) or Form 211 (identified, potential financial award). If the business is yours and you need audited financial statements for a lender, investor, or regulator, you hire an independent CPA firm and sign an engagement letter for a private audit. The paperwork, cost, and timeline are completely different, and picking the wrong path wastes months.

Reporting a Business to the IRS

The IRS runs two separate reporting tracks, and the right form depends on whether you want compensation for what you know.

Form 3949-A, the Information Referral, is the general-purpose form for reporting a suspected tax law violation by any individual or business. You describe the alleged violation, identify the business if you can, and provide supporting details. The form asks whether you have access to books and records but tells you not to send them with the initial report; the IRS will contact you later if it needs documentation. The personal information section is optional, and the IRS states that skipping it will not affect processing.¹ Mail the completed form to the Internal Revenue Service, PO Box 3801, Ogden, UT 84409. There is no online submission option, and no award.

Form 211, the Application for Award for Original Information, is the whistleblower route. Filing it requires you to identify yourself with your name, address, and taxpayer identification number. You also provide the name and address of the business, a description of the specific violations, the tax years involved, and an explanation of how you learned about the misconduct. The IRS also requires a description of your past or present relationship to the business. Specific supporting documents — internal financial records, communications discussing tax avoidance, records of unreported income — strengthen the referral considerably. Mail Form 211 with all evidence to the IRS Whistleblower Office, 1973 N. Rulon White Blvd., M/S 4110, Ogden, UT 84404.² Send it certified so you have tracking and delivery confirmation.

Whistleblower Awards and What You Give Up

The IRS pays awards of 15 to 30 percent of collected proceeds when a case qualifies under the mandatory program.² To qualify, the total tax, penalties, and interest in dispute must exceed $2 million, and if the target is an individual, that person’s gross income must exceed $200,000 in at least one of the tax years at issue. The exact percentage depends on how substantially you contributed to the investigation. If the claim relies primarily on information already available from news reports, government audits, or court records, the maximum drops to 10 percent.³

Cases below the $2 million line fall under 26 U.S.C. § 7623(a), where the Secretary may pay “such sums as he deems necessary” for information leading to detection of underpayments or fraud.³ These discretionary awards are typically smaller with no statutory minimum. A small local business skimming cash or underreporting tips almost always lands here.

Filing Form 211 also carries risks that Form 3949-A does not. Federal law does protect employees who report tax violations from retaliation. The Taxpayer First Act of 2019 added 26 U.S.C. § 7623(d), which bars employers from firing, demoting, suspending, threatening, or harassing workers for reporting suspected tax fraud to the IRS, the Treasury Department, or Congress. A retaliated-against whistleblower can seek reinstatement, double back pay, full lost benefits, attorney fees, and compensation for other damages.⁴

Confidentiality is thinner. The IRS and the Office of Chief Counsel use best efforts to shield a whistleblower’s identity and may withhold identifying information under the informant’s privilege. But if a case reaches court and a judge finds disclosure vital to a fair proceeding, or if the government needs the whistleblower as a witness, identity can be revealed.⁵ Anyone using a whistleblower as a witness must explain beforehand that their informant status will be disclosed. If anonymity matters more than a possible award, Form 3949-A is the safer choice.

What Happens After You File

Processing of new whistleblower claims has averaged about 14 days in recent fiscal years. After intake, a classification specialist evaluates whether the information warrants a formal examination. The decision to open an audit, and any eventual award payment, can take months or years depending on complexity and whether the IRS pursues administrative or judicial action. The agency generally does not provide detailed status updates during this time, though IRS policy calls for timely notifications when a matter is referred for examination.⁶ You will not get regular case updates. You may not learn anything at all until the audit closes.

Arranging a Private Audit of Your Own Business

A private audit is a voluntary engagement with an independent CPA firm, and businesses rarely pay for one unless something external requires it. A bank wants audited financials before extending a line of credit. A venture capital investor demands them as a funding condition. A nonprofit crosses a state revenue threshold that mandates independent examination. Companies preparing for an IPO typically need two to three years of audited statements before going public, which means starting well ahead of the target date.

Nonprofits face the most variable rules. State audit thresholds range from a few hundred thousand dollars in annual revenue to $1 million or more, and specifics differ in every state. Some states accept a CPA review instead of a full audit in a middle revenue bracket. Check your state’s charity registration office before committing.

Do You Actually Need a Full Audit?

CPAs offer three levels of financial statement service, and paying for a full audit when a review would satisfy your lender is expensive. Ask whoever is requiring the statements which level they will accept before signing anything.

Compilation: The CPA organizes your financial data into standard statement format but provides no assurance the numbers are accurate. Cheapest option, useful when you just need presentable statements.
Review: The CPA performs analytical procedures and asks management questions to provide limited assurance the statements are free of material misstatement. Reviews cost less than audits and satisfy many bank and creditor requirements.⁷
Audit: The CPA performs extensive testing, verifies account balances, evaluates internal controls, and issues an opinion providing high (but not absolute) assurance that the statements are fairly presented.⁷

Cost

Audit fees scale with size and complexity. Small businesses with straightforward books typically pay $5,000 to $30,000 for a complete audit. Mid-sized companies with more transactions, subsidiaries, or complex revenue recognition run $30,000 to $100,000 or more. Hourly rates for experienced auditors generally fall between $175 and $400, and most audits take several weeks of billable time.

The biggest cost drivers are transaction volume, the number of locations or entities involved, and the condition of your records. A clean, reconciled general ledger costs meaningfully less to audit than a shoebox of receipts. When picking a firm, verify the CPA’s license through your state board of accountancy and ask for the firm’s most recent peer review report, which shows whether its audit work meets professional standards.

Documents to Have Ready

Auditors request a substantial volume of records before fieldwork begins. Pulling these together in advance shortens the engagement and holds fees down:

General ledger and trial balance for every account at year-end.
Bank statements and reconciliations for every account over the full audit period.
Payroll registers showing wages, withholdings, and employer tax contributions.
Prior year tax returns, which the auditor uses to check for consistency.
Debt agreements and loan documents, including any covenants that impose reporting obligations.
Accounts receivable and payable aging reports.

Auditors also need documentation of your internal controls: the written policies covering who authorizes purchases, how cash is handled, and whether duties are separated so no single employee runs a transaction from start to finish. Weak controls mean more sampling and a higher bill.

The Engagement Letter

A private audit formally begins when both sides sign an engagement letter. This contract spells out the scope of work, the firm’s responsibilities, management’s obligations, the fee arrangement, and the expected timeline for the final report.⁸ Read it carefully. Any task not described in the engagement letter will require a contract modification and additional fees.

After signing, the auditor plans the work and walks through your systems, then moves into fieldwork: testing transactions, confirming balances with banks and customers, and examining supporting documentation. Your accounting staff needs to be available for questions during this phase. Near the end, the CPA firm will require management to sign a representation letter formally confirming that all records were provided, any known fraud was disclosed, related-party transactions were identified, and the statements are fairly presented. This letter is required under professional standards; without it, the auditor cannot issue an opinion.⁹

The Opinion You Pay For

The whole point of the private audit is the opinion letter at the end. That is what your lender, investor, or regulator reads. Four outcomes are possible:

Unmodified (clean) opinion: The financial statements are fairly presented in accordance with generally accepted accounting principles. What everyone wants.
Qualified opinion: The statements are mostly accurate, but the auditor found material misstatements or could not verify certain items. Significant, but not pervasive.
Adverse opinion: The misstatements are both material and pervasive. The statements as a whole do not fairly represent the business’s financial position.
Disclaimer of opinion: The auditor could not obtain enough evidence to form any opinion. This typically happens when records are too incomplete for meaningful work.

Alongside the opinion, the auditor often issues a separate management letter flagging internal control weaknesses or operational issues found during fieldwork. That letter goes to leadership and the board rather than to outside readers. Addressing what it identifies before the next cycle is one of the most practical ways to reduce future audit costs and avoid a qualified opinion later.

1
Internal Revenue Service. Form 3949-A Information Referral
2
Internal Revenue Service. Submit a Whistleblower Claim for Award
3
Office of the Law Revision Counsel. 26 USC 7623 – Expenses of Detection of Underpayments and Fraud, Etc
4
WhistleBlowers.gov. Taxpayer First Act (TFA) 26 USC 7623(d)
5
Internal Revenue Service. Responding to Petitioner’s Information Gathering Attempts
6
The Anti-Fraud Coalition. FY 2024 at the IRS Whistleblower Office – Improved Processing Times, the Third Highest Awards Total, and More
7
AICPA & CIMA. What Is the Difference Between a Compilation, Review, and Audit
8
AICPA & CIMA. Say “I Do” to Engagement Letters
9
PCAOB. Management Representations