Many taxpayers assume a “civil audit” means the IRS only wants substantiation. That assumption can become dangerous. The IRS can develop criminal tax investigation potential from a civil examination or collection case, and IRS procedures expressly address how compliance employees identify “first indicators” of fraud, develop “firm indications” of fraud or willfulness, and make a criminal referral to IRS Criminal Investigation (CI). A civil auditor does not need to announce that shift while the IRS evaluates criminal tax criteria. IRS procedures instruct the compliance employee, after consultation with the Fraud Enforcement Advisor (FEA), to suspend the civil examination or collection activity without disclosing the reason if the IRS determines that the case has firm indications of fraud or willfulness and meets criminal tax referral criteria. The procedures also state that if the taxpayer asks whether a fraud referral is being considered or whether CI is involved, the examiner or revenue officer must not give a false or deceitful response.
This is why experienced practitioners treat certain civil audits as “eggshell audits.” The facts may expose the taxpayer to criminal tax liability even though the IRS has not said so. The related “reverse-eggshell” concept applies when the IRS criminal investigation division hides behind a civil audit from the very outset so as to not alert a potential criminal tax target that they are at risk in which case they would likely lawyer up from the audit’s outset. The egg shell labels above are criminal tax defense industry coined terms, but the underlying risk comes directly from IRS fraud and criminal tax referral procedures.
How Fraud Development in a Civil Audit Leads to CI Involvement
The IRS trains civil compliance employees to recognize, develop and handoff tax fraud. The Internal Revenue Manual describes “first indicators” or “badges” of fraud and explains that the government substantiates fraud by establishing affirmative acts, also referred to as “firm indications” of fraud, which reflect intentional taxpayer actions taken to deceive or defraud. Once a compliance employee identifies indicators, the IRM directs early managerial involvement and the use of specialized fraud resources. In current IRM terminology, the Fraud Enforcement Advisor (FEA) serves as a resource and liaison to civil compliance employees, and the IRM expects consultation when potential criminal tax fraud is suspected.
If, after consultation, the matter meets criminal tax criteria, the referral process becomes formal. The IRM states that when a potential tax fraud case has firm indications of fraud or willfulness and meets criminal tax criteria, the compliance employee will suspend examination or collection activity without disclosing the reason for the suspension. That suspension often appears to be a harmless pause to the taxpayer. It is not. It can reflect a decision point where the IRS is preparing a Form 2797 referral and scheduling evaluative conferences with CI.
You should also understand what the IRS can and cannot say during this phase. The IRM provides that although compliance employees are not required to initiate disclosure of a potential criminal tax referral, they may not deceive taxpayers when specifically asked about the character or nature of an audit or criminal tax investigation. This matters because some taxpayers try to talk their way out of risk, treating silence or a pause as reassurance. IRS procedure does not support that inference.
What “CI Behind a Civil Posture” Looks Like in Practice
CI involvement may occur in multiple ways that don’t always feel like a cinematic “special agents at the door” moment. First, CI can accept a civil referral. The IRM states that if CI accepts the referral, the matter elevates into a subject criminal investigation (SCI), and CI places transaction code 914 controls on the taxpayer’s account modules to protect the criminal case. Civil examination status codes and civil actions frequently change once those controls are in place.
Second, CI can run an administrative joint investigation with a cooperating civil examiner or revenue officer. The IRM states that CI requests cooperation when it needs technical assistance, and it uses Form 6544 to request a cooperating examiner or revenue officer. During an administrative joint investigation, the compliance employee must exercise care in dealings with the person under investigation and avoid conduct that could be construed as an offer of immunity, an attempt to settle civil liabilities, or remarks that lead the person to believe that prosecution is not contemplated. This is a key reason CI can “operate behind” a civil posture. The civil compliance employee may still appear in the case, but it has a criminal architecture and criminal tax sensitivities.
Third, CI can initiate an administrative criminal investigation without a civil referral, and then notify civil functions to cease their activities. The IRM states that when CI initiates an administrative criminal tax investigation, CI sends a notification (Form 14584) to verify and cease all civil activity, and the IRM contemplates decisions regarding joint investigation, parallel investigation, or a full suspension of civil activity. The taxpayer can still experience this as a “civil matter” because the IRS does not always announce the internal routing.
Fourth, information gathering continues even when you think the case is “only civil.” Federal law allows the IRS to examine records and summon information for multiple purposes, including “inquiring into any offense” connected with tax administration or enforcement. The key statutory limitation is that the IRS cannot issue an administrative summons when a Justice Department referral is in effect for that person. The practical takeaway is that third-party records, banking trails, and business documentation can move into the government’s hands without the taxpayer experiencing an in-person “criminal” event.
Interviews, Rights, and Why Careless Cooperation Creates Willfulness Evidence
When CI agents interview a subject, the procedural environment changes materially. The IRM states that the special agent will advise an individual of constitutional rights during non-custodial interviews when the individual is a subject of an investigation or otherwise implicated, and it references Document 5661-A, Statement of Rights, as the required Miranda like warning document. The IRM also recognizes the Fifth Amendment right to refuse to answer questions that may incriminate the subject. These are not technicalities. They reflect the reality that statements become evidence of tax crimes, and a taxpayer can create criminal exposure by improvising explanations, making inconsistent claims, or submitting altered documents during a “civil” phase that later becomes part of a criminal tax investigation file.
This is where attorney client and work product privilege truly matters. Communications with accountants and return preparers generally do not carry attorney-client privilege. The same is true where an attorney prepares a tax return as a return is considered a public disclosure. Federal law provides a limited “tax practitioner privilege” under IRC § 7525, but it applies only to noncriminal tax matters before the IRS and noncriminal tax proceedings in federal court. Once criminal tax exposure exists, you should assume that only an attorney-led strategy can reliably secure sensitive communications & work product, and you should treat document creation and narrative “clean-up” as high-risk. When you need accounting analysis to support a legal strategy, counsel can structure accountant involvement under a Kovel framework, which derives from United States v. Kovel and can protect certain communications when the accountant functions as a necessary agent for legal advice.
You also have a baseline right to retain representation in dealings with the IRS. IRS Publication 1 and the Taxpayer Bill of Rights materials describe that right. In an eggshell or reverse-eggshell posture, representation is not a formality. It is the mechanism that controls communications, sequencing, and the risk that your response itself becomes the government’s willfulness narrative.
California follow-through can magnify the consequences after a federal dispute resolves. If the IRS changes a federal return and additional California tax is due, California generally requires reporting the change to the Franchise Tax Board within six months of the final federal determination. A criminal tax investigation can also create parallel state exposure through audits, assessments, and professional licensing consequences, even when California does not run the criminal case.
Contact the Tax Law Offices of David W. Klasing if You Are Worried About IRS-CI
Contact the Tax Law Offices of David W. Klasing if your cheated and find yourself under audit or your civil audit or collection case shows fraud-development signals, including an unexplained audit pause, rapidly expanding document demands, third-party verifications that do not match your books, or questions that shift from substantiation to intent. IRS procedures allow civil compliance employees to suspend activity without disclosing the reason when criminal tax referral criteria are met, and they prohibit deceit if you ask directly whether a fraud referral is being considered. You need a strategy that assumes elevated risk until the facts prove otherwise.
Contact the Tax Law Offices of David W. Klasing if you need dual-licensed Tax Attorneys and CPAs to manage an eggshell or reverse-eggshell audit, preserve privilege, and build a defensible record without manufacturing evidence or creating inconsistent statements. We handle these matters as civil and criminal tax exposure problems from day one, with the goal of damage control and keeping the matter civil whenever the facts allow. Call 800-681-1295 for a confidential, reduced-rate initial consultation or schedule online HERE.
