Eggshell Audit Attorney | Civil-to-Criminal IRS Defense | Brotman Law

What Makes an Audit “Eggshell”

An audit is “eggshell” when the taxpayer or representative knows of material problems with the return that the IRS does not yet know about — and the wrong civil-audit moves could expose those problems and trigger criminal referral.

The classic eggshell scenarios:

• Unreported income. Cash receipts, foreign-account income, cryptocurrency gains, or third-party payments that did not flow onto the return.
• Fabricated deductions. Receipts that don’t reflect actual expenses; mileage logs reconstructed long after the fact in ways the documentation can’t support; charitable contributions to entities the taxpayer controls.
• Sham transactions. Inter-company transfers that lack economic substance, related-party transactions priced outside arm’s-length norms, structures designed primarily to shift income to lower-rate or lower-visibility entities.
• Material foreign-asset non-disclosure. Foreign accounts above the FBAR threshold ($10,000 aggregate) never reported on Form 114; foreign-source income never reported on Form 8938 or Schedule B.
• Estate or gift tax non-filing. Estates that filed no Form 706 when required; gifts above the annual exclusion never disclosed on Form 709.

The audit is “eggshell” because the wrong move cracks it. Producing the wrong document, signing the wrong consent, answering the wrong interview question — any of these can convert what was a civil deficiency case into a criminal referral. The civil deficiency might cost the taxpayer back tax, penalties, and interest. The criminal referral can cost the taxpayer their freedom.

The Reverse Eggshell Audit

A “reverse eggshell” audit is one in which IRS Criminal Investigation is already involved — sometimes parallel to the civil exam, sometimes already directing it — but the taxpayer and the civil-side representative don’t know that yet.

The reverse eggshell scenario is the more dangerous of the two. In an ordinary eggshell, the taxpayer knows of the problems and the IRS doesn’t. In a reverse eggshell, IRS-CI knows of the problems and the taxpayer doesn’t realize the agency has already crossed the civil-criminal line.

Warning signs of a reverse eggshell audit:

• Radio silence. The civil agent goes quiet for an extended period — typically 60 to 120 days — after a substantial document production. The case may have been referred internally for fraud review under Form 11661 (Fraud Development Recommendation) and is being parallel-tracked by a Fraud Technical Advisor.
• Questions about state of mind. Revenue agents are trained to gather facts, not to develop willfulness. When a civil agent starts asking why the taxpayer reported items the way they did, whether the taxpayer knew specific items were taxable, or how the taxpayer’s understanding of the law was formed, the agent may be developing willfulness for a criminal referral.
• Grand jury subpoena. If the taxpayer (or any business associate, employee, accountant, or bank) receives a grand jury subpoena while the civil exam is open, the case has already crossed into criminal investigation. The civil exam may continue in parallel but the criminal track controls the strategic options.
• IRS-CI special agent contact. Two agents arriving unannounced at a home or business, presenting badges, requesting a voluntary interview — this is IRS-CI, and the civil exam has been left behind.
• New agent assignment with a different focus. A civil agent transferring the case to a Fraud Technical Advisor or to a new agent who immediately reframes the questions toward intent and willfulness.

The strategic response to a reverse eggshell is fundamentally different from an ordinary eggshell. In an ordinary eggshell, the goal is to contain disclosure to the civil exam and resolve as a civil deficiency. In a reverse eggshell, the criminal investigation is already underway and the priority becomes managing criminal exposure first, civil deficiency second.

The Tweel Doctrine — When the IRS Can Be Wrong to Use the Civil Audit

Under United States v. Tweel, 550 F.2d 297 (5th Cir. 1977), evidence obtained during a civil audit can be suppressed in a subsequent criminal proceeding if the IRS used the civil exam as a pretext for criminal investigation — meaning a criminal referral was already in process or imminent at the time the IRS was gathering documents and statements under civil-audit authority.

The doctrine addresses a fundamental asymmetry. The IRS has broad civil-audit authority — summons power under IRC §7602, broad discovery, expansive documentary requests. The IRS has narrower criminal-investigation authority — grand jury subpoenas, IRS-CI special agents who must give a modified Miranda-style warning before custodial interviews. A taxpayer cooperating with a civil audit reasonably expects the case to be civil. Cooperation given under that mistaken expectation is constitutionally problematic if the IRS is actually running a criminal investigation through the civil examination.

The Tweel facts: a revenue agent represented to the taxpayer that the audit was a “routine examination” when in fact the agent had already received information from another agency suggesting criminal conduct and the audit was being conducted at the request of an IRS-CI special agent. The Fifth Circuit suppressed the evidence obtained during the audit, reasoning that the taxpayer’s consent to the civil examination was induced by the agent’s material misrepresentation.

The doctrine has limits. Tweel requires affirmative misrepresentation or “sneaky deliberateness” by the IRS — mere silence about an ongoing internal fraud review is usually not enough. Most courts read Tweel narrowly to require active deception, not passive concealment. But the doctrine survives as a meaningful constraint on the IRS’s ability to weaponize the civil audit for criminal-investigation purposes.

The practical implication: when a civil exam shows signs of being a reverse eggshell, documenting the timeline of IRS contacts, internal referrals (where discoverable), and any agent representations becomes critical to preserving a potential Tweel motion in any subsequent criminal proceeding.

The Kovel Arrangement — Extending Attorney-Client Privilege to the CPA

Under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), an attorney can engage a CPA or accountant as the attorney’s agent for purposes of understanding the client’s tax situation — extending attorney-client privilege to communications with that CPA.

The privilege problem in eggshell audits: tax matters routinely require accountant input. The taxpayer’s own CPA — who prepared the return under audit — does not enjoy attorney-client privilege. Communications between taxpayer and CPA are typically discoverable. So are the CPA’s work papers. If the CPA prepared a return that contains fraudulent items, the CPA may be called as a witness against the taxpayer in any criminal proceeding, and the CPA’s notes and work papers are evidence against the taxpayer.

The Kovel solution: the attorney engages a separate forensic accountant (not the return preparer) as the attorney’s agent for purposes of analyzing the tax issues. Communications among the taxpayer, attorney, and Kovel accountant are within the attorney-client privilege because the accountant is functioning as a translator or analyst extending the attorney’s ability to advise. The Kovel accountant’s work papers are within the attorney work-product doctrine.

Two practical points. First, the original CPA stays in the picture for the actual civil-audit work but is firewalled from privileged criminal-defense conversations. Second, the Kovel engagement letter has to be properly structured — the accountant is engaged by counsel, paid by counsel, and reports to counsel, not directly to the taxpayer. Bypassing the structure undermines the privilege.

The Kovel arrangement is one of the most powerful tools in eggshell audit defense and one of the most commonly overlooked. We set up Kovel arrangements proactively when an eggshell audit becomes apparent, before any privileged communications are inadvertently shared with the original CPA.

Fifth Amendment Item-by-Item Assertion During a Civil Audit

A taxpayer can assert the Fifth Amendment privilege against self-incrimination during a civil audit — but the assertion must be selective and item-by-item, not a blanket refusal to participate. Blanket refusal invites administrative summons, court enforcement, and adverse inferences in any subsequent civil deficiency proceeding.

The Fifth Amendment protects against compelled testimonial communications that could incriminate the speaker. The privilege applies fully in criminal proceedings and applies in civil proceedings as well, but with two important nuances.

First, the privilege protects against incriminating compelled statements — not against producing pre-existing documents. The act of production doctrine under Fisher v. United States, 425 U.S. 391 (1976), can extend Fifth Amendment protection to document production where the act of producing itself communicates incriminating information (e.g., that the documents exist, that the taxpayer has them, that they are authentic). But pre-existing voluntary records — bank statements, tax returns, financial records — are generally not protected by the privilege because their creation was voluntary.

Second, the privilege has to be selectively asserted. A taxpayer who refuses to answer any audit question on Fifth Amendment grounds — across the entire exam — invites several adverse consequences. The IRS can issue an administrative summons and seek court enforcement. Federal courts will compel testimony in civil proceedings if the taxpayer’s incrimination concern is unrelated to the specific question. In a civil deficiency case (Tax Court), the IRS can ask the court to draw adverse inferences from the taxpayer’s silence — under Baxter v. Palmigiano, 425 U.S. 308 (1976), adverse inferences are permitted in civil proceedings even though they would not be in criminal proceedings.

The defense move is to assert the Fifth Amendment item-by-item — only on specific questions where the answer could be incriminating, with a clean record of which questions the privilege is being asserted on and why. Strategic item-by-item assertion preserves the privilege without inviting blanket adverse inference or summons enforcement.

This is delicate work. Done correctly, the taxpayer cooperates on questions that pose no criminal risk while declining to answer questions that do. Done incorrectly, the taxpayer either over-cooperates (waiving privilege on incriminating items) or under-cooperates (blanket assertion that fails the selectivity requirement).

The IRS Forms Behind a Civil-to-Criminal Referral

The civil-to-criminal referral process inside the IRS runs through specific internal forms and procedural touchpoints. Understanding which form has been filed and when is critical to assessing where an eggshell audit actually stands.

Form 11661 — Fraud Development Recommendation

When a civil revenue agent identifies indications of fraud during an audit, the agent prepares Form 11661 to recommend that the case be developed for civil-fraud penalty assertion under IRC §6663. The Form 11661 is reviewed internally — typically by a Fraud Technical Advisor — and the case may be re-tracked for fraud development, parallel-tracked between civil and criminal investigators, or returned for standard civil-deficiency processing.

The Form 11661 itself is not the criminal referral. It is the internal recommendation that triggers fraud-development review. But the existence of a Form 11661 is a signal that the case has moved beyond ordinary civil-deficiency processing — and the next step in the internal sequence is often a Form 2797 criminal referral.

Form 2797 — Criminal Referral

Form 2797 is the actual referral from civil examination to IRS-CI for criminal investigation. Once a Form 2797 is filed and accepted by IRS-CI, the case is no longer a civil audit — it is a criminal investigation that may continue to run a civil track in parallel.

The taxpayer is typically not notified that a Form 2797 has been filed. The first indication may be the civil agent going silent (because the civil case has been suspended pending criminal investigation) or the appearance of IRS-CI special agents.

Power of Attorney (Form 2848) and Strategic Implications

The power-of-attorney form does not protect against criminal referral — it simply names the representative who receives IRS correspondence. But the POA controls who in the IRS has the ability to communicate with the taxpayer directly. In eggshell audits, we file a POA early to channel all IRS contact through counsel, prevent direct taxpayer-agent communications that could create unfavorable record evidence, and ensure we are present for any interview or document discussion.

The Badges of Fraud — What the IRS Looks For

The IRS Internal Revenue Manual catalogs specific factors — “badges of fraud” — that revenue agents are trained to identify when developing a case for fraud penalty or criminal referral. Understanding the badges is the first step in defending against them.

The principal badges, drawn from IRM 25.1 and standard fraud-development materials:

• Understatement of income. Particularly substantial or repeated understatement, especially of items the taxpayer would obviously know about (W-2 wages, brokerage 1099s).
• Concealment of bank accounts. Domestic or foreign accounts the taxpayer controls but did not report or list on Schedule B / Form 114.
• Substantial unexplained deposits. Bank deposits inconsistent with reported income, particularly cash deposits and structured deposits below the §5313 currency-transaction-report threshold.
• False or altered documents. Receipts, invoices, contracts, or correspondence that have been modified to support a tax position.
• Inconsistent statements. Statements to the IRS that conflict with statements to lenders, regulators, courts, or other federal agencies (Form 4506-T transcript requests often surface these inconsistencies).
• Refusal to make books available. Particularly when accompanied by document destruction or “lost records” claims.
• Attempts to evade or defeat tax. Affirmative acts to mislead the IRS — corporate structures lacking economic substance, sham employee arrangements, fabricated business expenses.
• Pattern of fraud across years. The IRS looks for repeated fraudulent items across multiple tax years, not isolated mistakes.
• Failure to file. Multiple years of non-filing despite known reporting obligations.
• Use of nominees or fictitious entities. Putting assets or income in the name of family members, employees, or shell entities to obscure ownership.

One badge alone usually does not produce a criminal referral. A pattern across multiple badges, particularly in combination with substantial understatement, does. The defense strategy is to address each badge specifically — either by demonstrating the badge does not apply on the facts, or by presenting innocent explanations that defeat the inference of fraudulent intent.

Is Your Audit an Eggshell Audit? Seven Diagnostic Questions

The following questions help identify whether an IRS civil audit carries criminal exposure. If you answer yes to one or more of these honestly, this is an eggshell audit and the defense strategy should account for criminal exposure from day one.

1. Did the return under audit omit material income — cash receipts, foreign-source income, cryptocurrency gains, related-party payments, or other items that you knew about but that did not appear on the return?
2. Did the return claim deductions that were not actually incurred — fabricated receipts, expenses reimbursed by an employer or third party, personal expenses run through a business, charitable contributions to entities you controlled?
3. Did the return include items that you knew the IRS would view differently — related-party transactions priced outside arm’s-length norms, structures designed primarily to shift income, sham transactions lacking economic substance?
4. Are there foreign accounts with aggregate balances over $10,000 that were never reported on Form 114 (FBAR) — or foreign-source income or foreign assets above the Form 8938 threshold that were never disclosed?
5. Did the return preparer raise concerns at filing that you waved off — or did the preparer accept aggressive positions that the preparer was uncomfortable with?
6. Has the audit shown any of the warning signs of a reverse eggshell — radio silence from the agent, questions about intent or state of mind, a grand jury subpoena to you or anyone in your orbit, new agent assignment with different focus?
7. Are there other tax years — not yet under audit — that contain similar issues, where the issues might extend the audit’s scope or trigger a pattern-of-fraud analysis?

If any of these are yes, the audit is at least partially eggshell. If multiple are yes, the audit is squarely an eggshell audit and the defense strategy needs to account for criminal exposure from the start. Engagement with eggshell-experienced counsel before the next document production or interview is essential.

How We Defend Eggshell Audits

Eggshell audit defense is fundamentally different from ordinary audit defense. The work is procedural, doctrinal, and meticulous — and starts before the next document production, not after the next interview.

Our standard sequence on a new eggshell engagement:

Step 1 — Diagnostic interview. Privileged conversation to understand the actual return issues, the audit posture, the agent’s questions to date, the documents already produced, and any communications between the taxpayer and the agent or preparer. This is the moment to be fully honest with counsel — the conversation is privileged, and the defense strategy depends on accurate facts.

Step 2 — File a power of attorney. Form 2848 channels all IRS contact through counsel. The taxpayer stops communicating directly with the agent. All future document production, interview scheduling, and substantive correspondence runs through our office.

Step 3 — Kovel engagement. Where the case requires accounting analysis, we engage a separate forensic accountant under a properly structured Kovel arrangement. The original return preparer continues to participate in the civil audit at the document level but is firewalled from privileged criminal-defense conversations.

Step 4 — Document review and selective production. We review every document the IRS has requested before production. Documents covered by privilege are withheld. Documents not within the scope of the audit are objected to. Documents that contain incriminating information are evaluated against the act-of-production doctrine and against potential Fifth Amendment issues. The goal is full compliance with legitimate civil-audit document requests while preserving privilege and Fifth Amendment protections.

Step 5 — Interview preparation. If the agent requests a taxpayer interview, we prepare extensively. Questions that pose Fifth Amendment risk are flagged. Item-by-item assertion is rehearsed. Where the interview is unavoidable, we attend and we manage the question-by-question response.

Step 6 — Strategic resolution. Depending on case facts, the resolution path may be civil deficiency settlement (Form 870 or Tax Court petition), civil-fraud penalty negotiation under §6663, voluntary disclosure to mitigate criminal exposure on unreported items not yet identified, or eggshell-to-criminal track planning if a referral becomes imminent.

The defense work compounds. Every move during the civil audit affects the criminal-exposure analysis. Every document produced is potentially exhibit-marked in any later criminal proceeding. Every statement to the agent is potentially evidence. The job is to navigate the civil audit while preserving every available defense for any later criminal proceeding — and ideally, to keep the case civil entirely.

Why Brotman Law for an Eggshell Audit

Most criminal tax firms engage after the referral to IRS-CI. We work the civil-examination side every day — and the eggshell audit is exactly where civil and criminal converge.

Many firms handling criminal tax work bring post-indictment defense backgrounds — useful once charges are filed, less suited to the pre-charge work an eggshell audit actually requires. Brotman Law is a tax-controversy practice first. The procedural discipline, the doctrinal analysis, and the civil-examination experience that define eggshell audit defense are the core of what we do — not a specialty grafted onto a general criminal practice.

Brotman Law is a tax-controversy practice. Civil examinations, IRS appeals, FTB residency audits, CDTFA sales tax audits, EDD payroll audits — this is daily work for us. The eggshell audit sits at the intersection of civil tax controversy (where we operate every day) and criminal tax exposure (where the strategic decisions matter most). Our advantage is that we understand the civil-audit playbook from the inside because we run civil audits every week, and we understand the criminal-track implications because we have to make these decisions on real cases.

Sam Brotman is was admitted to the California Bar in 2010 (State Bar No. 274966) and is admitted to practice before the United States Tax Court and the California Superior Court. Since 2013, Brotman Law has handled 2,500+ tax matters and resolved more than $1 billion in tax liabilities. Sam has been recognized as a Super Lawyer in tax law every year since 2016. The firm has been named to the Inc. 5000 list of fastest-growing private companies.