You Got an IRS Letter. Here's What Your Financials Need to Show (And What Happens If They Don't)
You open the mailbox on a Tuesday. There it is — the envelope with the Department of the Treasury return address. Your stomach drops. Your hands get slightly clammy. You open it. It's a notice from the Internal Revenue Service. Maybe it's a CP2000 proposing changes to your return. Maybe it's an audit letter requesting documentation for the 2024 tax year. Maybe it's a penalty notice for something you didn't even know was wrong.
The first thing most business owners do is panic. The second thing they do is call their CPA.
Both reactions are understandable. Neither is particularly productive without the right financial records behind them. Because here's the thing the IRS letter is really asking: can you prove the numbers on your tax return? Not "did your CPA file the right forms." Not "do you have a QuickBooks subscription." Can you produce clean, reconciled, properly documented financial records that support every single line on your return?
If the answer is yes, an IRS notice is a paperwork exercise: you pull the records, your CPA prepares the response, and it's over in 30 to 60 days. If the answer is no — if your books are a mess, your bank reconciliations don't exist, your revenue doesn't match your 1099s, your deductions have no supporting invoices — then that IRS letter is the beginning of a very expensive problem.
I've seen both outcomes. Many times. In multiple countries.
When the IRS sends a letter, clean and reconciled financial records turn it into a 30-day paperwork exercise — messy books turn it into a $40,000+ forensic reconstruction nightmare. This guide covers the common IRS notice types (CP2000, audit letters, penalty notices), exactly what financials they expect, and how a controller keeps your business audit-ready year-round so you never scramble.
Common IRS Notice Types — And What Each One Means
Not all IRS letters are created equal. The notice number — printed in the upper-right corner of the letter — tells you exactly what the IRS is asking for and how serious the situation is. Most business owners don't know the difference between a CP2000 and a Letter 525, and that lack of knowledge causes unnecessary panic (or, worse, unnecessary complacency).
Here are the notice types you're most likely to encounter:
CP2000 — Underreporter Inquiry
This is the most common IRS notice for businesses. According to the IRS, over 9.3 million CP2000 notices were sent in 2022. It means the income reported on your tax return doesn't match what third parties (banks, clients, brokerages) reported to the IRS via 1099s, W-2s, or 1098s. The IRS isn't auditing you. They're telling you their records don't match yours and proposing a change to your return.
What you need: Your filed return, all 1099s received and issued, bank statements showing the income in question, and your general ledger detail for the revenue accounts. If the discrepancy is legitimate (e.g., a client issued a 1099 for a gross amount but you reported net of expenses), you need documentation proving the correct treatment.
Letter 525 / Letter 566 — Examination (Audit) Notification
This is the real thing. According to the IRS, only 0.38% of individual returns were audited in fiscal year 2022, but when your return is selected, the process is thorough. The IRS is examining your tax return, either specific line items (correspondence audit) or your entire return (field audit). Letter 525 typically requests specific documents. Letter 566 may notify you that an in-person audit has been scheduled. The letter will specify exactly which tax year and which items are under review.
What you need: Everything. Complete financial statements, general ledger, bank reconciliations, all source documents (receipts, invoices, contracts) for the items being examined, depreciation schedules, loan documents, payroll records, and your chart of accounts. If you claimed a home office deduction, expect to document square footage, mortgage/rent, and utilities.
CP504 / LT11 — Balance Due and Intent to Levy
These arrive when you owe money and haven't responded to previous notices. CP504 is a warning: the IRS intends to levy (seize) your state tax refund or other assets. LT11 is a final notice of intent to levy and your right to a Collection Due Process hearing. By this stage, the financials question is secondary, but your ability to negotiate an installment agreement or offer in compromise depends entirely on having documented financial records.
What you need: Full financial statements (P&L, balance sheet), personal financial statement (Form 433-A or 433-B), bank statements for all accounts, proof of current income, and documentation of essential living expenses. The IRS uses these to determine your ability to pay.
CP2100 / CP2100A — Information Return Penalty Notice
You failed to file correct 1099s: either missing forms, wrong TIN numbers, or incorrect amounts. This is a compliance issue, not an income issue, but the penalties add up fast: $60–$310 per form depending on how late the correction is filed. A company issuing 50 incorrect 1099s could face $15,500 in penalties.
What you need: Your vendor records, W-9s on file, 1099s as filed, and corrected information. A controller maintains W-9 collection as part of the vendor onboarding process. Most bookkeepers don't.
What Financials the IRS Actually Expects to See
When the IRS requests financial records, whether through a CP2000 response, an audit examination, or a collection inquiry, they have a specific checklist. They're not interested in your Stripe dashboard screenshots or your "QuickBooks summary." They want formal, reconciled financial documentation that creates a complete audit trail from your tax return back to the original transaction.
Here's what "audit-ready financials" actually means, document by document:
| Document | What the IRS Checks | Red Flag If Missing |
|---|---|---|
| Income Statement (P&L) | Revenue matches 1099s received; expenses are categorised correctly and match deductions claimed | Revenue discrepancies trigger automatic CP2000 notices |
| Balance Sheet | Assets match depreciation schedules; liabilities match loan documents; equity ties to retained earnings | No balance sheet = no way to verify asset/liability claims |
| General Ledger | Transaction-level detail for every entry; supports all summary figures on the P&L and balance sheet | Lumped or uncategorised entries suggest poor recordkeeping |
| Bank Reconciliations | Every bank transaction ties to a ledger entry; no unexplained deposits or withdrawals | Unreconciled accounts are the #1 audit risk factor |
| Bank Statements | Deposits match reported income; withdrawals match reported expenses and documented draws | Missing statements suggest intentional concealment |
| 1099s (Sent & Received) | Forms issued match contractor payments; forms received match reported income | Mismatches trigger automatic penalties and further inquiry |
| Receipts & Invoices | Every deduction has a supporting source document | No receipts = disallowed deductions = higher tax bill |
| Depreciation Schedules | Asset purchases, useful life, method, and accumulated depreciation are documented | Incorrect depreciation is one of the most commonly adjusted items |
| Payroll Records | W-2s issued, payroll tax deposits (941s), worker classification (employee vs. contractor) | Misclassification can trigger both income tax and employment tax adjustments |
| Loan Documents | Interest deductions match loan agreements; principal vs. interest split is documented | Unsubstantiated interest deductions get disallowed immediately |
This isn't an exhaustive list. It's the minimum. For specific industries (construction, real estate, e-commerce), the IRS may request additional records like job costing reports, inventory counts, or sales tax documentation. The point is this: every number on your tax return needs to trace back to a source document through your general ledger. If any link in that chain is broken, the IRS will fill in the gaps themselves, and their version is always more expensive than yours.
How to Prepare Your Records When the Letter Arrives
The letter is here. The deadline is real. Here's the step-by-step process for assembling your response, whether it's a simple CP2000 or a full examination:
Step 1: Identify What You're Dealing With
Read the notice number, check the response deadline, and identify the tax year in question. Understand whether the IRS is proposing a change (CP2000), requesting information (Letter 525), or demanding payment (CP504). Each requires a different type of response.
Step 2: Pull the Tax Return for the Year in Question
You need the exact return that was filed, not a draft, not a summary. Your CPA should have this on file. If they don't, request a tax return transcript from the IRS (Form 4506-T). You're going to compare line by line what was reported against what your books show.
Step 3: Reconcile Your Books to the Return
This is where most businesses fall apart. Your QuickBooks (or Xero, or Sage) P&L should match the figures on your tax return. If it doesn't — and it often doesn't, because your CPA made adjusting entries that never made it back into your books — you need to identify every difference and document the reason. Common discrepancies include: depreciation adjustments, meals and entertainment limitations, Section 199A deductions, and officer compensation reclassifications.
This reconciliation is exactly what a controller does every month. According to the AICPA, nearly 60% of small and mid-size businesses say understanding financial data is a challenge. If you don't have a controller, this step alone can take 40+ hours of reconstruction.
Step 4: Gather Source Documents for Every Questioned Item
If the IRS questions $12,000 in "Office Supplies," you need the invoices, receipts, or credit card statements proving those purchases. If they question $45,000 in contractor payments, you need the 1099s, contracts, and payment records. Every line item needs a paper trail. No exceptions.
"I know I have those receipts somewhere." If you can't produce documentation within the response window, the deduction gets disallowed. Period. The IRS doesn't accept "I'll find it later." A controller maintains a document management system where every transaction has a linked source document: receipt, invoice, contract, or bank statement. This isn't perfectionism. It's audit insurance.
Step 5: Prepare Bank Reconciliations
The IRS will compare your bank deposits to your reported income. Every deposit needs to be explained: customer payment, loan proceeds, owner contribution, transfer between accounts. Unexplained deposits are treated as unreported income. Your bank reconciliations should show a zero variance between your ledger and your bank statements for every single month of the year under review.
Step 6: Assemble the Response Package
Work with your CPA to prepare the formal response. The package typically includes: a cover letter referencing the notice number, the specific documents requested, supporting schedules or reconciliations, and any explanatory statements. Your CPA handles the IRS communication. Your controller (or you, if you don't have one) provides the financial documentation behind it.
This is the division of labour that most growing businesses don't understand: your CPA files returns and talks to the IRS. Your controller produces the financial records that make the CPA's job possible. Without both, you're driving with one hand.
What Happens If Your Books Are a Mess
Let's talk about the downside scenario. According to U.S. Bank, 82% of small business failures cite poor cash flow management, and disorganised books are often the root cause. Because "my books aren't great" covers a spectrum, from "slightly behind on reconciliations" to "I've been running my business out of a personal checking account for three years and I file based on what my CPA can piece together." The consequences scale accordingly.
Disallowed Deductions = Higher Tax Bill
If you can't substantiate a deduction with documentation, the IRS disallows it. Claimed $22,000 in travel expenses but only have receipts for $8,000? You lose $14,000 in deductions. At a 24% effective tax rate, that's $3,360 in additional tax. Now multiply that across every category the IRS questions — office supplies, meals, vehicle expenses, contractor payments, home office — and a $15,000 to $30,000 adjustment isn't unusual for a business doing $1M–$3M in revenue.
Interest Charges — Backdated to the Original Due Date
Any additional tax owed accrues interest from the original due date of the return, not from the date of the IRS notice. At the current federal rate of approximately 8% per annum, a $20,000 underpayment on a 2023 return that's resolved in 2026 accumulates roughly $4,800 in interest. You can't negotiate this away. It's statutory. The only way to avoid it is to not owe additional tax in the first place.
Accuracy-Related Penalty — 20% on the Underpayment
IRC Section 6662 imposes a 20% penalty on any underpayment attributable to negligence, disregard of rules, or a substantial understatement of income. "Negligence" includes failure to keep adequate books and records. So if the IRS adjusts your return by $25,000 because you couldn't document your deductions, the penalty alone is $5,000, on top of the $25,000 in additional tax and the accruing interest.
Expanded Audit Scope
If the IRS finds significant errors in the year under examination, they have the authority to expand the audit to additional years, typically the two preceding tax years, but potentially more if they suspect fraud. What started as a CP2000 for 2024 can become a full examination of 2022, 2023, and 2024. Three years of messy books is three times the reconstruction cost, three times the penalties, and three times the interest.
Civil Fraud Penalty — 75%
If the IRS determines that the underpayment was due to fraud (intentional misrepresentation of income or deductions), the penalty jumps to 75% of the underpayment. The burden of proof shifts to the IRS for fraud, but patterns like unreported bank deposits, fake invoices, or systematic over-deduction of expenses can be enough. Messy books don't equal fraud, but messy books make it much harder to disprove fraud when the IRS raises the question.
Criminal Referral — The Worst Case
In extreme cases — we're talking wilful tax evasion, not sloppy bookkeeping — the IRS Criminal Investigation division can get involved. This is rare for small businesses (CI initiates roughly 2,000 investigations per year), but the consequences are severe: criminal prosecution, fines up to $250,000, and imprisonment. I'm not saying messy books lead to prison. I'm saying messy books take one of your strongest defences, "I made an honest mistake," off the table.
The IRS can abate most penalties if you demonstrate "reasonable cause," essentially that you acted in good faith and the error wasn't due to wilful neglect. But here's the catch: reasonable cause requires evidence. Monthly reconciled financial statements, a documented internal control process, professional accounting oversight. These are all evidence of good faith. A shoebox of unsorted receipts is evidence of negligence. A controller creates the paper trail that supports the reasonable cause defence.
How a Controller Keeps You Audit-Ready Year-Round
The entire thesis of this article comes down to one idea: the time to prepare for an IRS letter is not when it arrives. It's every month, every reconciliation, every properly coded transaction throughout the year. According to the SBA, 20% of small businesses fail in their first year and 50% within five years. Financial disorganisation accelerates that timeline. That's what a controller prevents. Not occasionally. Not when tax season approaches. Every single month.
Here's specifically what a controller maintains that makes IRS notices a non-event:
Monthly Bank Reconciliations
Every bank account — operating, savings, payroll, credit card — reconciled to the general ledger within 5 business days of month-end. Zero unexplained variances. Every deposit categorised. Every withdrawal documented. When the IRS asks "what is this $15,000 deposit on March 14th?" the answer is in the reconciliation, not in your memory.
Clean General Ledger with Source Documents
Every transaction in your ledger links to a source document: an invoice, a receipt, a contract, a bank statement. No "miscellaneous expense" categories with $30,000 in them. No "ask my accountant" entries. Every journal entry has a memo explaining what it is and why it's there. This is the audit trail the IRS follows.
Accurate Revenue Recognition
Revenue recorded when earned, tied to invoices and contracts, reconciled to 1099s received. If your client's 1099 doesn't match your books, the controller catches it in January, not when the CP2000 arrives 18 months later.
Proper Expense Classification
Expenses coded to the correct accounts, following IRS categories (not "whatever bucket the bookkeeper guessed"). Meals vs. entertainment. Repairs vs. capital improvements. Advertising vs. sponsorship. These classifications matter because they map directly to your tax return. Get them wrong monthly, and your CPA is either fixing them at year-end (expensive) or filing with errors (more expensive).
Depreciation and Asset Tracking
Fixed asset register maintained with purchase date, cost basis, useful life, depreciation method, and accumulated depreciation. When the IRS questions why you claimed $18,000 in depreciation, the schedule is ready, with invoices for every asset listed.
1099 and W-9 Compliance
W-9s collected from every vendor before first payment. 1099s filed accurately by January 31st. If a vendor's TIN doesn't match IRS records, it's caught during the W-9 collection process, not when the CP2100 penalty notice arrives.
Monthly Financial Statements Delivered by the 5th
Income statement, balance sheet, and cash flow statement, closed, reconciled, and delivered within 5 business days of month-end. These aren't just management tools. They're your audit defence system. Twelve months of clean monthly financials demonstrate a systematic, well-controlled operation. The IRS treats that very differently from a business that produces one annual set of numbers cobbled together at tax time.
| Scenario | With Controller | Without Controller |
|---|---|---|
| CP2000 response | 3–5 business days | 2–4 weeks (plus CPA reconstruction fees) |
| Audit document assembly | 1–2 weeks | 4–8 weeks (often requires deadline extension) |
| Average additional tax owed | $0 – minimal adjustments | $15,000–$40,000 in disallowed deductions |
| CPA audit support fees | $2,000–$5,000 | $8,000–$25,000+ (reconstruction + representation) |
| Penalties and interest | Typically $0 | $5,000–$15,000+ |
| Business disruption | Minimal — records already exist | Significant — owner involvement for weeks |
The cost of a fractional controller — $3,995 to $5,995 per month — is a fraction of what a single poorly handled IRS notice costs. Unlike audit reconstruction fees, the controller investment pays dividends every month in the form of better financial visibility, better decisions, and permanent audit readiness. It's not a cost. It's insurance you actually use.
Frequently Asked Questions
What should I do first when I receive an IRS letter?
Don't panic, and don't ignore it. Read the notice number in the upper-right corner — it tells you exactly what the IRS wants. Check the response deadline (usually 30 or 60 days). Then pull the tax return for the year in question and compare it to the notice line by line. Gather the specific records referenced before calling your CPA — you'll save time and money by arriving with documentation, not just questions. If you have a controller, they should already have the records organised and ready.
What financials does the IRS expect to see during an audit?
At minimum: income statements that match your tax return, a balance sheet, bank statements with reconciliations for every account, accounts receivable and payable aging reports, general ledger detail, 1099s and W-2s, receipts and invoices supporting every deduction, depreciation schedules, and loan agreements for any interest deductions claimed. The key requirement is that every number on your return traces back to a source document through your books. "I have it in QuickBooks" isn't enough. The IRS wants the reconciled, documented audit trail.
What happens if my books aren't ready for an IRS audit?
The IRS disallows any deduction you can't substantiate, which increases your tax bill. Then they add interest (currently ~8% annually) backdated to the original return due date. Accuracy-related penalties add 20% on top of the underpayment. If they find systemic problems, they may expand the audit to additional years. In extreme cases involving intentional misreporting, criminal referral is possible. The total cost of messy books during an audit routinely reaches $25,000–$50,000 for a business doing $1M–$3M in revenue. A fractional controller costs a fraction of that and prevents the problem entirely.
How is a controller different from a CPA when it comes to IRS audit preparation?
Your CPA files your tax return and represents you before the IRS, but they work from the records you provide. They don't maintain your books. A controller is the person who maintains your general ledger, reconciles bank accounts, produces clean financial statements monthly, and keeps supporting documentation organised year-round. When the IRS letter arrives, the controller already has everything the CPA needs to respond. Without a controller, the CPA has to reconstruct records after the fact, which is slower, more expensive, and often incomplete. Getting a controller before your CPA needs one is the single best investment in audit readiness.