The IRS Audit Survival Blueprint: How to Maintain Bulletproof Financial Records

Here's the thing about an audit that nobody tells you: you don't win it in the conference room. You win it — or lose it — years earlier, in whatever passes for your filing system. By the time a notice arrives, the records either exist or they don't.

So let's skip the panic and talk about the work that actually matters. In an audit, the burden is on you. The IRS doesn't have to disprove your deductions; you have to substantiate them. A number on your return is a claim, and a claim you can't back up is a number that gets disallowed. Bulletproof records are simply the proof, built in advance.

The law actually requires this

This isn't just good practice — it's a statutory duty. Under IRC §6001, you're required to keep records sufficient to establish the income and deductions on your return. The code doesn't dictate a specific system, but it does demand that one exist and that it support every figure you filed.

And for certain categories, the bar is much higher.

The deductions that get disallowed first

There's a general rule in tax law called the Cohan rule — from a 1930s case involving the entertainer George M. Cohan — that lets a taxpayer estimate some expenses when records are imperfect, as long as there's a reasonable basis. Useful. But it has a hard wall.

IRC §274(d) carves out specific categories and says: no estimates, no exceptions. These require strict, contemporaneous substantiation:

• Vehicle and mileage
• Travel (away-from-home)
• Meals
• Gifts

For these, the Cohan rule does not save you. "I drove a lot for work" is not a record. A mileage log with date, destination, business purpose, and miles is. These four categories are where I see the most deductions vanish in an exam, because owners treat them casually all year and then can't reconstruct them. You can't recreate a contemporaneous log after the fact — the word "contemporaneous" is the whole point.

How long is "long enough"?

The honest answer depends on the statute of limitations, and it's longer than most people keep things.

• Three years is the general federal window under §6501(a) — the IRS has three years from when you file to assess additional tax.
• Six years if you omit more than 25% of your gross income (§6501(e)). That's not fraud — that's a big enough understatement, even an honest one.
• No limit at all if you never filed, or in the case of fraud. The clock simply never starts.

And here in California, the FTB gets four years, not three (R&TC §19057) — and a federal adjustment can reopen your California return on top of that. So a record that's safe from the IRS may still be live for the state.

My practical rule: keep tax returns and the records behind them for seven years, and keep anything tied to property — purchase documents, improvement receipts, depreciation schedules — for as long as you own the asset plus seven years after you sell. Basis records outlive everything, because you'll need them to calculate gain on a sale that might be a decade away.

What "bulletproof" actually looks like

It's less about volume and more about structure. A few moves do most of the work:

Separate the money. A dedicated business bank account and card is the foundation of the entire thing. Commingling personal and business spending is the single fastest way to make every deduction look questionable, because now an examiner has to untangle which charges were which — and they'll resolve the doubt in the government's favor.

Run an accountable plan. If your S-corp or company reimburses you for mileage, home office, or out-of-pocket costs, do it under an accountable plan that meets the substantiation and timing requirements of Treas. Reg. §1.62-2. Done right, the reimbursements are deductible to the company and tax-free to you. Done sloppily, they become taxable wages.

Keep it contemporaneous and digital. Reconcile monthly — that habit alone catches the gaps while you can still fix them. Photograph receipts before the ink fades (thermal paper receipts physically disappear). The §274(d) categories especially need to be logged as they happen, not assembled in a scramble when the notice arrives.

The one thing to do this week

If you do nothing else: open the separate business bank account and card if you haven't, and route everything through it. Every clean audit defense I've ever built started there, and every painful one started with commingled accounts. It's the cheapest insurance in tax — and it costs you nothing but an afternoon.

This is general information, not advice for your specific situation, and reading it doesn't create a client relationship. Your facts — entity type, industry, what you're deducting — change what "sufficient" records mean for you. And if you ever do need to send documents over, use the secure client portal, never email.

If you'd rather know your records would hold up before a notice ever shows up, that's a review I do with clients year-round — not a once-a-year scramble. If you want yours pressure-tested, let's talk.