You filed your 2023 return in April 2024, paid what you owed, and moved on. Eighteen months later your bookkeeper asks a question that stops you cold: if the IRS can still come back and question that return, how many years do you actually need to be ready to defend?
For most small businesses the answer is three years. But that number comes with footnotes that double it to six — and in two specific situations, erase it entirely. Understanding which clock applies to you is the difference between confidently shredding old receipts and discovering the one document you need is the one you already threw away.
The Short Answer: Three Timelines Run at Once
The IRS does not have one audit window. It has several, stacked on top of each other under Section 6501 of the Internal Revenue Code:
- Three years — the default assessment window for most honestly filed returns.
- Six years — when you omit more than 25% of gross income.
- Unlimited — when you do not file a return or file a fraudulent one.
- Parallel clocks — separate windows for collecting assessed tax (10 years), claiming a refund (3 years from filing or 2 years from payment), keeping employment tax records (4 years), and supporting property basis (until disposition plus 3 years).
The IRS itself puts it simply: it generally includes returns filed within the last three years in an audit, may add additional years if it identifies a substantial error, and usually does not go back more than six years -- unless fraud or failure to file is involved. That sentence is worth unpacking, because each phrase turns on a different legal trigger.
Why the Clock Matters More for Small Businesses
Larger companies have tax departments and outside counsel whose job is to keep records on an institutional timeline. A ten-person business has you, a bookkeeper, and a cloud drive. If you assume three years and the real window is six, you are three years short on exactly the records that would prove the point under audit.
The clock also matters because it determines your leverage. Once the assessment statute expires, the IRS can no longer assess additional tax for that year (and you can no longer claim a refund for it without a protective claim). Before it expires, every information request carries weight. Knowing where you are on that timeline tells you whether to cooperate quickly, negotiate an extension, or stand on the statute.
The Three-Year Rule: Your Normal Window
What the rule says
Under IRC 6501(a), the IRS has three years from the date you file your return to assess additional tax. File early and the clock is treated as starting on the due date. File on extension on October 15 and the clock starts October 15, not April 15.
If you file a return for 2024 on April 10, 2025, the three-year window generally closes April 10, 2028. If you filed that same return on February 1, 2025 -- two and a half months early -- the IRS treats it as filed April 15, 2025, and the window closes April 15, 2028.
A few details owners miss:
- Amended returns do not restart the clock. Filing Form 1040-X or 1120-X does not give the IRS a fresh three years on the original items; it only affects the items amended.
- A return filed before the due date is deemed filed on the due date. Filing early does not shorten the window.
- The clock starts when a return is filed, not when the tax year ends. A fiscal-year S corporation with a September 15 due date starts its three years on its actual filing date, not December 31.
In practice, most correspondence audits arrive within 12 to 18 months of filing. The IRS says it tries to audit returns as soon as possible after they are filed, and most audits will be of returns filed within the last two years. If you hear nothing by the two-year mark, the risk drops -- but does not disappear until year three closes.
What you should keep for three years -- at minimum
If the three-year rule is the only one that applies to you, keep every record that supports an item of income, deduction, or credit until three years after filing. That includes bank statements, sales invoices, expense receipts, mileage logs, and the filed return itself (many advisors keep the return permanently even when the law allows three years).
When the IRS Gets Six Years: The 25% Omission Rule
The trigger
Under IRC 6501(e), the window doubles to six years if you omit from gross income an amount that is more than 25% of the gross income stated on the return. Note the precise language: omitted gross income, not overstated deductions.
Example: You report $400,000 of gross receipts on Schedule C but leave out a $120,000 1099-NEC from a major client. That omission is 30% of stated gross income -- more than 25% -- so the IRS has six years, not three, to assess tax on that year.
The Supreme Court settled a long-running fight on this point in 2012: overstating your basis -- for example, reporting that you bought inventory for $80,000 when you actually paid $40,000, and thus understating gain by $40,000 -- is not an omission of gross income for purposes of the six-year rule. The IRS can only invoke six years for income you left off the return entirely, not for deductions you inflated. Congress later tweaked related partnership rules, but the core distinction stands: missing income extends the clock; aggressive deductions are generally stuck at three years (unless fraud is involved).
How the math works
The 25% test compares omitted gross income to gross income as stated on the return, not to net income or taxable income:
- A service business with $300,000 gross receipts that omits $80,000 of cash receipts (26.7%) trips the test.
- The same business that reports all $300,000 but overstates supply deductions by $80,000 does not trip it -- though it may still face accuracy penalties within the normal three-year window.
If your revenue comes from many small transactions, marketplace payouts, or cash sales that do not generate matching information returns, this is the window that should worry you. The IRS matches every 1099-K, 1099-NEC, and 1099-MISC it receives against what you reported. A mismatch that exceeds 25% can quietly turn a three-year exposure into six.
What this means for recordkeeping
If any year includes hard-to-track income -- cash sales, barter, crypto payments, platform sales where gross and net settlement amounts differ, or large related-party transfers that could be recharacterized as income -- default to a six-year retention posture for that year's financial records. That includes:
- All 1099s received and your reconciliation of gross receipts to bank deposits
- Merchant settlement reports (Shopify, Amazon, Stripe, Square) showing gross vs. net
- Invoices and contracts that explain gaps between billed and collected amounts
When There Is No Time Limit
Two situations give the IRS an unlimited assessment window under IRC 6501(c):
1. You never file a return
No return, no clock. If you were required to file and did not, the IRS can assess at any time. This also applies if the IRS prepares a substitute for return under Section 6020(b) on your behalf -- that administrative filing does not start the statute for you.
Filing late starts the clock when you finally file. A 2020 return filed in 2025 closes in 2028 (three years later), not 2023. The cost of catching up late is not just penalties and interest; it is an open-ended window until you actually file.
2. You file a false or fraudulent return with intent to evade tax
If the IRS can prove, by clear and convincing evidence, that you filed a fraudulent return intending to evade tax, there is no time limit. This is a higher bar than negligence or even a substantial understatement. Honest mistakes, even large ones, stay on the three- or six-year clock. Fabricated invoices, omitted income with concealed bank accounts, or a second set of books point toward fraud.
There is a practical middle ground many owners miss: even if only one year's return is fraudulent, the IRS does not get an unlimited window on every year -- just the fraudulent one(s). Each tax year's return carries its own clock.
Bottom line: The unlimited rule is not about errors. It is about not filing at all and about willful fraud. If either applies, assume the records for those years are permanent.
The Other Clocks Owners Forget
The income-tax assessment window is the most discussed, but four parallel clocks determine how long you actually need records:
| Clock | How long | What it covers |
|---|---|---|
| Assessment - income tax | 3 / 6 / unlimited | IRS can audit and assess additional income tax |
| Collection | 10 years from assessment (IRC 6502) | After the IRS assesses tax, it has 10 years to collect it -- liens, levies, offsets |
| Refund claim | 3 years from filing or 2 years from payment, whichever is later (IRC 6511) | You can amend to claim a refund; after this, even a valid overpayment is forfeited |
| Employment tax records | 4 years after tax becomes due or is paid, whichever is later | Forms 941, 940, W-2, W-3, payroll registers, tip reports |
| Bad debt / worthless securities | 7 years | Deduction for a business bad debt or worthless security under Section 166(g) |
| Property basis | Until disposition + 3 years (or +6 if omission rule applies) | Closing statements, improvement invoices, depreciation schedules for any asset you still own |
Two practical notes:
- The collection clock (10 years) only starts after assessment, which is itself bounded by the 3/6/unlimited window. A 2024 liability assessed in 2027 can be collected through 2037.
- The refund clock bites owners who overpay and file late. If you file a 2024 return in October 2028 and paid withholding throughout 2024, your refund claim for 2024 may already be barred. Filing on time preserves both sides of the statute.
How an Audit Can Grow Beyond Three Years in Practice
Even when a single year is under the three-year rule, audits expand:
1. A substantial error is found. The IRS's audit manual allows examiners to expand to additional years when a material issue is identified. If your 2023 cost-of-goods-sold computation is wrong because you never counted ending inventory, the examiner has reason to suspect the same method infected 2022 and 2021.
2. Related returns are linked. Auditing your S corporation often pulls in your individual return for the same year, and vice versa. A partnership audit can flow through to every partner's return.
3. You agree to extend the statute. As the three-year deadline approaches, the examiner will often ask you to sign Form 872, Consent to Extend the Time to Assess Tax. This is voluntary, but declining has consequences (see below).
4. Employment and income issues overlap. An examiner reviewing officer compensation may open both income-tax and employment-tax years, which sit on different clocks.
Think of the three-year window as the initial scope, not a ceiling. Clean books for the year under examination make expansion less likely; messy books invite it.
What Triggers the IRS to Look Further Back
Small businesses are not audited at random. Computer scoring (DIF), information-return matching, and issue filters flag returns. Common flags that also correlate with expanded lookbacks:
- Income that does not tie to 1099s and bank deposits. Cash-intensive businesses -- restaurants, salons, contractors, auto repair, convenience stores -- face higher match risk. If deposits exceed reported receipts, expect questions.
- Consecutive years of losses, especially on Schedule C. Repeated losses that look like a hobby or that offset W-2 income draw scrutiny, and once one loss year is examined, the examiner looks at the pattern.
- Large, round, or disproportionate deductions. Meals, travel, vehicle, and contractor expenses that are large relative to revenue, or that end in round numbers, are classic filters.
- Worker classification. Paying a workforce entirely on 1099-NEC when competitors in your industry use W-2s is a persistent trigger. Misclassification can span employment-tax and income-tax issues at once.
- Related-party transactions. Rent paid to your own LLC, management fees to a family entity, or loans with no documentation invite recharacterization and multi-year review.
- Math that does not foot. Gross profit that does not reconcile to inventory changes, or cost of goods sold that ignores beginning and ending inventory, signals a bookkeeping failure the IRS assumes repeats annually.
None of these guarantees an audit. All of them raise the probability that, if an audit occurs, the examiner will ask for more than one year.
The Extension Request: Form 872 and What to Do When Asked
When the assessment deadline is near and the audit is not finished, the IRS will ask you -- in writing -- to extend the statute. The request usually comes as Form 872 or the open-ended Form 872-A. The TIGTA has reported that field examiners routinely request these consents as part of case management.
You are not required to sign. Publication 1035 and the Taxpayer Bill of Rights are explicit: you can decline. But understand the trade-off:
- If you sign: You give both sides more time. You gain time to gather documentation, seek an appeal if you disagree, or file a refund claim. The IRS gains time to complete the exam without rushing to a determination based on an incomplete file. You can limit the extension to specific issues or to a fixed date rather than an open-ended period.
- If you decline: The examiner must make a determination on the information at hand, which often means disallowing deductions you have not yet substantiated and issuing a notice of deficiency. You can then petition Tax Court, but you have lost the chance to resolve it at the exam level with more records.
Practical tips if you receive the request:
- Ask why. How many months does the examiner need and for what specific issues? A 90-day extension to review vehicle logs is different from a 12-month extension to expand to two more years.
- Limit scope and time. Cross out open-ended language and write in a fixed date (for example, 180 days) and the specific tax years and issues covered. Initial the changes.
- Get your representative involved. If you have a CPA or attorney with a Power of Attorney on file, they should negotiate the terms before you sign.
- Calendar the new date. The extended statute becomes your new hard deadline. Missing it while believing the original date applied is a common error.
What Happens If You Get Audited: Three Types, Three Experiences
Knowing the format tells you how far the paper trail needs to reach:
- Correspondence audit (by mail). The most common for small businesses. The IRS asks for documentation on one or two items -- for example, business miles or a home-office deduction. You respond with records. These rarely expand beyond the initial year unless your response reveals a systemic issue.
- Office audit. You bring records to an IRS office. Broader in scope, often covering an entire Schedule C or the full Form 1120-S. Expect requests for bank statements, general ledgers, and source documents.
- Field audit. The examiner comes to your place of business. Reserved for more complex or higher-dollar cases -- multi-entity structures, heavy inventory, or employment-tax issues. The most likely to expand to multiple years and related returns.
Every audit notice should tell you the tax year under examination, the items being questioned, and the deadline to respond. Keep every notice permanently; the statute discussion in the closing letter determines when that year's window actually ends.
Your Recordkeeping Playbook for Each Window
Translate the legal clocks into a retention system your bookkeeper can run without a lawyer on call:
Keep for at least 3 years after filing
Daily sales summaries, credit card receipts, vendor invoices for non-capital expenses, bank deposit slips, petty cash logs, routine correspondence.
Default to 6 years for financial records
Most CPAs advise small businesses to default financial records to six years -- bank statements and reconciliations, general ledgers, sales invoices, accounts payable, 1099s issued and received, inventory counts, and merchant settlement reports. The extra three years costs little in cloud storage and covers the substantial-omission scenario without requiring a judgment call on whether you omitted 25% of gross income.
Keep for 7 years
Anything supporting a bad-debt deduction or worthless-security loss, plus records for an NOL carryforward (keep through the year the NOL is fully absorbed plus three more years).
Keep for 4 years after due or paid
All employment tax records -- Forms 941, 940, W-2/W-3, payroll registers, time cards, tip reports, and Forms 1099-NEC for contractors.
Keep until disposition + 3 years (effectively, until you sell + 3)
Closing statements, purchase invoices, capital improvement receipts, and depreciation schedules for every asset you own -- real estate, vehicles, equipment, and capitalized intangibles. Store these in a permanent asset folder, not in the yearly tax file. When you sell, move the folder to the year-of-sale file and apply the normal retention rule from there.
Keep permanently
Filed tax returns, IRS audit reports and closing agreements, entity formation documents, corporate minutes, stock ledgers, deeds, title policies, intellectual property registrations, and canceled checks for major payments.
If that sounds like a lot, it is -- which is exactly why version-controlled, searchable storage beats a box in the garage. The IRS accepts electronic records under Rev. Proc. 97-22 and later updates, as long as they are complete, legible, and reproducible. A scanned receipt stored in a system with an audit trail is a record; a faded thermal slip in a shoebox that you cannot read at audit is not.
State Rules: Why Three Years Is Not Always Three Years
Federal law sets a floor, not a ceiling. States set their own assessment statutes, and many are longer:
- Several states have a four-year general assessment window rather than three.
- States that piggyback on federal adjustments often get one additional year after the federal change becomes final, which can reopen a state year even after the federal window closed.
- States with their own substantial-understatement thresholds may have a corresponding six-year rule that is triggered at a different percentage.
If you operate in more than one state, apply the longest applicable window to your retention schedule. An online seller with nexus in a four-year state should not shred 2023 sales tax exemption certificates in 2026 on the assumption that the federal window controls.
A Simple Checklist Before You Shred
Before destroying any tax-related record, run this five-question test for the return year it supports:
- Was the return filed? If not, the window is still open -- do not destroy.
- Was the return fraudulent or willfully evasive? If potentially yes, keep permanently and seek advice.
- Did you omit gross income that could exceed 25% of what you reported? If yes or unsure, keep six years.
- Does the record support property basis, an NOL, a bad-debt deduction, or employment taxes? If yes, apply the longer 4-year, 7-year, or disposition-plus rule.
- Does your state require longer? If yes, apply the state window.
If the answer to all five is "no, standard three-year year," you can archive or destroy after three years from the filing date -- but most advisors add a one-year buffer and keep the filed return itself forever.
Simplify Your Financial Management
Knowing how far back the IRS can look is only useful if your records are actually there when you need them. Clear, consistent bookkeeping -- reconciled monthly, with income tied to bank deposits and 1099s, and with asset purchases tracked separately from repairs -- shortens audits, prevents expanded lookbacks, and makes a three-year or six-year retention policy effortless to follow.
Beancount.io gives you plain-text accounting that is transparent, version-controlled, and AI-ready -- no black boxes, no vendor lock-in, and every transaction traceable to its source document. Get started for free and build a set of books you can defend in any window, whether it is three years, six, or longer.