Statute of Limitations on IRS Audits: 3 Years, 6 Years, or Forever

The statute of limitations on an IRS audit of a business is generally three years from the date you filed the return. It stretches to six years if you leave out more than 25% of your gross income, and it never closes at all for a fraudulent return or one you never filed. Which window applies is not something you get to pick, and you rarely know which one is in play until a notice arrives, so the practical answer to all of them is the same: keep the records that support the return. Our guide on whether the IRS can audit a business that already closed covers what happens after you shut the entity down. This page explains the windows themselves.

The three-year default

Most returns sit under a three-year clock. The IRS says an audit generally includes returns filed within the last three years, and its record-retention guidance frames the same period as the period of limitations, meaning the span of time in which the IRS can generally assess additional tax. Refund claims run on related but separate timing rules.

The clock runs from the date you filed. One timing detail is easy to miss: a return filed before its due date is treated as filed on the due date for this purpose. So filing your 2025 return in February does not start the clock early; it still runs from the spring due date. For a business filing on time, the ordinary exposure closes about three years after that date.

Six years: the 25% understatement rule

The three-year default has a well-known extension. The IRS says to keep records for six years if you do not report income you should report and it is more than 25% of the gross income shown on your return. This is the audit and assessment window itself getting longer: leave enough income off the return and the IRS gets three additional years to come back and assess. On the audit side, the agency says it usually does not go back more than the last six years, adding years to the standard three when it finds a substantial error.

The threshold is about the size of the omission, not intent. A large understatement can trigger the six-year window even if it was an honest mistake, which is one reason the exposure is wider than many owners assume.

No limit: fraud and an unfiled return

At the far end, some situations have no expiration. The IRS says to keep records indefinitely if you do not file a return, and indefinitely if you file a fraudulent one. The logic follows from where the clock starts. Because the period runs from the date a return is filed, a return that was never filed has no start date, and the window stays open with no defined end. A fraudulent return is treated the same way. For a business that shut down in a chaotic final year and never filed its last return, this is the case that quietly stays open the longest.

Seven years is a different clock

You will often see "seven years" listed next to these audit windows, and it is worth separating out, because it is not the assessment period stretching to seven. The IRS lists a seven-year retention period for records that support a claim for a loss from worthless securities or a bad-debt deduction. That is a records-retention rule tied to those specific claims, not an extension of the general audit window the way the six-year rule is. The six-year figure is about how long the IRS has to assess; the seven-year figure is about how long to hold the documents behind a particular kind of loss. We put that seven-year expectation against QuickBooks' one-year data window in a separate guide.

You cannot know in advance which window applies

The uncomfortable part of all this is that the window is decided by facts you may not weigh the same way the IRS does, and you learn which one applies only if a notice shows up. Before discarding older tax records on the assumption that only three years matter, ask your CPA which retention period applies to your situation. The defense is the same regardless of which clock turns out to govern: the source documents that back the numbers on the return, kept accessible and tied to the transactions they support. Our guide to what records the IRS actually asks for breaks down the categories a request usually names.

If those records live in QuickBooks Online, the retention math collides with a much shorter timer. Cancelling a paid subscription holds the company in read-only mode for 12 months and then deletes it permanently, while a cancelled trial gets only 90 days, and the audit windows above can run years past that. The safe move is to pull a complete copy while the company is still open, and if you would rather not do it by hand, that is the archive we build for you: the full ledger, every report in cash and accrual basis, every attachment kept with its transaction, and the audit log, all verified against your live company before you cancel.