Cannabis 280E Audit Red Flags: What Triggers an IRS Audit and How to Stay Clear

Cannabis businesses are audited by the IRS at materially higher rates than the general business population — driven by industry-specific risk scoring, federal-state information sharing, and the unusual complexity of §280E returns. If you operate a dispensary, cultivation facility, or processing lab, the IRS knows what you do before you file.

The red flags that trigger — and intensify — a cannabis audit are specific, identifiable, and largely avoidable. Understanding what examiners look for is the difference between a clean exam and a six-figure adjustment.

How the IRS Picks Cannabis Businesses

The selection process typically follows several pathways, and most cannabis operators hit one of them without realizing it. Cannabis NAICS codes — especially 424710 for wholesalers, 453998 for retail tobacco stores covering dispensaries, and 111998 for cultivation — flag returns for automated scoring review. Large cash transaction reporting (Form 8300 filings for payments over $10,000) feeds into the same scoring models and is treated as a risk signal in its own right.

If a previous return claimed 280E treatment that was inconsistent with peer benchmarks, or if state licensing data cross-references you against a federal taxpayer record that hasn't been updated, you're more likely to be in the pool that gets pulled for examination. A spike in Form 8300 filings — say, a dispensary that filed three the previous year and files fifteen the next — is an especially strong trigger.

The IRS also uses state cannabis licensing data, METRC seed-to-sale reporting, and Financial Investigations Unit cash movement reports to identify operators. Your state license application gives examiners a starting point — state-level decoupled treatment does not protect you from federal review.

The Top 280E Audit Red Flags

When an examiner opens a cannabis return, certain patterns draw immediate attention. These are the most common red flags that elevate a routine review into a full audit — and most are operator-fixable:

• Misclassified COGS — Inventory costs claimed under COGS without supporting treatment under IRC §471. The IRS challenges these aggressively and often disallows the entire deduction if the methodology isn't documented.
• Inconsistent allocation methodology — Square-footage allocations that differ year over year, allocation bases that changed mid-period, or methodology shifts after the year closed. Inconsistency signals opportunism, even when each year's approach was defensible.
• Undocumented dual-role payroll — Splitting wages between COGS and operating expenses without contemporaneous time records. Post-hoc spreadsheets assembled during an audit carry almost no weight.
• Packaging misclassification — Pulling decorative or marketing packaging into COGS, or pushing compliance-required packaging out. Child-resistant containers required by state law are COGS; logo-printed mylar is not.
• Vendor and supplier issues — Paying suppliers who don't match state licensing records, sourcing from inventory that can't be reconciled against METRC or seed-to-sale data, or paying vendors without proper 1099 filings.
• Transfer pricing between related entities — Inflating the intercompany transfer price between commonly owned cultivation and retail operations. The IRS tests related-party transactions at arm's length and will recharacterize both sides if the price isn't defensible.
• Missing or back-dated time logs — The single most common documentation failure in cannabis audits. Time records that are reconstructed, retroactive, or maintained only on outside spreadsheets are routinely disallowed.
• Reconciliation gaps between cash receipts and reported revenue — Especially in retail dispensary operations. Any gap between point-of-sale totals and 1120/1120-S revenue above a few percent is a near-automatic escalation.

COGS Classification Errors: The #1 Trigger

COGS classification is the single biggest trigger of 280E-related audit adjustments. Most examiners lead their review here because the dollar impact is largest and the documentation gaps are most common. Three categories account for the majority of disallowances.

Over-claimed shared overhead

Rent, utilities, or facility costs that don't tie back to a defensible physical allocation. A cultivation facility that allocates 80% of facility rent into COGS — when visually only 50% of the building is production space — invites recharacterization. Square footage must match physical layout, not what would be most tax-advantageous to claim. A written methodology adopted before year-end, applied consistently, saves the audit.

Misclassified labor

Non-production wages pulled into COGS without supporting time records, or production wages excluded because they appear in a "management" payroll bucket. A head of cultivation who also handles regulatory compliance and HR should not have 100% of their wages in COGS — but neither should 0% just because their job title is "Director." Hours are what matter, not labels. Operators who can't produce contemporaneous time logs during an exam routinely lose the labor portion of their COGS deduction entirely.

Packaging overreach

Pulling branded tins, decorative bags, or marketing giveaways into COGS as if they were compliance-required. Child-resistant exits bags required by state law are clearly COGS. Logo-printed mylar with no regulatory function is not. Examiners know the difference and they ask for state-by-state packaging requirements.

Documentation That Defends You

The single best protection against an audit adjustment is documentation that exists before the IRS asks for it. By the time an examiner shows up, retroactive reconstructions carry almost no weight. Build your defenses in advance:

• Chart of accounts separating production from G&A from day one. Production costs and operating costs should live in distinct account categories. Reclassifying expenses post-filing looks opportunistic and is much harder to defend.
• Contemporaneous time records for dual-role employees. Punch-clock or time-tracking-app entries that match payroll records, with allocation percentages applied consistently across pay periods.
• Written allocation methodology. A one-page document describing the basis for your COGS allocations (square footage, headcount, direct measurement) and the year the methodology was adopted. The IRS wants to see that you thought about it before claiming it.
• Vendor invoices categorized by function, not just by vendor. "I bought it from this supplier" is not the same as "this expense went into production."
• METRC or seed-to-sale reconciliation. Closing the loop between state-mandated inventory tracking and tax return inventory numbers. Gaps here are immediate red flags.
• Consistent methodology applied across periods. Year 1's approach should match Year 3's approach. Inconsistency signals opportunism to examiners, even if each year was defensible in isolation.

The documentation doesn't need to be perfect. It needs to exist, be contemporaneous with the relevant transaction, and tie back to a defensible methodology. Operators who meet that bar are largely insulated from the largest adjustments.

What to Do If You're Audited

If you receive an IRS examination notice for a cannabis return, the first move is to assemble your representation. Most operators work with a cannabis-experienced CPA or tax attorney from the first notice forward — not because the issue is necessarily adversarial, but because 280E examinations are procedurally and substantively complex in ways general practitioners routinely miss.

The §280E proof burden sits with you. Once the IRS establishes that you operated a cannabis business (a low bar — your state license and METRC participation are public), you bear the burden of demonstrating that each COGS claim is properly classified under IRC §471 and not allocated from a blocked §162 expense. That's a higher bar than most examinations impose.

During the audit, the IRS typically requests: your chart of accounts, all invoices for sampled expenses, payroll records and time logs for sampled employees, your written COGS allocation methodology, METRC reports, and bank statements. The examiner will sample — they will not review every transaction — but the sample must be defensible. Two mistakes to avoid: do not reclassify expenses during an audit in response to examiner questions (that signals the original classification was incorrect), and do not produce documents you didn't already have. Both destroy credibility.

The Bottom Line

IRS audit risk for cannabis businesses is real and elevated — but it is manageable. The red flags are identifiable, the documentation playbook is well-understood, and operators who classify correctly and maintain contemporaneous records are largely insulated from the worst adjustments. The discipline is to do this work during the year, not during the audit.

The wider landscape is also shifting. The ongoing federal rescheduling process — moving cannabis from Schedule I to Schedule III under the Controlled Substances Act — would eliminate 280E entirely and remove this audit-risk profile. Until that resolves, 280E remains in full force, and the documentation discipline outlined above is your strongest defense. Plan to operate as if 280E will remain; benefit if it changes.

Related Guides

Go deeper on the topics covered in this guide:

• What Is IRC Section 280E? A Cannabis Business Owner's Guide
• What Cannabis Businesses Can (and Can't) Deduct Under 280E in 2026
• Cannabis Accounting for Dispensaries: What Operators Need to Track, Deduct, and Survive an Audit
• 280E Compliance Checklist: What Every Cannabis Operator Needs