FINHelp - Understand Money. Make Better Decisions.

Preparing a Virtual Audit: How to Share Documents Securely with the IRS

How can I share documents securely with the IRS during a virtual audit?

Preparing a virtual audit is the process of collecting, organizing, and transmitting requested tax records to the IRS using secure, documented methods that protect taxpayer data and satisfy IRS procedures and deadlines.
Tax professional and client at a minimalist desk using a laptop showing a secure file transfer with a padlock icon and checklist while a remote auditor appears on a video call.

Why secure document sharing matters

Virtual audits require taxpayers and representatives to send sensitive personal and financial records electronically. That data often includes Social Security numbers, bank account details, payroll records and tax returns — all of which are high-risk if exposed. The IRS and professional standards require safeguards. Follow IRS guidance on audits and e-services to avoid data breaches and delays (see IRS audit and e-Services guidance).

In practice, an insecure or poorly documented transfer can: cause identity theft, trigger additional IRS scrutiny, or create evidence problems if the agency questions the chain of custody. A secure, organized delivery both protects taxpayers and speeds resolution.

Sources: IRS — Audits (https://www.irs.gov/businesses/small-businesses-self-employed/audits) and IRS e-Services (https://www.irs.gov/e-services). For practitioner data-handling practices see IRS Publication 4557, Safeguarding Taxpayer Data (https://www.irs.gov/pub/irs-pdf/p4557.pdf).

Step-by-step checklist to prepare documents

  1. Read the IRS request carefully. Note specific forms, tax years, page ranges, and deadlines. If the request is unclear, contact the IRS auditor to confirm what they need.
  2. Create a single audit folder structure (local, then cloud backup). Example: /Audit-2024/Returns/, /Audit-2024/Bank-Statements/, /Audit-2024/Receipts/. Keep a copy offline (encrypted external drive) as a backup.
  3. Gather originals and supporting documents. For paper receipts or checks, scan at 300–600 DPI to ensure legibility.
  4. Redact unnecessary sensitive data. Do not include unrelated Social Security numbers or account numbers. If a SSN is needed, only include the one the IRS specifically requested.
  5. Convert to PDF and OCR where useful. PDFs are easier to password-protect, sign, and timestamp than image files.
  6. Name files consistently. Example: 2022Form1040Complete.pdf, 2022BankABCBank01-2022.pdf.
  7. Create an index or cover letter listing every file uploaded and a brief description. The index becomes part of your audit trail.

Secure transmission methods (what to use and why)

  • IRS e-Services / Secure portals. Tax professionals who qualify can use IRS e-Services tools. Confirm registration and access procedures before the audit timeline begins [IRS e-Services].
  • Secure file-sharing platforms with link expiration and AES-256 encryption at rest and in transit. Look for SOC 2 or ISO 27001 attestations from vendors.
  • Encrypted email only if both sender and recipient support modern end-to-end encryption (S/MIME or PGP) and you verify their public key. Many auditors cannot accept standard email attachments.
  • Password-protected PDFs with separate password delivery. If you must use email, password-protect the PDF and send the password through a different channel (phone call, SMS to a verified number, or a separate email account). Use strong passwords.

Avoid: standard unencrypted email attachments, consumer file links with public access, or file-sharing that creates public indexes. If you use a third-party vendor (e.g., ShareFile, Dropbox Business, Box), confirm vendor compliance and set strict sharing permissions and expiry.

Practical security settings and recommendations

  • Encryption: Verify TLS 1.2+ for data in motion and AES-256 for data at rest. Ask vendors for encryption details.
  • Access control: Grant access only to named IRS personnel or your authorized representative, and set links to expire after the required window.
  • Two-factor authentication (2FA): Enable 2FA on accounts that host audit documents.
  • Audit logging: Use platforms that provide access logs showing who downloaded or viewed files and when. Save those logs as part of your audit record.
  • Document integrity: Save MD5/SHA-256 hashes of key files before upload. If a dispute arises about file contents, hashes prove the files were not altered after upload.

Organizing evidence and creating an audit trail

A clear audit trail reduces follow-up requests and demonstrates good-faith cooperation. Include:

  • A cover letter or index with file descriptions and page counts.
  • Timestamps and receipts from your file-sharing platform or exported log files.
  • A short notes file (Audit_Notes.txt) explaining any edits, redactions, or reconstructed documents.
  • Proof of transmission: screenshots of upload completion, email delivery receipts, or portal confirmations.

In my practice I store the index and transmission receipts in a single “Audit Package” folder and keep a second encrypted backup offline for seven years, consistent with record-retention best practices.

Folder and file naming template (example)

  • 2023Form1040Signed.pdf
  • 2023ScheduleCProfitLoss.pdf
  • 2023BankChase01-2023to_12-2023.pdf
  • IndexAudit2023.txt (includes file list, short descriptions, and timestamps)

Consistent naming speeds reviewer searches and reduces the chance items get overlooked.

Communication tips when dealing with IRS examiners

  • Confirm the examiner’s identity and official contact information (IRS phone number, examiner name and badge number for in-person contacts).
  • Ask whether the IRS has a preferred secure method (some auditors accept uploads directly to an IRS portal; others prefer practitioner portals).
  • Ask for a single point of contact and clarify acceptable file formats and deadlines.
  • If you need more time, ask for an extension in writing and confirm any changes by email or portal message.

Common mistakes and how to avoid them

  • Sending unencrypted email attachments. Use secure portals instead.
  • Uploading unnecessary or unrelated documents. Limit uploads to only what’s requested.
  • Poor file labeling and no index. Create a clear index up-front.
  • Forgetting to obtain access logs. Export logs immediately after transmission.

Sample timeline for a routine correspondence/virtual audit

  • Day 0: Receive audit notice. Read request and confirm deadline.
  • Day 1–3: Gather documents, scan, and assemble index.
  • Day 4: Upload using secure portal, export logs and receipts.
  • Day 4–7: Confirm IRS receipt and availability to answer follow-ups.

Adjust timelines for complexity; complex business audits will require more preparation time.

What the IRS requires and technical references

Note: the IRS does not endorse commercial vendors named here. Always verify vendor security certifications and compatibility with IRS instructions.

When to use a representative

If the request is complex, or you are unsure how to format and transmit sensitive records, appoint a qualified representative (CPA, EA, or tax attorney) and file Form 2848 (Power of Attorney) if appropriate. A representative experienced with virtual audits will typically have secure, documented processes and may use practitioner e-Services portals.

See our guides: “What to Expect During a Virtual Tax Audit: Remote Documentation Tips” and “Preparing for a Tax Audit: Documents, Timeline, and Tips” for more on timing, evidence and representation.

FAQs (short answers)

  • Can I send documents by standard email? No. Standard email is not secure for taxpayer-identifiable information unless you use end-to-end encryption.
  • Is password-protecting a PDF enough? Password protection is useful but should be combined with secure delivery and separate password transmission.
  • How long should I keep audit files? Keep audit copies and logs for at least three years; many professionals recommend keeping them 7 years depending on the issue and statute of limitations.

Final checklist before sending

  • [ ] Confirm list of requested items and deadlines.
  • [ ] Create an index and name files consistently.
  • [ ] Redact unrelated sensitive data.
  • [ ] Save hashes and generate logs.
  • [ ] Use secure transmission and set access expiration.
  • [ ] Deliver password or access code by a separate channel.

Professional disclaimer
This article is educational and not legal or tax advice. For guidance specific to your situation, consult a qualified tax professional. The IRS rules and tools evolve; always confirm current procedures at IRS.gov.

Authoritative sources

Interlinked resources on FinHelp

By applying these steps you reduce exposure, keep accurate records of transmission, and help ensure the IRS receives the documents it needs to complete the audit efficiently.

Recommended for You

View All Glossary
FINHelp - Understand Money. Make Better Decisions.

One Application. 20+ Loan Offers.
No Credit Hit

Compare real rates from top lenders - in under 2 minutes
See My Offers