Why tax audits are currently becoming a problem for many startups

It is every founding team’s nightmare. You have spent years developing innovative technology, applied for the Forschungszulage (Germany’s R&D tax credit), received the notices and invested the money in growing your startup. Everything feels secure. And then an unremarkable letter from the Finanzamt (tax office) arrives, ordering a Betriebsprüfung (tax audit).

Anyone who thinks nothing can go wrong after certification by the Bescheinigungsstelle Forschungszulage (BSFZ) and the subsequent assessment by the tax office is mistaken. Around five years after the R&D tax credit was introduced, tax offices are now auditing much more often and more closely. The grace period is over. And since 2026 even more money is at stake, because the maximum assessment base has risen to 12 million euros and there is now a 20 percent flat-rate overhead allowance.

Many current cases show that concerns about these audits are justified. It makes no difference whether companies applied for the R&D tax credit themselves or were supported by advisers such as Zebra Embassy. Nor does the amount of funding make a difference.

As a commercial consultancy, Zebra Embassy is not permitted to represent companies before the tax office. That is why we work closely with our partner law firm ZE Tax & Legal, an independent firm that can also represent companies in a tax audit. Zebra Embassy and ZE Tax & Legal are two separate companies. The firm’s managing director is lawyer Stefan Höhn, a co-founder of Zebra Embassy who specialises in questions around the R&D tax credit. A tax audit is exactly where it shows how good the preparatory work was.

Practical examples

Stefan Höhn has accompanied many tax audits in recent years, back then as a lawyer working alongside Zebra Embassy, today as managing director of ZE Tax & Legal. One example is a young company that suddenly found itself facing a proverbial “one-million-euro cliff”. The tax office questioned the project start date. In its view, the project had already begun before 1 January 2020, the cut-off date from which the R&D tax credit applies at all. It therefore initially demanded repayment of the full amount. The audit order left the founder and CEO fearing that he would have to repay the entire R&D tax credit of one million euros.

The psychological pressure was enormous.

Stefan Höhn recalls: “The founder genuinely thought that if the entire funding had to be repaid, he would be facing insolvency. That is why he immediately cut costs and reduced staff.”

An audit like this drags on for many months, in this case nine. But Stefan Höhn also knows: “Audits can affect anyone, not just companies that have received such a large amount of funding.”

In another case, the auditor criticised a company for allocating all newly hired employees fully to the funded project from their very first working day. “Her argument was that new employees first have to be onboarded, for which she allowed the first two working days per employee,” Stefan Höhn reports. “In total, this meant the audited company had to repay around 3,500 euros out of 180,000 euros in funding.” So a tax audit does not necessarily mean financial disaster. And good preparation can have a real positive influence on how an audit unfolds.

The focus of an audit can also vary considerably. “Around two thirds of audits are dominated by legal questions: How are the costs of pension and social security contributions properly calculated? What is the legal basis? Questions like these can often be resolved without any reduction,” Stefan Höhn explains from his experience. Cases become more complex when individual documents are examined in depth. The intercompany agreement, the contractual relationship between affiliated companies where one conducts research on behalf of the other, is frequently under scrutiny. If its provisions were not examined carefully and the result was not reflected in the R&D tax credit application, this can hide a serious risk. As with the project start, whether a company acted as a contractor for a third party or on its own account is decisive for eligibility, Stefan Höhn explains.

“On the other hand, there are also audits that close without any discussion or findings. And the same or very similar facts are often treated completely differently by different tax offices, not even necessarily in different federal states,” says Stefan Höhn. External circumstances rarely tell you when particular caution is needed and when you can face an audit calmly. His short summary: “The only thing you can rely on is your own good documentation and your preparation for the audit.”

Important: For founders, receiving the tax assessment often feels like the safe end of the process. In reality, this is where a tax audit really begins. Anyone who documented too casually when applying will feel it painfully now.

01 The roadmap: How does a tax audit work?

Anyone who expects a tax audit to follow a digital, nationwide standard will quickly learn otherwise. In reality, the procedure resembles a bureaucratic patchwork.

The chronology of the procedure

• The audit order: Everything starts with an official letter from the responsible tax office, requesting the first data and supporting documents.

• Format chaos: The format in which this data must be provided differs completely from one federal state to the next, and sometimes even from one tax office to the next.

• Review and interviews: Once the auditor has reviewed the documents, there are targeted follow-up questions, interviews with the team and, depending on the case, even an on-site inspection.

• The Schlussbesprechung (closing meeting): the finale. Company, advisers and auditor sit across from each other. Only here is the real outcome of the audit decided.

Stefan Höhn, co-founder of Zebra Embassy, lawyer and managing director of ZE Tax & Legal, sums up the current situation from accompanying companies through tax audits: “The process of a tax audit focusing on the R&D tax credit currently varies a lot from state to state, because these audits are new territory for everyone involved. Auditing this kind of funding is completely new for the authorities. And it shows.”

In one case, for example, an auditor wanted to reject everything from the outset because, in her view, there were no “real” timesheets, meaning records kept weekly or at least monthly and regularly signed off by a supervisor. There is no supreme court case law on this specific requirement yet, which leaves a lot of room for interpretation. In the auditor’s view, if the company disagreed, it would simply have to go to court and create legal certainty that way.

02 The overlooked problem: auditor psychology

There is a wide gap in understanding between the everyday reality of a tech startup and the working world of a tax office. Auditors are usually not software architects or engineers. They want to understand what the BSFZ has confirmed in substance, but they often do not understand the technical processes in a company. That leads to the familiar request: “Explain the project to me in simple terms.” At best. When things go badly, fundamental misunderstandings arise.

As with one Zebra Embassy client, where the auditor highlighted the word “design” every time it appeared in the activity records. Only in conversation with her did it turn out that she had assumed graphic design, which she considered ineligible. What was meant was software design. A trivial example of how easily a linguistic misunderstanding can turn into a real reduction.

If you meet the auditor with technical jargon, you lose. You need to meet auditors at eye level and build the bridge they need to sign off on the file. Without that understanding, auditors quickly reach for the red pen. Stefan Höhn reports from a case he accompanied as a lawyer working alongside Zebra Embassy:

“The auditor really went through all the project reports in detail. For each employee, the reports contained a short description of what that person had done in the project during the financial year. And she took every single one of these descriptions and marked the parts she did not consider part of the R&D project. In many places you could see there was no technical understanding.”

Because many auditors are unfamiliar with the field and case law is still thin, misunderstandings can occur even with properly kept timesheets. Auditors often picture research and development as someone in a laboratory doing an experiment with a test tube. The work of startups, for example in software, is hard for them to see through. With this in mind, it helps to show understanding for the auditors’ situation and to explain the processes in a funded project in a way that makes clear what research actually involves.

What we take away from our clients’ tax audits is that you have to approach the auditor actively, guide them and offer help instead of keeping your distance.

Important: As soon as the audit order arrives, no unprepared employee talks to the auditor. No unprepared conversations with developers. Appoint one internal point of contact and make clear that only this person speaks with the auditor. And involve your tax adviser or the law firm representing you, and Zebra Embassy, right away. Letting the auditor roam the office unaccompanied puts the whole procedure at risk.

03 Tax audit strategy: the three pillars

To come through a tax audit well, the company’s case has to rest on three pillars. This is where it shows, when it matters, who worked properly from the start.

• Pillar 1, working-time documentation: The gold standard is genuine, project-based time tracking. In most cases, however, it does not exist. Retrospective reconstructions therefore have to be carefully derived, documented and justified. Using “internal company documentation” is expressly permitted, but the way it is translated into the R&D tax credit claim must be comprehensible to the tax office. Internal documentation of the work is the prerequisite. In such cases, the audit focuses on a traceable link to auditable timesheets. Blanket estimates without a source (“the CTO surely spent 50% of their time on research”) are usually struck out.

• Pillar 2, what counts as research: a clear line between genuine research and development (R&D), defined by technical uncertainties, hypotheses and the risk of failure, and normal product development or day-to-day business.

• Pillar 3, the project start: By law, the R&D tax credit only applies to projects that started after certain cut-off dates. The Forschungszulagengesetz applies to projects that began after 1 January 2020. The funding was adjusted twice, on 28 March 2024 by the Wachstumschancengesetz and on 1 January 2026 by the Wachstumsbooster. Depending on the funding claimed, these dates can also be decisive. The actual project start must be clearly separated from strategic preparatory work. This third pillar was exactly where the million-euro case described above caught fire.

Stefan Höhn knows from experience: “The documents and the documentation show in the audit who worked properly. That is good advice for everyday business in general: if you document cleanly and correctly, you are in a better position when an audit comes. Every company is responsible for that itself.”

04 Where the tax office looks closely: the critical audit points

When auditors dig deeper, they usually focus on the same weak spots. If you know them, you can close them in advance:

• Project reports and evidence: Does the documentation read like an experimental, iterative search for solutions (R&D)? Or like the implementation of a finished specification?

• Payroll reconciliation: Does the claimed R&D share match the payroll data exactly? Holidays, public holidays and sick days must be deducted from the research hours day by day.

• Mixed roles in startups (the trouble with founders’ hours): In partnerships, founders or shareholders who are not employed can claim their own work at a flat rate. In corporations such as a GmbH, the claim is based on the regular gross salary of employed management. In both cases, a CTO or founder is usually also involved in fundraising, sales or general management. Those hours must be consistently deducted. Claiming 100% R&D raises suspicion, although there are exceptions, especially in the early founding phase.

• Freelancers and contract research: If agencies or service providers were involved, part of these costs can be claimed. Commissioning documents, contracts, invoices and detailed work records (SOWs) must be complete and show clearly what the contractors actually did.

• The ban on double funding: Were funds from ZIM projects, the BMBF or EU programmes already received for the same employee hours? Those hours must be cleanly separated and deducted.

Note: Since 2026, the maximum assessment base has risen to 12 million euros, and there is also a 20 percent flat-rate overhead allowance. So potentially even more money is at stake.

05 The finale: the closing meeting

Important: A tax audit often ends in a mutual understanding, and many founders do not know this. The disputed points are discussed in the closing meeting, and company and tax office not infrequently agree on a joint result, the so-called tatsächliche Verständigung (factual agreement).

That is exactly what helped the startup mentioned at the beginning. What started as a demand for repayment of the full funding had already been reduced to 40 percent of the funding by the closing meeting, still an enormous sum. Because the company was very well prepared and went into the meeting with a complete line of argument, the parties finally agreed on 11 percent. This is an individual case and not a result that can be transferred to other audits. For the other company mentioned above, the repayment ultimately came to around 3,500 euros, less than two percent of the total funding.

Stefan Höhn puts it this way: “The result of a tax audit is not fixed from the start. In the closing meeting, an agreement is often possible, and there is always some give and take. You need to know that.”

Even if an audit is lost and a notice demanding repayment of the full funding is issued, you can file an objection. “Many companies don’t know that either,” says Stefan Höhn. “In one case I accompanied as a lawyer, the objection reduced the repayment demanded in the notice by a further 50 percent.”

Important: A company should never go into a closing meeting unprepared or even intimidated. You need to know exactly on which minor points you can meet the auditor halfway and on which core points you have to stand firm. It helps to keep the auditor’s psychology in mind. In one case Stefan Höhn accompanied, the company went into the closing meeting very well prepared and with its own tax adviser. It quickly turned out, however, that the very young auditor was not allowed to make any decisions herself. She had to discuss and clear every step with her supervisor. Another example of how there are no clear routines yet for tax audits on the R&D tax credit.

06 The typical pitfalls at a glance

Some mistakes come up again and again when startups go through a tax audit. We have listed them here, with tips on how to avoid them.

No or incomplete time tracking

Problem: If you only estimate working hours across the board or document them with gaps, you risk the auditor striking out all or part of the project’s personnel costs after the fact.

Tip: A timely, project-based time tracking system from day one, in which employees record their R&D hours accurately.

Timesheets “polished up” or backdated

Problem: Spreadsheets created in a rush shortly before the audit or backdated with identical patterns stand out quickly in metadata checks and can be treated as an attempt to deceive.

Tip: Be open about gaps. Mistakes happen, and work records are often based on internal records such as GitHub. In our experience, auditors usually value honesty more than an attempt to cover something up.

Unclear line between research and day-to-day business

Problem: When the line between innovative development (with technical risk) and standard product maintenance blurs, the tax office strikes out the costs of “normal” software or product work.

Tip: Document the underlying hypothesis, the technical uncertainties and the failures, so the experimental nature of the work is properly evidenced.

Inconsistencies between the BSFZ and tax office applications

Problem: If the project description in the BSFZ application does not match the figures and employee roles later claimed with the tax office, the auditor becomes suspicious. Minor deviations are not a problem, but key data such as the project start must match.

Tip: A thorough consistency check before filing with the tax office. Are the key data on project duration, title and key personnel consistent in both applications?

Double funding not deducted

Problem: Hours or invoices already funded by other programmes (such as ZIM, BMBF or EU funds) may not be claimed again through the R&D tax credit.

Tip: A strict, cross-project booking history and a reconciliation of other funding notices with your tax adviser.

The “mixed role” of founders and executives

Problem: Auditors look particularly closely at shareholders. A CTO who is also involved in sales, HR or fundraising may not declare those hours as R&D.

Tip: Deduct management and admin activities day by day and document the operational R&D work with particular care.

Poorly documented use of freelancers (contract research)

Problem: Part of the costs of external service providers can be claimed, but the contractor’s detailed time records are often missing, or the arrangement is wrongly just temporary staffing.

Tip: State the project reference clearly in the contract with agencies and freelancers and require monthly, project-based time records that show the technical risk of their work.

07 Lessons learned: What startups should do now

• Prevention from day one: Document promptly and per project, not only when the letter from the tax office arrives. Timesheets per employee and year, kept coherently and per project. Project start and course clearly documented, the project described so that non-specialists can understand it.

• Honesty pays off: If there are gaps in the past, communicate them openly and close them actively instead of covering them up. In our experience, auditors react much more mildly to transparency than to attempts at concealment.

• First-aid check: Run a consistency check between the BSFZ application, the tax office application and time tracking in advance. This is exactly where the inconsistencies arise that set an audit in motion.

Note: How Zebra Embassy and ZE Tax & Legal support you in a tax audit

Zebra Embassy supports its clients in applying for the R&D tax credit and, within the scope of the respective engagement, also when the tax office audits. Representation before the tax office is handled by your tax adviser or our partner law firm ZE Tax & Legal.

• Documents that stay: Active support formally ends with the last notice. Zebra Embassy keeps the documents from your project within the scope of the engagement.

• Ready quickly: When the audit order arrives, Zebra Embassy compiles the requested documents from your project.

• Subject-matter backing: Zebra Embassy provides the concise technical documentation and prepares your team for the conversations with the auditor.

• Representation by the law firm: In the audit and the closing meeting, you are represented by your tax adviser or ZE Tax & Legal. Zebra Embassy supports on the subject matter.

A good first step is the consistency check between the BSFZ application, the tax office application and time tracking. If you want to do it together with us, get in touch.

This article is general information and not legal or tax advice. It does not replace a review of your individual case by your tax adviser or a law firm.