Audit-Defensible 409A Valuations: What Makes a Report Hold Up

Short answer: An audit-defensible 409A requires a credentialed independent appraiser, documented methodology selection, stage-appropriate allocation (OPM or PWERM), a quantified DLOM, and a valuation dated within 12 months of grant — a report that puts you inside the IRS safe harbor and shifts the burden of proof to the government.

An audit-defensible 409A valuation in 2026 is one that meets four specific tests: (1) signed by a credentialed appraiser (ASA, ABV, or CVA) under Treasury Regulations Section 1.409A-1(b)(5)(iv), (2) documents the methodology selection rationale (OPM vs PWERM, comparable set, DLOM model), (3) reconciles with secondary market data where available, and (4) survives Big 4 ASC 718 review and M&A diligence. Every provider claims defensibility, but most 409As are never tested — the ones that are, often fail at the methodology-justification step. You can inspect the full sourced, documented methodology for your own company in a free draft 409A report.

This article walks through what makes an audit-defensible 409A valuation in concrete terms: the legal standard, the documentation a defensible report contains, the inputs and methodology that hold up under audit, the red flags that warn of weak defensibility, and how late-stage and VC-backed startups in particular should evaluate firms on the audit defense criterion. By the end, you will be able to read a 409A report and form a defensible judgment about whether it would hold up.

If you want to skip the sticker shock and the guesswork, get your 409A report free — expert sign-off for IRS safe harbor is just $499, with the same independent-appraiser standard, documented methodology, and audit-defensibility footing as firms charging ten times more.

What Does “Audit-Defensible” Actually Mean in 409A?

Audit defensibility is a legal standard, not a marketing phrase. Under Section 409A, stock options must be granted at FMV on the grant date — a strike below FMV triggers ordinary income tax on the spread plus a 20% additional federal penalty, in the year the option vests. The independent appraisal safe harbor under Treas. Reg. § 1.409A-1(b)(5)(iv)(B)(2) creates a presumption that the FMV is reasonable; the IRS can only override it by showing the determination was "grossly unreasonable." A defensible 409A puts you inside that safe harbor and gives the IRS no easy route out.

For a complete walkthrough of the safe harbor framework, see our 409A safe harbor compliance guide. For details on what the IRS actually examines when it does pull a 409A valuation, see how the IRS evaluates a 409A in audit.

What Are the Five Requirements of the Independent Appraiser Standard?

The independent appraisal safe harbor has five substantive requirements. Every audit-defensible 409A valuation satisfies all five. A report that misses any one of them is at material risk.

1. Independent and qualified appraiser. The valuation must be performed by a person or firm that is independent of the company (no equity, no management role, no contingent fee tied to the valuation outcome) and that is qualified by training or experience to perform the appraisal. The regulations do not list specific credentials, but in practice the qualified-appraiser standard is satisfied by ASA (Accredited Senior Appraiser, business valuation specialty), CFA (Chartered Financial Analyst), CPA/ABV (Accredited in Business Valuation), or equivalent training, combined with hands-on 409A experience. An appraiser without recognized credentials and a track record is the single most common audit-defensibility failure.

2. Reasonable valuation methodology. The appraiser must apply a reasonable valuation method given the facts and circumstances. The regulations and the AICPA Practice Aid on the Valuation of Privately-Held-Company Equity Securities Issued as Compensation describe the three accepted approaches -- income, market, and cost -- and the allocation methods (OPM, PWERM, hybrid) used to assign value to common stock. A defensible report selects an approach appropriate to the company’s stage and explains why. Our 409A valuation methodology guide covers the framework the AICPA and IRS recognize.

3. Consideration of all material information. The valuation must account for the company’s stage, recent financings, comparable company data, intellectual property, customer concentration, and any other material factors. A boilerplate report that ignores a recent priced round, a material customer loss, or a pending acquisition offer fails this requirement. Material event handling is one of the most-tested aspects in audit -- see our guide to what counts as a material event for 409A purposes.

4. Valuation no more than 12 months old. The FMV used at grant must be supported by a valuation that is no more than 12 months old, and there must have been no material event between the valuation date and the grant date. Granting in month 13 -- even with no material event -- knocks you out of the safe harbor. Granting in month 6 after closing a Series B without refreshing the 409A also knocks you out, because the financing is itself a material event. Our coverage of the refresh timing after a funding round walks through this in detail.

5. Written valuation report. The appraisal must be documented in a written report. There is no minimum page count in the regulations, but in practice a report that meets the “considers all material information” and “reasonable methodology” standards almost always runs 25-50+ pages. A one-page certificate of value fails on its face.

What Does an Audit-Defensible 409A Report Document?

The clearest signal of an audit-defensible 409A is the report itself. Pull a sample report from any firm you are considering and check whether the following sections are present, complete, and specific to your company.

A report that contains all of the above is doing the work that the safe harbor requires. A report that lists only a single page of conclusions, or that has a generic methodology section identical from company to company, is not.

What Methodology and Inputs Hold Up Under 409A Audit?

Beyond having the right sections, an audit-defensible 409A applies inputs that are reasonable and documented. The IRS and external auditors will not redo the entire analysis, but they will examine specific inputs that are common levers for manipulation.

Volatility selection. For an OPM-based allocation, volatility is sourced from publicly traded comparable companies. The defensible report names the peer set, explains why each peer is included, and uses a lookback period that matches the expected time to liquidity. Volatility plucked from a generic industry index, or from a peer set that does not match the company’s sector, raises a flag. See our deep dive on Black-Scholes volatility inputs for 409A for the standards a defensible report meets here.

Time to liquidity. The expected holding period drives both the OPM allocation and the DLOM. For a Series A company with no exit process, 3.0-3.5 years is typical. For a late-stage company in active S-1 preparation, 1.0-1.5 years is appropriate. A report that uses a 12-month assumption for an early-stage company without a specific basis -- or a 4-year assumption for a company that has filed an S-1 -- is internally inconsistent and audit-vulnerable.

DLOM calculation. The discount for lack of marketability is the single largest discretionary adjustment in most 409A valuations. A defensible report uses an established quantitative method (Finnerty, Chaffe) cross-checked against empirical restricted stock studies. Our walkthrough of the Finnerty DLOM model shows what audit-defensible DLOM documentation looks like in practice.

Allocation method. OPM is appropriate for early- and mid-stage companies with no specific exit visibility. PWERM (Probability-Weighted Expected Return Method) becomes appropriate as exit scenarios crystallize, typically Series C and later. A hybrid approach -- OPM with a probability-weighted IPO scenario broken out -- is the dominant late-stage standard. Using a current-value method (CVM) on a company that should be on OPM, or sticking with OPM on a company that has filed an S-1, are both common defensibility failures.

Cap table treatment. The defensible report layers in the full economic structure: liquidation preferences, participation features, conversion ratios, anti-dilution, outstanding warrants, the option pool, and any convertible notes or SAFEs. Failing to model a convertible-note conversion or an outstanding warrant can change the common-stock allocation by tens of percent.

What Are the Red Flags That a 409A Report Will Not Hold Up?

Some patterns in 409A reports are reliably problematic. Any single one is a warning; multiple together mean the report likely fails the safe harbor on its face.

• Unqualified appraiser. No ASA, CFA, CPA/ABV, or equivalent credential; no documented relevant experience.
• Report under 10 pages. Cannot plausibly meet the “considers all material information” standard.
• Missing methodology section. No explanation of approach selection, allocation method, or DLOM methodology.
• Boilerplate company narrative. Company description that could apply to any startup -- a sign the report was templated, not analyzed.
• DLOM far below stage norms. A 10% DLOM for a Series A or a 5% DLOM for a seed company without supporting analysis.
• Unsupported time-to-liquidity. 12-month assumption with no exit process, or 4+ year assumption when an exit is imminent.
• Stale valuation date. Granting more than 12 months after the valuation date, or after a financing or other material event.
• Failure to model convertibles. SAFEs or convertible notes ignored in the cap table allocation.
• FMV that contradicts a recent priced round. A common stock value that implies a total enterprise value materially different from the priced-round indication, with no documented explanation.
• Contingent fees. An appraiser whose fee depends on the valuation outcome is not independent.

For a broader list of preparation and methodology errors, see common 409A valuation mistakes founders make.

What Are the 409A Audit Defensibility Requirements for Late-Stage and Pre-IPO Companies?

Audit defensibility matters at every stage, but the bar rises as a company approaches an exit. For a late-stage or pre-IPO company, the 409A valuation will be examined not only by the IRS in the event of an option-grant audit, but also by the company’s external auditors during ASC 718 stock-based compensation review, by SEC reviewers during the S-1 process, and by the acquirer’s diligence team in M&A. Each of these reviewers applies a different lens, but all of them are looking at the same report.

For pre-IPO companies, the SEC pays particular attention to the “cheap stock” question -- whether common stock options were issued at FMVs that are materially below the eventual IPO price. The SEC will look at the methodology, the inputs, and especially the assumed time to liquidity in the most recent 409A valuations leading up to the S-1. A defensible late-stage 409A explicitly probability-weights an IPO scenario, ties the time-to-liquidity assumption to the S-1 timeline, and produces a per-share value that reconciles -- with documented adjustments for DLOM and the IPO probability -- to the expected IPO price range. Our coverage of pre-IPO 409A valuation timing and SEC scrutiny walks through the specifics.

For Series C and beyond, audit defensibility increasingly requires PWERM or hybrid allocation, more detailed cap table modeling, and a documented track record of refreshing valuations in response to material events. The provider standard is also higher: a firm that handles seed-stage companies well may not have the bench depth to defend a Series D 409A under Big 4 auditor scrutiny. See our coverage of 409A valuation providers for Series C and late-stage companies for the firm-selection criteria that apply at this stage.

How Do You Evaluate a 409A Firm on Audit Defensibility Before You Buy?

Most founders evaluate 409A firms on price and turnaround. Audit defensibility is at least as important -- and harder to evaluate, because the cost of a weak report shows up only when the report is challenged, often years later. Here are the questions to ask a prospective provider before you sign.

• What credentials does the appraiser who will sign my report hold? Look for ASA, CFA, CPA/ABV, or equivalent.
• Can I see a redacted sample report for a company at my stage? Look for 25-50+ pages, full methodology disclosure, and stage-appropriate allocation method.
• Have your reports been reviewed by Big 4 auditors? Have any been challenged in audit? A firm that routinely passes Big 4 ASC 718 review is meeting an external audit standard close to what an IRS examiner would apply.
• How do you select the volatility peer set? Defensible answer: documented public comparables in the same sector and stage, with a stated lookback period matched to expected time to liquidity.
• What DLOM method do you use, and how do you cross-check it? Defensible answer: Finnerty or Chaffe, cross-checked against restricted stock studies (Pluris, FMV Opinions).
• How do you handle convertible notes and SAFEs in the cap table? Defensible answer: explicitly modeled in the OPM/PWERM, with conversion price and discount/cap mechanics applied.
• What do you do if a material event occurs between valuation and grant? Defensible answer: refresh the valuation; do not grant on a stale FMV.
• How do you support a 409A under IRS audit? Defensible answer: the appraiser is available to defend the methodology and inputs; the firm has experience supporting valuations in audit.

For broader provider evaluation criteria across stage and budget, see our guide to comparing 409A valuation providers.

What Actually Happens in an IRS 409A Audit?

A 409A challenge typically arises four ways: IRS examination of an option holder's personal return, payroll tax audit, external auditor objection during ASC 718 review, or M&A diligence. In each scenario, the reviewer requests the same package — the valuation report, appraiser credentials, supporting workpapers, and board minutes approving the FMV and grant.

If the package satisfies the independent appraisal safe harbor, the burden of proof shifts to the IRS to show the FMV was "grossly unreasonable" — a bar the IRS rarely clears. If the package fails the safe harbor, the IRS can recharacterize options as below-FMV grants, with the 20% penalty falling on the option holder and reputational damage falling on the company. Audit defensibility is a board-level concern for any company that has issued meaningful equity.

What Does an Audit-Defensible 409A Actually Look Like?

An audit-defensible 409A valuation is not exotic. It is a written report, prepared by a credentialed independent appraiser, applying a stage-appropriate allocation method with documented inputs, considering all material information about the company, dated within 12 months of the grant date, with no intervening material events. Reports that do all of this are inside the safe harbor; reports that miss any of these elements are at risk.

For founders, the practical move is to apply the firm-evaluation questions above before you commit to a provider, ask to see a redacted sample report, and verify that the appraiser who will sign your report has relevant credentials and experience. For boards and CFOs at later-stage companies, audit defensibility means selecting a firm whose reports clear Big 4 ASC 718 review and SEC cheap-stock scrutiny on the way to an IPO.

None of this requires paying $10,000+ for a 409A. What it requires is making sure the firm you choose -- whatever it costs -- meets the documentation, methodology, and credential standards described above. Audit defensibility is a function of how the work is done, not how much it costs.