An inspection by the Guardia di Finanza in a company can create operational and decision-making difficulties in a matter of minutes: business operations must continue, you need to understand what the officers are doing, and you must avoid making mistakes in handling documents, computers, or statements. The first distinction to make is between a tax audit and a criminal search. They are not the same thing, even though they may take place on the same premises and involve some of the same data.
In this guide, I explain what information you can request, why the minutes matter, what changes if PCs, servers, or phones are seized, and what behaviors help protect the business without hindering operations. The objective is not to find formulas to use on the spot, but rather to recognize the type of act and carefully preserve useful elements for subsequent choices.
Tax Inspection and Search: Two Acts with Different Rules
The purpose of a tax audit is to acquire data useful for tax control. Access to company premises may involve accounting records, invoices, contracts, inventory, IT flows, and other elements related to the company's tax position. Depending on the subject of the audit, tax regulations granting powers of access, inspection, and search apply; for VAT, the central reference is Article 52 of Presidential Decree No. 633 of 1972, which is also referenced for the activities of the Guardia di Finanza.
A search, on the other hand, is of a criminal nature. It is aimed at looking for the corpus delicti, items related to the offense, or elements to be subjected to seizure within the framework of criminal proceedings. This act must therefore be distinguished from the normal acquisition of documents during a tax audit: the legal basis, the authority ordering or validating it, the content of the act, and the possible defensive initiatives all change.
The name of the act alone is not enough. You must read the order or the report delivered: it must be specified whether the activity is an inspection access, a local search, an evidentiary seizure, a preventive seizure, or an urgent judicial police activity. The same visit may have both tax and criminal significance, but this does not allow treating every acquisition as if it were automatically a criminal seizure.
During a Tax Audit: What Guarantees Does the Company Have
The company must be informed of the reasons and purpose of the audit. Article 12 of the Taxpayer's Statute provides that, at the beginning of the audit, the taxpayer receives information on the reasons for the inspection, its purpose, the related rights and obligations, and the right to be assisted by a professional qualified for defense before the tax judiciary. These guarantees are set out in current Article 12 of Law 212/2000. Since 2025, authorizations and access records must also expressly explain the circumstances justifying access.
Assistance does not turn the inspection into a negotiation. The professional cannot prevent access or replace the auditors, but can help understand the purpose of the requests, organize the presentation of documents, and formulate specific observations. If the examination concerns administrative and accounting documents, the taxpayer may request that it take place at the auditors' office or at the office of the professional assisting or representing them, within the limits established by the applicable regulations.
Observations must be entered into the minutes of the operations. This is the moment to have specific facts recorded: for example, that a document is incomplete because it is kept by a third party, that data exported from the management software covers a period different from the one requested, or that a file contains provisional entries. There is no point in filling the record with generic disputes; the goal is to prevent a technical or organizational element from remaining unexplained.
The duration of the presence at the premises has limits, but does not always coincide with the total duration of the audit. The Statute regulates the days of actual presence of the auditors at the taxpayer's premises and provides for different thresholds for businesses under simplified accounting and for self-employed workers. The expiration of that period does not cancel the audit or exclude further activities permitted by law; however, it signals that a distinction must be made between access to the premises and subsequent requests, analyses, and interactions.
Authorizations, Premises, and Documents: What Access Can Change
Access to company premises requires an instrument indicating its purpose. Article 52 of Presidential Decree No. 633 of 1972 regulates access for documentary inspections, verifications, and searches in premises used for business activities and requires specific authorization for the operators. The same article provides for more incisive guarantees for access to premises also used as dwellings, for places other than business locations, and for the forced opening of containers or closed spaces. The reference is Presidential Decree No. 633 of 1972.
The presence of a dwelling changes the level of authorization required. An office located in the administrator's home, a storage room set up in a mixed-use building, or an archive kept at home should not be treated as normal business premises simply because they contain company documents. It is important to immediately indicate which space is actually destined for business activity and which is residential, avoiding both hiding the situation and confusing different purposes.
Failing to exhibit a document can have consequences even after access. Tax regulations link the refusal to exhibit documents or evading inspection to unfavorable effects regarding the subsequent usability of documents in favor of the taxpayer. For this reason, it is not advisable to respond impulsively that a document does not exist. If the document is with the accountant, a consultant, a group company, or an external archive, it is more useful to accurately state where it is located and on what medium it is stored.
Criminal Search: Reading the Order and Not Hindering Operations
A search does not authorize blanket requests on any aspect of the company. In the Code of Criminal Procedure, a local search is linked to the search for items or traces relevant to the crime under investigation. The order makes it possible to understand which proceeding is indicated, which premises are involved, and what connection is suggested with the items sought. Article 252 regulates the seizure of items found following a search in the Code of Criminal Procedure.
The prudent approach is to cooperate materially without improvising explanations. Do not delete files, move documents, alert external parties to conceal elements from the searches, modify passwords, or create new versions of data. At the same time, those operating on behalf of the company must not turn technical questions or requests for clarification into unconsidered statements on facts that may have criminal relevance. If a defense counsel is present or can intervene quickly, their assistance helps maintain a clear boundary between handing over data and making personal statements.
Minutes and orders must be kept in their complete form. The judicial police document searches and seizures with minutes. It is useful to separately note the start and end times, the persons present, the devices indicated, any requested credentials, the copied media, and the receipts issued. This reconstruction does not replace the official record, but allows it to be compared with what actually happened and to promptly identify any issues regarding the scope of the acquisition.
PCs, Servers, Phones, and Cloud Data: IT Seizure Is Not a Technical Detail
A device and the data contained within the device are separate issues. The seizure of a laptop, a company smartphone, or a server can halt operations; data copying, on the other hand, may involve archives much broader than the single file sought. Therefore, it is necessary to understand whether the act concerns the physical asset, data duplication, selective extractions, or access credentials to remote services.
The presence of extraneous or confidential data must be pointed out in a concrete manner. A company server may contain data belonging to employees, clients, suppliers, affiliated companies, and archives not pertinent to the indicated event. Confidentiality alone does not create an absolute prohibition on acquisition, but it makes it essential to describe where the archives are located, who owns the accounts, and which application contains the requested data. Documents covered by professional secrecy also require special attention, as their handling follows specific rules.
Do not modify systems to make them inaccessible. Deactivating accounts, deleting backups, changing encryption keys, or initiating automatic cleaning procedures can worsen the position of the person intervening. If the system is essential for deliveries, payments, customer support, or security, this operational necessity can be stated and documented. This does not mean automatically obtaining the immediate return of the asset, but it allows the issue to be raised correctly.
Subsequent protection depends on the type of seizure and the order received. An evidentiary seizure, aimed at evidence, and a preventive seizure, aimed at preventing further consequences or the continuation of activity deemed illegal, have different prerequisites and control instruments. There is no standard dispute valid for all cases: the decisive point is to verify the reasoning, the nexus between the acquired data and the hypothesis of a crime, the proportionality of the acquisition, and the applicable forms of appeal.
How to Behave Immediately Without Compromising the Defense
Designate a person to maintain operational contact. The legal representative, a manager, or an authorized employee can accompany the operators, avoid disorderly access to departments, and identify who can provide technical clarifications on accounting and IT systems. The function is not to arbitrarily filter requests, but to enable orderly and verifiable interaction.
Ask to identify the act and keep available copies. It is reasonable to ask whether it is a tax audit, a search, or a seizure, who issued the order, and which premises, periods, or archives are involved. Summons, authorizations, minutes, inventories, and receipts must then be kept in the same file without annotations that alter the originals.
Separate certain facts from explanations requiring further study. You can immediately indicate where a register, an archive, an IT manager, or an external consultant is located. This is different from providing reconstructive explanations on corporate transactions, financial flows, or management choices that require comparing documents and timelines. Precision regarding immediately verifiable facts is useful; improvisation on what you do not remember can become harmful.
After the intervention, the defense begins with an orderly reconstruction. With our staff, we can help you connect the received acts with company documents, distinguishing the tax level from the criminal one and identifying initiatives compatible with the type of order. The first concrete step is to preserve data and minutes, without altering the original sources and without relying on rushed reconstructions.
Frequently Asked Questions
Can I prevent access until my lawyer arrives?
No, you cannot block a legitimately initiated activity. In a tax audit, you can request professional assistance and arrange for a contact person to be present; in a search, the intervention of counsel is important, but it does not generally entail the right to postpone operations. Obstructing access or concealing documents can create further consequences.
Must I hand over company passwords immediately?
The answer depends on the order and the specific request. It is not appropriate to improvise refusals, nor to hand over personal or third-party credentials without understanding which accounts are involved. The technical availability of the system must be distinguished from the legal basis for the acquisition. If a search or seizure order exists, its content guides the methods of cooperation.
Can I add observations to the verification minutes?
Yes, pertinent observations can be recorded. During a tax audit, it is useful to point out specific facts that change the meaning of a document or data: archives kept by third parties, provisional entries, periods not included in the request. Generic disputes are less useful than concrete and verifiable clarifications.
Does the seizure of a computer block company activity forever?
No, but it can seriously impact operational continuity. It is necessary to understand whether the device was seized, a portion of data copied, or an entire archive acquired. The need to continue payments, production, or support can be documented, but the return, the extraction of copies, or other measures depend on the type of seizure and the proceeding authority.
Does a tax audit mean that a criminal charge already exists?
No, a tax audit does not in itself equal criminal proceedings. The audit may conclude without objections, with tax adjustments, or with elements transmitted to the judicial authority if potentially relevant facts emerge. The appearance of a search, a seizure, or the indication of a proceeding instead requires immediately distinguishing the criminal level from the administrative one.
Essential Regulatory References
For tax audits, Article 12 of Law No. 212 of 2000, in the text amended by Legislative Decree No. 219 of 2023, and Article 52 of Presidential Decree No. 633 of 1972 are relevant. For searches and seizures, the provisions of the Code of Criminal Procedure apply, including those concerning the documentation of judicial police acts.
If you have received a report, an order, or an inventory of acquired assets and data, you can contact me to immediately distinguish tax acts from criminal ones and evaluate the defense steps compatible with the specific case.