CRA Audit Canada: What It Is, Triggers, and Your Rights

CRA audits a business or individual to verify that a tax return, source deduction, or GST/HST return is accurate. Any Canadian corporation or sole proprietor can be selected. The standard CRA reassessment window is three years from the original notice of assessment. This guide covers all Canadian provinces and territories except Quebec.

CRA conducts several hundred thousand audit and review actions each year across income tax, GST/HST, and payroll accounts. Most businesses operating in Canada for a decade or more will face some form of CRA review during that period. Understanding in advance what an audit involves, what triggers one, what auditors look for, and what rights you have converts a stressful event into a manageable compliance process.

This guide covers the full CRA audit landscape for Canadian small and mid-size businesses: the different audit types, how far back CRA can reassess, what generates selection, what auditors examine when they arrive, your rights under the Taxpayer Bill of Rights, and how to build the documentation record that shortens any audit and reduces its cost. For businesses specifically concerned about payroll audit risk, the detailed specialist resource on CRA payroll audits is at surviving a CRA payroll audit.

What a CRA audit actually is

An audit is a formal CRA examination of your books, records, and tax filings to determine whether the amounts you reported are accurate and complete. CRA distinguishes between several types of review activity, and not all of them are full field audits.

A desk review or review request is the lightest form of CRA contact. CRA sends a letter asking you to substantiate a specific claim on your return — a deduction, a credit, a business expense category. You respond by mail with supporting documents, and the file is closed or escalated depending on what CRA receives. No auditor visits your premises and no auditor is formally assigned to your file. This type of review is common and routine, particularly for returns that claim large home office deductions, vehicle expenses, or employment expenses.

A correspondence audit is similar but more structured. CRA's automated assessment systems flag a return for follow-up based on statistical scoring. You receive a letter identifying the line items under review and requesting specific documentation. Most correspondence audits are resolved without the business owner ever speaking directly to a CRA employee. The key risk in a correspondence audit is providing incomplete documentation — if CRA's original information request is not fully satisfied, the file can escalate to a field audit.

A field audit is a more intensive examination. A CRA auditor is assigned to your file and contacts you directly to arrange the review. Field audits typically cover two to three taxation years and involve the auditor examining source documents, general ledger entries, bank account statements, contracts, and payroll records. The audit can take place at your business premises, at your accountant's office, or in some cases entirely by correspondence if records are well organized and the issues are straightforward.

A reassessment is the outcome when CRA determines your original filing was incorrect. CRA issues a Notice of Reassessment adjusting the tax, CPP, EI, or GST/HST amounts calculated on your original return. Reassessments carry interest from the original due date of the tax that was owing, compounding daily at the prescribed rate plus four percentage points. The interest alone can be significant when a reassessment reaches back three years.

CRA runs separate audit streams for income tax, GST/HST, and payroll source deductions. A business can be audited across all three account types simultaneously or for only one type at a time. Understanding which account is under review is the first step in preparing an organized response, because the records required are different for each.

How far back CRA can audit

The reassessment window is the most important concept in any CRA audit discussion. It determines how many prior years are exposed to reassessment and how large a total assessment can become.

Standard three-year window. Under subsection 152(3.1) of the Income Tax Act, CRA has three years from the date of the Notice of Assessment to issue a Notice of Reassessment for that taxation year. This period is called the normal reassessment period. For Canadian-controlled private corporations (CCPCs) and for individual taxpayers, the three-year clock starts from the date of the original Notice of Assessment for each taxation year filed. Most small business audits operate within this window, which means CRA typically reviews the three most recently completed fiscal years.

Four-year window for non-CCPCs. Private corporations that are not Canadian-controlled private corporations — including Canadian subsidiaries of foreign corporations — have a four-year normal reassessment period under the same subsection. If your business is controlled by non-residents, your exposure window is one year longer than for a typical Canadian small business.

Fraud and misrepresentation: unlimited. If CRA can establish that a taxpayer made a misrepresentation attributable to neglect, carelessness, or wilful default, or committed fraud in filing the return, there is no statutory limitation on how far back CRA can reassess. Subsection 152(4) of the Income Tax Act expressly provides for this. The misrepresentation finding opens the return for all prior years without limit. In practice, CRA rarely pursues reassessments more than six or seven years old even where misrepresentation is established, because the administrative cost of reconstructing older records is high. The legal authority to go back further exists regardless.

Extended six-year window for non-arm's-length international transactions. Subsection 152(4) also provides a six-year reassessment period for transactions between the taxpayer and non-arm's-length non-residents. If your business has payments, loans, or supply arrangements with related parties in other countries, those transactions are subject to the extended window regardless of the general normal reassessment period.

GST/HST reassessment window. For GST/HST accounts, the Excise Tax Act governs rather than the Income Tax Act. The standard reassessment window under the ETA is four years from the date the GST/HST return was filed. Where CRA establishes fraud or misrepresentation, the window is unlimited. GST/HST audits often run concurrently with income tax audits, but the applicable limitation period is computed separately under the ETA, which means additional GST/HST exposure can exist even after the income tax years are closed.

Payroll source deductions. Payroll reassessments operate differently from income tax reassessments. There is no single normal reassessment period for source deductions equivalent to the income tax three-year rule. CRA's authority to assess under subsection 227(10) and related provisions of the Income Tax Act is broader. In practice, CRA payroll audits begin by reviewing the most recent three full calendar years, but nothing prevents CRA from extending the review further if the audit reveals a pattern of misclassification or non-remittance that predates the initial period. The specialist guide on surviving a CRA payroll audit covers payroll-specific reassessment mechanics in detail.

Voluntary Disclosures Program. If you discover that a prior-year return was materially incorrect — unreported income, improperly claimed deductions, unfiled returns — CRA's Voluntary Disclosures Program allows you to correct the record with reduced penalties and in some cases interest relief. The disclosure must be voluntary, meaning it must be filed before CRA has initiated any audit, review, or enforcement action related to that return or period. Once an audit letter has been received, the disclosure is no longer voluntary and the program is no longer available for the years under review.

What triggers a CRA audit

CRA does not publish the specific weights in its risk-scoring models, but the audit triggers are well documented through CRA's own public guidance, tax court decisions, and professional advisors who handle audit files across the full range of industries.

Random selection. A portion of every CRA audit stream is random. A business that files correctly, remits on time, and claims only legitimate deductions can still receive an audit notice because random selection exists in part to validate that CRA's risk models are correctly calibrated. There is no way to eliminate the possibility of a random selection, only to ensure that a randomly selected file is easy to resolve.

Statistical outliers. CRA's T1 and T2 processing systems compare every return against statistical benchmarks for businesses in the same industry, the same province, and the same revenue range. A return that claims deductions, losses, or credits substantially outside the norm for its sector will generate a higher risk score. Home office expenses that seem disproportionate to the declared square footage, vehicle expenses claimed without evidence of business use, and interest expense without corresponding asset purchases all generate review flags.

Repeated losses. A corporation that reports a net loss year after year while the owner-manager draws a salary or other compensation raises a question under CRA's reasonable expectation of profit doctrine. CRA's position is that a genuine business must have a reasonable expectation of profit over time. A structure that continuously generates business losses that shelter other income is subject to challenge regardless of whether each individual expense is legitimate.

Cash-intensive industries. Restaurants, construction subcontractors, retail cash businesses, personal service providers, and parking operations are audited at materially higher rates than businesses whose income flows entirely through traceable bank deposits and electronic payments. CRA designates these sectors for targeted audit programs because cash income is the most common area of underreporting and the hardest to verify without direct examination of daily receipts and point-of-sale records.

Inconsistent or late remittances. For payroll accounts, a pattern of late or irregular source-deduction remittances is a strong audit trigger. Late remittance indicates either cash flow strain — which itself raises questions about whether declared income is accurate — or a payroll process that lacks basic controls. Either way it generates a review flag in CRA's payroll systems.

Large, unusual, or one-time deductions. A deduction that is significantly larger in one year than in prior years and that did not appear before attracts a desk review as routine. Capital loss carrybacks, large charitable donations, significant ABIL claims on small business shares or debt, and terminal loss claims on asset dispositions all fall into this category. CRA reviews these items before applying the credit or deduction to confirm that the claim is properly documented.

Third-party information mismatches. CRA receives information returns from banks, employers, real estate brokerages, and other businesses. When amounts on those slips do not match what appears on the filed return, the mismatch generates an automatic review flag. A common example is a T5 slip showing interest or dividend income that does not appear on the corresponding income tax return. The mismatch is identified before the return is even assessed.

Tips and referrals. CRA accepts and acts on tips from third parties including employees, former business partners, and competitors. CRA does not disclose the source of a referral and does not require the informant to provide evidence. CRA's own audit process determines whether the tip has merit. Tips alleging cash income, unreported sales, or fictitious expense claims are investigated through the same field audit process as risk-model selections.

What CRA auditors actually look for

When a field audit begins, the auditor's mandate is to verify that your reported income matches your actual receipts, that your claimed expenses are legitimate business expenses supported by records, and that your tax, GST/HST, and payroll accounts are internally consistent.

Bank deposit analysis. Almost every field audit begins with a systematic comparison of total bank deposits across all business accounts to total reported revenue. If deposits exceed reported sales, CRA will ask you to explain the difference. Non-taxable deposits — inter-company transfers, shareholder loans, capital contributions, GST/HST collected — must each be documented. Deposits that cannot be explained with documentation are assessed as unreported income. Businesses that use multiple personal and business accounts intermixed have the highest risk of unexplained deposit findings.

Expense substantiation. CRA requires every claimed business expense to be supported by a source document: an invoice, a receipt, a signed contract, or a bank or credit card statement showing the payment. The Income Tax Act does not permit estimated expense amounts. Every deduction must be tied to a documented transaction. The auditor will sample expenses from each category — often reviewing every transaction above a threshold amount and a random sample of smaller amounts — and disallow those without adequate documentation.

Payroll records. A payroll account audit focuses on whether source deductions were calculated correctly and remitted on time for every pay period during the years under review. The auditor will request payroll journals, T4 slips, T4 summaries, remittance records, employment contracts, and documentation for any independent contractors who received T4A slips. Source deductions for a sample of pay periods will be recalculated using the CRA payroll tables applicable to those periods. The groundwork for a clean payroll audit starts with properly registering a payroll account from the first hire — see the guide on CRA payroll account registration for how that process works.

Payroll deduction accuracy. Beyond remittance timing, auditors verify that the right amounts were withheld in the first place. CPP contributions, EI premiums, and income tax must all be calculated from the correct gross insurable and pensionable earnings amounts. Taxable benefits included in employment income — personal vehicle use, parking, group benefit premiums paid by the employer — must be included in the gross earnings before source deductions are calculated. The guide on payroll deductions in Canada covers the full calculation framework.

GST/HST input tax credits. Where the business is registered for GST/HST, the auditor verifies that claimed input tax credits correspond to genuine business expenses supported by valid tax invoices. For supplies over $150, a valid invoice must include the supplier's GST/HST registration number, the date, a description of the supply, and the GST/HST amount charged. Missing registration numbers on supplier invoices are the most common ITC disallowance in GST/HST audits.

Related-party transactions. Transactions between the business and related parties — family members, associated corporations, non-arm's-length shareholders — receive heightened scrutiny. Salaries paid to family members must be reasonable and proportionate to services actually rendered. Management fees paid to holding companies or related corporations must reflect real services. Transactions that appear designed primarily to move income into lower-tax hands or into a corporation without business purpose will be closely examined.

Vehicle and home office claims. Vehicle expense claims require a contemporaneous logbook recording every business trip by date, destination, business purpose, and kilometres driven. CRA does not accept logbooks reconstructed after an audit notice arrives. Home office claims require evidence that the space is used exclusively and regularly for business. Both areas are high-frequency disallowance items because many business owners estimate these deductions without maintaining the required documentation.

Your rights during a CRA audit

The Taxpayer Bill of Rights, published by CRA, codifies the rights of taxpayers dealing with CRA audit, collections, and appeals functions. It is a policy document, not a statute — it does not override the Income Tax Act — but CRA treats it as a binding commitment to how its employees must conduct themselves. Knowing these rights before an audit begins prevents procedural errors that could disadvantage your file.

Right to receive entitlements and pay no more than required by law. You are entitled to claim every deduction, credit, election, and benefit available under the applicable legislation. CRA cannot deny a legitimate claim on administrative grounds, nor suggest that claiming a legal entitlement is somehow aggressive or improper.

Right to service in the official language of your choice. Audit correspondence, telephone communications, and audit meetings can be conducted in English or French at your election. You are entitled to request a CRA auditor or appeals officer who can communicate in your preferred official language.

Right to privacy and confidentiality. Information you provide to CRA during an audit is confidential. CRA cannot share it with third parties except in circumstances specifically authorized by statute. This protection covers your financial records, your tax returns, and the existence of the audit itself.

Right to representation. You have the right to be represented by an accountant, tax lawyer, or other advisor at every stage of the audit process. You are not required to speak directly with a CRA auditor. Any auditor who discourages you from seeking representation or suggests you do not need one is acting contrary to CRA policy.

Right to a formal review and appeal. If you disagree with a Notice of Reassessment, you have 90 days from the date of the reassessment to file a Notice of Objection. CRA's Appeals Division reviews objections independently of the audit function. If the objection is not resolved to your satisfaction, you can appeal to the Tax Court of Canada. Beyond that, appeal to the Federal Court of Appeal and ultimately the Supreme Court of Canada is available on questions of law.

Right to lodge a service complaint. If a CRA auditor provides incorrect information, acts unprofessionally, fails to follow CRA procedures, or causes unnecessary delay, you can file a formal service complaint through the Taxpayer Service Feedback program. Serious conduct issues can be escalated to the Office of the Taxpayers' Ombudsperson, an independent office that reports to the Minister of National Revenue, not to the CRA Commissioner.

Right to an impartial review. You have the right to have your objection reviewed by an Appeals officer who was not involved in the original audit. CRA's Appeals Branch is structurally separate from its Audit function. If you believe the assigned Appeals officer has a conflict of interest or has not approached your file impartially, you can request a transfer to a different officer through the Appeals Branch manager.

One practical right that the Bill of Rights does not explicitly enumerate but that exists in CRA's own operational policies: you can request that an audit file be transferred to a different auditor where you have a documented concern about the assigned auditor's conduct. That request goes to the auditor's team leader, and CRA's service standards require that the request be addressed within a specified response time.

How Canadian small businesses prepare in advance

The most effective CRA audit preparation happens before any audit notice arrives. A business that maintains organized, contemporaneous records moves through any audit faster and at lower professional cost than one that must reconstruct prior-year records under time pressure.

Register payroll properly from the first hire. A payroll program account must be registered with CRA before the first remittance due date. Payroll accounts registered on time, remitting on schedule, and using the correct remittance frequency for your payroll size avoid the late-remittance penalties that are among the most common audit triggers. A new employer's obligations, including how to calculate remittance amounts and what schedules apply, are covered in the guide on CRA payroll account registration.

Retain six years of records. CRA's general requirement is that business records be retained for six years from the end of the tax year to which they relate. This includes invoices, receipts, bank statements, payroll records, contracts, and correspondence. Electronic records are fully acceptable provided they can be produced in a readable format on CRA's request. Corporate records — minute books, shareholder registers, articles of incorporation — must be retained permanently.

Separate business and personal bank accounts. Using a single account for business and personal transactions creates significant tracing complexity in an audit. CRA's bank deposit analysis becomes substantially more difficult, and the risk of personal receipts being flagged as unreported business income increases. A dedicated business account with payments received only from clients and payments made only to business vendors is the single most effective administrative step a small business can take to simplify a future audit.

Document contractor relationships before work starts. Every independent contractor engagement should be supported by a written contract. The contract should describe the scope of work, payment terms, and the basis for treating the relationship as independent. A written contract does not bind CRA — CRA looks at the actual working relationship, not the document — but the absence of any contract is a negative indicator. The four-factor employment test CRA applies to every contractor classification question is covered in the guide on employee versus contractor Canada.

Reconcile payroll monthly. A monthly reconciliation between your payroll system output and your general ledger catches calculation errors and timing differences before they compound across a full year. Year-end discrepancies between the T4 summary and the payroll account balance in your accounting system are a common audit trigger that monthly reconciliation eliminates entirely.

Maintain a contemporaneous mileage log. If you claim vehicle expenses, keep a logbook for every business trip: date, origin, destination, business purpose, and kilometres. CRA will not accept a reconstructed logbook created after an audit notice arrives. Multiple apps can capture GPS trip data automatically, which satisfies CRA's documentation requirement provided the required fields are captured for each trip.

Consider outsourcing payroll. For businesses with ten or more employees, a Canadian payroll service provider handles remittances on schedule, calculates source deductions correctly, issues T4 slips accurately, and maintains records in the organized format CRA auditors expect. A business using an outsourced payroll provider consistently has a shorter and less disruptive payroll audit experience because the records are already centralized and properly formatted. For businesses that want a fully outsourced employment and payroll solution, PEO Canada covers how professional employer organizations handle employment compliance for Canadian businesses operating outside Quebec.

Specialized audit types

Beyond the standard income tax and payroll audit, CRA runs targeted programs that focus on specific industries or compliance issues. Knowing which programs exist helps a business assess whether its structure or activity patterns place it in a higher-risk category.

GST/HST audit. GST/HST audits are conducted by CRA's Commodity Tax Audit function separately from income tax audits. These audits focus on whether all taxable supplies were reported and taxed correctly, whether ITC claims are supported by valid invoices with the vendor's registration number, and whether the business is registered at the right threshold. The mandatory GST/HST registration threshold is $30,000 in annual worldwide taxable sales. Businesses that exceed this threshold and have not registered are subject to retroactive GST/HST assessment with interest and penalties from the date registration was required.

Scientific research and experimental development (SR&ED) audits. SR&ED tax credit claims above a threshold are reviewed by a CRA Research and Technology Adviser. The technical review asks whether the claimed activities meet the specific legislative definition of scientific or technological uncertainty under the Income Tax Act. SR&ED claims are one of the most consistently audited tax credit categories because the dollar amounts are significant and the eligibility criteria require technical judgment.

Real estate and housing audits. CRA has specific programs targeting real estate transactions where property sellers report capital gains on properties that CRA classifies as business income — particularly properties bought and sold within short periods and by taxpayers with a pattern of similar transactions. New housing supply subject to GST/HST is also actively audited, particularly for builders who do not collect and remit GST/HST on the sale of newly constructed residential units. The Underused Housing Tax, introduced in 2022, adds an annual filing obligation for non-resident owners of Canadian residential property and is being actively enforced.

Employment status audits. CRA's worker classification audit program specifically reviews whether workers treated as independent contractors meet the legal test for independent contractor status or should be classified as employees. The program is triggered by worker complaints filed under CPP and EI legislation, industry sweeps in sectors with known misclassification patterns, and referrals from other audit streams. An employment status finding results in assessment for unremitted CPP contributions, EI premiums, and income tax source deductions for all misclassified workers across the full audit period, with interest compounding from the original remittance due dates.

Aggressive tax planning reviews. CRA's General Anti-Avoidance Rule unit reviews transactions that appear structured primarily to obtain a tax benefit in a manner that defeats the object and spirit of the legislation. GAAR can apply to corporate reorganizations, surplus stripping transactions, loss-trading arrangements, and structures that produce a technical result that Parliament did not intend when drafting the specific provisions involved. GAAR assessments are relatively rare but carry significant dollar exposure when they apply.

Transfer pricing audits. Large corporations with cross-border transactions involving related parties are subject to CRA's transfer pricing audit program. The program examines whether amounts charged between the Canadian entity and its foreign related entities for goods, services, intangibles, or financing reflect arm's-length pricing. Transfer pricing adjustments can be very large and carry the additional risk of double taxation if the corresponding foreign jurisdiction does not agree with CRA's position on the appropriate pricing.

Quick Answers

What is a CRA audit? A CRA audit is a formal examination of a taxpayer's books, records, and tax filings to verify that reported amounts are accurate. CRA can audit income tax returns, GST/HST accounts, and payroll source deduction accounts. The audit can be conducted by correspondence or through a field audit where an assigned auditor works directly with the business.

How far back can CRA audit? For Canadian-controlled private corporations and individual taxpayers, the standard reassessment window is three years from the date of the original Notice of Assessment. For non-CCPCs it is four years. For GST/HST under the Excise Tax Act it is four years from the date the return was filed. If CRA establishes misrepresentation or fraud, there is no limit.

What triggers a CRA audit? The most common triggers are statistical outliers in deductions or revenue relative to industry norms, inconsistent or late source-deduction remittances, cash-intensive business activity, large one-time deductions, mismatches between third-party information slips and filed returns, and random selection. Even a business that files correctly can be randomly selected.

Can a CRA auditor require me to produce records I no longer have? CRA can request any records that should have been retained under the six-year retention requirement. If records were destroyed before the retention period expired, you may be assessed based on alternative methods such as the net worth method or the bank deposit analysis, and the absence of records is itself a negative indicator in a misrepresentation analysis.

Does this guide apply to Quebec businesses? No. This guide covers Canadian businesses in all provinces and territories except Quebec. Quebec payroll, income tax, and consumption tax obligations operate under provincial legislation administered by Revenu Québec rather than CRA.

Ready to put your payroll and compliance records on a foundation that holds up to any CRA review? Request a free payroll assessment and a specialist will review your current setup and identify the gaps most likely to create exposure.