CRA Audit Readiness: 2026 Small Business Guide

No accountant can promise that a business will never be audited. The Canada Revenue Agency selects files using risk assessment and, in some GST/HST programs, random selection. What an owner can control is the accuracy of the returns, the quality of the records, the consistency between tax accounts and the discipline of the response.

For an owner-managed company, audit readiness is part of governance—not an emergency project that begins when a CRA letter arrives. Drawing on more than 20 years of Canadian tax experience, our CPAs help businesses build an audit trail that connects contracts and source documents to the general ledger, financial statements and filed returns.

Key distinction: a processing review, matching letter, GST/HST examination and full audit are not the same. The scope, legal authority and response strategy should be identified from the CRA correspondence before documents are produced.

How the CRA selects business files

The CRA states that it chooses income-tax audit files using a risk assessment. Factors can include the likelihood or frequency of errors, indications of non-compliance, information already on file, comparisons with similar businesses and findings from other audits or investigations. For GST/HST, selection can be risk-based or random.

An audit does not, by itself, mean the CRA has concluded that tax is owing. It means the Agency has selected one or more issues, periods or accounts for examination.

Common areas that create audit exposure

The CRA does not publish a formula that taxpayers can safely “manage around.” The practical goal is therefore not to imitate an imagined algorithm, but to eliminate preventable inconsistencies and support every material position. Common areas requiring careful review include:

Unreported or mismatched revenue

sales deposits that do not reconcile to reported revenue;
T4A, T5018, payment-processor or platform information that differs from the books;
foreign revenue or online sales recorded outside the main accounting system;
shareholder or related-company receipts posted directly to balance-sheet accounts; and
GST/HST taxable sales that do not reconcile to the income-tax return.

Expenses with mixed business and personal use

motor vehicles, travel, meals and entertainment;
home-office and occupancy costs;
telephone, internet and technology subscriptions;
shareholder-paid or corporation-paid personal expenditures; and
capital assets incorrectly deducted as current expenses.

A general ledger description is not proof. The business purpose, payee, date, amount and relationship to earning income should be evident from invoices, contracts, receipts, mileage records and payment evidence.

Shareholder and related-party transactions

debit shareholder-loan balances;
unrecorded benefits or personal use of corporate assets;
management fees without agreements or support;
dividends that do not match resolutions, T5 slips and corporate tax accounts;
transfers among associated companies; and
non-arm’s-length pricing or balances that remain unreconciled.

GST/HST input tax credits and refund claims

Input tax credits require valid supporting documentation and must relate to commercial activities. High or recurring refunds, large capital purchases, exempt activities, change-of-use transactions and differences between sales reported for GST/HST and income tax deserve a pre-filing reconciliation.

Payroll and worker classification

Paying a worker as a contractor does not make that person self-employed. Control, tools, chance of profit, risk of loss, integration and the complete relationship matter. Misclassification can produce payroll assessments, employer and employee contributions, interest and penalties. Bonuses, taxable benefits, shareholder remuneration and T4/T4A reporting must also agree with the books and corporate return.

Cash, digital assets and foreign transactions

Cash-intensive businesses require strong daily sales, till, deposit and inventory controls. Digital-asset transactions need complete exchange and wallet histories. Foreign accounts, property, affiliates, related-party services and non-resident payments can create information-return and withholding obligations even where no additional Canadian income tax is ultimately payable.

Records the CRA expects a business to maintain

Canadian businesses are legally required to keep records that support income, deductions, tax collected, input tax credits, payroll and other filed amounts. The CRA generally requires records and supporting documents to be retained for six years from the end of the last tax year to which they relate.

Certain records should be kept longer or indefinitely, including documents affecting the long-term ownership, acquisition and disposition of property, share registers and historical information relevant to a sale, liquidation or wind-up. Records involved in an objection or appeal must be retained until the dispute and further appeal periods are resolved.

Electronic records must preserve an audit trail

Scanning receipts does not eliminate the need for reliable books. Electronic records should show the path from the source document through transaction-level detail to summarized financial accounts. They must remain accessible and readable, and proper backup copies should be maintained.

The CRA’s electronic record-keeping guidance states that the audit trail must contain enough detail to substantiate summarized information.

A practical monthly audit-readiness control file

A well-run private company should be able to produce a consistent monthly or quarterly package containing:

bank and credit-card reconciliations;
accounts receivable and payable listings;
sales reports reconciled to deposits and GST/HST returns;
payroll registers reconciled to remittances and the general ledger;
shareholder-loan continuity and supporting documents;
fixed-asset additions, disposals and invoices;
intercompany balances confirmed by both entities;
loan agreements and interest calculations;
foreign-exchange and foreign-account reconciliations;
board resolutions for dividends, bonuses and material transactions; and
a list of unusual or judgmental tax positions with supporting analysis.

This control file reduces year-end adjustments, improves financial reporting and allows the business to answer a focused CRA request without producing an unstructured data dump.

What happens during a CRA audit?

1. Initial contact and scope

The CRA generally contacts the taxpayer or authorized representative and identifies the years, accounts and information required. Confirm the officer’s identity through official CRA channels, record deadlines and determine whether the matter is a review, examination or audit.

2. Information production

Requests may include ledgers, electronic accounting files, bank and credit-card statements, contracts, invoices, corporate records, payroll data, GST/HST documentation and explanations of specific transactions. The response should be complete, organized, indexed and limited to the proper scope unless a broader legal obligation applies.

3. Questions and proposed adjustments

The auditor may ask follow-up questions or issue a proposal letter setting out potential adjustments. This is an important opportunity to correct factual misunderstandings, provide missing support and make legal submissions before reassessment.

4. Completion, reassessment or no change

An audit can result in no changes or in reassessments of income tax, GST/HST, payroll, interest and penalties. Related years, shareholders or entities may also be affected where the facts are connected.

How to respond when the audit letter arrives

Do not ignore the deadline. Calendar it immediately and request a reasonable extension early if genuinely needed.
Verify the request. Confirm the officer, tax account, period and issue under review.
Preserve records. Suspend routine destruction and secure backups, emails and transaction data relevant to the request.
Appoint one response lead. Uncoordinated replies from multiple employees can create inconsistency.
Reconcile before producing. Tie requested records to the filed return and explain known differences.
Index the response. Use a document list, clear file names and written answers tied to each CRA question.
Separate fact from assumption. Do not guess. Identify information that requires confirmation.
Review sensitive material. Obtain legal advice where solicitor-client privilege or litigation issues may arise.
Keep a complete audit file. Retain every request, response, call note and document supplied.

Taxpayer rights and professional conduct

Taxpayers have the right to privacy and confidentiality and to be treated professionally, courteously and fairly. They may authorize a representative and should expect the CRA to explain its decisions. At the same time, the business must provide records and information required by law and should maintain respectful, accurate communication.

The CRA has published guidance on taxpayer rights during an audit.

If you disagree with a reassessment

First review the auditor’s working position and the notice of reassessment. A factual correction may sometimes be resolved directly, but a formal objection may be necessary. A corporation generally has 90 days from the date of the notice of assessment or reassessment to file an objection. An extension application may be available in limited circumstances, but missing the deadline creates avoidable risk.

See the CRA’s current corporate dispute guidance and objection process.

Frequently asked questions

Can a small business prevent a CRA audit?

No. Selection may be risk-based or random. Accurate filings, reconciled accounts and strong records can reduce preventable compliance concerns and make an audit more efficient, but they cannot guarantee that a file will not be selected.

How far back can the CRA audit?

Normal reassessment periods vary by taxpayer and tax account, and extended or unlimited periods can apply in certain circumstances, including misrepresentation attributable to neglect, carelessness, wilful default or fraud. Record-retention and reassessment periods are related but not identical.

Should I send the CRA my entire accounting backup?

Only after understanding the lawful request, scope and format. Electronic records may be required, but a controlled, indexed production reviewed by the taxpayer and advisor is preferable to an unexplained data dump.

Can my CPA speak to the auditor?

Yes, after proper authorization. Management must still provide accurate facts and may need to participate where operational knowledge is required.

What if I discover an error during the audit?

Raise it promptly with the advisor handling the file. The response depends on whether the error is within the audit scope, affects other periods or accounts, and whether a correction, disclosure or legal submission is appropriate.

How our CPAs can help

Perfect Accounting provides CPA-led audit readiness, CRA review and audit support for owner-managed companies, high-net-worth families and cross-border groups. We reconcile filed returns to the records, organize document production, prepare technical responses, model proposed adjustments and coordinate objections or legal referrals where required.

Book an introductory call as soon as a CRA review or audit letter is received.

This article is general information as of August 2026 and is not legal or tax advice. Audit rights, deadlines and strategy depend on the taxpayer, tax account, period, correspondence and complete facts.

CRA Audit Readiness for Small Businesses: 2026 Guide