What Is a CRA Audit? How It Works and How to Prepare
A CRA audit is the Canada Revenue Agency checking the figures you reported against the records that back them up. For a sole proprietor that usually means an auditor asking to see the receipts, invoices, and bank statements behind the income and expenses on your return. Most audits end quietly when the records line up, which is why the single best defence is keeping your books in order and holding them for the six years the CRA requires. This guide walks through how files get selected, how far back the CRA can go, what happens during an audit, what it costs to get wrong, and how to be ready before the call comes.
What a CRA audit is
An audit is a close examination of your books and records to confirm you reported your income and claimed your deductions correctly. It is not an accusation. The CRA describes it as making sure the tax system is fair, and the Business audits page sets out exactly what an auditor may look at: your business records such as ledgers, journals, invoices, receipts, contracts, and bank statements, plus the personal records of the owners and, where relevant, the records of related people or entities like a spouse, family members, or a corporation.
An audit is a step beyond a review. A review is quick: a mailed request to see support for one line, usually settled in a few weeks. An audit goes deeper. It covers a whole period, runs under a named auditor who contacts you directly, and asks for the records behind many lines at once. The preparation, though, is identical either way: the records have to exist and be findable.
How the CRA decides who to audit
The CRA does not publish the formula it uses to pick files, so no one can promise you a way to stay invisible. What the agency does say is that its risk-assessment systems identify returns considered to be at high risk for non-compliance, and a CRA officer then reviews information from various sources before deciding an audit is warranted.
Two things worth understanding sit behind that. First, the CRA already holds copies of the information slips that payers file about you. If a client issued you a T4A slip or a contractor issued you a T5018 slip, the CRA has that figure, and a return that reports less than the slips show invites a closer look. Second, when reported income does not square with a taxpayer's assets and spending, the CRA can use an indirect method. The most common is the net worth method, which measures the change in what you own and owe over a period, adds personal spending, and treats an unexplained increase as income. When the CRA uses it, it will ask for the personal financial records of your spouse and other household members too.
You cannot control the risk score. You can control whether your reported numbers match the slips and whether you can explain every deposit, and that is where your effort belongs.
How far back can the CRA audit you?
For most people the CRA works within a window called the normal reassessment period. Under subsection 152(3.1) of the Income Tax Act, that period is three years for an individual or a Canadian-controlled private corporation, and four years for a mutual fund trust or a corporation that is not a CCPC. The clock starts on the day the CRA sends the original notice of assessment for the year, not the day you filed.
That window is not absolute. Subsection 152(4) lets the CRA reassess after the normal period when the taxpayer made a misrepresentation attributable to neglect, carelessness, or wilful default, or committed fraud in filing the return. In plain terms, careless or dishonest reporting removes the time limit, so there is no safe year once a real error is in the file. A reassessment can also be reopened beyond the period if you signed a waiver within it.
This is the reason retention rules matter. The CRA expects you to keep your books and records for six years from the end of the last tax year they relate to, and longer if you filed the return late, in which case the six years run from the filing date. You need written permission to destroy them early. Purging records at the three-year mark on the theory that the audit window has closed backfires here: if the CRA alleges a misrepresentation, the window stays open, and the missing records become your problem to explain.
What happens during a CRA audit
The process is more orderly than most people fear. Here is the shape of it, drawn from the CRA's own description.
First contact. An auditor usually phones you to start, then sends a letter confirming the audit, the years under review, and what they need. If a caller claims to be from the CRA and you are not sure, you can hang up and call the auditor or their team leader back, or wait for the written confirmation. Worth knowing: the CRA does not accept audit documents by email, and it will not text you to start a conversation about your taxes. A text message claiming to be a CRA audit is a scam, not an audit.
Where it happens. Most audits run at your place of business so the auditor can see the operation and the records together. Sometimes they borrow documents to work at a CRA office or at your accountant's office, and they give you a detailed receipt for anything they take.
What you provide. You answer the auditor's questions, give access to your books and records, and hand over support when asked. Electronic records are usually requested up front. You can deliver documents through the CRA's secure online services, by mail, or to a tax services office. The cleaner and more complete your records, the shorter this phase runs.
The findings. After reviewing everything, the auditor gives you a written summary. If nothing needs to change, the audit closes. If the auditor proposes adjustments, you have 30 days to respond before the audit is finalized, and you can agree or make your case to the auditor and then the team leader. Changes to your income or tax produce a notice of reassessment; changes to a claimed loss produce a notice of redetermination.
What a CRA audit can cost you
An honest error found in an audit is not a disaster. You pay the additional tax and arrears interest on it, and that is usually the end of it. The cost climbs when the CRA concludes the error was more than a mistake.
Two penalties bite hardest, both set out on the CRA's false reporting page:
| Situation | Penalty | What it means |
|---|---|---|
| False statement or omission made knowingly or through gross negligence (s. 163(2)) | Greater of $100 or 50% of the understated tax | The CRA must prove the conduct, not just the error |
| Repeated failure to report income (s. 163(1)) | Lesser of 10% of the unreported amount or 50% of the net tax difference | Applies when you omit $500+ now and in one of the three prior years, even unintentionally |
A worked example shows the gap. Say an auditor finds $12,000 of income you left off a return, and your marginal rate on it is 30%. The tax itself is $3,600. If the omission is treated as an honest slip, you pay that $3,600 plus arrears interest. If the CRA applies the gross-negligence penalty, it adds 50% of $3,600, another $1,800, on top of the tax and interest. Same missing income, very different bill, and the difference turns on whether you could show you took reasonable care.
If you disagree with a reassessment, you can file an objection, as covered in the guide to your notice of assessment. Note that filing an objection does not pause the balance: the CRA expects payment of amounts owing, and interest generally keeps running while the dispute is open.
How to be ready before the CRA calls
Audit-readiness is not a scramble you do when the letter arrives; it is the state your books are already in. Three habits carry most of the weight.
Keep the proof behind every number. Every expense on your T2125 needs a receipt or invoice that shows what was bought, from whom, when, and the tax charged, which is exactly what the CRA's receipt requirements call for. A bank or card statement alone is not enough; it shows that money moved, not what it bought. Missing receipts are the most common audit weakness, and they carry their own penalties for undocumented claims.
Reconcile against your statements. Match every deposit to an invoice and every charge to a receipt. The deposits you cannot explain are the ones an auditor asks about first, and the net worth method feeds on exactly those gaps.
Keep it findable for six years. Electronic records are fine with the CRA as long as they stay readable, so a searchable digital archive beats a box of fading thermal paper. The point is that when the auditor names a date and a vendor, you produce the document in seconds.
This is the quiet case for keeping records as you go rather than at year-end. SparkReceipt scans each receipt the moment you get it, pulls the vendor, date, total, and tax, and sorts it into the right category, so the evidence behind every expense is already captured and tagged. Its bank statement matching flags any charge without a supporting receipt, which is the same gap an auditor hunts for, and a one-click expense report hands over exactly what the CRA asks for with each original image attached. Being audit-ready stops being a project and becomes a byproduct of how you work.
Frequently asked questions
How far back can the CRA audit? The normal reassessment period is three years from the date of your original notice of assessment for individuals and CCPCs, and four years for other corporations. The CRA can go further back if it alleges a misrepresentation from neglect, carelessness, or wilful default, or fraud.
What triggers a CRA audit? The CRA does not publish its selection criteria. It uses risk-assessment systems to flag returns, and it compares what you reported against the information slips payers file about you. Income that does not match your slips or your lifestyle draws attention.
How long does a CRA audit take? It depends on the complexity and how complete your records are. Audits run faster when you can produce electronic records promptly; delays come from missing documents or the need to consult specialists.
Does the CRA look at your bank account during an audit? Yes. Bank statements are standard audit records, and the CRA can review your personal bank statements and those of related people, especially when it uses the net worth method to test reported income.
Will the CRA contact me by text about an audit? No. The CRA does not send text messages to start a conversation about your taxes. An auditor contacts you by phone and confirms in writing. A text claiming to be a CRA audit is a scam.
Key takeaways
- A CRA audit checks the figures on your return against the records behind them; most audits close quietly when the records line up.
- The CRA uses risk-assessment systems and compares your return against the information slips payers file, so reported income that does not match draws scrutiny.
- The normal reassessment period is three years for individuals and CCPCs (four for other corporations) from the notice of assessment date, but careless or fraudulent reporting removes the limit.
- An auditor contacts you by phone then letter, examines your ledgers, invoices, receipts, and bank statements, and gives you 30 days to respond to any proposed changes.
- Honest errors cost tax plus interest; the gross-negligence penalty adds 50% of the understated tax when the CRA proves the error was deliberate or grossly negligent.
- Keep readable records for six years with a receipt behind every expense, and reconcile deposits and charges as you go, so you are audit-ready before the CRA ever calls.
Want the records behind every expense already captured, categorized, and matched to your bank statements before an auditor asks? SparkReceipt keeps your receipts and income organized the moment they happen, so you answer the CRA in seconds instead of searching a shoebox. Get Started and make audit-readiness a byproduct of your bookkeeping.