Written by Maryam Ajorloo, CPA · Reviewed by Behdad Karimi Dermeni, CPA
The Canada Revenue Agency (CRA) plays a crucial role in making sure taxpayers and businesses meet their tax obligations. One of the ways it does that is through audits, where it examines your books and records to confirm you reported income correctly and claimed only the deductions you were entitled to, including any applicable GST/HST.
An audit is not something anyone looks forward to, but it is a possibility every business owner should be ready for. The good news: the CRA can only reach back a set number of years, and if your records are in order, an audit becomes a filing exercise rather than a crisis. Let's break down exactly how far back the CRA can audit, what extends that window, and how long you need to keep your documents.
How far back can the CRA audit? In most cases, the CRA can reassess a return within 3 years of the date on your Notice of Assessment (4 years for corporations that are not Canadian-controlled private corporations). Beyond that normal window, it can only go further in specific situations, and there is no time limit at all when it suspects misrepresentation or fraud.
Staying ready for that possibility is a lot easier when your books are already clean. See how ReInvestWealth keeps your records audit-ready.
Key Highlights
Normally, the CRA can reassess the 3 most recent tax years for individuals and Canadian-controlled private corporations, and the 4 most recent years for other corporations, counted from your Notice of Assessment date.
The window extends by 3 more years (6 in total) for specific items such as foreign property, loss carrybacks, and non-arm's-length transactions with foreign parties.
There is no time limit when the CRA can show a return contained a misrepresentation from neglect, carelessness, wilful default, or fraud.
You are required to keep your financial records and supporting documents for 6 years from the end of the tax year they relate to. Digital copies count.
Understanding the CRA Audit Process
When the CRA selects a business for an audit, it will usually contact you and confirm the audit in writing. You then work with the auditor, providing the supporting documents and records (receipts, invoices, bank statements) that back up the numbers on your return.
The auditor reviews those documents and may ask for more detail. How long the process takes depends on the complexity of your situation and, honestly, on how quickly you can put your hands on the right paperwork. There are simple steps you can take to handle a CRA audit with the best possible outcome, but the two words that matter most are communication and cooperation. An auditor who gets clear, organized answers tends to move on faster than one who has to chase them.
The Scope of CRA Audits and Reassessments
CRA audits exist to confirm compliance with the rules set out in the Income Tax Act. The scope varies with your circumstances, but the CRA generally focuses on two things: whether you reported all of your income, and whether the deductions you claimed are legitimate and documented. Expect it to review the records that support both.
How Far Back Can the CRA Audit?
The CRA is limited in how far back it can normally reach. This is called the normal reassessment period, and it runs from the date on your original Notice of Assessment:
3 years for individuals and Canadian-controlled private corporations (CCPCs), which covers most small businesses.
4 years for corporations that are not CCPCs at the end of the year.
Once that period passes, the year is generally considered "statute-barred," and the CRA cannot reassess it. That is the protection the clock gives you, and it is exactly why complete, accurate records for the current window matter so much.
When the CRA Can Go Back Further
The normal period is the general rule, not an absolute ceiling. A few situations extend it:
Foreign property and income: the window stretches by an extra 3 years (6 in total) for matters involving foreign property, income from a foreign affiliate, or certain non-arm's-length transactions with non-residents.
Loss carrybacks: applying a loss to an earlier year can extend the period for that adjustment.
Misrepresentation or fraud: if the CRA can establish that a return contained a misrepresentation from neglect, carelessness, wilful default, or fraud, there is no time limit. It can reassess the year at any time. The catch for the CRA is that the burden is on it to prove the misrepresentation, which is one more reason honest, well-documented books are your best defence.
A quick note on a number that gets misquoted a lot: the "10 years" you may have read about is not the audit period for fraud. It refers to the CRA's 10-year limit on collecting a tax debt and to the 10-year window for requesting taxpayer relief, not to how far back it can audit.
Impact of Previous Audits on Current Assessments
Past audits can shape future ones. If a prior audit turned up significant discrepancies, the CRA may look at your later returns more closely. The practical takeaway is simple: fix whatever an audit flagged, and make sure the same issue does not resurface on your next return. A clean track record works in your favour.
What Triggers a CRA Audit?
The CRA uses risk assessment to decide who to audit, comparing your return against businesses like yours and flagging anything that looks out of place. Common triggers include:
Numbers that do not match: amounts on your return that disagree with slips, GST/HST filings, or third-party data the CRA already has.
Expenses that look high for your revenue: deductions that are large relative to your income, or that sit outside the norm for your industry.
Repeated or large business losses: several years of losses can prompt the CRA to ask whether there is a real profit motive.
Round numbers and missing documentation: suspiciously tidy figures and gaps in your records draw attention.
Cash-heavy industries: businesses that handle a lot of cash tend to face more scrutiny.
None of these are things to panic about. They are reasons to keep your reporting accurate and your receipts matched to your transactions, so anything the CRA asks about has a clear paper trail behind it.
CRA Audit Time Limits at a Glance
Here is the whole picture in one place:
Individuals and CCPCs (most small businesses): 3 years from the Notice of Assessment.
Other corporations: 4 years from the Notice of Assessment.
Foreign property, loss carrybacks, transfer pricing: the normal period plus 3 years.
GST/HST: generally a 4-year assessment window.
Misrepresentation, neglect, or fraud: no time limit.
How Many Years Do You Need To Keep Business Documents?
Even though a typical audit lands within the 3 or 4 year window, you are required to keep your business records and supporting documents for a minimum of 6 years from the end of the last tax year they relate to. For a return covering the 2024 tax year, that generally means holding the records until the end of 2030.
A few practical points from the CRA's record-keeping rules:
Digital counts. You can keep records electronically. A clearly readable scanned or photographed receipt is a valid record, which means the shoebox of fading thermal-paper receipts is optional (and frankly, retired).
Do not toss early. If you want to destroy records before the 6-year period is up, you need written permission from the CRA first.
Keep the support, not just the summary. Receipts, invoices, and bank statements are what actually back up the totals on your return, so they matter as much as the return itself.
Six years is a long time to keep paperwork legible and findable. This is exactly the kind of task worth handing to software rather than a filing cabinet.
How To Stay Audit-Ready Without the Panic
Most audit stress does not come from the audit itself. It comes from scrambling to find a receipt from 18 months ago to justify an expense. When every transaction already has its documentation attached, an audit request turns into a quick export instead of a weekend of digging.
This is where ReInvestWealth does the heavy lifting:
Smart Shoebox (your receipt inbox) keeps the proof attached. Snap a photo, upload a file, or forward a receipt by email, and it lands in one place. The AI reads the merchant, date, and amounts, then matches each receipt to the right bank transaction, so every expense on your books has documentation sitting right behind it. That matched trail is precisely what an auditor asks to see.
You capture deductions you would otherwise lose. A receipt that never gets recorded is a write-off you never claim. Because capturing receipts takes seconds (photo, upload, email, or auto-forward), the deductible expenses that usually vanish into a coat pocket actually make it onto your return.
The AI Bookkeeper keeps your books current, not a March project. It categorizes your transactions as they come in and applies CPA-level logic, so your records stay clean year-round instead of being rebuilt in a panic at tax time. Bookkeeping readiness is built daily, not fixed once a year.
Because ReInvestWealth is built by CPAs, the goal is not just automation for its own sake. It is accurate, audit-proof books that you barely have to think about. See how it works.
Conclusion
You cannot control whether the CRA selects you for an audit, but you can control how prepared you are when it does. Know the timelines: the CRA can normally reach back 3 years (4 for larger corporations), further for foreign matters and carrybacks, and without limit where there is misrepresentation. Keep your records for 6 years, keep them organized, and keep them backed by matched receipts.
Rather than fearing audits, stay proactive and compliant with organized finances and quality bookkeeping. Connect your bank, let the AI categorize your transactions and match your receipts, and keep CPA-level clean books all year. Start your 30-day free trial.
Frequently Asked Questions
Can the CRA audit me after I have filed my taxes?
Yes. The CRA can audit taxpayers and businesses after a return is filed. It selects returns based on risk factors, including discrepancies between your return and other data it holds. An audit typically covers the 3 most recent tax years (4 for non-CCPC corporations), and it can go further back in specific situations or without limit where it suspects misrepresentation.
How far back can the CRA go if it suspects fraud?
There is no time limit. If the CRA can establish that a return contained a misrepresentation attributable to neglect, carelessness, wilful default, or fraud, it can reassess that year at any time, well beyond the normal 3 or 4 year period. The burden is on the CRA to prove the misrepresentation.
What triggers a Canada Revenue Agency audit?
Common triggers include figures that do not match the slips and filings the CRA already has, expenses that are unusually high for your revenue, repeated business losses, missing documentation, and operating in a cash-heavy industry. The CRA uses risk assessment to compare your return against similar businesses and flag anything unusual.
Do I need to keep paper receipts, or are digital copies okay?
Digital copies are fine. The CRA accepts electronic records, so a clear scanned or photographed receipt is a valid record. What matters is that the record is legible, complete, and kept for the full 6-year retention period. Tools like Smart Shoebox store the digital copy and match it to the matching transaction automatically.
How can I reduce the risk of a CRA audit?
Keep accurate, well-supported records, report income and expenses correctly, and file on time. Matching every receipt to its transaction and keeping your books current throughout the year (rather than reconstructing them at tax time) both reduces errors and gives you a clean paper trail if the CRA ever does come calling.
Written by Maryam Ajorloo, CPA
> Maryam Ajorloo is the co-founder of ReInvestWealth and a CPA who specializes in small business tax, sales tax, and everyday bookkeeping. She helps entrepreneurs keep clean, audit-ready books and make sense of write-offs, filing deadlines, and the numbers behind their business. Read more · Connect on LinkedIn
Reviewed by Behdad Karimi Dermeni, CPA
> Co-founder of ReInvestWealth and a founding community builder at Stripe. Behdad built ReInvestWealth to give smart, busy entrepreneurs CPA-level accounting without the CPA-level price tag. Read more · Connect on LinkedIn
*Related: keeping clean records starts with the right form. Here is the T2125 tax form explained for self-employed Canadians.*
The content of this blog post is for informational purposes only and does not constitute accounting, tax, business, or legal advice. While ReInvestWealth offers professional accounting and tax advice through paid consultations with a CPA, the information provided here is general in nature and may not apply to your specific circumstances.
Related reading: How to Track Business Expenses in Canada (2026 Guide)
Related reading: How to Catch Up on Years of Missed Bookkeeping (Canada)
