Written by Maryam Ajorloo, CPA · Reviewed by Behdad Karimi Dermeni, CPA
Short answer: A CRA audit checks that your business reported its income and expenses correctly. To handle one, confirm the contact is really from the CRA, reply by the date given, send the requested records through a secure channel, and review the written findings. You have 30 days to respond to proposed changes and generally 90 days to object.
Receiving a letter or call about a tax audit from the Canada Revenue Agency (CRA) is nobody's favourite kind of mail. The good news is that a CRA audit follows a predictable process, and most of it comes down to having your records in order and answering on time. This guide walks you through what the letter means, what happens next, and what to do at each step.
Organized books make every one of these steps faster. Start free for 30 days and keep your records audit-ready all year.
Key Highlights
A review letter is not the same as an audit, so read the letter first and note what it actually asks for.
Always confirm the contact is genuinely from the CRA before you share any information.
Respond promptly, and send documents through CRA secure channels (auditors cannot receive files by email).
You have 30 days to respond to an auditor's proposed adjustments, and generally 90 days to object to a Notice of Reassessment.
Your accountant can deal with the CRA for you once you authorize them as your representative.
Accurate records kept all year are the best way to make any future CRA audit short and uneventful.
Audit or Review? Read the CRA Audit Letter First
Not every letter from the CRA is an audit. The CRA runs a number of review programs every year, where it asks you to back up a specific claim (a receipt for an expense, a slip, a credit). In its own words, being selected for a review does not represent a tax audit.
A review letter usually lists the exact items the CRA wants to see and a date to respond by. Answer it with those documents and you are usually done. (It is the tax equivalent of being asked to show your ticket, not being escorted off the train.)
An audit is broader. An auditor examines your books and records for one or more periods, may look at several parts of your return, and may also review your GST/HST or payroll accounts. If your letter names an auditor, lists audit periods, and asks for general ledgers or bank statements across a whole year, you are in audit territory.
So, can the CRA audit me? Yes. The CRA can audit any business that files a return in Canada, incorporated or not. Canada's tax system is self-assessed, which means you report your own numbers and the CRA checks a portion of them. An audit is the CRA doing that checking, not an accusation.
Is It Really the CRA? How to Verify Before You Share Anything
Scammers love pretending to be the CRA, so a quick check is smart before you send a single document.
A real auditor will usually call first and then send a letter confirming the audit details. If you are unsure about a caller, you can end the call and phone back through the CRA Business Enquiries line, or wait for the confirmation letter.
Check your CRA account. Sign in to My Business Account and look for the correspondence there.
Know the red flags. The CRA does not demand payment by gift card, prepaid card, cryptocurrency, or Interac e-Transfer, and it does not threaten arrest. A caller who cannot give a name and office location is another warning sign.
The CRA's guide on how to verify the CRA has contacted you lists the current phone numbers and verification tools.
Why You Might Have Been Picked
The CRA uses risk-assessment systems that flag returns with a higher risk of errors or non-compliance, and an officer then decides whether an audit is warranted. Common reasons include income that does not match slips or other information the CRA already has, expenses that look high for your revenue, several years of losses, and businesses in sectors the CRA is reviewing more closely. Being selected does not mean you did anything wrong.
We cover the most common audit triggers, and how far back the CRA can go, in our guide to how far back the CRA can audit a business.
What Happens During a CRA Audit
Every CRA audit is different, but most follow the same six steps.
First contact. The auditor reaches out by phone, mail, or both, and confirms which periods are being audited and how to send documents.
Records request. Expect a request for business records such as ledgers, invoices, receipts, bank statements, and payroll records. The auditor may also ask for the owner's personal records and records of related people or companies. Electronic records are normally requested first.
Review and questions. Many audits are done virtually, but an auditor may also work at your place of business, or borrow documents (with a detailed receipt) to review elsewhere. Expect follow-up questions as they work through your records.
Proposal letter. When the review is done, the auditor sends a written summary of the findings. If no changes are needed, the audit closes. If changes are proposed, you have 30 days to respond, agree or disagree, and send anything that supports your position.
Final letter and reassessment. The CRA confirms the outcome in writing. If your tax changes, you receive a Notice of Reassessment (or a Notice of Redetermination if a loss you claimed changes). Sometimes the outcome is a reduction, which can mean a refund.
Objection, if you disagree. You can file a formal objection, generally within 90 days of the date on the notice. More on this below.
One practical detail: for security reasons, CRA auditors cannot receive files by email. Use the CRA's secure online document submission, mail, or deliver documents to a tax services office.
Preparing for Your Business Tax Audit
Proper preparation is the most useful thing you can do. It may feel daunting to get that first notification, but a calm, organized response sets the tone for the whole audit. Start with 3 simple steps.
Step 1: Respond Promptly to the Canada Revenue Agency
When you receive notice of a CRA audit, respond by the date in the letter. Ignoring or delaying your response can drag the process out and invite more questions. Acknowledging the audit and cooperating on time shows good faith and keeps things moving.
If you need more time to gather records, ask the auditor early. A short, specific request ("I need two more weeks to pull last year's bank statements") is usually received far better than silence.
Step 2: Gather Essential Documents
Auditors will request records that support the numbers on your returns. Gather these first:
Business records, including journals and ledgers, to show income and expenses.
Receipts and invoices for expenses, to support the deductions you claimed.
Purchase and sales invoices, to show the transactions you reported.
Bank and credit card statements and financial statements, to give the full picture of your financial activity.
If your business and personal spending run through the same account, untangling them is the first job. When records are unreliable or accounts are mixed, the CRA can estimate income indirectly, for example by comparing changes in your assets and spending against the income you reported. A separate account (here are some of the best business bank accounts in Canada) keeps that from ever being a question.
Step 3: Understand Your Rights
Before the audit gets going, take a few minutes to read your rights. They are set out in the Taxpayer Bill of Rights, which includes the right to be treated professionally, courteously, and fairly, the right to privacy and confidentiality, the right to complete and accurate information, and the right to a formal review and appeal of CRA decisions.
You also have the right to be represented by the person of your choice, which brings us to accountants.
What to Expect During the Initial Meeting
During the first meeting or call, the auditor will typically explain the audit process, the periods and areas under review, and gather initial information about your business. Have your key records ready and know your numbers at a high level: your main revenue sources, your largest expense categories, and how you track receipts.
Your auditor may ask questions and request additional documents. It is fine to say "I will confirm and get back to you" rather than guess. An accurate answer next week beats an inaccurate one today. Staying on top of your business finances all year is what makes this meeting easy.
How to Communicate Effectively with Auditors
Clear, professional communication makes a CRA audit go faster for everyone. A few simple habits go a long way:
Respond promptly to every request for information or documents.
Answer what was asked, clearly and concisely, and send documents in an organized way (labelled by period and category).
Keep a log of every call, request, and document you send, with dates.
Stay professional and respectful in all correspondence, even when you disagree.
Respect and cooperation go a long way, and they help you get the audit finished as soon as possible.
ReInvestWealth's AI Bookkeeper keeps every transaction categorized, and Smart Shoebox (your receipt inbox) matches receipts to transactions, so pulling records for an auditor takes minutes instead of a weekend. See how it works.
When to Consider Getting Professional CRA Audit Help
When to bring in an accountant or tax lawyer depends on how complex your situation is. If you are not confident dealing with the auditor yourself, if the audit covers several years or several tax accounts, or if it involves legal questions, professional CRA audit assistance is worth it.
Let your accountant deal with the CRA for you
Your accountant can speak to the auditor, send documents, and receive correspondence on your behalf once you authorize them as your representative. Businesses can do this in My Business Account, or your accountant can submit a request that you then confirm. Authorizations generally take a few business days to process, so do this early.
Even if you handle the audit yourself, it can be smart to involve a professional later if you decide to object to the result. A good accountant knows what the auditor is looking for and how to present your records clearly. Think of it as bringing a translator who speaks fluent CRA.
Resolving and Responding to Tax Audit Findings
At the end of the audit, the auditor gives you a written summary of the findings. If nothing needs to change, the audit is closed and that is the end of it. If the auditor proposes changes, you have 30 days to respond to that summary, and you can agree or disagree with each proposed adjustment.
Start by reading exactly what the auditor determined and why. If you need clarification, ask. Then reply with any additional facts or documents that support your position. This is often where adjustments get reduced or dropped, so it is worth a careful response.
Options for Dispute Resolution and Appeals
If you disagree with the CRA's decision, you do not have to file a formal objection right away. You can start by discussing it with your auditor, or their team leader, to resolve the issue directly.
If that does not work, you can file an official objection. Key deadlines:
Corporations (T2) and GST/HST: 90 days from the date on your Notice of Reassessment.
Individuals, including sole proprietors: the later of 90 days from the notice or one year after the filing deadline for that return.
Missed the deadline? You can apply for an extension, up to one year after the objection deadline.
An objection is a formal and impartial review by a different area of the CRA than the one that did your audit. Interest generally keeps accruing on amounts owing while it is decided. To see how interest and late penalties add up on a balance, try our CRA tax penalty calculator.
How to Keep Future CRA Audits Short and Uneventful
You cannot guarantee you will never be audited again. You can make sure the next one is quick. It is simple, but not always easy, so here are the habits that matter most:
Review your return before filing, and double-check that the numbers match your slips and your sales tax filings.
Keep accurate records of income and expenses all year, not just at year-end.
Store your records safely and in an organized way, and keep them for 6 years from the end of the tax year they relate to.
Keep business and personal spending separate, with a dedicated business account and card.
Claim everything you are entitled to, and nothing you are not. Our list of small business tax credits and grants in Canada is a good place to start.
If you have spotted a past error and no audit has started, the CRA Voluntary Disclosures Program may let you correct it with penalty and interest relief. Relief is most generous before the CRA contacts you about the issue, and once an audit or investigation begins the program is closed, so timing matters.
This is where ReInvestWealth helps. Connect your bank and the AI Bookkeeper categorizes your transactions, Smart Shoebox stores your receipts digitally and matches them to transactions, and you can invite your accountant to see the same clean books. When an audit letter arrives, your records are already in one place.
You could keep your receipts in a shoebox and hope the auditor likes shoeboxes. Or you could have CPA-level clean books ready before anyone asks. Start free for 30 days.
Frequently Asked Questions
How long does a CRA business tax audit typically take?
It depends on how complex your business is and how quickly records are provided. Many audits take several weeks to several months, and complex audits can take more than a year. Delays can come from missing records or from the CRA side, such as a file being reassigned to a new auditor.
Can the CRA audit a business for past tax years?
Yes. The normal reassessment period is generally 3 years from the date of the original notice of assessment for individuals and Canadian-controlled private corporations, and 4 years for other corporations. It can be extended in some situations, and there is no time limit where a return contains a misrepresentation due to neglect, carelessness, wilful default, or fraud.
What are the penalties for discrepancies found during an audit?
If an audit increases your tax, you owe the extra tax plus interest. Penalties depend on the cause. An honest error usually means tax and interest, while repeated failures to report income or a false statement made knowingly or through gross negligence can bring additional penalties, and the gross negligence penalty can be 50% of the understated tax.
Does the CRA audit every tax return?
No. The CRA selects files using risk assessment and other information sources, so most returns are never audited. Certain industries and profiles may be reviewed more often, and the CRA also runs review programs that check specific claims without a full audit.
Is a CRA review letter the same as an audit?
No. A review asks you to support specific items on your return, such as a receipt or a slip, and the CRA says a review does not represent a tax audit. An audit is a broader examination of your books and records for one or more periods.
How long do I have to respond to a CRA audit proposal?
You generally have 30 days from the auditor's proposal letter to respond to the proposed changes. If you need more time, contact the auditor before the deadline. After the CRA issues a Notice of Reassessment, you generally have 90 days to file an objection.
Can my accountant talk to the CRA for me during an audit?
Yes. Once you authorize your accountant as your representative, for example through My Business Account, they can deal with the auditor, send documents, and receive correspondence for you. You remain responsible for your return, so stay informed about what is sent.
A note from our CPAs: This guide is educational and covers the general rules for Canadian businesses going through a CRA audit. Tax situations vary, so for advice on your specific circumstances, talk to your accountant. (If they use ReInvestWealth, they'll already have clean books to work from.)
Written by Maryam Ajorloo, CPA
Maryam Ajorloo is the co-founder of ReInvestWealth and a CPA who specializes in small business tax, sales tax, and everyday bookkeeping. She helps entrepreneurs keep clean, audit-ready books and make sense of write-offs, filing deadlines, and the numbers behind their business. Read more · Connect on LinkedIn
Reviewed by Behdad Karimi Dermeni, CPA
Co-founder of ReInvestWealth and a founding community builder at Stripe. Behdad built ReInvestWealth to give smart, busy entrepreneurs CPA-level accounting without the CPA-level price tag. Read more · Connect on LinkedIn
