CRA audits and small businesses: what actually happens
How the CRA selects small businesses for audit, review letters vs full audits, your rights, and what to do on day one — Revenu Québec included.
Most letters from the Canada Revenue Agency are not audits. Most of what a small business receives is a review — a targeted request to support one or two amounts on a return. A full audit, where an assigned auditor examines your books and records, is much less common — and it is a manageable process, with published selection rules and defined rights and deadlines at every step. Here is how corporations actually get selected, how an audit unfolds, and what to do on day one.
A review letter is not an audit
The CRA runs routine review programs that check returns before and after assessment. A review letter asks you to support a specific amount — a deduction, a credit, a balance — and is handled by mail or through your online CRA account. No auditor is assigned: you send the documents by the deadline, the CRA accepts them or adjusts the line, and the file closes. Answer on time — but do not mistake these letters for an audit.
An audit is a comprehensive examination of your books and records by an assigned auditor, often covering more than one year and sometimes income tax and GST/HST together. The right response differs too: a review needs documents; an audit needs a plan and a single point of contact.
What actually puts a corporation on the audit list
The CRA publishes how selection works: risk-assessment systems score returns, and an officer reviews flagged files before an audit opens. The factors it names: the likelihood or frequency of errors, indications of non-compliance, comparisons with similar files, and information from other audits, investigations or informant leads.
In practice, the patterns that raise a small corporation's risk profile are concrete:
- Numbers far from industry norms. The CRA benchmarks your revenue, margins and expense ratios against comparable businesses. A contractor claiming double the sector's typical vehicle costs stands out.
- Recurring losses. A corporation that loses money year after year while continuing to operate raises an obvious question: how — and is all the revenue on the return?
- Shareholder account anomalies. Money moving between you and your corporation without documentation — a shareholder loan that grows every year or never gets repaid — is a classic audit issue.
- Sales tax that does not match income. GST/HST filings that cannot be reconciled with the revenue on the corporate return invite a closer look at both.
- A weak compliance record. Chronic late filing signals weak books. Filing and paying on time is the cheapest risk reduction there is — our corporate tax deadline guide covers every date.
None of these guarantees an audit — some arise from a related file, not yours. The goal is not to avoid ever reporting a loss; it is to be able to document every number you report.
How the process unfolds
An auditor contacts you by letter, phone or both, identifying the years under audit, the taxes covered and the records needed. The work happens at your place of business, your representative's office or a CRA office — and increasingly through electronic records transmitted securely. The auditor can examine business records — ledgers, invoices, contracts, bank statements — and, where relevant, personal records, including those of family members or related corporations, to verify that reported income is complete.
How long it takes depends mostly on the state of your records and the speed of your responses. Two endings are possible: the auditor closes the file with no change — it happens regularly — or you receive a written proposal of adjustments, with 30 days to respond with anything that changes the analysis. If a reassessment follows and you still disagree, you have 90 days from the notice of reassessment to file a formal objection.
How far back can it go? The normal reassessment period is three years from the original notice of assessment for a Canadian-controlled private corporation (CCPC), four years for other corporations — longer only where there is misrepresentation attributable to neglect, carelessness, wilful default or fraud. Keep your records for six years.
Your rights do not pause during an audit
The Taxpayer Bill of Rights applies throughout. Among its 16 rights: professional, courteous and fair treatment; complete, accurate, clear and timely information; having the costs of compliance taken into account; and representation by the person of your choice. Concretely, you can ask for requests in writing, ask why information is needed, raise concerns with the auditor's team leader, file a service complaint — and object to the numbers themselves after reassessment.
Day one: the first 48 hours after the letter
- Read the whole letter. Note the years, the taxes covered, exactly what is requested and the deadline.
- Do not call the auditor angry. Venting has never narrowed the scope of an audit; calm and factual is the only posture that helps you.
- Call your CPA before you respond. Authorize them as your representative so everything flows through one person who does this regularly.
- Provide what is asked — completely, on time, and nothing more. Volunteering unrequested records widens the conversation for no benefit.
- Keep everything in writing, and keep copies of every document you hand over.
Clean books change the outcome
Fast, uneventful audits share one feature: every number on the return traces to a document. Reconciled bank accounts, organized receipts, statements that tie to the return, a shareholder account reconciled to the dollar: that is what lets an auditor confirm and close. A CPA-prepared file adds a second layer — the questions an auditor will ask have usually been asked, and answered, before filing. Stamped prepares corporate returns this way, CPA-prepared and reviewed, with supporting documents organized on our platform, so an auditor's request is a retrieval, not a reconstruction. See how our corporate tax service works.
In Québec: Revenu Québec runs its own audits
A Québec corporation answers to two tax administrations. Revenu Québec administers Québec corporate income tax (the CO-17) and the GST/QST for most Québec businesses, with its own auditors and its own selection. The process is formalized: the auditor confirms the meeting in writing, hands you the COM-366-V rights brochure and, if changes are proposed, issues a draft assessment with generally 21 days to submit new information. You then have 90 days to object. An audit by one administration does not automatically trigger the other, but the two exchange information — and one clean set of books answers both.
A letter arrived? Start with a calm second opinion
Not sure which kind of letter your corporation received? That is a fifteen-minute question for a CPA — and getting day one right is worth more than anything you do later. Reach us; we respond within 24 hours.
Frequently asked questions
What is the difference between a CRA review and a CRA audit?
A review is a targeted request to support specific amounts on a return, handled by mail or online, with no auditor assigned. An audit is a comprehensive examination of your books and records by an assigned auditor, often covering multiple years. Reviews are routine and usually end once you send the requested documents.
What triggers a CRA audit of a small business?
The CRA scores returns with risk-assessment systems, weighing the likelihood of errors, indications of non-compliance, comparisons with similar files, and information from other audits, investigations or informant leads. In practice, figures far from industry norms, recurring losses, undocumented shareholder-account movements and GST/HST filings that do not match reported income are common risk patterns.
How far back can the CRA audit my corporation?
The normal reassessment period is three years from the original notice of assessment for a CCPC and four years for other corporations. There is no limit where the CRA establishes misrepresentation attributable to neglect, carelessness, wilful default or fraud. Keep your records for six years.
What should I do first if my business is selected for an audit?
Read the letter fully, note the years covered and the deadline, and contact your CPA before responding. Authorize them as your representative so all correspondence flows through one person, then provide exactly what is requested — on time and in writing.
Can Revenu Québec audit my business separately from the CRA?
Yes. Revenu Québec administers Québec corporate tax and the GST/QST with its own auditors and its own selection. Its audits follow a similar process: written confirmation, the COM-366-V rights brochure, a draft assessment with generally 21 days to respond, then 90 days to file an objection.