What Triggers a CRA Audit? A Former Auditor Explains How Files Get Picked

Almost every owner who calls us about a CRA letter asks the same thing first. Why me?

The honest answer is that it is rarely personal, and it is usually not luck either. The Canada Revenue Agency scores your return before a human being ever opens it. Something in your file scored high enough to be worth an auditor’s time, and that something is knowable.

We spent years in the CRA’s audit division, which means we sat on the side of the desk where those files landed. This is what actually pushes a Canadian small business up the list, taken from what the CRA publishes about its own selection process, and what you can change about it.

The short answer: a risk score, then a person

The CRA chooses a file for audit based on a risk assessment. In the agency’s own words, that assessment looks at factors such as the likelihood or frequency of errors in tax returns, whether there are indications that a taxpayer is not meeting their obligations, and the information already on file, which the CRA may compare to similar files or weigh against information from other audits and investigations. That is set out in RC4188, What you should know about audits.

For businesses the CRA is more specific. Its business audits page says the risk assessment systems identify tax returns considered to be at high risk, and only then does an officer review information from various sources to decide whether an audit is needed.

So there are two gates. A model scores you. Then a person decides. Almost everything below is about the first gate, because that is the one your bookkeeping actually controls.

Most CRA letters are not audits

This matters before you panic. The CRA runs eight separate review programs, including the Pre assessment Review Program, the Processing Review Program, the Matching Program and the Special Assessments Program. The CRA states plainly that when it selects your return for review, that does not represent a tax audit.

A review is usually one line item and one request for documents. An audit is an examination of your books. The letter tells you which one you are in. Read it properly rather than asking a chatbot what it means, because the CRA’s own tax chatbot was tested and found correct only about a third of the time, which is one reason we are cautious about AI tax advice in Canada. If it really is an audit, our guide on how to prepare for a CRA audit covers what happens from there.

What the CRA actually feeds into the score

The agency does not publish its scoring formula, but it publishes more than most people realise. The privacy assessment for the GST/HST Audit and Examination program describes predictive models built on data elements that have been statistically correlated with audit results, and it lists examples of what goes in.

Internally, that includes prior audit results, the number of owners, gross revenue, the average age of the owners, any history of bankruptcy of the owners, and the number of times the account changed from monthly to quarterly to annually. Externally, it includes information from other federal and provincial departments and commercially purchased data such as credit bureau information and real estate data.

The same document describes a tool called Quantum, built on identity resolution software, that integrates internal and external data to visualise the relationships and connections between individual and business entities. In plain language, the CRA can see the shape of your group before it ever calls you.

Read that list again and notice what is on it. Your filing frequency changes are on it. Your bankruptcy history is on it. Your property is on it. None of those are secrets, and none of them are accusations. They are inputs.

The signals that move a small business up the list

1. Your numbers do not match slips the CRA already holds

The CRA’s own list of why a return gets picked for review starts with this: the information on your return does not match the information received from third party sources, such as T4 slips. That is on the page about how tax returns are selected for review.

Construction is the sharpest example. A contractor whose primary source of business income is more than 50 percent from construction has to issue a T5018 slip for every Canadian resident subcontractor paid more than $500 in the calendar year, not counting GST/HST. The CRA says the requirement exists to promote compliance in construction and reduce underground economy activity. If you are the subcontractor, the agency already has a number for what you were paid. Your return either matches it or it does not.

The same logic runs through T4s, T4As, T5s and slips from the platforms you sell on. The matching is automatic. Nobody has to suspect you. It is the same pool of information the agency draws on for automatic tax filing in Canada, which is worth understanding for the same reason.

2. You report less than the rest of your industry

The CRA lists five conditions that push it toward what it calls indirect verification of income, meaning it stops trusting your books and starts rebuilding your income from the outside. One of them is that the business consistently reports income lower than other similar businesses in the same sector.

When we worked audit files, this was the single most common way a perfectly honest business ended up under review. A restaurant with a food cost ratio nothing like its neighbours. A trades business with a gross margin half the sector average. There is often a real explanation. You just have to be able to give it.

3. Personal and business money run through the same account

Another of those five conditions is that the business and personal bank accounts may have been used interchangeably. This one is entirely within your control and it is the most expensive habit we see. Reconciling both accounts every month is how the mixing gets caught early.

Mixed accounts do two things at once. They raise your score, and they make the audit itself longer, because an auditor has to sort every transaction rather than accept a clean set. Longer audits find more. The fix is boring and it works, and it is the first of the bookkeeping mistakes Canadian small businesses cannot afford. If you are incorporated, the discipline goes further than a separate card, because how you take money out of the company matters too. That is the subject of our guide to salary versus dividends in Canada.

4. Your lifestyle does not match your reported income

A third condition is exactly that: the taxpayer’s lifestyle does not seem to match the income reported to the CRA.

This is where the net worth method comes in, and it is worth understanding because it is nothing like a normal audit. The CRA describes it as a comprehensive review of the owner’s lifestyle using personal financial records and other verifiable information, specifically naming motor vehicle registration information and land title information. It will also ask for the personal financial records of the owner’s spouse and any other contributing member of the household.

Vehicles show up in this more than anything else, which is one more reason a real logbook matters. We cover what one has to contain in our guide to business vehicle expenses and the mileage log.

5. One person does all the books

The first of the five conditions is that the books and records are prone to error, and the CRA gives its own example: when one person does most of the accounting, or when the main functions in a business are done by one person or a small group of related persons.

That is not an accusation of fraud. It is a statement about controls. A single person doing sales, banking and bookkeeping has nobody checking the work, and the CRA treats that as a higher chance of error. This is one of the quieter reasons owners bring in outside bookkeeping, and it is worth knowing that the agency writes it down.

6. You are in a sector the CRA is already watching

The fourth condition is short: the business is in a sector considered to be at high risk for unreported income.

The CRA is open about which ones it is building capacity for. Its GST/HST compliance strategy names four categories of platform work specifically: the sharing economy, the gig economy, peer to peer selling, and social media influencers. It also describes a Cryptocurrency Centre of Expertise and the use of unnamed persons requirements to get user data from exchanges. Construction has had its own slip since long before any of that.

If you earn from a platform, the sector is not the problem. Reporting as though nobody is watching is the problem. For creators specifically we wrote a separate piece on content creator write offs in Canada, because the deduction rules are where most of that group gets into trouble.

7. The deductions you claimed

The CRA lists the types of deductions or credits you claimed as its own reason for selecting a return. Nothing about that means a claim is wrong. It means some categories get looked at more often, usually the ones with a personal use component.

Home office, vehicle, meals, travel and anything you also enjoy on a weekend all sit in that group. The defence is never a smaller claim. It is a claim you can support. Our guide to what you can write off as a small business owner in Canada walks through the ones that actually hold up.

8. Your compliance history

Compliance history is the third item on the CRA’s selection list, and it is the one owners underestimate. Late returns, unremitted source deductions, repeated adjustments and a filing frequency that keeps moving all live in your file permanently.

Remember that the number of times a GST/HST account changed from monthly to quarterly to annually is a named input into the risk model. If your reporting period has bounced around, that is visible. Getting the account set up correctly at the start avoids a lot of it, which we cover in how to register for GST/HST in Canada. Payroll has the same memory, and late remittances are among the fastest ways to get attention, as we explain in our guide to payroll for your first employee.

9. Somebody reported you

The CRA runs the Leads Program, which lets anyone anonymously report a business, a charity or an individual they believe is cheating on taxes or benefits.

We are not going to dress this up. Former partners, former employees and unhappy competitors use it. A lead does not automatically produce an audit, because it still has to survive the same risk assessment as everything else. It does put your name in front of a person.

10. Random selection

Random selection is genuinely on the CRA’s published list of why a return gets reviewed, and the GST/HST program says it also randomly selects returns to verify that taxpayers are paying in full and on time.

This is the part nobody can manage. It is also the reason the only real defence is books that would survive a look on any given Tuesday, rather than books you plan to tidy if you are ever asked.

What an auditor can reach for once the file is open

People assume an audit is limited to the business. It is not, and RC4188 says so directly. Your personal records and the personal or business records of other individuals and entities are legally considered part of what relates to the return being audited. An auditor can examine the records of family members. An auditor may ask the employees who do your accounting entries about how the business operates.

The CRA also describes an economic entity approach, where it groups related, associated or otherwise connected legal entities together and reviews them as one, and it says audits of multiple members of that group may occur when the group is identified as high risk.

One more thing worth stating plainly, because it surprises people: failing to provide the required books and records is an offence under the law. Not producing them is not a strategy.

How far back the CRA can go

For a corporation, the normal reassessment period runs three years from the date the CRA sent the original notice of assessment if the company was a Canadian controlled private corporation at the end of the year, and four years if it was not. That is set out on the CRA page about when it can reassess your T2 return.

Those limits come off entirely where there has been a misrepresentation attributable to neglect, carelessness, wilful default or fraud. In that case the CRA can reassess at any time. The same is true where a corporation did not report a disposition of real property in its original return.

Which is why the retention rule is six years and not three. The CRA requires books and records to be kept for a minimum of six years, and the review pages repeat the same number for receipts supporting a claim. We set out what that actually means in practice in our guide to small business record keeping in Canada.

What it costs when the numbers do not hold up

Two penalties are worth knowing by name, both on the CRA’s page about false reporting or repeated failure to report income.

The repeated failure to report income penalty applies when you fail to report $500 or more on your 2025 return and also failed to report $500 or more on your 2022, 2023 or 2024 return. It is the lesser of 10 percent of the amount you failed to report, or 50 percent of the difference between the understated tax and the tax withheld on that amount. Two missed slips in four years is enough.

The false statements or omissions penalty is the heavier one. Where a false statement or omission was made knowingly or in circumstances amounting to gross negligence, the penalty is the greater of $100 or 50 percent of the understated tax or overstated credits. That sits on top of the tax and the interest.

If you already know something is wrong

Come forward first. The Voluntary Disclosures Program grants relief case by case, and it has five conditions. The one that decides everything is the first: you have to apply before an audit or investigation has been started against you or a related taxpayer about the information you are disclosing.

The other four are that you include all the relevant information and documents, that there is an actual error or omission carrying interest or penalties, that it is at least one year or one reporting period past the due date, and that you include payment of the estimated tax owing or request a payment arrangement. The CRA also offers a pre disclosure discussion you can have anonymously before revealing who you are. The program was changed on 1 October 2025, so check the current conditions rather than an old summary.

The window closes the moment that letter arrives. If your books are behind and you already suspect what is in them, that is a reason to move now, and our guide to catching up on books that are behind sets out the order to do it in.

What actually lowers your score

After years of reading these files, the short list barely changes.

• Keep one bank account and one card for the business, and never run a personal purchase through either.
• Reconcile to the slips. If a T4A or a T5018 exists for money you received, your return should agree with it before you file.
• Know your own ratios. If your margin is unusual for your industry, have the reason written down while you still remember it. This is one of the practical arguments for reading monthly financial reports rather than filing them.
• File on time, every time, including nil returns, and stop moving your GST/HST reporting period unless there is a real reason. If you use the GST/HST quick method, recheck the $400,000 ceiling every year end so the election does not lapse without anyone noticing.
• Keep six years of records in a form you could actually hand over, not a drawer you would have to excavate.
• Let real numbers be untidy. Books full of round figures read as estimates, and estimates invite questions.

None of that is clever. All of it is visible from the outside, which is the entire point. If you want the foundation rather than the checklist, start with our beginner’s guide to small business bookkeeping in Canada.

Frequently asked questions

What triggers a CRA audit for a small business?

The CRA selects files using a risk assessment rather than suspicion. The published factors include information that does not match third party slips, the types of deductions claimed, your compliance history, and random selection. For businesses, the CRA also weighs whether you report less income than similar businesses in your sector and whether personal and business bank accounts appear to have been used interchangeably.

Does the CRA really audit people at random?

Yes, though it is a small share. Random selection is one of the four reasons the CRA lists for picking a return for review, and its GST/HST program says it randomly selects returns as well as risk scoring them. Most files still arrive through the risk assessment systems rather than a lottery.

How far back can the CRA audit a Canadian business?

The normal reassessment period is three years from the original notice of assessment for a Canadian controlled private corporation and four years for other corporations. There is no limit where the CRA finds a misrepresentation attributable to neglect, carelessness, wilful default or fraud, or where a disposition of real property was left off the original return. Records must be kept for at least six years.

Does a bookkeeper reduce my chance of being audited?

It cannot remove the risk, because random selection exists and your industry ratios are what they are. It does address several published risk factors directly, including mixed personal and business accounts, books that one person handles end to end, and a compliance history of late filings. It also shortens the audit if one happens, because clean records are faster to verify.

Can I fix a mistake before the CRA finds it?

Often, yes. The Voluntary Disclosures Program can grant relief from penalties and partial interest, but only if you apply before an audit or investigation has been started against you or a related taxpayer about that issue. You can request an anonymous pre disclosure discussion first. Once the CRA contacts you, that option is gone.

Worried your books would not survive a look?

Most of the risk factors the CRA publishes are bookkeeping problems, not tax problems, which means they are fixable before anyone asks. We spent years on the other side of these files and we build books for Canadian small businesses with that view in mind. If you want a second opinion on where yours stand, get in touch and we will tell you straight.