CRA business audit: what your business needs to know

Types of business audits

CRA conducts three main types of business audits, distinguished by where they take place and how intensive they are.

Correspondence audit

The most common type. CRA sends a letter asking for specific information or documents — typically focused on one or two items such as vehicle expenses, home office deductions, or a large one-time transaction. You respond by mail, fax, or through My Business Account. These audits are usually handled by CRA audit personnel at a tax centre and do not involve an auditor visiting your location. Response times are typically 30 days from the request date.

Desk audit

A desk audit is conducted at a CRA tax services office. An auditor reviews your records in a more comprehensive way than a correspondence audit, but you do not meet at your business premises. You or your representative may be asked to come to the CRA office, or to submit your records digitally. Desk audits often cover one to two tax years and examine multiple aspects of your business — income, expenses, payroll, and sometimes GST/HST.

Field audit

The most intensive type. A CRA auditor (sometimes a team) visits your business premises to review your books and records on-site. Field audits are used for larger businesses, cash-intensive operations, situations where CRA suspects significant unreported income, or where the volume of records makes a remote review impractical. The auditor may interview you, your bookkeeper, or your accountant. Field audits can take weeks or months to complete and may cover multiple tax years simultaneously.

Common business audit triggers

CRA's automated risk-scoring system flags returns that deviate from expected patterns. For businesses, the most common triggers are:

Cash-intensive businesses

Restaurants, bars, hair salons, nail salons, auto body shops, landscapers, and other businesses that handle significant cash revenue face higher audit risk. CRA uses net-worth audits and indirect verification methods to cross-reference reported revenue against assets, lifestyle indicators, and third-party data. If your reported gross revenue seems low relative to industry norms, expect scrutiny.

Large vehicle and travel expenses

Vehicle expenses are consistently among the most audited deductions. CRA looks for claims where 100% business use is claimed (extremely rare for most businesses), where the vehicle is a luxury or personal-use type (sports cars, SUVs), or where the business rationale is unclear. A contemporaneous logbook is the best defence — mileage apps like MileIQ or manual logs maintained weekly, not reconstructed at year-end.

Meals and entertainment

Only 50% of legitimate business meals and entertainment are deductible. CRA auditors look for personal expenses disguised as business meals, claims without clear business purpose, and expenses incurred in locations that suggest personal use (ski resorts, vacation destinations). Each meal expense over $50 should have a note of the business purpose and who was present.

Home office deductions

Self-employed individuals and incorporated business owners who claim home office expenses need to document the business-use percentage carefully. The Canada Revenue Agency accepts the proportion of the home used exclusively for business purposes, calculated by square footage or number of rooms. Claiming your entire basement as an office when it includes a gym and storage is a red flag.

Shareholder loans and benefits

Amounts a corporation lends to its shareholder-employees — or benefits provided to shareholders — are carefully scrutinized. A shareholder loan that is not repaid within one year after the end of the fiscal year in which it was made is generally included in the shareholder's income. Corporate funds used for personal expenses of shareholders (the company credit card used for personal groceries, for example) must be properly documented and either repaid or treated as a taxable benefit or dividend.

Related-party transactions

Transactions between related corporations or between a corporation and its owner-manager must be at arm's length (market value). Paying a family member a salary far above what you would pay an unrelated employee, or transferring assets between related companies at below-market prices, can be challenged by CRA.

T4 and payroll discrepancies

If the total payroll expenses deducted on your T2 corporate return do not match the T4 Summary you filed, CRA will flag the discrepancy. Similarly, if you have employees but your payroll remittances seem low relative to your employee count and wages, CRA's payroll division may initiate a review.

T2 corporate audit vs. personal audit

When CRA audits a corporation, they examine the T2 corporate tax return, the corporation's financial statements, and often the related T1 personal returns of the shareholders. The two audits may run concurrently.

T2 corporate audit focus areas

CRA auditors reviewing a T2 return focus on:

• Revenue recognition: Is all revenue recorded? Are there unreported cash sales or off-book transactions?
• Business purpose of expenses: Every expense claimed must have a genuine business purpose. The expense must be incurred to earn income from the business.
• Capital vs. current expenses: Expenses that provide a lasting benefit (building renovations, major equipment) should be capitalized and depreciated, not expensed immediately. Misclassifying capital expenditures as current expenses inflates deductions.
• Capital Cost Allowance (CCA): The correct CCA class and rate must be applied to each asset. Claiming accelerated depreciation that is not permitted by the Income Tax Regulations is a common audit issue.
• Scientific Research and Experimental Development (SR&ED): SR&ED claims are scrutinized heavily. CRA technology reviewers assess whether the claimed work qualifies as SR&ED under the definition in the Act.

Integration with personal returns

Because many owner-managers pay themselves through a combination of salary and dividends, CRA often reviews both the T2 and T1 together. They verify that salary paid from the corporation matches the T4 slips issued, that dividends paid match the corporation's dividend resolution and are consistent with retained earnings, and that any shareholder benefits are reported on the shareholder's T1.

What CRA auditors can and cannot do

CRA auditors can:

• Examine all books, records, and documents related to your business income and expenses for the taxation years under review
• Enter any premises (other than a dwelling place) that is used for carrying on a business, during normal business hours
• Require you to provide reasonable assistance and to answer questions verbally or in writing
• Require you to make your computer systems available if records are stored electronically
• Contact third parties such as your bank, suppliers, or customers to verify information (but must first serve a requirement for information that you can challenge)
• Request information about your personal financial situation if your business income appears understated relative to your personal assets and spending

CRA auditors cannot:

• Enter a dwelling place (home) without your consent or a court-authorized warrant
• Demand records that are clearly protected by solicitor-client privilege (communications with your lawyer about legal advice)
• Conduct a criminal investigation under the guise of an audit — if CRA suspects criminal tax evasion, a separate Special Investigations unit handles that with different legal authority
• Assess penalties without following the proper administrative process, including giving you a reasonable opportunity to respond
• Harass, threaten, or intimidate you or your staff

If an auditor behaves improperly or exceeds their authority, document it and raise it with their supervisor or the Taxpayers' Ombudsperson.

Document retention requirements

The Income Tax Act requires businesses to keep adequate records for a minimum of six years from the end of the last tax year to which the records relate. "Adequate records" means books and records that are sufficient to determine your tax obligations and entitlements.

What to keep

• Accounting records: General ledger, accounts payable and receivable ledgers, bank reconciliations, journal entries
• Source documents: Invoices, receipts, contracts, and purchase orders — both incoming and outgoing
• Payroll records: Employee time records, payroll calculations, T4 data, Records of Employment
• Bank records: Bank statements, cancelled cheques, deposit slips, credit card statements
• Corporate records: Minutes of directors' meetings, share registers, dividend resolutions, shareholder agreements
• Asset records: Purchase invoices for capital assets, CCA schedules, disposal records
• GST/HST records: Records of all taxable and exempt supplies, input tax credit claims, and remittance records

Electronic records

CRA accepts electronically stored records, but they must be in a format that CRA can access and read. If you use cloud accounting software (QuickBooks Online, Xero, Sage), ensure you retain access to the account for the full six-year retention period, even after you stop using the software. Exporting your data periodically to a standard format like CSV is good practice.

What happens if you cannot produce records

If you cannot produce adequate records, CRA may use indirect audit methods to estimate your income — industry ratios, net-worth analysis, or bank deposit analysis. These methods often result in higher assessments than your actual income. Failing to maintain adequate records also exposes you to a failure-to-keep-adequate-records penalty under the Income Tax Act.

Getting professional representation

While you can handle a simple correspondence audit yourself, professional representation becomes important when:

• The audit covers multiple tax years or multiple issues
• CRA is conducting a field audit or has requested access to your premises
• The audit involves complex transactions: real estate, share sales, related-party transactions, or foreign operations
• CRA has alleged unreported income or is using indirect audit methods
• You are a cash-intensive business and CRA is questioning your revenue
• The potential reassessment amount is significant
• You have not been keeping adequate records and need to reconstruct them

A CPA with experience in CRA audit representation knows what auditors typically focus on, how to present information clearly, and when to push back. A tax lawyer becomes essential if the audit has criminal investigation overtones, if you are considering a formal dispute process (objection or Tax Court), or if large penalties are at stake.

Authorize your representative using Form T1013 (individuals) or by authorizing them through My Business Account. Once authorized, CRA must deal with your representative and cannot contact you directly without going through them.