CRA Audit Triggers: What Actually Prompts a Review and How to Be Ready

Most people imagine a CRA audit as something that happens because someone decided to look at them. That is not usually how it starts.

The majority of reviews begin with a computer comparing your return to thousands of similar returns and flagging the parts that do not sit where the others do. It is statistical. It is not personal. And that matters, because it tells you exactly what to do about it: the goal is not to avoid attention, it is to be able to substantiate whatever draws it.

What actually draws attention

Figures that sit far outside the range for your industry. The CRA has extensive data on what a plumbing contractor, a consultant or a restaurant typically reports. A number well outside the normal band gets flagged. Note that being outside the band is not evidence of anything wrong: it simply invites the question.

Repeated business losses. A business that loses money for several consecutive years attracts the question of whether it is a business at all or a personal activity being deducted. The test is whether there is a genuine source of income pursued in a commercial manner.

Expense categories that are commonly abused. Vehicle, meals and entertainment, home office, and travel are reviewed more closely than others because they are where personal and business spending blur. Claiming them is entirely legitimate. Claiming them without a log is where it goes wrong, see vehicle expense deductions in Canada and the home office deduction.

Information slip mismatches. T4s, T5s, T3s and T5008s are filed with the CRA independently of your return. If your return omits one, the mismatch is automatic and immediate. This is the most common review of all, and it is entirely preventable: check your CRA My Account slips before filing rather than relying on what arrived in the mail.

Real estate activity. Property dispositions, principal residence designations and rental reporting have all received sustained attention. Reporting the sale of a principal residence is required even when no tax is owing, and failing to report it is a well-known trigger.

Cryptocurrency. Exchanges operating in Canada report to the CRA, and international information-sharing has expanded considerably. The assumption that crypto activity is invisible has not been true for years: the reporting mechanics are covered in crypto tax Canada and the record-keeping side in crypto ACB and record keeping.

Large or unusual GST/HST refund claims. A refund position gets more scrutiny than a remittance position, for the obvious reason.

Shareholder loan balances. An owner-manager with a large outstanding shareholder loan is a familiar pattern to the CRA, and it interacts with how you have chosen to pay yourself, see salary vs dividends.

Third-party information. Leads arrive from other audits, from mismatched counterparty reporting, and from informants.

The three levels, which are not the same thing

People use “audit” for all of these. They are meaningfully different.

A processing review is a letter asking you to support one line: usually medical expenses, donations, or childcare. You send documents. It resolves. This is routine and is not an audit.

A desk audit is broader. A CRA officer reviews specified areas from their office and asks for supporting records. Still document-driven, still bounded.

A field audit means an auditor attends your premises and examines the books directly. Scope is wider and it can extend to related years and related entities.

Knowing which one you are in determines how much of your life it will occupy. The letter tells you. Read what is actually being asked before assuming the worst: the CRA’s own overview is at what you should know about audits.

How long they can look back

The normal reassessment period is three years from the date on your notice of assessment for most individuals and Canadian-controlled private corporations, and four years for certain other corporations.

That limit disappears where there has been misrepresentation attributable to neglect, carelessness, wilful default, or fraud. In those circumstances there is no statutory time limit at all.

Separately, the requirement to keep records is six years from the end of the tax year they relate to: longer than the normal reassessment window, and longer for certain records such as those relating to long-held property. The CRA sets this out under keeping records.

Preparation, which is really just bookkeeping

Nothing in this section is exotic. It is the ordinary discipline that makes a review a nuisance rather than a crisis.

Keep source documents, not summaries. A bookkeeping entry is not evidence. The invoice is evidence. A bank statement showing a payment proves money moved, not what it was for.

Separate business and personal banking completely. The single largest driver of audit pain is a commingled account, because now every transaction requires explanation. A dedicated business account costs a few dollars a month and removes an entire category of problem.

Keep a contemporaneous vehicle log. Reconstructed logs are recognised as reconstructed. A log kept as you drive is worth more than any argument made afterwards.

Document the business purpose of anything unusual. A note written at the time, who, why, what was discussed, is far more persuasive two years later than a memory.

Reconcile monthly. Errors found in month two are corrections. Errors found in year three are patterns. A monthly close routine is described in the monthly close for Ottawa small business.

If a letter arrives

Read it carefully and note the deadline. Most requests have a specific response date. Missing it can result in the CRA reassessing on the basis of the information it has, which is rarely the basis you would prefer.

Answer what was asked. Nothing more. Volunteering additional records invites additional questions. This is not evasiveness; it is scope management, and it is standard practice.

Ask for an extension if you need one. Extensions are commonly granted when requested before the deadline and far less commonly afterwards.

Get representation if the scope is broad. For a single-line processing review, handle it yourself. For a field audit, or anything touching multiple years, professional representation generally pays for itself: partly in outcome, largely in the time you do not spend on it.

Keep everything in writing. Confirm phone conversations by email. A written record of what was agreed is worth having.

If you already know there is a problem

If you are aware of unreported income or a materially incorrect return, the Voluntary Disclosures Program exists precisely for that situation. Accepted applications can provide relief from penalties and partial interest relief, and protection from prosecution.

The critical condition: the disclosure must be voluntary. Once the CRA has contacted you about the issue, the door closes. If you are going to use the programme, the time is before the letter, not after it.

You have rights, and one of them is disagreement

The Taxpayer Bill of Rights includes the right to professional representation, the right to complete and accurate information, and the right to a formal review.

If you disagree with a reassessment, you can file an objection, generally within 90 days of the notice. An auditor’s conclusion is a position, not a verdict. Reasonable positions supported by records are frequently sustained on objection.

The honest summary

You cannot audit-proof a return, and trying to is the wrong objective. Aggressive tax positions are not the main driver of trouble; poor records are. A defensible claim with documentation behind it survives a review. A modest claim with nothing behind it does not.

Keep the receipts, separate the accounts, keep the log, and reconcile monthly. That is most of it.

If a letter has already arrived and you are not sure how to respond, get advice before you reply - the first response sets the tone for everything that follows.