Preparing for a CRA Audit or Review: A Guide for Ontario Small Businesses

1. Know whether you face a review or an audit

The CRA runs several kinds of checks, and the first step is to read the letter carefully to see which one you face.

A review usually asks you to support specific amounts. The CRA says being selected for a review of an individual return does not represent a tax audit. For corporations, the Corporation Assessing Review Program conducts limited reviews of single line items on a T2 return. A GST/HST post-assessing review checks that GST/HST returns were reported properly and, the CRA says, is not an audit nor a “books and records” review.

An audit goes further. In a business audit, the CRA examines your books and records to confirm the amounts you filed, and it may ask for the owners’ personal records and records of related people or entities.

Take a review seriously too. The CRA says that if you do not respond to a corporate review, it will reassess the return by disallowing the claim, expense, deduction or credit in question.

2. Understand what can lead to CRA contact

The CRA does not publish a list of audit triggers. It says its risk-assessment systems identify returns considered at high risk of non-compliance, and a CRA officer then reviews information from various sources to decide whether an audit is needed. Publication RC4188 adds that the CRA may compare your file with similar files or with information from other audits or investigations.

The CRA describes situations where it may verify income indirectly, for example when records are error-prone, when business and personal accounts are mixed, or when a lifestyle does not match the income reported. Its most common indirect method is the net worth method, which looks at changes in assets and liabilities, personal spending and non-taxable income.

A review or audit is not an accusation. Keep business and personal finances separate, and keep records that explain unusual amounts.

3. Confirm it is really the CRA

For a business audit, the CRA says an auditor will usually contact you by phone and then send a letter confirming the details. You can end the call and call back the auditor or team leader, or wait for the letter before sharing more information. Review programs may also contact you by letter, phone or a message in My Business Account.

When someone calls, ask for their name, their office and a callback number. Do not give personal information during the call, and do not rely on caller ID. Hang up, verify the number using the CRA’s tool, or call the CRA business line at 1-800-959-5525.

The CRA lists things it will not do, including:

• demand or pressure immediate payment by Interac e-transfer, cryptocurrency, prepaid credit cards or gift cards
• threaten to deport or arrest you, or put you in prison
• use aggressive or threatening language
• set up a meeting in a public place to collect a payment
• ask for personal or financial information in a voicemail or email

CRA emails will not ask you to reply or include a link asking for personal or financial information. If you suspect a scam, the CRA’s reporting guidance says to contact the CRA, your financial institution and local police as needed, and to notify the Canadian Anti-Fraud Centre.

4. Keep records that can answer questions

Good records are your best preparation. The CRA says complete and organized records help if your income tax or GST/HST returns are audited, and that claims your records do not support could be disallowed. Supporting documents include sales invoices, purchase receipts, contracts, bank statements and cancelled cheques.

How long to keep them: generally for six years after the end of the last tax year they relate to. The CRA’s record-retention page lists exceptions, including:

• records about long-term property and corporate history, which you keep indefinitely
• late-filed returns, where the six years run from the date you file
• records involved in an objection or appeal, which you keep until the later of the resolution, the end of the appeal period or the six-year mark

Where to keep them: at your place of business or residence in Canada, unless the CRA gives written permission otherwise. To destroy records early, you need written CRA permission first, for example by using Form T137.

Keep electronic records in a format that can be read. RC4188 also reminds owners that using a tax professional does not relieve you of your own responsibilities.

5. Decide who will speak for the business

You have the right to be represented by a person of your choice. Before the CRA can discuss your account with an accountant or other representative, the business has to authorize them.

The CRA describes several ways to give authorization:

• My Business Account: the CRA calls this the fastest way. Add the representative from the Profile section.
• Represent a Client: your representative submits a request, and you confirm or deny it in My Business Account.
• Form AUT-01: gives offline access by phone, mail, fax and in person, but not online access. Fill in a separate form for each representative and send it to the CRA tax centre within six months of signing.

Set up authorization before a deadline approaches. Decide who receives CRA correspondence, who gathers records and who approves what is sent.

6. Respond by the deadline with an organized package

Write the deadline down as soon as the letter arrives. For a corporate review, the CRA says the letter sets the timeframe and explains how to request an extension.

Auditors normally ask for electronic records before meeting you, and the audit usually takes place at your place of business. You can deliver documents to a tax services office, mail them or submit them online. The CRA says auditors cannot receive files by email.

A useful response package:

• answers each item in the letter, in the order asked
• includes the records that support each amount, labelled clearly
• explains unusual items briefly and factually
• keeps a copy of everything sent and notes the date and method

If an auditor borrows documents, you should receive a detailed receipt. Delays can come from missing records, so gather what is asked for early.

7. If you disagree: proposals, objections and appeals

If an auditor proposes changes, you receive a written summary of the findings and have 30 days to respond. You can agree or disagree. Contact the auditor to explain your position and send supporting documents. If that does not resolve it, you can contact the auditor’s team leader. The audit ends with a final letter, and changes to tax payable lead to a notice of reassessment.

If you still disagree, you can file a formal objection. The CRA’s dispute guide for income tax sets these time limits:

• Corporations: 90 days from the date of the notice of assessment or determination.
• Individuals, including sole proprietors: the later of one year after the return’s filing due date or 90 days after the notice.
• GST/HST: the CRA says the time limit is 90 days from the date of the notice of (re)assessment.

You can file online in My Business Account, or by mail using Form T400A or a signed letter. If you miss the deadline, you can ask for an extension no later than one year after it. Interest generally continues on disputed amounts, and large corporations must pay 50% of the disputed amount when they object. After the CRA decides the objection, you can appeal to the Tax Court of Canada within 90 days.

8. Know your rights during the process

The Taxpayer Bill of Rights sets out 16 rights. Several matter during a review or audit:

• to pay no more and no less than the law requires
• to be treated in a courteous, professional and fair way
• to request a formal review and then appeal if you disagree with a decision
• to request relief from penalties and interest caused by circumstances beyond your control
• to be represented by a person of your choice
• to file a service complaint or request a formal review without fear of reprisal

The CRA’s Commitment to Small Business includes administering the tax system in a way that minimizes compliance costs and explaining the steps it follows with small businesses, including audits, objections and collections.

A service complaint is different from an objection. Start with the employee you have dealt with, then their supervisor. If that does not resolve it, use Form RC193, Service Feedback, or the CRA’s online process. Unresolved service complaints can go to the Office of the Taxpayers’ Ombudsperson.

9. Correct past errors before the CRA asks

If you discover an error or omission in past filings, the Voluntary Disclosures Program (VDP) may grant relief case by case. Updated rules took effect on October 1, 2025.

The CRA lists five conditions. You must apply before an audit or investigation has started against you or a related taxpayer, include all relevant information, disclose an error or omission that carries interest or penalties, involve information at least one year or one reporting period past its due date, and include payment of the estimated tax owing or request a payment arrangement.

Relief depends on timing. General relief, which normally applies to unprompted applications, covers 75% of the applicable interest and 100% of the applicable penalties. Partial relief, normally for applications prompted by CRA communication such as an education letter, covers 25% of the interest and up to 100% of the penalties. The relief applies to interest and penalties, not the tax itself.

The CRA considers only fully completed applications. A representative can submit one for you, but both of you must sign it.

10. Featured Ontario provider: Versa LLP

Versa LLP is a Brampton accounting firm led by four CPA partners. Its CRA audit support service is for individuals and businesses that have received a CRA information request or audit-related correspondence. The published scope includes reviewing the correspondence and requested records, organizing documents and planning the response, CRA representation where authorized and agreed, and discussing next steps and the limits of the engagement.

Partner Ranjit Mann, CPA, focuses on corporate tax, tax planning and CRA matters. His profile says he began his career at KPMG and MNP and later worked in the CRA’s income tax division.

Bring the CRA letter, its deadline and any records you have already gathered to the first conversation. Ask which steps the firm would handle, whether you need to authorize it as your representative, and what the fee covers. Confirm the scope in writing.

You can view Versa LLP’s PCBO business profile, meet Ranjit Mann or read about the CRA audit support service.

11. Checklist: when a CRA letter arrives

• Confirm it is genuine. Check My Business Account or call the CRA using a number you have verified yourself.
• Identify the type. Is it a review, an audit, a proposal letter or a notice of reassessment?
• Write down the deadline. Ask for an extension in the way the letter describes if you need one.
• Authorize your representative if someone else will deal with the CRA.
• Gather the requested records and match each one to the item it supports.
• Send documents securely, never by email to an auditor, and keep copies.
• If you disagree, respond to the proposal in writing, then file an objection within the time limit if needed.
• Afterwards, keep the file with your records for at least as long as the CRA requires.

An organized, on-time response does not guarantee a particular outcome, but it gives the CRA what it needs to understand your position.