CRA Is Auditing Your Business. What Happens Now?

What happens now: the audit, stage by stage

Here is the whole process in one paragraph. An auditor contacts you and identifies what is under audit — typically specific years and specific taxes, such as corporate income tax or GST/HST. They request records and ask questions, working at their desk or at your premises. When they finish, they either close the file with no changes or send a proposal letter setting out the adjustments they intend to make, and you get a window — usually 30 days — to argue back with representations and further documents. Only after that does a notice of reassessment issue, and even then you have 90 days to file a notice of objection, which moves the dispute to CRA's appeals branch, with the Tax Court of Canada behind that. Every stage has a response built into it. Businesses lose audits by defaulting through the stages, not by lacking rights.

Hold on to three facts through everything that follows. The notice decides nothing — it is the start of a process, not a verdict. The auditor's job is to test whether the returns match the records, so the records, and how they are presented, are the whole game. And you are entitled to representation at every stage: your CPA can stand between you and the process from the first phone call onward. If what you received was actually a letter asking for documents on specific lines of one return, that is a review rather than an audit, and the calmer playbook in what to do with a CRA review letter applies instead.

Set expectations inside your business early, because an audit is a marathon run in office hours. Someone has to pull records, answer follow-ups and keep the log for months, and that someone has a day job. Naming the internal owner, agreeing what time it will take and routing everything through the representative keeps the audit from quietly consuming the finance function — and keeps the rest of the staff working instead of speculating about the envelope from CRA.

Your first moves: representation, scope and one channel

Three things belong in the first two weeks, before any records move. First, authorize a representative. Once your CPA is authorized through CRA's portal, the auditor can be directed to communicate through them — which slows nothing down and prevents the most common self-inflicted wound: the owner explaining things casually, inaccurately, or beyond the question asked. Auditors write down what you say. An offhand guess about how something was recorded five years ago becomes part of the file.

Second, confirm the scope in writing: which taxpayer, which years, which taxes, desk audit or field visit, and the requested records as a list. A written scope protects both sides. It tells you exactly what to assemble, and it gives you a principled basis for handling requests that drift beyond it — expansions of scope do happen, but they should happen explicitly, not through an ever-lengthening trickle of informal asks. Third, set one channel: a single person — normally your CPA — through whom every document and answer flows, with a running log of what was provided and when. That log sounds bureaucratic until the day the auditor's summary of what they received differs from yours.

Two prohibitions complete the opening moves. Do not alter, backdate or recreate documents — presenting a reconstruction as an original can turn a tax dispute into something far worse, while an honest reconstruction, labelled as such, is often perfectly acceptable. And do not stall: audits reward organized cooperation, and an auditor left waiting fills the silence with assumptions that are rarely in your favour.

Desk and field audits need slightly different preparation. A desk audit runs on documents and calls, so the discipline is in the paper: complete packages, on time, through the representative. A field visit puts the auditor in your space — decide in advance where they sit, who they may speak to and who walks them through the premises, and brief the two or three staff they might meet that questions go to the designated contact. None of that is obstruction; it is the same message control any professional process deserves.

What the auditor can ask for — and what you must have kept

The auditor's reach over business records is broad. Expect requests for some or all of the following, and expect the list to be tuned to whatever pattern drew the audit in the first place:

• The books themselves: general ledger, journals, trial balances and the working papers behind the financial statements and returns.
• Banking: business account statements, deposit books and e-transfer records — often reconciled against reported revenue, since unexplained deposits are a classic audit issue.
• Source documents: sales invoices, purchase invoices, contracts, leases and expense receipts behind the categories under audit.
• Payroll and contractor records, where employment status or remittances are in play.
• The minute book and agreements behind management fees, intercompany balances, dividends and shareholder loans.
• Personal financial information, in shareholder-benefit and unreported-income audits — where business and personal money have mixed, the auditor follows the mixing.

The legal backdrop is the books-and-records requirement: businesses must keep records adequate to verify their returns, generally for six years from the end of the tax year they relate to, and organized digital copies are acceptable. Gaps are not automatically fatal — auditors can accept secondary evidence, and reasonable reconstructions beat empty hands — but gaps shift the dynamic, because where records fail, the auditor estimates, and estimates skew against the taxpayer. The auditor can also verify your numbers from the outside, checking with banks and other third parties, which is one more reason the file you present should be complete and internally consistent before it goes over.

Modern audits are also substantially electronic. Expect requests for exports from your accounting system, sales data and sometimes point-of-sale records — auditors run their own analysis on data files, testing for gaps, patterns and unexplained entries. That cuts both ways: clean, consistent electronic records shorten audits dramatically, while books adjusted casually over the years generate questions in bulk. If the bookkeeping has known problems, tell your CPA before the data goes over, not after the auditor finds them.

Assemble everything against the scope letter before the first delivery, and note the holes immediately. Missing records found early can often be replaced — banks reissue statements, suppliers reissue invoices, CRA itself holds copies of filed slips — while holes discovered at the proposal stage simply become adjustments.

The deadlines that matter at each stage

The audit is a sequence of windows, and each one closes whether or not you use it:

The proposal-letter window is the most valuable and the most wasted. It is the last point where the decision-maker is still the person who knows the file, and a focused response — this adjustment is wrong, here is the document, here is the calculation — resolves more disputes than any later stage, at a fraction of the cost. The 90-day objection deadline is the hardest edge in the table: extensions exist but are never guaranteed, so the date on the notice of reassessment goes on the calendar the day it arrives. Note also what the reassessment stage says about money: interest runs on the assessed balance regardless of any dispute, so paying — or arranging terms — while you object is often the cheaper path even when you expect to win.

One nuance on paying under protest: for most income tax disputes, CRA's collection powers are restricted while a timely objection is outstanding, but interest keeps accruing on whatever is ultimately upheld — and GST/HST assessments are generally collectible even during a dispute. The decision to pay, arrange terms or hold is therefore a cash-and-odds calculation, made file by file rather than on principle.

Penalties, interest and corrections once an audit starts

The arithmetic of an audit has three layers. The tax on any adjustment. The interest, which runs from each year's original balance-due date at CRA's prescribed rate, compounded daily — on a three-year-old adjustment the interest alone is substantial, which is why audit years cost more than the same error would have cost caught early. And in the worst cases, gross negligence penalties, which can add 50% of the understated tax where CRA considers a misstatement was made knowingly or with serious carelessness. Ordinary documentation disputes do not attract that penalty; it belongs to patterns the auditor reads as deliberate. Where interest arose from circumstances beyond your control, taxpayer relief provisions allow CRA to waive some of it — worth requesting in the right cases, never guaranteed.

Corrections have their own timing logic once an audit begins. The Voluntary Disclosures Program requires that you come forward before CRA is already looking at the issue — so for the years and matters under audit, that door has closed, and the right strategy becomes full, accurate responsiveness inside the process. But issues outside the audit's scope may still be correctable on better terms, and fixing them proactively is usually wiser than waiting for the auditor to widen the file; the mechanics are laid out in how to correct unreported investment income. And if the audit is exposing problems in returns someone else prepared, you have a distinct set of questions — about responsibility, penalties and how to change firms mid-process — covered in what happens when your previous accountant made a tax error.

Budget for the professional time as well as the tax. An audit response done properly — records vetted before submission, representations argued from documents, deadlines never missed — costs real fees, and it is still consistently cheaper than the version where adjustments go unchallenged and interest compounds on all of them. This is also why the engagement is scoped in writing at the start: you should know what defence costs before you decide how to fight.

What changes how an audit goes — and how audit defence works

Six facts drive how an audit unfolds and where it lands:

• The state of your records. Complete, organized books resolve most questions before they become adjustments; gaps invite estimates that skew against you.
• What triggered the file. An industry project, a pattern in the returns and a tip are different audits with different centres of gravity — the trigger usually shows in the first records list.
• The scope. One year and one tax is a contained exercise; multiple years with GST/HST alongside income tax raises the stakes and the coordination burden.
• How separate business and personal money are. Shareholder-benefit issues are where owner-managed audits most often turn expensive.
• The quality of your representation. Auditors reach conclusions faster, and more favourably, when responses are complete, consistent and on time.
• How past filings were prepared. Returns built on defensible positions with working papers behind them survive contact; returns built on habit do not.

Audit defence, as we practise it inside CRA support, means taking over the process: representative authorization, the scope conversation, assembling and vetting every response before it goes over, the proposal-letter representations, and the objection if it comes to that — with you briefed at each stage instead of ambushed. We take on businesses mid-audit; onboarding then starts with reconstructing the record of what has already been said and sent, because the file's history constrains every move that follows. And when the audit closes, the same engagement fixes what attracted it: the retention system, the shareholder-account hygiene and the compliance calendar that keep filings clean and dated. That is the quiet case for having CRA support and corporate compliance handled by an Ontario CPA before a notice ever arrives — the best audits are the ones that end in a no-change letter because there was nothing loose to find.

Two closing notes on the aftermath. Audits repeat where their causes persist: a file that closed with adjustments in shareholder benefits or unrecorded revenue is a candidate for a follow-up look, so the fixes need to be real and documented, not cosmetic. And where the notice names GST/HST alongside income tax, coordination is its own discipline — the two audits share records but follow different rules, and an answer given in one file is read in the other. The reassessed years reset nothing about the future: the same six-year retention clock, the same deadlines and the same instalment obligations continue, now with a history attached. The compliance calendar exists so the history stays history.