Few things rattle a small business owner more than a letter from the Canada Revenue Agency requesting a review of their books. If you have received — or are worried about receiving — a CRA audit notice in 2026, you are not alone. The CRA conducts thousands of audits every year, targeting businesses of all sizes across every industry.

The good news: a CRA audit does not automatically mean you did something wrong. The better news: with the right preparation, professional support, and knowledge of your rights, you can navigate the process confidently and minimize disruption to your operations.

At Insights CPA, our Accounting Intelligence approach combines deep tax expertise with data-driven analysis to help Canadian small businesses prepare for, respond to, and resolve CRA audits efficiently. Here is everything you need to know.

What Triggers a CRA Audit in 2026?

The CRA uses sophisticated risk-assessment algorithms, third-party data matching, and industry benchmarking to flag returns for review. While audits can be random, most are triggered by specific patterns in your filings.

Unusually Large Deductions Relative to Income

If your business expenses appear disproportionate to your reported revenue, expect scrutiny. Claiming $80,000 in vehicle expenses on $120,000 of gross revenue, for example, will almost certainly raise a flag. The CRA compares your deductions to industry averages, and outliers get flagged.

Home office deductions, meals and entertainment, and vehicle expenses are perennial audit magnets. If you claim them, make sure you can substantiate every dollar.

Cash-Heavy Businesses

Restaurants, salons, construction trades, and retail stores that handle significant cash transactions face higher audit risk by default. The CRA knows cash businesses have more opportunity for unreported income, and it uses indirect verification methods — bank deposit analysis, net worth assessments, and lifestyle comparisons — to test whether reported income matches reality.

Inconsistent GST/HST Reporting

When your GST/HST filings do not align with your income tax return, the CRA notices. If you report $500,000 in revenue on your T2 but your GST/HST return only reflects $400,000 in taxable supplies, that discrepancy will trigger questions. Similarly, consistently claiming large input tax credits (ITCs) relative to your sales can prompt a review.

Other Common Triggers

Repeated losses: Claiming business losses year after year, especially if you have other income sources, invites the CRA to question whether your business is a legitimate commercial activity.
Prior audit adjustments: If a previous audit resulted in significant reassessments, your file is more likely to be selected again.
Third-party tips: The CRA accepts and investigates informant tips, including through the Informant Leads Program.
Industry-wide campaigns: The CRA periodically targets specific sectors (real estate, cryptocurrency, e-commerce) for compliance sweeps.

Types of CRA Audits

Not all audits are created equal. The type you face determines the scope, timeline, and level of disruption to your business.

Correspondence Audit (Desk Review)

The simplest form. The CRA sends a letter requesting specific documents to support a particular claim — a charitable donation receipt, a tuition credit, or proof of a specific expense. You mail or upload the documents, and the CRA reviews them remotely. These are typically resolved within weeks.

Desk Audit

More thorough than a correspondence review but still conducted from the CRA office. The auditor examines a broader range of documents and may request bank statements, invoices, contracts, and ledgers. Communication happens by mail, phone, or the CRA’s online portal.

Field Audit

The most intensive type. A CRA auditor visits your place of business to examine your books, records, and operations in person. Field audits can last weeks or months, cover multiple tax years, and require extensive documentation. The auditor may interview staff, inspect inventory, and review your accounting systems on-site.

Field audits are typically reserved for larger businesses, complex structures, or situations where the CRA suspects significant non-compliance.

Your Rights as a Taxpayer During a CRA Audit

Many business owners do not realize they have substantial rights during an audit. The CRA Taxpayer Bill of Rights and the Income Tax Act provide important protections.

Right to Professional Representation

You are entitled to have a CPA, tax lawyer, or other authorized representative deal with the CRA on your behalf. You do not have to speak to the auditor directly. In fact, having a professional handle communications often leads to better outcomes — they know what to provide, what to push back on, and how to frame responses.

Right to Complete and Accurate Information

The CRA must explain why you are being audited, what records are required, and what the auditor’s findings are. You are entitled to receive a detailed explanation of any proposed adjustments before they become final.

Right to Privacy and Confidentiality

Your tax information is protected under the Income Tax Act. The CRA can only share it under specific, limited circumstances defined by law.

Right to Object

If you disagree with the audit results, you can file a Notice of Objection within 90 days of the reassessment. This triggers a formal review by the Appeals Division, which operates independently from the audit team.

Right to a Reasonable Process

The CRA is expected to conduct audits in a professional, courteous, and fair manner. Unreasonable demands, excessive delays, or improper conduct can be reported to the Taxpayers’ Ombudsperson.

Documentation Requirements: What the CRA Expects

Proper record-keeping is your single best defence in an audit. Under Canadian tax law, you are required to maintain adequate books and records for a minimum of six years from the end of the last tax year to which they relate.

What to Keep

Sales records: Invoices, receipts, contracts, and POS records showing all revenue
Expense records: Receipts, cancelled cheques, credit card statements, and vendor invoices for every deduction claimed
Bank records: Complete bank statements for all business accounts, plus any personal accounts used for business transactions
Payroll records: T4s, records of employment, payroll registers, and documentation of any contractor payments (T4A/T5018)
GST/HST records: Detailed records supporting every ITC claimed, including supplier GST/HST numbers
Vehicle logs: A contemporaneous logbook if claiming vehicle expenses, showing business versus personal kilometres
Home office records: Measurements, utility bills, and mortgage/rent statements if claiming a home workspace

Digital Records

The CRA accepts digital records, but they must be accessible and readable. If you use cloud bookkeeping software, ensure you can produce reports and source documents on demand. Disorganized or inaccessible records create delays and suspicion.

How a CPA Helps During a CRA Audit

Engaging a CPA before or during an audit is one of the most impactful decisions you can make. Here is what professional representation looks like in practice.

Pre-Audit Preparation

A CPA reviews your records before the auditor sees them, identifies potential problem areas, and ensures documentation is complete and organized. This preparation often determines the outcome before the audit formally begins.

Communication Management

Your CPA becomes the single point of contact with the CRA. They respond to document requests, answer auditor questions, and ensure you do not inadvertently provide information that goes beyond what was requested. Saying too much during an audit is a real risk — a CPA knows the boundaries.

Technical Advocacy

If the auditor proposes adjustments you disagree with, your CPA can present technical arguments supported by tax law, CRA administrative positions, and relevant case law. This is particularly important for complex issues like the classification of independent contractors versus employees, the deductibility of specific expenses, or the application of corporate tax provisions.

Negotiation and Resolution

Experienced CPAs know how to negotiate with auditors on issues where the law allows for interpretation. They can often reduce proposed adjustments through well-supported arguments and strategic presentation of facts.

The Voluntary Disclosures Program (VDP)

If you realize you have unreported income, unclaimed GST/HST, or errors in previous filings before the CRA contacts you, the Voluntary Disclosures Program may offer a path to compliance without full penalties.

How the VDP Works

You submit a complete and voluntary disclosure to the CRA, reporting all previously unreported income or correcting all errors. If accepted, you will still owe the taxes and interest, but gross negligence penalties (typically 50 percent of the tax owing) may be waived.

VDP Eligibility Requirements

The disclosure must be voluntary — if the CRA has already contacted you about the issue, you are too late
It must be complete — you must disclose everything, not just part of the problem
There must be a penalty applicable — the VDP does not apply if no penalty would have been assessed
The information must be at least one year overdue

When to Consider the VDP

If you discover errors in past filings, inherited unreported foreign assets, or failed to file required information returns (T1135, T1134), consult a CPA immediately. Timing is critical — once the CRA initiates contact, the VDP door closes.

Penalties and Interest: What Is at Stake

Understanding the financial consequences of an audit helps you assess risk and make informed decisions about how to respond.

Late-Filing Penalties

Five percent of the balance owing, plus one percent per month for up to 12 months. For repeat late filers, the penalty doubles to 10 percent plus two percent per month.

Gross Negligence Penalties

Where the CRA determines you knowingly or under circumstances amounting to gross negligence made a false statement or omission, the penalty is 50 percent of the understated tax or overstated credits. These are serious and can be financially devastating.

Interest

The CRA charges compound daily interest on all unpaid amounts, including penalties. The prescribed interest rate is adjusted quarterly and applies from the original due date of the return — not from the date of reassessment. This means interest can accumulate for years before you even know there is a problem.

Criminal Prosecution

In extreme cases involving deliberate tax evasion, the CRA can refer files for criminal prosecution under the Income Tax Act, with penalties including fines of up to 200 percent of the evaded tax and imprisonment of up to five years.

Statute of Limitations: How Far Back Can the CRA Go?

The CRA’s ability to reassess is not unlimited — but it extends further than many business owners realize.

Normal Reassessment Period

For Canadian-controlled private corporations (CCPCs), the CRA can reassess within four years from the date of the original notice of assessment for that tax year. For individuals and other entities, the period is three years.

Extended Reassessment Period

If the CRA alleges misrepresentation due to neglect, carelessness, or wilful default, there is no time limit on reassessment. This is the CRA’s most powerful tool, and it is used more often than many taxpayers expect.

For matters involving foreign reporting (T1135 and related forms), the reassessment period extends to six years if the required forms were filed, and is unlimited if they were not.

What to Do Right Now

If you have received a CRA audit notice — or if you want to be prepared before one arrives — take these steps:

Do not ignore the notice. Failing to respond to a CRA audit request makes everything worse. Deadlines matter.
Do not contact the CRA without professional advice. What you say during an audit can be used to expand its scope.
Gather your records. Organize everything by tax year and category. Identify any gaps.
Engage a CPA immediately. Professional representation from the start produces consistently better outcomes than trying to handle an audit alone and calling for help after problems emerge.
Review prior years proactively. If you know there are issues in unfiled or incorrectly filed returns, address them through the VDP before the CRA finds them.

Facing an Audit? Insights CPA Is Here to Help

At Insights CPA, we bring Accounting Intelligence to CRA audit defence. Our team has represented small businesses through correspondence reviews, desk audits, and full field audits across the GTA and Ontario. We know how the CRA operates, what auditors look for, and how to protect your interests at every stage.

Whether you need help preparing your records, responding to an audit notice, or correcting past filings through the Voluntary Disclosures Program, we provide the expertise and advocacy your business deserves.