What Triggers a CRA Audit (and How to Avoid One)

Most guides to CRA audits describe a precise-sounding risk algorithm, exact ratios that trigger scrutiny, a formula CRA supposedly runs your return through. CRA has never published that algorithm, and no accounting firm has it either, no matter how confidently a blog post presents one. What CRA does confirm is a set of general categories its risk assessment considers, and that's worth knowing precisely, without the invented specificity.

It's also worth knowing that the word "audit" covers two very different things. Most CRA contact is a routine, largely automated desk review, a letter asking for a receipt, resolved in weeks. A full field audit is something else entirely, rarer, broader, and worth understanding on its own terms. This guide covers both honestly: what CRA actually says it looks at, the real reassessment periods, what happens procedurally if you're selected, and what rights you actually have.

The Short Answer: What CRA Confirms, and What It Doesn't

CRA selects files for review using a risk assessment that weighs the likelihood or frequency of errors, indicators of non-compliance, comparisons against similar files and industry data, and leads from other audits or tips. That's the general shape CRA itself confirms. What it doesn't publish is the exact scoring, weighting, or thresholds behind it, so treat any guide claiming a precise formula, including ones with confident-sounding percentages, with real skepticism.

What Those Categories Actually Mean in Practice

Comparison against industry data generally means CRA has a sense of what a typical business in a given sector reports, revenue, expense ratios, margins, so a return that sits far outside that range for no obvious reason draws more attention than one that tracks close to it. Non-compliance indicators tend to mean things like a history of late filings, prior reassessments, or gaps between what's reported and what third parties, banks, payment processors, other businesses, have already told CRA. None of that translates into a specific number a business can check itself against, since CRA doesn't publish the comparison data itself, only the fact that the comparison happens.

Cash-intensive businesses, restaurants, salons, contractors paid directly, tend to draw more scrutiny for a structural reason rather than any specific wrongdoing: cash transactions are harder to verify against a paper trail than card or e-transfer payments, so an auditor has less to independently confirm income against. That's a pattern CRA has spoken about publicly in general terms, not a confirmed algorithm weight, but it's consistent enough across real files to be worth knowing.

Desk Review vs. Full Audit: Not the Same Thing

A desk review, sometimes called a correspondence or matching review, is the far more common form of CRA contact. It's handled by mail or phone, targets one specific issue or slip, a T4 that doesn't match, a receipt for a claimed deduction, and is typically resolved in a few weeks once the requested documents are sent in. A full field audit is a different scale of scrutiny: an in-person or representative-office review covering multiple years and potentially expanding into payroll or GST/HST if something concerning turns up, generally taking months rather than weeks. CRA doesn't publish exact timelines for either, so those durations reflect common professional experience, not an official CRA figure.

Field audits sometimes use what's called the indirect verification of income method, essentially reconstructing income by tracking changes in assets, liabilities, and spending, used specifically when records are unreliable or missing, or when personal and business funds have been mixed together. It's the exact scenario clean, separated bookkeeping is designed to prevent, since a business with clear records rarely gives an auditor a reason to reach for it.

How Far Back CRA Can Actually Go

This is the number most guides get vague about, and it varies by return type. Individual T1 returns generally have a three-year reassessment window from the date of the original Notice of Assessment. Corporate T2 returns run three years for a Canadian-controlled private corporation and four years for a non-CCPC, both counted from the original Notice of Assessment date.

Those windows extend further in specific situations, certain non-arm's-length loss carrybacks can add several additional years, and some provincial reallocation cases add one. None of that matters if CRA determines a return involved misrepresentation attributable to neglect, carelessness, wilful default, or fraud, or if unreported real estate dispositions turn up: in those cases, there's no time limit at all. The same is true if a taxpayer has signed a waiver on a specific matter, form T2029, which keeps that issue open indefinitely by choice.

Why Six Years, Not Three or Four

CRA's general recommendation is to keep supporting records for a minimum of six years, longer than the standard three or four-year reassessment window for a reason: it covers the normal window with margin, plus enough runway to handle a return that gets reassessed close to the deadline, or where an extended-period situation applies. Six years, not the three or four most people assume matches their actual risk, is the number worth building retention habits around.

What Actually Happens Once You're Selected

The process follows a fairly consistent shape regardless of whether it's a desk review or a full audit, just at different scales. An auditor makes initial contact by phone, usually followed by a confirmation letter, and may ask for identity verification before anything else proceeds. From there, they review the books, records, and supporting documents relevant to the issue, and discuss any findings directly before anything is finalized.

• Initial contact by phone, followed by a confirmation letter
• Possible identity verification before the review proceeds
• Review of the specific books, records, and documents at issue
• A discussion of findings directly with the taxpayer or their representative
• Either a no-change letter, or a proposal letter outlining adjustments
• 30 days to respond, agree, or dispute the proposal before it's finalized
• A final letter confirming the outcome and any reassessment

What Rights You Actually Have

The Taxpayer Bill of Rights sets out sixteen specific rights, including the right to retain a representative and have CRA deal with them directly, the right to receive an explanation for a reassessment, and the right to file a formal objection, generally within 90 days of the date on the Notice of (Re)assessment. One right people often assume exists but isn't guaranteed: being told exactly why a specific file was selected for review. CRA isn't obligated to disclose that, which is part of why guides promising to reveal "the real reason" a file gets flagged are overstating what's actually knowable.

The businesses that handle a CRA letter calmly aren't the ones who never get selected. They're the ones whose books already answer the question before the auditor finishes asking it.

What Actually Reduces Risk

Since CRA's exact criteria aren't public, the honest version of "reducing risk" is really about not giving a reviewer an easy reason to dig further. Keeping personal and business spending in separate accounts, maintaining bookkeeping that's current rather than reconstructed after the fact, keeping receipts for anything claimed as a deduction, and responding to any CRA correspondence promptly rather than letting a desk-review letter sit unanswered are the practical habits that come up repeatedly across real files, not because they guarantee anything, but because a business that already has clean answers rarely turns a routine question into something bigger.

Self-employed filers and incorporated owner-managers, covered in our self-employed tax filing guide, generally see more of this scrutiny than someone with a single T4 slip, simply because there's more room for a mismatch between reported income and actual activity. That's not a reason to worry, just a reason those filers specifically benefit from tighter records.

Already Got a Letter?

If CRA has already been in touch, or you're aware of a past error you haven't corrected, the Voluntary Disclosures Program exists specifically for coming forward before CRA finds it independently, and can reduce penalties that would otherwise apply. Our tax services team handles both sides of this: getting ahead of a filing before it becomes a problem, and representing a business once a review or audit letter has already landed.

Book a free call and we'll help you figure out exactly where you stand.