Nearly every article on this subject gives you the same list of red flags and stops there. The list is not wrong, but it leaves out the part that decides how an audit actually goes: what the auditor is permitted to look at, how they reconstruct income when they do not trust your books, how many years they can reach back, and what it costs when they find something.
Everything below comes from the CRA's own published material, verified on the day this page was written. Where a figure changes quarterly or annually, it is dated so you can tell whether you are reading something stale.
How does the CRA actually choose who gets audited?
Not at random. In the CRA's own words, its "risk-assessment systems identify tax returns that are considered to be at high risk for non-compliance." When a return is flagged, a CRA officer reviews information from various sources and decides whether an audit is warranted.
Two things follow from that, and they matter more than any single item on a red-flag list.
The first is that the system is comparative. It is not asking whether your meals expense is large in absolute terms. It is asking whether it is large for a business of your size in your industry. A $9,000 meals and entertainment claim is unremarkable for a firm that entertains clients for a living and conspicuous for a solo bookkeeper working from a spare room.
The second is that a flag is not an audit. A human being looks at the file first. That is the window where clean records quietly end the process, and where messy records turn a question into a field audit.
The 9 things that get small businesses flagged
These are the recurring triggers, ordered roughly by how often they catch owner-managed businesses.
| # | Trigger | What the CRA is comparing it against |
|---|---|---|
| 1 | Income that does not match the CRA's own records | T4A, T5 and other slips filed by third parties |
| 2 | Expenses out of line with your industry | Ratios for comparable businesses of your size |
| 3 | Losses year after year | Whether a commercial business exists at all |
| 4 | GST/HST that disagrees with your income tax return | Taxable supplies reported versus revenue reported |
| 5 | Vehicle, meals and home-office claims with nothing behind them | Your logbook, receipts and square footage |
| 6 | Business and personal accounts run as one | Whether the books can be relied on at all |
| 7 | A lifestyle that does not match reported income | Assets, spending, vehicle and land records |
| 8 | Operating in a cash-heavy sector | Sector risk for unreported income |
| 9 | Payroll problems: misclassification and late remittances | T4s, remittance history, CPP and EI |
1. Income that does not match what the CRA already has
The CRA receives slips about you before you file. If a client issued you a T4A for $40,000 and your return reports $28,000 of revenue, the mismatch is arithmetic, not judgment. This is the cheapest trigger to avoid and the most common one to trip, usually because a deposit was recorded net of fees or a year-end invoice landed in the wrong period.
2. Expenses out of line with your industry
Claiming a deduction you are entitled to is not a red flag. Claiming a proportion of revenue that no comparable business claims is. The usual suspects are meals and entertainment, travel, vehicle, and management fees. If your ratio sits far outside the range for your sector, expect a request for documentation rather than an accusation.
The fix is not claiming less than you are owed. It is being able to produce the paper. Our guide to small business write-offs sets out what each category actually requires, including the 2026 vehicle limits and the fact that meals are deductible at 50%.
3. Losses year after year
A business that loses money for several consecutive years, particularly when the owner has employment income elsewhere, invites a question the CRA is entitled to ask: is this a commercial activity or a hobby being used to shelter other income? Genuine early-stage losses are ordinary and defensible. What defends them is evidence of commercial intent, such as a business plan, marketing spend, pricing that could plausibly produce a profit, and separate accounts.
4. GST/HST filings that disagree with your income tax return
These two filings are read against each other. If your T2 reports $500,000 of revenue and your HST returns for the same period report $400,000 of taxable supplies, the $100,000 gap needs an explanation. Sometimes there is a perfectly good one, such as exempt or zero-rated supplies. Sometimes the explanation is that one of the two filings is wrong. Our HST guide for Ontario small businesses covers what counts as taxable revenue and the filing deadlines by reporting period.
5. Vehicle, meals and home-office claims with nothing behind them
These three are perennial audit magnets for one reason: they are the deductions where business and personal use blend, so they are the ones where a claim is easiest to inflate and hardest to prove after the fact. A vehicle claim without a kilometre log is a number with no support. A home-office claim that is not prorated by the space actually used for business is an invitation.
6. Business and personal accounts run as one
This one is different in kind from the others, and it is the most underrated item on the list. Mixing accounts does not just look careless. It is one of the specific conditions the CRA names for switching to a method of reconstructing your income that bypasses your books entirely. See the next section, because that method is the part of an audit that costs people real money.
7. A lifestyle that does not match the income you report
If the reported income could not plausibly fund the house, the vehicles and the spending, the CRA notices, and it has access to motor vehicle registration and land title records to check. This is also a named condition for the net worth method below.
8. Operating in a cash-heavy sector
Restaurants, salons, construction trades, and retail carry higher audit risk as a class, because the CRA treats sectors it considers high risk for unreported income as a trigger in their own right. Nothing about your own conduct has to be wrong for this to apply to you. The response is not to worry about it but to make cash controls visible: daily sales summaries, point-of-sale reports that tie to deposits, and deposits that tie to the books.
9. Payroll problems: misclassification and late remittances
Treating someone as a contractor who is functionally an employee is the classic one, and the CRA can reassess years of unremitted CPP and EI plus penalties and interest if it disagrees with your classification. Chronically late source deduction remittances flag the account independently. Our Ontario payroll guide has the remitter-type thresholds that determine how often you are actually required to remit, which is where a surprising number of small employers are quietly non-compliant.
What the CRA looks at that most audit guides never mention
If the CRA does not trust your books, it does not give up. It changes method. This is called indirect verification of income, and the CRA publishes the circumstances in which it uses it. It will generally reach for an indirect method when there are indications of one or more of the following:
- The books and records are prone to error, which the CRA says can be the case when one person does most of the accounting, or when the main functions of the business are done by one person or a small group of related people.
- The business and personal bank accounts may have been used interchangeably.
- The taxpayer's lifestyle does not seem to match the income reported to the CRA.
- The business is in a sector considered at high risk for unreported income.
Read that first bullet again, because it describes most small businesses in Canada. One person doing the books is not misconduct, and on its own it does not trigger anything. But it is on the CRA's own list of indicators, which means the practical protection is not secrecy. It is records good enough that the direct method works and the indirect one never gets used.
The most common indirect method is the net worth method. Rather than auditing your revenue, the auditor estimates what your income must have been by looking at changes in your assets and liabilities, your personal spending, and other relevant information including non-taxable sources such as gifts, inheritances and lottery winnings. The result is then compared with what you reported.
Two features of this make it far more intrusive than the phrase "business audit" suggests. It goes well beyond the books of the business, into the owner's personal financial records, motor vehicle registration and land titles. And because the CRA needs a complete picture of the household to make the arithmetic work, it will ask for the personal financial records of your spouse, as well as any other contributing member of the household.
There is also an economic entity approach, where the CRA groups related, associated or otherwise connected legal entities into a single economic entity and reviews them together. If you run three corporations and a holdco, the risk is not assessed one company at a time.
Will the CRA really ask for my spouse's bank statements?
Under the net worth method, yes. The CRA states plainly that it will ask for the personal financial records of the business owner's spouse and of any other contributing member of the household, because it needs a complete financial picture of the family unit for the calculation to mean anything.
This is worth knowing in advance for a reason that has nothing to do with tax. It is the moment in an audit that people find genuinely upsetting, and being surprised by it tends to produce exactly the defensive, slow, partial responses that extend an audit. The way to avoid the net worth method is upstream: separate accounts, and books that reconcile.
How far back can the CRA go?
Further than most owners assume, and in one case without any limit at all.
| Window | How long | When it applies |
|---|---|---|
| Normal reassessment period | 3 years from the original notice of assessment | The corporation was a CCPC at the end of the tax year. Also individuals and trusts. |
| Normal reassessment period | 4 years from the original notice of assessment | The corporation was not a CCPC at the end of the tax year |
| Extended period | An extra 3 years | Specific situations, including carrying back a loss or credit from a later year, non-arm's length transactions with a non-resident, and foreign tax paid or refunded |
| Unlimited | No time limit | Misrepresentation attributable to neglect, carelessness or wilful default, or fraud. Also where you filed Form T2029 waiving the normal period, and for an unreported disposition of real property |
The last row is the one that matters. "Statute-barred" is not a state your old returns reach automatically. It is a protection you lose if the CRA concludes there was a misrepresentation, and note how low that bar sits: carelessness is enough, and no fraud is required. A year that was never filed at all never becomes statute-barred, which is the reason unfiled years are a different problem from filed-but-wrong years. Our catch-up bookkeeping guide deals with that case specifically.
Separately, you must keep your books and records for a minimum of six years, and if you keep your accounting on a computer you must keep the records in an electronically readable format even if you also keep paper. The CRA is blunt about the consequence of not producing them: failure to provide required books and records is an offence under the law.
What does it cost if they find something?
The assessment itself is only part of the bill. These are the amounts as they stand for 2026.
| Charge | Amount | Trigger |
|---|---|---|
| Interest on overdue tax | 7% a year, compounded daily (July 1 to September 30, 2026) | Any unpaid balance, running from the original due date |
| Late-filing penalty | 5% of the balance owing plus 1% per full month, to a maximum of 12 months | Filing after the deadline with a balance owing |
| Repeated late-filing penalty | 10% of the balance owing plus 2% per full month, to a maximum of 20 months | Penalized in any of the three prior years and served a demand to file |
| Repeated failure to report income | The lesser of 10% of the unreported amount and 50% of the understated tax net of tax withheld | Failing to report $500 or more in the current year and in any of the three preceding years |
| False statements or omissions (gross negligence) | The greater of $100 and 50% of the understated tax or overstated credits | A false statement or omission made knowingly, or in circumstances amounting to gross negligence |
| Instalment penalty | Applies only where instalment interest for 2026 exceeds $1,000 | Instalments late or short of what was required |
Two things about that table are worth saying out loud. The gross negligence penalty is 50% of the tax, not 50% of the deduction disallowed, so a $20,000 disallowed expense in a corporation paying 11.2% is roughly $2,240 of tax and about $1,120 of penalty on top, plus interest from the original due date. And interest is compounded daily from that original due date, not from the day the auditor calls, which is why a three-year-old reassessment arrives materially larger than the tax alone.
If circumstances beyond your control caused the problem, you can ask the CRA to cancel or waive penalties and interest under taxpayer relief. Requests must be made within a 10-year period ending in the calendar year the request is made.
What happens when the auditor makes contact?
The sequence is published, and knowing it removes most of the fear.
- A CRA auditor usually contacts you by telephone first, and also sends a letter confirming the details of the audit.
- You are entitled to verify who you are speaking to. The CRA's own guidance says that if you are not comfortable, you may end the call and call the auditor or their team leader back, or wait for the confirmation letter before providing information. Given how many scam calls impersonate the CRA, do exactly that.
- The audit normally happens at your place of business. Sometimes the auditor borrows documents to work at a CRA office or at your accountant's office, and gives you a detailed receipt for anything borrowed.
- The auditor may examine business records, your personal records including bank statements, mortgage documents and credit card statements, and the records of related people and entities such as a spouse, family members, corporations, partnerships or a trust. They may also ask your accountant, bookkeeper or employees about what was reported.
- At the end, you get a letter. If an adjustment is proposed, you receive a proposal letter and have 30 days to agree or disagree, and you are encouraged to give the auditor documents supporting your position. If it is not resolved, you can escalate to the auditor's team leader, whose contact details are on all correspondence.
- If you disagree with the final reassessment, you have the right to object and appeal.
One practical note: if the auditor can give you an estimate of the amount owing before the notice is issued, paying early stops interest from accruing on that portion. You do not have to wait for the paperwork to start reducing the interest.
Can you fix a problem before the CRA finds it?
Usually yes, through the Voluntary Disclosures Program, and the rules here changed on October 1, 2025 in a way that most articles written before that date get wrong.
The old program closed the door once the CRA made contact. The current program does not. Taxpayers who are prompted by a communication about potential non-compliance, for example an education letter about unreported income or ineligible expenses, are now eligible. What still disqualifies you is being under audit or investigation, or having been egregiously non-compliant.
| Relief tier | Normally applies to | Penalties | Interest |
|---|---|---|---|
| General relief | Unprompted applications | 100% relief | 75% relief |
| Partial relief | Prompted applications | Up to 100% relief | 25% relief |
You apply on Form RC199. For non-compliance spanning several years, include documents for the most recent six years for Canadian-sourced income or assets, four years for GST/HST, and ten years for foreign-sourced income or assets.
The timing point is the one to take away. There is a window between "the CRA has written to you" and "the CRA has opened an audit", and in that window you still have a program available that wipes the penalties and a quarter of the interest. It is not a wide window. It closes when the audit starts, not when the letter arrives.
What actually lowers your audit risk
Nothing on this list is exotic. That is rather the point.
- Separate the accounts. A dedicated business chequing account and card is the single highest-value habit here, because commingling is a named condition for the net worth method.
- Reconcile monthly, not annually. Books reconciled twelve times a year are books that survive a direct-method audit.
- Keep the support with the claim. A kilometre log for the vehicle, receipts for meals with who and why noted, square footage for the home office.
- Reconcile HST to revenue before filing. A five-minute check that removes trigger 4 entirely.
- Remit payroll on time and settle contractor-versus-employee questions before the first payment, not after a reassessment.
- File on time even when you cannot pay. The late-filing penalty is charged on the balance owing and stacks with interest. Filing and then arranging payment is almost always cheaper than doing neither.
- Keep six years of records in a readable electronic format.
An accountant is not an audit shield, and anyone who tells you otherwise is selling something. The CRA is explicit that using a tax professional does not relieve you of your responsibilities. What a good accountant does is make the direct method work: books that reconcile, claims with support behind them, filings that agree with each other, and a defensible position on the judgment calls. That usually costs less than one reassessment. If you want a sense of what that support costs, our guide to choosing a small business accountant in Toronto sets out the ranges.
Frequently asked questions
What triggers a CRA audit for a small business in Canada?
The most common triggers are income that does not match the slips and deposits the CRA already holds, expenses that are out of line with comparable businesses in your industry, business losses claimed year after year, GST/HST filings that disagree with your income tax return, vehicle, meals and home-office claims without supporting records, mixing business and personal bank accounts, a lifestyle that does not match reported income, operating in a cash-heavy sector, and payroll problems such as contractor misclassification or chronically late remittances.
Does the CRA audit small businesses randomly?
Generally no. The CRA states that its risk-assessment systems identify tax returns considered to be at high risk for non-compliance, and that a CRA officer then reviews information from various sources to determine whether an audit is needed. The assessment is comparative, so what matters is how your figures look beside businesses of a similar size in your industry rather than in absolute terms.
How far back can the CRA audit my business?
The normal reassessment period is three years from the date of the original notice of assessment if the corporation was a Canadian-controlled private corporation at the end of the year, and four years if it was not. That can be extended by an additional three years in specific situations, such as carrying back a loss from a later year. There is no time limit at all where the CRA finds a misrepresentation attributable to neglect, carelessness or wilful default, or fraud, and a year that was never filed never becomes statute-barred.
Does the CRA look at my personal bank account during a business audit?
It can. The CRA says an auditor may examine your personal records, including bank statements, mortgage documents and credit card statements, as well as the records of related people and entities such as a spouse, family members, corporations, partnerships or a trust. If the CRA uses the net worth method to reconstruct your income, it will ask for the personal financial records of your spouse and of any other contributing member of the household, because it needs a complete financial picture of the family unit.
How much is the CRA gross negligence penalty?
For a false statement or omission made knowingly, or in circumstances amounting to gross negligence, the penalty is the greater of $100 and 50% of the understated tax or the overstated credits related to the false statement or omission. It is calculated on the tax, not on the amount of the deduction disallowed, and interest on the underlying balance runs from the original due date.
Can I still use the Voluntary Disclosures Program after the CRA contacts me?
Usually yes, since the program changed on October 1, 2025. Taxpayers prompted by a communication about a potential non-compliance issue, such as an education letter about unreported income or ineligible expenses, are now eligible, and normally receive partial relief of up to 100% of penalties and 25% of interest. Unprompted applications normally receive general relief of 100% of penalties and 75% of interest. What disqualifies you is already being under audit or investigation, or having been egregiously non-compliant.
How long do I have to keep my business records in Canada?
Generally a minimum of six years. If you use a computer for your accounting records, you must keep those books and records in an electronically readable format even if you also keep them on paper. The CRA states that failure to provide required books and records is an offence under the law, and that using the services of a tax professional does not relieve you of the responsibility to keep them.
Want books that hold up, frankly?
Frankly Financial gives Toronto small businesses monthly bookkeeping, CFO-grade reports, and proactive tax planning in plain English. See where you stand in 5 minutes.