CRA Audit Preparation Checklist for Canadian Companies (2026)
What triggers a CRA audit in 2026, the documents every company should have ready year-round, the difference between a desk audit and a field audit, and a complete step-by-step checklist for before, during, and after a CRA review.
1. CRA Audit Activity in 2026: The Numbers
The Canada Revenue Agency carried out nearly 96,000 audits in the 2023–24 year — up from about 63,000 the year before. The CRA is increasing its audit activity, with a stronger focus on small and medium-sized businesses, utilizing more funding and new enforcement tools, and increasingly using AI-driven audit selection that flags unusual deductions or income patterns.
Want to Know Whether Your Company's Books Would Hold Up Under CRA Review?
Talk to a Custom CPA advisor about a proactive audit-readiness review before any notice arrives.
2. How the CRA Actually Selects Files for Audit
The CRA employs a sophisticated, risk-based methodology to select taxpayers for audit — rather than relying on a static, publicly disclosed list of triggers, the agency utilizes complex Workload Development processes that combine computerized data matching with manual risk assessment to identify files with the highest potential for non-compliance and revenue loss. These triggers are evolving risk indicators rather than a rigid checklist.
CRA audits are rarely random. The agency continues to rely heavily on data matching, industry benchmarking, and cross-checking between tax filings to identify audit targets. Audits are increasingly triggered by patterns that look unusual or inconsistent, even when returns are filed on time and taxes are paid.
3. Common CRA Audit Triggers for Canadian Companies
| Trigger | What It Signals to CRA |
|---|---|
| Inconsistent revenue reporting across filings | One of the most common and highest-risk triggers — revenue mismatches are increasingly flagged electronically before a file is ever manually reviewed. |
| Income vs. third-party slip mismatch | CRA receives copies of every T4, T4A, T5, and T3 slip issued — if reported income doesn't match what employers, banks, and investment firms report, the system flags the discrepancy automatically. |
| High expenses relative to revenue | If business expenses consume 90% of revenue year after year, the CRA will notice. |
| Large or unusual GST/HST refund claims | A common and specifically flagged trigger category. |
| Cash-heavy business operations | Restaurants, salons, construction trades, and other cash businesses face higher audit rates due to underreporting risk. |
| Repeated business losses (3+ consecutive years) | Raises the question of whether the activity is a genuine business or a vehicle for writing off personal expenses — CRA may determine there's no reasonable expectation of profit. |
| Disproportionate home office claims | If claiming 40–50% of the home for business use, CRA may question whether that's realistic; the space must be used regularly and exclusively for earning income. |
| Improperly documented shareholder loans | Improper shareholder loan handling can trigger significant tax consequences — loans must be cleared within the required timeframe and properly documented. |
4. Sectors Facing Increased Audit Attention in 2026
Sector-Level Audit Focus, 2026
Key 2026 updates include more small business audits, especially in sectors like construction, digital services, and hospitality. Illustrative relative emphasis — audit selection remains risk-based within any sector, not universal.
Operating in a High-Scrutiny Sector and Want a Second Set of Eyes on Your Books?
Custom CPA reviews financial records specifically against the triggers CRA's systems are watching for in 2026.
5. Desk Audit vs. Field Audit: What to Expect
| Aspect | Desk Audit | Field Audit |
|---|---|---|
| Where it happens | Remote — documents submitted online | CRA auditor visits the business premises |
| How it starts | A formal Request for Information; documents sent via CRA's secure portal, never by email | Often follows an initial desk review that raised further questions |
| Typical scope | Most common starting point for the majority of audits | Reserved for larger, more complex, or higher-risk files |
| Representative role | Can respond and correspond on the company's behalf | Can be present during the visit and manage all interactions |
6. Record Retention Requirements
| Record Type | Minimum Retention Period | Notes |
|---|---|---|
| Income tax records | 6 years from the end of the taxation year | Standard requirement for most business records |
| GST/HST records | 4 years | Separate and shorter than the income tax retention period |
| Foreign income / T1134 / T1135 records | 10 years recommended | Given VDP lookback requirements; longer than the statutory minimum is prudent |
| Records where misrepresentation is alleged | No time limit | If neglect, carelessness, or wilful default is alleged, CRA can reassess indefinitely |
7. Document Preparation Checklist by Category
Core Documents Every Company Should Have Organized
- Sales records: invoices, receipts, contracts, and POS records showing all revenue
- Expense records: receipts, cancelled cheques, credit card statements, and vendor invoices for every deduction claimed
- Bank records: complete bank statements for all business accounts, plus any personal accounts used for business transactions
- Payroll records: pay stubs, remittance confirmations, and timekeeping logs reconciled to payroll totals
- Contracts and agreements supporting major revenue or expense items
- Records must be accurate, complete, and easy to access — a system that prevents unauthorized changes or deletions, with audit trails showing all changes, is a significant advantage.
8. High-Scrutiny Areas: Home Office, Vehicle, Meals, Shareholder Loans
- Home office: Document the square footage used exclusively for business with a floor plan, keep copies of rental/utility bills, and use conservative, defensible estimates — CRA generally expects roughly 20–30% of home area for most home offices.
- Vehicle expenses: Track mileage with written logs or apps, recording date, trip purpose, destination, and distance; if reimbursing personal vehicle use, calculate the business percentage accurately via a logbook.
- Meals and entertainment: Keep itemized receipts and note who attended and the business purpose — only 50% of meal costs are deductible unless exceptional conditions apply.
- Shareholder loans: Clear shareholder loans within the required timeframe, properly document the compensation strategy (salary vs. dividends), and keep corporate and personal funds strictly separate — clean books reduce audit risk dramatically.
- Cash handling: For cash-heavy operations, daily cash count sheets and periodic spot audits deter skimming and provide documentation that supports reported revenue.
9. How to Respond Once an Audit Notice Arrives
Immediate Response Checklist
- Act fast — gather all relevant T-slips, invoices, receipts, bank statements, ledgers, and contracts
- Engage a tax professional immediately upon receiving audit requests to reduce the risk of escalation
- Review the specific scope of the Request for Information — respond only to what's asked, completely and accurately
- Respond completely and on time; ask clarifying questions if the request is unclear
- Submit documents through CRA's secure online portal, never by email
- Keep a copy of everything submitted and a log of all communications with the CRA
10. Notices of Non-Compliance and the Cost of Missing Deadlines
11. Building Year-Round Audit Readiness
- A mid-year review catches problems early: A mid-year review can position a business to avoid red flags, correct mistakes, and stay ahead of potential audit triggers — rather than scrambling to respond when the CRA selects the business for audit.
- Digital record organization: Digital organization is strongly recommended, provided files are clear, complete, and securely backed up.
- Monitor CRA My Account regularly: Frequently logging into CRA My Account allows a business to monitor tax status, view notices, and verify that information is up to date.
12. What Happens After the Audit: Outcomes and Appeals
- Possible outcomes: No change, a reassessment with additional tax owing (plus interest and possibly penalties), or in rare cases a refund if the audit identifies an overpayment.
- Formal objection process: If a taxpayer disagrees with a reassessment, filing a formal objection triggers a review by the Appeals Division, which operates independently from the audit team.
- Conduct standards: The CRA is expected to conduct audits in a professional, courteous, and fair manner — unreasonable demands, excessive delays, or improper conduct can be reported to the Taxpayers' Ombudsperson.
13. Complete CRA Audit Preparation Checklist
Year-Round and Audit-Specific Master Checklist
- Reconcile reported income against all T4, T4A, T5, and T3 slips before filing each year
- Maintain a documented, defensible home office percentage with floor plan and utility bill support
- Keep contemporaneous vehicle mileage logs, not reconstructed estimates
- Retain itemized meal receipts with attendees and business purpose noted
- Clear and document all shareholder loans within the required timeframe
- Keep corporate and personal bank accounts strictly separate
- Maintain 6 years of income tax records, 4 years of GST/HST records, and consider 10 years for foreign income records
- Conduct a mid-year internal review to catch issues before year-end filing
- Engage a CPA immediately if any audit notice or Request for Information is received
- Respond to every CRA deadline on time, or proactively request an extension if one is needed
14. Common Mistakes That Escalate an Audit
- Ignoring or delaying the initial Request for Information: Silence is treated far more seriously than a documented request for more time, and can trigger a Notice of Non-Compliance with daily penalties.
- Submitting incomplete or inconsistent documentation: Partial responses or documents that don't reconcile to the filed return raise further questions rather than resolving the original ones.
- Handling the audit without professional representation: A business owner responding directly, without a CPA reviewing the request and the response, is more likely to provide information in a way that inadvertently expands the audit's scope.
- Not maintaining contemporaneous documentation: Reconstructing mileage logs, home office measurements, or meal receipts after the fact — rather than maintaining them as the year unfolds — produces weaker documentation that CRA auditors are trained to notice.
- Commingling personal and business funds: This is one of the fastest ways to expand the scope of a business audit into a personal review, since it becomes difficult to separate business from personal transactions.
Custom CPA's core accounting and tax compliance services include audit-ready record-keeping systems and direct representation during CRA reviews, integrated with our specialized reporting services. Our CFO advisory services and business planning and financial modeling build the financial reporting discipline that keeps a company audit-ready year-round rather than scrambling when a notice arrives. If your company already has outstanding penalties or interest from a prior year, our guide on requesting tax relief from penalties and interest covers that separate process. For sector-specific compliance context, our guides on mining company business planning, REIT compilation services, and property management compilation services address the record-keeping standards specific to those regulated industries.
15. Frequently Asked Questions
What triggers a CRA audit for a Canadian company in 2026?
CRA audit selection is rarely random — the agency relies heavily on data matching, industry benchmarking, and increasingly AI-driven pattern detection. Common triggers include inconsistent revenue reporting, expense-to-revenue ratios significantly higher than industry norms, mismatches between reported income and third-party T-slip data, large or unusual GST/HST refund claims, cash-heavy business operations, disproportionate home office claims, repeated business losses over three or more years, and improperly documented shareholder loans. Construction, digital services, and hospitality are receiving increased attention in 2026.
How long does a Canadian company need to keep records in case of a CRA audit?
Businesses generally need to maintain adequate books and records for a minimum of six years from the end of the last tax year for income tax purposes, and four years for GST/HST purposes. For foreign-sourced income or assets subject to T1134/T1135 reporting, a longer retention period — commonly recommended at 10 years — is prudent given VDP lookback requirements. If the CRA alleges misrepresentation due to neglect, carelessness, or wilful default, there is no time limit on reassessment.
What is the difference between a desk audit and a field audit?
A desk audit is conducted remotely, with the CRA issuing a formal Request for Information and the taxpayer submitting documents through CRA's secure online portal. Most audits begin this way. A field audit involves a CRA auditor visiting the business premises directly, typically reserved for larger, more complex files or when the desk audit process raised further questions. In both cases, the taxpayer can have a representative handle correspondence and interactions with the CRA.
What happens if a company doesn't respond to a CRA audit request on time?
Failing to respond within the specified deadline can result in a Notice of Non-Compliance, carrying penalties of up to $25,000 per day for continued non-response in serious cases, and can escalate the file's risk profile or trigger a reassessment based on the information CRA already has, without the benefit of the taxpayer's documentation. If a deadline genuinely cannot be met, contacting the CRA proactively to request an extension is treated far more favourably than silence.
Should a Canadian company hire a professional before or during a CRA audit?
Engaging a CPA or tax professional as early as possible — ideally before any audit notice through proactive audit-ready record-keeping, and immediately upon receiving a notice if one is received — is consistently recommended. A professional can review the specific triggers, ensure the response is complete and consistent, communicate directly with the auditor, and identify issues before the CRA does. Involving a professional early tends to reduce both the duration and financial exposure of an audit.
16. Final Thoughts
The companies that handle a CRA audit with the least disruption aren't the ones that avoid audit selection entirely — audit selection is increasingly automated and pattern-driven, and no business can guarantee it will never be selected. They're the companies that maintained organized, contemporaneous records year-round, understood the specific triggers relevant to their sector, and had a clear response protocol ready before any notice arrived. The checklist in this guide — from record retention and document organization through the specific response steps once a Request for Information lands — is the same discipline that turns a CRA audit from a crisis into a routine administrative process.
