An audit letter from the Canada Revenue Agency usually arrives without warning. You have a set number of days to respond, and the clock starts on the date printed on the letter. For a small business owner with a messy bank feed, a bookkeeper managing ten client files, or a municipal finance office midway through a property tax billing run, that deadline can feel impossible. How to respond to a CRA audit in Canada starts with understanding what you are dealing with before you open the file folder. The right process keeps the audit contained, protects your recovery rights, and prevents one review from becoming a multi-year problem. If you are still trying to make sense of the original assessment or reassessment, start with our guide to CRA notices of assessment and then come back to the audit response plan below.

On this page

Understand What Kind of Audit You Are Facing

CRA audits come in different shapes, and the shape determines how much detail you need to produce. The most common is a correspondence audit, where a letter asks for specific documents or a written explanation. A desk audit is similar but usually involves a larger sample of transactions. A field audit means a CRA officer visits your business premises to review the books in person. There are also specialized audits for GST/HST, payroll source deductions, and particular credits or claims.

The statutory authority for these requests comes from the Income Tax Act and the Excise Tax Act. The audit letter normally names the provision and the records you must provide. The kind of audit changes your approach: a field audit may last months and require interviews, while a correspondence audit may be handled entirely by fax or through the CRA My Business Account portal.

Audit type Typical trigger What CRA usually asks for Typical timeline
Correspondence audit A mismatch on a return, high expense ratio, or random selection Receipts, invoices, bank statements, and schedules for specific lines Usually 30 days, check the letter
Desk audit A particular filing like a GST/HST return or a T4 summary Whether you have records to support the filed amounts Often 45 to 60 days
Field audit Larger business, repeated losses, or a referral from another audit Full accounting records, source documents, and interviews Scheduled weeks ahead, can stretch for months
Payroll or GST/HST audit Late remittances, missing T4s, or inconsistent input tax credits Payroll registers, T4/T4A and ROE records, GST/HST returns, bank statements Usually 30 to 90 days

The tradeoff is speed versus completeness. A small correspondence audit can turn into a broader review if the documents you send raise more questions. A field audit feels more invasive, but it gives you a chance to explain context that a desk audit cannot absorb. Either way, prepare for the records CRA asked for first, and only expand if the auditor asks. You do not need to send your entire filing history when someone has asked for a single expense category.

The process is the same whether you are being audited on your T1 personal return as a self-employed owner or your T2 corporate return. If you need a refresher on what a self-employed T1 looks like, see our guide to the CRA T1 personal tax return for self-employed Canadians.

How to Respond to a CRA Audit in Canada: Start With the Letter

The first step is to confirm receipt. If CRA sent the letter by registered mail, sign for it. If it appeared in your CRA My Business Account, note the date it was posted. Then read the letter three times. CRA will almost always tell you exactly what documents it wants and the date by which you must provide them. The deadline is not flexible because you were busy. It is flexible only if you ask for an extension before the deadline passes and give a concrete reason.

Follow this sequence when the letter arrives:

  • Note the audit reference number and the deadline.
  • Identify whether CRA wants documents, a written explanation, or a meeting.
  • Assign one person to own the response, preferably someone who knows where the records live.
  • Ask for a written extension if you need one, and do it before the deadline.
  • Send the response through the same channel CRA used, by mail, fax, or the online portal.

Missing the deadline matters. CRA can reassess using the information it already has, and the burden shifts to you to prove that the reassessment is wrong. That is a much worse position than showing the records on time. If your file is weak, the audit will look larger than it is because you are scrambling to reconstruct evidence while the auditor waits.

Here is where the manual method and an automated system diverge. If you keep receipts in an envelope and only enter transactions at year-end, responding to an audit means rekeying months of data under pressure. If you use a system with automatic bank feeds, the transactions are already there. You only need to attach the source documents, and if you have receipt OCR, the document is already paired with the transaction. The comparison is stark: one workflow takes weeks, the other takes a long afternoon. For a small business owner, that difference is often the entire audit experience.

Organize the Records CRA Actually Asked For

CRA wants a three-way match: the bank statement shows the money moving, the invoice or receipt shows why, and the ledger entry shows where you recorded it. If that match exists for the transactions in question, the audit is usually quick. If it does not, you need to reconstruct the record starting from the filed return.

Start with the tax return under audit. Pull the source documents that support the lines CRA flagged. Do not print every bank statement from the last five years unless the letter explicitly asks for full statements. Extra paper slows the auditor and can create new questions about transactions that were never part of the original request.

Common records CRA requests in a small business audit include:

  • Business bank statements and credit card statements
  • Invoices issued and invoices received
  • Receipts for expenses, including meals, travel, and equipment purchases
  • Payroll registers, T4 and T4A slips, and source deduction remittance records
  • GST/HST returns and the working papers behind them
  • General ledger and trial balance for the audited period
  • Vehicle log for mileage claims and supporting lease or fuel receipts

A real example: a 12-person contractor firm in Ontario received a correspondence audit for two years of job-cost expenses. The bookkeeper used Awditify for small business with AI transaction categorization, so every expense was already classified to a contract or overhead account. When the audit letter arrived, she exported a general ledger report by project code, attached the underlying receipts from the document store, and sent everything through the client portal. The file was assembled in a day. A firm without those categories would have had to sort two years of uncategorized bank feed data during the exact period when mistakes are most likely to happen. The easiest way to survive this stage is to already have a document retention policy for accounting firms or a similar policy for your own business, so the records exist before CRA asks for them.

Deal with Payroll, GST/HST, and Municipal Compliance Points

Payroll and GST/HST audits follow their own patterns. On the payroll side, CRA will reconcile your source deduction remittances against your T4 summaries. They will check whether you remitted CPP, EI, and income tax on time and whether the amounts match the payroll register. On the GST/HST side, they will test whether every input tax credit you claimed was supported by a valid invoice from a registered supplier and whether you collected the right amount of GST or HST on taxable supplies.

These audits are common after missed remittance deadlines or repeated late filings. The records look like a simple list, but the underlying timing matters. A CPP or EI remittance that arrived a day late can create penalties and interest even if the amount was correct. The same is true for a GST/HST return that was filed on time but with a net tax calculation that does not match the invoices you issued.

Municipalities are not outside this process. A municipal finance team can be audited on GST/HST rebate claims, on payments to contractors, or on expense reimbursements to employees and elected officials. PSAB reporting creates its own pressure to keep the books clean, but a CRA audit tests whether the underlying transactions are real, supported, and correctly classified. If your municipality runs property tax billing and utility billing through a system that keeps a consistent record, you are in a stronger position than if you are pulling from three spreadsheets.

If you run payroll in-house, verify that every payroll run matches the remittance amounts before the deadline. Awditify's payroll learning hub explains the remittance schedule for Canadian payroll, including the date the actual payment is due to CRA. Even with automated payroll calculations, the audit proof is still the report you can run after the fact.

Use Your Accounting System to Build a Defensible Audit Trail

A CRA audit is, at its core, a test of your audit trail. The auditor needs to see the path from a source document to a ledger entry to a line on your return. If that path is clean, you are explaining your business. If it is filled with late journal entries and unbacked adjustments, you are explaining your bookkeeping, and that is a much harder conversation.

A defensible audit trail shows who entered a transaction, when it was entered, when it was approved, and whether it was changed after the fact. It also shows the source document itself. An auditor who sees an invoice attached to an expense entry is less likely to challenge it. An auditor who sees a lump-sum adjustment with no backup will want to know what created it. The full feature set of an accounting platform matters less than the workflow behind that trail. The objective is to make your records tell the same story no matter which report the auditor asks for.

Compare the manual approach to an automated one. If you categorize a year of transactions at tax time, you are working from your memory of what happened, which is unreliable. If you categorize transactions continuously using AI and attach receipts through OCR, the record is less likely to contain you guessing. When CRA asks a question, you can answer with the exact transaction and the source document, not a story about why the receipt is missing.

Awditify also keeps a permanent audit trail of changes. If an entry is edited, the original and updated values remain visible. That visibility is valuable when an auditor questions a transaction that was changed after the audit letter arrived. Instead of explaining a deletion, you can show the history.

Cooperate With the Auditor Without Losing Control

Cooperation does not mean handing over your entire life. It means answering the specific questions, providing the requested documents, and respecting the auditor's schedule. It also means drawing a line around what is in scope. If the audit letter asks for 2023 business expenses, you do not need to volunteer information about your 2022 rental property loss or the side consulting income you reported net.

When speaking with an auditor, keep this boundary in mind. Answer the question that is asked and stop there. If you do not know an answer, say that you will confirm it in writing. Do not guess in an interview, because a guess becomes a statement that can be used later if it turns out to be wrong. You also have the right to have your accountant or lawyer present during a field audit meeting.

You also have the right to ask for the auditor's questions in writing. This is useful when the audit involves many transactions, because it gives you a clear list to work through. You can also ask CRA to confirm the end date of the audit period. The tradeoff is that asking for clarifications can slow the process, but a slower audit with accurate answers is better than a fast one that produces a reassessment you have to fight.

Do not destroy anything after the audit letter arrives. If you use paper files, leave them where they are. If you use a cloud-based system, you already have backup copies. Penalties for destroying records exist in the Income Tax Act, and the appearance of deleting documents after an audit notice is far worse than the original weakness in the files.

What Happens After the Audit: Reassessment and Objection

When the audit ends, CRA will usually send a notice of reassessment. Sometimes the reassessment says the original return stands. Often it asks for more tax, and interest runs from the date the tax was originally due. A notice of reassessment is not a suggestion. It is a legal document with its own deadline for you to object.

If you disagree with the reassessment, you need to file a notice of objection within 90 days of the date on the notice. The objection should list the specific errors and include the facts or documents that support your original position. This is not the time to say that you simply do not like the result. You need a technical argument and the records to back it up.

The reassessment is also when you can ask CRA to waive the interest or penalties that were added to the audit bill. That request is separate from the objection. It should explain why the error happened and why it was not caused by gross negligence. Clean records, a documented audit trail, and a consistent response process make that request much easier to support. Once the reassessment arrives, read the next guide on what to do if CRA reassesses you in Canada before you decide how to respond.

Frequently Asked Questions

How do I respond to a CRA audit letter in Canada?

Read the letter carefully and note the deadline, then gather documents for the specific items CRA asked about. Send your written response by the deadline, and if you need more time, request an extension in writing before the due date. Keep a copy of everything you send and use the same channel CRA used. An accounting platform with a clear audit trail, like Awditify, makes it easier to produce the supporting records quickly.

What does a CRA auditor look for in a small business audit?

Auditors test whether your reported income matches your bank deposits and whether your expenses have valid source documents. They also check payroll remittances, GST/HST collected, and owner draws against the related records. The common thread is that every number on your return must be traceable to an invoice, receipt, or contract. Automatic bank feeds and receipt OCR in Awditify build that traceability for you before the audit starts.

How long do I have to respond to a CRA audit?

The audit letter names the deadline, usually 30 days for a correspondence audit and longer for a field audit. If you cannot meet it, ask CRA in writing for an extension and explain why. Do not ignore the letter, because CRA can reassess based on information it already has. Awditify's reporting and document management tools can help you gather what you need before the clock runs out.

Can I refuse a CRA audit?

No. CRA has authority under the Income Tax Act and the Excise Tax Act to require records and information. You can ask for an extension and you can have professional representation, but you cannot refuse to participate. What you can control is the response process and the scope of the documents you provide. Practice management features in Awditify help accounting firms track audit deadlines and client document requests.

How can accounting software help during a CRA audit?

Good accounting software, like Awditify, keeps a chronological audit trail, categorizes transactions from bank feeds, and stores source documents in one place. Instead of searching through boxes, you can run a report for the exact period CRA asks about. Awditify's client portal also allows you to share documents securely with the auditor or your accounting firm. The result is a faster response that does not depend on your memory of where you filed last year's paperwork.

What to Do Next

The most important decision in a CRA audit is not made at the last minute. It is made months earlier, when you decide whether your records are ready for scrutiny. A clean audit trail, organized bank feeds, and invoices attached to transactions turn an audit from a painful reconstruction into a controlled review. If your books are not ready, start the work now rather than waiting for the letter.

Awditify was built for Canadian businesses, bookkeepers, CPA firms, and municipalities that need to prove their numbers under pressure. With automatic bank feeds, AI transaction categorization, receipt OCR, and a permanent audit trail, the platform gives you the documentation CRA expects. See how Awditify for small business can prepare you for the next review. If you want to see the workflow before you buy, book a demo and ask about the audit trail report.