Common CRA Audit Triggers for Small Businesses
Understanding what may increase your audit risk and how to prepare your business
Receiving a Canada Revenue Agency (CRA) audit notice can be concerning for any business owner. However, an audit does not necessarily mean the CRA believes you have done something wrong.
Canada's tax system operates on a self-assessment basis, meaning businesses are responsible for accurately reporting their income, claiming eligible deductions, and maintaining proper records. To help identify potential areas of non-compliance, the CRA uses sophisticated risk assessment systems to review tax returns and other filings. If certain risk indicators are identified, the CRA may gather information from multiple sources before deciding whether a formal audit is appropriate.
While there is no single action that guarantees an audit, certain patterns and reporting issues are more likely to attract additional scrutiny. Understanding these common audit triggers can help business owners strengthen their recordkeeping, improve compliance, and reduce unnecessary risk.
Below is a breakdown of some of the most common CRA audit triggers for small businesses.
1. Poor or Incomplete Books and Records
One of the most common reasons a business attracts CRA attention is inadequate bookkeeping and recordkeeping.
Under the Income Tax Act, businesses are required to maintain books and records that allow the CRA to determine the amount of tax payable. Generally, these records must be retained for at least six years after the end of the taxation year to which they relate. In certain situations, such as late-filed tax returns, ongoing objections or appeals, or where the CRA requires additional retention, records may need to be kept longer. Businesses that maintain electronic records must also ensure those records remain accessible and electronically readable throughout the required retention period.
In practice, audit risk increases when a business has:
Missing invoices or receipts
No clear audit trail between source documents and financial statements
Poor separation between business and personal transactions
Inconsistent bookkeeping practices
Records that cannot be produced promptly when requested
During an audit, the CRA closely reviews a business's books and records and, where appropriate, may also examine personal records belonging to business owners or related individuals.
2. Mixing Personal and Business Finances
Keeping business and personal finances separate is one of the simplest ways to reduce audit risk.
The CRA notes that it may use indirect methods to verify income when business and personal bank accounts appear to have been used interchangeably. When personal expenses are paid through the business, or business revenue is deposited into personal accounts, it becomes more difficult to verify reported income and expenses.
In these situations, the CRA may reconstruct income using alternative methods, including the net worth method, to determine whether all income has been properly reported.
This issue is particularly common among owner-managed businesses and reinforces the importance of maintaining separate bank accounts and clear financial records.
3. Reported Income Does Not Match the Owner's Lifestyle
Another common audit trigger occurs when a taxpayer's reported income appears inconsistent with their lifestyle or personal spending.
The CRA may use indirect verification of income where an individual's assets, spending habits, or overall lifestyle do not appear to align with the income reported on their tax returns.
As part of this review, the CRA may examine:
Changes in assets and liabilities
Personal spending patterns
Non-taxable sources of funds, such as gifts or inheritances
While these circumstances do not automatically indicate non-compliance, significant inconsistencies may prompt additional questions and further review.
4. Operating in Higher-Risk Industries
Certain industries naturally receive greater attention because they present a higher risk of unreported income.
Although the CRA does not publish a definitive list of high-risk industries, businesses that operate primarily in cash or in sectors where informal payments are more common often receive closer scrutiny.
As part of its review process, the CRA may compare your reported revenue, profit margins, expenses, or overall financial performance against businesses operating in the same industry.
Being different from industry averages does not automatically indicate a problem, but significant differences may result in additional questions during an audit.
5. Financial Results That Differ Significantly from Similar Businesses
Businesses that consistently report financial results that differ significantly from similar businesses may also attract CRA attention.
For example, reporting substantially lower gross margins, unusually low net income, or expense ratios that fall well outside industry norms can prompt the CRA to seek further explanation.
This does not mean every low-margin or lower-profit business is non-compliant. Every business operates under different circumstances.
However, where financial results differ materially from comparable businesses, owners should be prepared to support those differences with complete, contemporaneous records that clearly explain the underlying business reasons.
6. Repeated Losses or Unusual Year-to-Year Fluctuations
Large fluctuations in income or profitability from one year to the next can also increase audit risk.
Businesses that repeatedly report losses, experience significant swings in profitability, or file amended tax returns may receive additional scrutiny as part of the CRA's broader risk assessment process.
Although this discussion originates from the CRA's transfer pricing guidance, the broader principle applies to businesses of all sizes: unusual reporting patterns often attract additional review.
7. Aggressive or Unusual Tax Positions
The CRA risk assessment process considers aggressive tax positions, compliance history, transparency, and overall tax governance when selecting files for audit.
For small businesses, this may include situations such as:
Deductions that are unusually high relative to revenue
Positions that rely on weak or incomplete supporting documentation
Structures designed primarily to generate tax benefits rather than reflect economic activity
Arrangements promoted as producing unusually large or tax-free benefits
The CRA has publicly stated that it continues to focus on aggressive tax planning arrangements and the individuals or promoters involved in such structures. Where tax positions appear aggressive or unsupported, the likelihood of further review increases.
8. Information Mismatches Across Filings
Audit risk may also increase where information reported on one tax filing does not align with information reported on another.
The CRA specifically identifies inconsistencies across filings as a risk factor, particularly where multiple information returns are involved.
For small businesses, mismatches can occur between:
T2 corporate returns, T1 personal returns, GST/HST filings, and payroll remittances
Slips (such as T4s) and corresponding summary filings
Bookkeeping records and filed tax returns
Reported revenue and actual bank deposits
Even small inconsistencies can trigger questions, especially where they appear repeatedly or cannot be easily explained with supporting documentation.
9. GST/HST Issues
GST/HST reporting errors can also lead to broader CRA review and, in some cases, income tax audits.
The CRA notes that outcomes of GST and customs audits may feed into broader risk assessment processes.
Common GST/HST issues include:
Claiming input tax credits without adequate supporting documentation
Failing to register for GST/HST when required
Reporting inconsistencies between GST/HST returns and income tax filings
Misclassifying exempt or zero-rated supplies
Because GST/HST reporting ties directly into business revenue reporting, issues in this area often raise additional questions about overall compliance.
10. Failure to Report Income or False Statements
Failure to report income or providing false or misleading information can result in penalties under the Income Tax Act.
Under subsection 163(1), a repeated failure to report income penalty may apply where a taxpayer fails to report an amount of at least $500 and has a similar omission in one of the prior three years, unless the gross negligence penalty applies instead.
Under subsection 163(2), penalties may apply where a person knowingly, or under circumstances amounting to gross negligence, makes or participates in a false statement or omission in a return.
While the existence of these penalties does not itself define an audit trigger, repeated omissions, unsupported claims, or inaccurate reporting significantly increase audit risk.
What the CRA Typically Reviews During an Audit
During an audit, the CRA may review a wide range of records and documentation to verify that your tax filings are accurate and complete. Depending on the circumstances, the scope of an audit may extend beyond a business's financial records if additional information is required to verify compliance.
The CRA may review:
Ledgers, journals, invoices, receipts, contracts, and bank statements
Personal financial records of the business owner
Records of related persons or affiliated entities
Explanations provided by accountants, bookkeepers, or employees
If the CRA determines that a business's records are inadequate, it may require the taxpayer to maintain books and records in a specified manner going forward under subsection 230(3) of the Income Tax Act.
Final Thoughts
There is no single factor that determines whether a small business will be audited by the CRA. Instead, audits are typically driven by a combination of risk indicators identified through the CRA’s assessment systems.
Common triggers include weak or incomplete records, mixing personal and business finances, income that does not align with lifestyle indicators, industry-based risk profiles, inconsistent financial results, aggressive tax positions, mismatches across filings, GST/HST reporting issues, and repeated or unexplained reporting errors.
The most effective way to reduce audit risk is to maintain disciplined bookkeeping practices, ensure all transactions are properly documented, and file tax returns that are internally consistent and fully supported by factual records.
At Miles T. Sweeney Limited, we help individuals and businesses maintain accurate records and navigate CRA requirements with confidence and clarity.
Book a call: 902-468-5500
Email us: info@msweeney.com
Note: The information provided in this article is for general informational purposes only and should not be considered tax advice. Please consult a qualified professional regarding your specific situation.