A letter or call from a CRA auditor is stressful, but the process follows published steps. An audit is a review of your records to confirm that your returns are correct; being selected does not by itself mean you did something wrong. This guide explains what usually happens and how to prepare.
First, confirm it is really the CRA
Scammers impersonate the CRA. A real auditor gives you their name and contact information, and you can verify the contact through your CRA account or by calling the CRA directly. (CRA: Scams and fraud)
How an audit starts
The auditor calls you, sends a letter, or both. They explain the scope of the audit, the tax years or reporting periods involved, and the documents they need. (CRA: What happens during an audit)
What the auditor can ask for
- Business records such as ledgers, journals, invoices, receipts, contracts, and bank statements
- Personal records of the business owners, such as personal bank and credit card statements and mortgage documents
- Records of related people or entities, such as a spouse, family members, corporations, partnerships, or trusts
If your records are electronic, the auditor will normally ask for them before meeting with you, which can shorten the time spent at your business. (CRA: Business audits)
Timelines
The CRA publishes standard timelines for audit information requests. In general, an initial request for records allows up to 30 days, and a follow-up may give more time where it is justified. If the auditor proposes changes, you usually have 30 days to respond to the written summary of findings. (CRA: Standard timelines for information requests; CRA: Business audits)
How an audit ends
If no changes are needed, the audit is closed. If changes are made, you receive a notice of reassessment (or redetermination for losses). In most cases interest continues to apply to amounts owing while they are in dispute. (CRA: Business audits)
If you disagree: objection deadlines
- Individuals (other than trusts): the later of one year after the filing deadline for the return, or 90 days after the date of the notice of assessment.
- Corporations: 90 days after the date of the notice of assessment.
An objection must explain why you disagree and include the relevant facts and documents. If you miss the deadline, you may be able to apply for an extension within one year. (CRA: Objection rights under the Income Tax Act)
Keep your records
Generally, records must be kept for six years from the end of the last tax year they relate to, and longer if an objection or appeal is open. (CRA: How long to keep records)
Your rights and your representative
The Taxpayer Bill of Rights describes how the CRA must treat you, and you can raise concerns with the auditor or their team leader at any time. You can also authorize an accountant to deal with the CRA for you. (CRA: Taxpayer Bill of Rights; CRA: Represent a Client)
A note on voluntary disclosures
The Voluntary Disclosures Program can offer relief for past errors, but only if you apply before an audit or investigation about that information has started. Once an audit is under way, it is generally too late for VDP relief on the same issue. (CRA: VDP eligibility)
Preparation checklist
- Read the letter carefully and write down every deadline.
- Confirm exactly which years, accounts, and documents are requested.
- Gather and organize the records; reconcile bank statements to your books.
- Answer what is asked, in writing where possible, and keep copies of everything you send.
- Do not guess. If you are unsure of an answer, say you will follow up.
- Ask for more time early if you need it, and explain why.
- Consider having a CPA represent you before your first conversation with the auditor.
I help clients respond to CRA reviews and audits. See CRA audit support.
This guide is general information based on CRA sources available in October 2026. Rules and amounts change; check the linked canada.ca pages or ask me before you act.