A CRA audit for a small business is usually triggered by numbers that disagree. Your income comes in under what slips and platforms already reported, your GST/HST sales do not tie to your income tax return, your expenses sit outside the range of similar businesses, or a refund claim needs checking before CRA pays it. The agency says so directly: it chooses files based on a risk assessment that looks at "the likelihood or frequency of errors" and "may compare that information to similar files."
That makes the useful question less "am I on a list?" and more "would my numbers survive being compared?" A former CRA auditor who posted a list of triggers on r/SmallBusinessCanada (879 upvotes, 236 comments) ended on the same point: "What protects you is that all your numbers agree with each other and with what CRA already holds on you." This guide goes through the triggers one at a time, each checked against CRA's own pages, with a check you can run yourself. If you want the wider view of where cash slips out of a business before tax time, start with where your business is losing money.
How does CRA decide which small businesses to audit?
CRA runs automated risk scoring on every return, and a human only looks when the score or a mismatch says so. CRA's business audits page puts it this way: "The CRA's risk-assessment systems identify tax returns that are considered to be at high risk for non-compliance," after which an officer "will review information from various sources to determine whether an audit is needed."
Three kinds of data feed that score:
- What third parties already reported: T4, T4A and T5 slips, T5018 contract payment slips from construction companies, and since January 1, 2024, digital platform operators that report sellers' income every year.
- Your own returns compared with each other: GST/HST returns against the T2 or T2125, and this year against last year.
- Your returns compared with similar businesses: the ex-auditor described corporate GIFI codes being used to compare you "against other businesses your size in your sector."
GST/HST now runs on its own track. For businesses with annual sales under about $4 million, CRA says combined audits have been discontinued, so you face either an income tax audit or a GST/HST audit, sometimes with "only a brief compliance review of the other tax." GST/HST files are also picked "on both risk assessment and on random file selection," so a random pick does happen, even though most selections are risk-based.
The 9 triggers, checked against CRA's own pages
Each trigger below pairs the ex-auditor's list with the CRA page that backs it, and the owner experiences in the thread are labelled as anecdotes.
1. Your income is lower than what CRA already has on file
If the income you report comes in under what slips or platforms reported for you, the mismatch can flag before anyone reads your return. The easy misses are a T4A from one client you forgot, platform payouts, and T5018 slips a general contractor filed on your payments. Reconcile slips to your ledger before you file, not after.
2. Your GST/HST sales don't tie to your income tax sales
CRA checks the sales line on your GST/HST returns against the business income on your income tax return. Its post-assessing review page gives the example of "when the amount reported as sales on your GST/HST return doesn't match business income reported on your income tax return," and it also compares sales with the tax collected on them.
Legitimate gaps exist: exports, out-of-province clients, zero-rated and exempt supplies. Line 101 of the GST/HST return is meant to include "zero rated and exempt supplies" too, per CRA's GST/HST registrant guide, so leaving them off is how honest businesses create a mismatch. Several owners in the thread said they were contacted for exactly this. One photographer with US and European clients had nothing to fix, because the accountant "cleanly and specifically" separated taxable, zero-rated and exempt sales. Another owner, who sold to First Nations reserves, said they lost the audit even though they kept the required certificates. Their fix was to charge full HST to everyone, and they said it cost them around $300,000 a year in lost customers.
The processor fee version of this mismatch. If Stripe, Square or your processor deposits sales net of fees and your bookkeeper records the deposit as the sale, your sales are understated and the fee expense is missing. Book the gross sale and the fee separately. A firm's own post on r/SmallBusinessCanada (promotional, so treat the number loosely) said a yoga studio missed about $15,000 in deductions because processor fees were never split out. Knowing what each line on your merchant statement means is the first step.
3. You claim a GST/HST refund
Every GST/HST refund request is screened before CRA pays it. CRA says refund requests "are systematically reviewed to identify errors or evidence of non-compliance. As a result, some are considered further before payment is approved." Refunds are normally issued within 4 weeks, so a longer wait is often a pre-assessment review.
What decides these is the paperwork behind your input tax credits (ITCs). CRA's ITC information requirements scale with the size of the purchase:
| Purchase total | What the invoice or receipt must show |
|---|---|
| Under $100 | Supplier name, date, total paid |
| $100 to $499.99 | All of the above, plus the GST/HST charged (or that it is included) and the supplier's GST/HST number |
| $500 or more | All of the above, plus your business name, a description and the payment terms |
A card slip that shows only a total is not enough above $100. That is why a clean receipt system by job matters more than the software you pick.
4. Your expenses are out of line with similar businesses
Expense ratios far outside your sector, or a category that jumps with no matching revenue change, are what the risk models look for. The usual culprits are meals, vehicles, home office and travel. Two CRA rules decide most of these:
- Meals and entertainment: the maximum claim is 50% in most cases. Claiming 100% is a visible error.
- Vehicles: CRA calls a full-year logbook "the best evidence," listing date, destination, purpose and kilometres. After one full base year you can keep a three-month sample logbook, as long as the result stays within 10% of the base year.
The vehicle one is real money even when it looks small. An owner with 25 years in business said their one HST audit "disallowed the ITC on the personal portion of our auto reimbursement which amounted to about $800."
5. Your books look like CRA should rebuild your income
CRA publishes the conditions under which it stops trusting your books and reconstructs income from your bank accounts and lifestyle. Its business audits page says it will "generally use an indirect verification of income method" when:
- The books are prone to error, for example "when one person does most of the accounting."
- Business and personal bank accounts "may have been used interchangeably."
- Your lifestyle "does not seem to match the income reported."
- The business is in a sector "considered to be at high risk for unreported income."
- The business "consistently reports income lower than other similar businesses."
The most common method is the net worth method, which uses vehicle registrations, land title information and, CRA says, the personal financial records of your spouse and "any other contributing member of the household." Conditions 1 and 2 are the ones you control. A separate business account and a bookkeeper or software setup where a second person reviews the books take most small businesses out of that list.
6. You incorporated, but you work like an employee of one client
A corporation that would be an employee of its client if the corporation did not exist is a personal services business (PSB), and CRA ran a two-phase pilot on them starting in 2022. A PSB loses the small business deduction and pays the full corporate rates "plus an additional 5% tax," per CRA's PSB pilot page.
The pilot's findings explain why this is on the list:
- In phase 2, 913 corporations agreed to a voluntary review and 291 (32%) were found to be operating as a PSB.
- 245 of those (84%) had claimed the small business deduction they were not eligible for.
- 83 (29%) said the hiring company told them to incorporate, and of those, 60% were told they could claim various operating expenses.
- Transportation, professional services and construction made up most of the potential PSBs found in phase 1.
The pilot was voluntary and let participants correct returns without an immediate reassessment. The ex-auditor's claim that CRA has since moved "from 'educating' people to reassessing them" is his read, not a CRA statement. The fix is the same either way: more than one client, your own tools and financial risk, and control over how the work is done.
7. Your subcontractors are really employees, or you skip T5018 slips
If CRA decides a worker was an employee, the payer carries the cost. An employer who fails to deduct CPP or EI "must pay both the employer's share and the employee's share" plus penalties and interest. If construction is your main activity, a T5018 slip is required for each subcontractor paid more than $500 in the period, not counting GST/HST. CRA frames T5018 reporting as part of its effort "to reduce activity in the underground economy," so missing slips stand out. Our guides on the subcontractor or employee decision and paying subcontractors go into the working side; for the tax rules, CRA's employment status pages are the authority.
8. You took money out of the corporation as a loan and left it
A shareholder loan that is not repaid within one year after the end of the corporation's tax year can be added to your personal income. CRA's shareholder loan folio describes that exception under subsection 15(2.6). The ex-auditor said the shareholder loan account "get[s] looked at almost every time CRA reviews a T2." Clear it with salary or dividends before the deadline, not in the next year's cleanup.
9. You fall behind on GST/HST or payroll remittances
Unremitted GST/HST and payroll deductions can become the directors' personal debt. CRA's directors' liability circular says directors can be assessed unless they exercised due diligence, and suggests steps such as a separate account for remittances. Incorporating does not protect you here. Cash flow is usually the cause, which is why payroll set up correctly and a remittance account pay for themselves.
If your processor deposits sales net of fees, your books may be understating both sales and expenses, and you may be overpaying the processor too. Send us your payment and bank statement exports, no logins, and we list the fees you are overpaying and where the charges do not match what you agreed to.
A 20-minute check you can run yourself
Pull last year's returns and your ledger, and answer these seven questions. Any "no" is the place a reviewer would start.
| Check | Where to look | Pass if |
|---|---|---|
| Slips match income | T4A, T5018, platform statements vs your revenue accounts | Every slip amount is inside reported revenue |
| GST/HST ties to income tax | Sum of line 101 for the year vs revenue on your T2 or T2125 | Equal, or the gap is explained by named zero-rated, exempt or out-of-country sales |
| Deposits recorded gross | Processor payout report vs sales in your books | Sales are gross and processor fees are a separate expense |
| ITC paperwork | Your 10 largest purchases with ITCs claimed | Each $100+ invoice shows the supplier's GST/HST number and tax |
| Vehicle use | Logbook or sample period vs percentage claimed | Business percentage comes from a log, not an estimate |
| Meals | Meals and entertainment line | Claimed at 50% |
| Owner draws | Shareholder loan account at year end | Cleared by salary or dividends within one year after year end |
The GST/HST return itself is a common source of the problem. CRA lists keying errors its reviewers see: switching the GST/HST and ITC amounts, missing a digit or the cents in sales, entering the same amount for GST/HST and ITCs, and entering only the net tax. Checking the return against the ledger before you file takes minutes.
Tip
Start with your ten biggest ITCs. One owner on r/SmallBusinessCanada said their HST auditors "start with your top 10 payables & receivables," then asked for the next 10, going "all the way to 40 of each... until they found $130 error." It took four months. If your top ten have proper invoices, most reviews end early. Getting staff to hand in receipts as they go is cheaper than recreating them later.
What happens if the CRA letter arrives?
You get a defined window to respond, and you can ask for more time. After the Auditor General's 2018 Report 7 found the time CRA gave taxpayers to answer requests "was inconsistent, depending on how the Agency categorized the taxpayer," with individuals given "less time to respond" (as summarized in the House of Commons committee report), CRA set standard timelines for audit requests:
| Request | Initial deadline | With extension |
|---|---|---|
| Preliminary request for books and records | Up to 30 days | Up to 90 days |
| Follow-up query, information readily available | Up to 15 days | Up to 45 days |
| Follow-up query, information not readily available | Up to 30 days | Up to 60 days |
| Response to a proposal letter | 30 days | Up to 60 days |
CRA also commits to contacting you within 30 days of receiving what it asked for, to tell you the next step. A few things to know:
- Send what is asked, through CRA's secure channels. Auditors cannot receive records by email. RC4188 says they may also look at your personal records and those of family members and related companies.
- Missing ITC paperwork has a price. The letter one owner posted warned that ITCs "may be reduced to zero under subsection 169(4)," and CRA's memorandum sets a $100 penalty for each failure to provide information.
- The proposal letter is not the end. You have 30 days to agree or disagree, can escalate to the auditor's team leader, and can file an objection after the reassessment. Interest usually keeps running on amounts in dispute.
- Service problems have a separate route. The Taxpayers' Ombudsperson reviews service complaints once CRA's own Service Feedback Program has had its turn, and its 2025-2026 annual report says that program was taking up to 100 business days to respond in November 2025. File early if delays are hurting the business.
How far back can they go?
For most small corporations, three years from the notice of assessment, and without limit if the error came from carelessness. CRA's T2 reassessment page says it can reassess a CCPC within three years of the original notice (four for other corporations), and "at any time" where there was a misrepresentation "because of neglect, carelessness, wilful default, or fraud." Some firm blogs give six years for carelessness; CRA's page does not. Keep records at least six years either way.
Found a problem? Fix it before CRA does
If your check turns up an error, correcting it yourself costs far less than having CRA find it. Small errors can usually be fixed by adjusting a return. For larger ones, the Voluntary Disclosures Program changed on October 1, 2025: unprompted applications normally get 75% relief of interest and 100% of penalties, while prompted ones, where CRA has already been in touch about the issue, normally get 25% interest relief. The PSB pilot page points one-client corporations to the same program.
Can you handle this yourself?
Most of the prevention is bookkeeping discipline you can do alone; the judgment calls are where a professional earns the fee. Owners in the HST audit threads were blunt that a simple review is DIY work. One accountant disagreed on scope: CRA "will likely require you to provide much more data," such as "a general ledger report of ALL transactions." Another owner was quoted $5,000 to respond to an HST review on credits worth under $1,000.
Do it yourself: separate accounts, gross-up processor deposits, ITC invoices with GST/HST numbers, a vehicle log, meals at 50%, T5018 slips, clearing the shareholder loan. Much of that routine is easy to automate in your business, from receipt capture to payout reports. Get help with: PSB or contractor status, a net worth review, anything covering several years, or a proposal letter you disagree with.
The firm post quoted earlier (promotional, so read the number loosely) claimed a $1,500 review for a plumbing company moved its HST position by about $22,000 through missed ITCs, wrong vehicle percentages and equipment expensed instead of depreciated. The mechanism is the useful part: small coding errors stack, and nobody checks them line by line unless it is someone's job. Before you sign up for any review, compare what you pay processors against published processor fees so you know which lines are worth questioning.
Ran the check and found deposits that don't match sales, or processor charges you can't explain? Send the exports. We read the processor, bank and platform statements line by line and send back a written list of what you are overpaying and who needs to act on each item.