What actually triggers a CRA audit (and what nobody can tell you)
Search this question and you will get a dozen confident lists of "red flags" — round numbers, high expense ratios, home office claims, too much cash. Those lists are written by people who do not know, because the Canada Revenue Agency has never published one. This page tells you the one thing CRA does say about how files get picked, and then spends the rest of its length on the part that is documented and genuinely useful: exactly what an auditor asks you for.
Nobody outside CRA can tell you what triggers an audit. The only sourceable statement CRA makes about selection is this: "The CRA's risk-assessment systems identify tax returns that are considered to be at high risk for non-compliance." That is the whole of it. There is no published red-flag list, no threshold, no ratio.
What is documented is what happens once you are selected — the records an auditor asks for, who they can talk to, where the audit takes place, and the 30 days you get to respond to proposed adjustments. That is the part you can prepare for, and preparing for it is the only useful thing anyone can tell you to do.
What CRA actually says about how files get selected
CRA's own page on business audits describes selection in a single sentence about risk-assessment systems identifying returns considered to be at high risk for non-compliance. It does not say what those systems weigh, how they weight it, or what would move you up or down. It is a description of a process, not a specification of it.
Read that plainly and it means: the criteria are not public. Not "hard to find" — not public. An agency that published the inputs to its risk model would be publishing a map of how to stay under it.
Source: CRA, Business audits — CRA page updated 2025-04-17.
Why the red-flag lists elsewhere are guesswork
The lists you have read are usually one of three things, and none of them is evidence.
- Inference from anecdote. A practitioner had three clients audited who all claimed vehicle expenses, so vehicle expenses became a trigger. Three files is not a sample, and nobody counted the thousands of identical claims that were never looked at.
- Imported American content. A great deal of what ranks for this question in Canada is a lightly reworded article about a different tax authority in a different country with different systems. It cannot be right about Canada except by accident.
- Marketing. A list of frightening triggers is an effective way to sell a service. That does not make it false, but it does mean nobody checked.
There is a practical harm in believing them, which is why this matters beyond pedantry. Owners who think a home office claim or a legitimate vehicle expense invites an audit stop claiming things they are entitled to. You end up paying more tax to avoid a risk nobody has measured. If an expense is real, business-related, and you can support it with a document, claim it and keep the document.
The honest version. You cannot make yourself un-auditable, and no page can tell you how. What you can control completely is what an audit costs you if one happens — and that is decided months or years earlier, by whether your records are organised.
What an auditor actually asks for
This part CRA does publish, and it is much broader than most owners expect. It falls into three groups, and it is the second and third that surprise people.
Your business records
Ledgers, journals, invoices, receipts, contracts and bank statements. In other words, the summarised accounts and the source documents underneath them. Books that reconcile but cannot be traced to a document are half an answer.
The owner's personal records
CRA lists personal bank statements, mortgage documents and credit card statements among the records that may be examined. This is the item that catches people off guard, and it is the strongest practical argument for keeping business and personal spending genuinely separate. Where the two are mixed, an auditor's questions extend into your household finances because there is no clean line for them to stop at.
Records of related persons and entities
The records of a spouse, family members, corporations, partnerships and trusts connected to you may also be examined. A business does not sit in isolation for audit purposes; the entities and people around it are within reach.
Who else CRA can talk to
CRA states that it "may also request input from your accountant, book-keeper, and/or employees." That is worth knowing in advance for two reasons. It means the quality of your bookkeeper's file organisation is part of your exposure, not just your own. And it means your staff may be asked about how things actually work day to day, so the way a process is described in your records should match the way it is really done.
Where it happens, and how it ends
An audit is normally conducted at your place of business. That is CRA's default, not a punishment — the records are there and so are the people who can explain them.
At the end, you get a written summary of the auditor's findings. If adjustments are proposed, you have 30 days to respond. Thirty days is enough time to get documents together and get advice, and it is nowhere near enough time to build records that don't exist. That gap is the entire argument of this page.
Source: CRA, Business audits — CRA page updated 2025-04-17.
What makes an audit cheap or expensive
Two businesses with identical numbers can have wildly different audit experiences, and the difference is almost entirely administrative. An auditor asks a question; you either answer it in an afternoon or you spend three weeks and a professional fee reconstructing the answer.
Cheap looks like this
Accounts reconciled monthly. Every transaction traceable to a document you can produce. Business and personal accounts genuinely separate. A vehicle logbook that was kept as you drove. Contracts filed with the invoices they relate to. Questions get answered from the file.
Expensive looks like this
A year reconciled in one sitting the following spring. Receipts in a box, or gone. One card used for groceries and inventory. Mileage estimated from memory. Someone is now paid by the hour to rebuild a record that should have taken minutes to file, while the clock runs.
None of that changes whether you are selected. All of it changes what selection costs you. And the same organisation that makes an audit cheap is what makes your year-end package for your accountant cheap, so you are not paying twice for the same disorder.
The two record rules that decide the outcome
Six years, and kept in Canada
You must keep your records for six years from the end of the last tax year they relate to. If a return was filed late, the six years runs from the date you actually filed it. A dissolved corporation keeps records for two years after dissolution. Records must be kept at your place of business or your residence in Canada unless CRA has given you written permission otherwise, and destroying them early requires Form T137 or a written request to your tax services office.
Six years is a long time, and it is measured from the end of the relevant tax year, not from the date of the transaction. A receipt from early in a fiscal year can need to survive close to seven years in practice.
The input tax credit documentation tiers
If you are registered for GST/HST, the documentation you need to support an input tax credit depends on the size of the sale, and an auditor will apply the tier rather than accept a general explanation.
There are three tiers, and they step up at $100 and again at $500: the bigger the sale, the more the receipt has to show. The one that costs people money is the middle tier, because a purchase over $100 needs the supplier's GST/HST registration number on the document and a great many receipts do not carry it. The full tier-by-tier list of what each receipt must show is set out on the twelve signs your books are wrong, which is where this site keeps it.
Two things worth knowing alongside it. These thresholds were raised from the old $30 and $150 levels effective 2021-04-20, so check the date on any summary you are relying on. And there are time limits on claiming credits — generally four years, but two years for listed financial institutions and for registrants whose threshold amount exceeded $6 million in both the current and preceding fiscal year, with exceptions.
Sources: CRA, Input tax credits — CRA page updated 2024-11-19; CRA, Where to keep your records and for how long — CRA page updated 2026-08-03.
If you already know your records are a mess
Then the useful move is not worrying about triggers, it is fixing the records — and doing it before anyone asks. A file that is current and traceable answers questions cheaply whether they come from CRA, your accountant or a lender. What catch-up bookkeeping costs when you are behind covers what that work involves and what waiting costs while you decide.
Records an auditor can follow, kept that way all year
We reconcile monthly and file source documents against the transactions they support, so if a question ever arrives you answer it out of the file in an afternoon instead of paying someone by the hour to rebuild a year you already lived through.
Questions people actually ask
What triggers a CRA audit?
Nobody outside CRA can answer that, and any page giving you a confident list is guessing. The only statement CRA publishes about selection is that its risk-assessment systems identify tax returns considered to be at high risk for non-compliance. It does not say what those systems weigh or how. What CRA does publish is what an audit involves once it starts, which is the part you can actually prepare for by keeping records that are organised and traceable.
Are round numbers or a home office claim a CRA audit red flag?
CRA has never published a red-flag list, so there is no source for that claim. Those lists come from anecdote, from articles about other countries' tax authorities, or from marketing. The practical harm is real: owners who believe them stop claiming deductions they are entitled to and pay more tax to avoid a risk nobody has measured. If an expense is genuinely business-related and you can support it with a document, claim it and keep the document.
What records does a CRA auditor ask for?
Ledgers, journals, invoices, receipts, contracts and bank statements, plus the owner's personal records including personal bank statements, mortgage documents and credit card statements. Records of related persons and entities may also be examined, which includes a spouse, family members, corporations, partnerships and trusts. CRA also states it may request input from your accountant, bookkeeper and employees. That reach is the strongest practical reason to keep business and personal spending genuinely separate.
Where does a CRA business audit take place?
Normally at your place of business. That is CRA's stated default, because the records and the people who can explain them are both there. At the end of the audit you receive a written summary of the findings, and if adjustments are proposed you have 30 days to respond. Thirty days is enough time to gather documents and get advice, but not enough to create records that were never kept.
How long do I have to keep records for a CRA audit?
Six years from the end of the last tax year the records relate to, and if you filed that return late, six years from the date you actually filed. A dissolved corporation keeps its records for two years after dissolution. Records must be kept at your place of business or your residence in Canada unless CRA gives written permission otherwise. Destroying them earlier requires Form T137 or a written request to your tax services office.
Does having a bookkeeper reduce my chance of being audited?
Nobody can honestly promise that, because the selection criteria are not published. What a bookkeeper changes is what an audit costs you if one happens. Reconciled accounts, source documents filed against the transactions they support, and business and personal spending kept apart mean an auditor's questions get answered from the file instead of reconstructed under time pressure. That is a real saving, and it is the only one anyone can legitimately claim.