Almost every business owner eventually opens a brown envelope from the CRA and feels their stomach drop. Usually the letter is routine — a review, not an audit — and the difference between a two-week resolution and a six-month ordeal is mostly about how the file was kept and how the response is handled. Here is how the CRA actually selects small business files for attention, and what to do when yours is selected.
Quick answer: Most CRA contact is a review — an automated or desk check asking you to support specific amounts — not an audit. Files get flagged by cross-matching (slips vs returns, GST vs reported revenue), by ratios that sit far outside industry norms, and by patterns like repeated losses or 100% vehicle claims. Respond by the deadline with exactly the documents requested; authorize your CPA so the CRA deals with them directly; and keep six years of records so any question is answerable from the file.
Reviews vs audits: know which letter you got
The CRA's compliance machinery has tiers. Pre- and post-assessment reviews are high-volume, largely automated: a letter asks you to substantiate a deduction or credit within a stated window. The matching program compares your return against third-party slips — T4s, T5s, T5018s — and proposes adjustments where they disagree. A full audit is different in kind: an auditor examines books, records and sometimes bank accounts, for one or more years. The response strategy differs, but the foundation — complete records, consistent filings — is identical.
What actually flags a small business file
- Slip mismatches. The matching program is arithmetic, not judgment: a T5018 filed by your general contractor that does not appear in your revenue, or a T5 your corporation issued that missed your T1, generates mail almost mechanically.
- GST that does not reconcile to income. Your GST returns declare revenue; your T2 declares revenue. When the two diverge materially without an obvious reason (zero-rated sales, timing), the discrepancy is an easy query.
- Ratios outside your industry's norms. The CRA benchmarks expense categories against businesses in the same industry and region. A drywall company claiming triple the typical vehicle costs, or margins persistently half the sector's, sits visibly outside the curve.
- Repeated losses. A business that loses money year after year while the owner keeps living invites the question of whether expenses are personal or the activity is commercial.
- Absolute claims. 100% business-use vehicles with no logbook, home-office claims out of proportion to the home, meals claimed at full cost rather than 50% — categorical claims read as unexamined ones.
- Shareholder loan balances. A persistent debit balance in the shareholder account is a known audit theme, because the one-year rule turns stale balances into income.
- Refund and rebate claims. Large or first-time GST refund claims are routinely verified before payment — fast, document-based, and entirely normal.
None of these is an accusation. They are statistical flags — and a well-kept file turns a flag into a short correspondence.
How to respond when the letter arrives
First, read what is actually being asked. Reviews request specific support for specific lines — answer that, completely and only that. Volunteering unrelated records widens the conversation. Second, respect the deadline. Missing it does not pause anything; the CRA simply adjusts the return against you and moves the argument to objection, which is slower and harder. If you need more time, ask before the deadline, not after. Third, put your CPA in the loop formally. With representative authorization in place (AUT-01 through Represent a Client), the CRA corresponds with your accountant directly — and a response drafted around the legislative test the reviewer is applying resolves faster than a shoebox of receipts with a cover note.
The audit posture you build in advance
Everything that shortens a review is built before it: bank and credit-card accounts reconciled monthly, a vehicle logbook that exists in real time rather than in retrospect, subcontractor agreements behind every T5018, and six years of records you can actually retrieve. This is the unglamorous case for professional bookkeeping: its highest value is not the monthly P&L, it is the fact that when the CRA asks a question, the answer already exists, labelled, in the right period.
If it does become an audit
Stay factual, stay organized, and route communication through one person — ideally your CPA. Provide what is requested on the agreed schedule; do not guess at answers you can verify; and if you disagree with a proposed adjustment, say so with the provision and the documents, because the auditor's report is written from what is on file. Most audits of well-kept small business files end in modest or no adjustment. The expensive ones are almost always reconstructions — years of books rebuilt after the fact under deadline. That outcome is chosen years earlier, in how the records were kept.
This article is general information for Canadian business owners and is current as of July 2026. CRA review and audit programs evolve; the flags described are common patterns, not a complete or guaranteed list. It is not tax advice; please speak with a CPA before acting on anything here.
Founder of EverStone CPA, an Abbotsford CPA firm, and a member of the Chartered Professional Accountants of British Columbia (CPABC). Sunny works with small business owners across BC and Canada on tax, bookkeeping and advisory. More about Sunny → · Book a free consult →