Updated Checked by the Tax-Services.ca editorial team How we check
An audit trail in bookkeeping lets someone follow a number in your reports back to the document behind it, and the CRA expects the chain to last six years from the end of the last tax year the records relate to. A GST/HST figure you can't trace is a problem in any software.
What does an audit trail actually contain?
Three things, in order. The source document (invoice, receipt, contract, deposit slip). The entry made from it (date, amount, account, who made it). And the report that entry ends up in. An auditor works backwards along that line, so each step needs a reference to the next.
The CRA’s own list of acceptable source documents is plain: invoices, vouchers, formal contracts, work orders, delivery slips, purchase orders and bank deposit slips. Nothing fancy. The point is that a stranger could pick your books up cold and rebuild a total.
Modern accounting software adds a fourth piece, a log of edits. It shows who changed an entry, when, and what it said before. Switch that on if your product has it, and check that a user with admin rights can’t quietly delete the log itself. What any particular product records isn’t something we could confirm, so test yours with a dummy entry.
How long do you keep the trail?
The default is six years. But the clock isn’t always the tax year end, and the exceptions are where people slip.
| Situation | How long to keep records |
|---|---|
| General rule | Six years from the end of the last tax year they relate to |
| Return filed late | Six years from the day the return is filed |
| Corporation that has been dissolved | Two years after the dissolution |
| Share registers, long-term property purchases and sales, other history affecting a sale or wind-up | Indefinitely, with no end date |
| Notice of objection or appeal | Until it is settled and the time for any further appeal has passed |
| Early destruction | Only with the CRA’s written permission (Form T137) |
Keep the records at your home or place of business in Canada, unless the CRA has agreed to another place. Paper, electronic or both are all fine. If your books live on a computer, the electronic version has to stay readable for the full period, even when you also hold paper copies. Information Circular IC05-1 covers the electronic rules, and the CRA’s Keeping Records publication covers the general ones.
Can you test a trail with one invoice?
Say an Ontario business invoices $48,000 for a job. At the 13% rate, the GST/HST calculator shows $6,240 of HST, so the customer owes $54,240. Here’s what a clean trail looks like for it.
The invoice is numbered and saved as a PDF. The sales entry shows $48,000 revenue, $6,240 HST collected and $54,240 receivable, all with the invoice number. When the customer pays, the bank deposit is matched to that receivable, not typed in as new income.
Now the awkward case. Someone later changes the sale to $46,000 because of a discount. A weak system overwrites the old figure. A good one keeps the original, posts a credit note, and records the new HST. The credit note here is $2,000 plus $260 of HST, $2,260 in all, which leaves the customer owing $51,980 ($46,000 plus $5,980 of HST). If you only know the amount paid, the HST reverse calculator backs the tax out of a total, but don’t rely on that alone. The credit note is the evidence.
How do you fix a mistake without wrecking the trail?
Don’t overwrite and don’t delete. Post a correcting entry that reverses the wrong one, then post the right one, and give both a short note: what was wrong, who found it, the date. Then anyone reading the books later can see the error and the fix side by side. An auditor who sees a clean correction with a note thinks “careful”. An auditor who sees a number that quietly changed thinks something else.
The same goes for bank errors and duplicate bills. Mark them, don’t make them vanish.
Where audit trails break
Most breaks aren’t fraud. They’re habits. Cash paid out with no receipt. One bank account used for personal and business spending. Journal entries with the description “adjustment”. Files renamed when the phone was full. Each one is small, and together they leave an auditor with nothing to follow.
Reconciliation is the cheapest fix. Match the bank to the books every month, and write a short note on anything you can’t explain. It takes an hour and it catches a wrong amount while you still remember the deal.
Picture Nadia, who runs a small bakery in Regina. She reconciles on the first Sunday of every month, and the one time a $412 supplier payment was keyed twice, she saw it within weeks. Left until tax time, that same duplicate would have taken an afternoon to explain and a worse afternoon to find.
Who should be allowed to post entries? Fewer people than you’d guess. If the person who approves payments also records them and reconciles the bank, nobody is checking anybody. In a small firm that’s hard to avoid, so at least have the owner look over the bank reconciliation and the list of edited entries each month.
How does the audit trail tie into your tax numbers?
Every line on a return should lead back to the books. If you’re self-employed, the self-employed tax calculator is a quick way to see what your profit figure means for tax, but the profit itself is only as good as the entries under it. The same goes for a corporation working out its bill with the corporate tax calculator. It ignores things like associated corporations and the phase-outs, and the Ontario small business figure for 2026 is a blend derived for a calendar year, not a published rate.
A short checklist for this month
- Every entry has a document, or a note saying why not.
- Edits are logged, and the log can’t be switched off by staff.
- Backups run, and someone has tried opening one.
- The bank is reconciled, with a signed or initialled record.
- Files are named the same way, so a search finds them.
Where this information comes from
Retention periods, the exceptions in the table and the location rules come from the CRA page on where to keep your records and for how long, and the electronic rules from the CRA's circular IC05-1, re-checked in November 2026. The HST rate for Ontario comes from our sales tax engine. Nothing here is a ruling, and this site isn't connected to the CRA. For a specific audit, the notice from the CRA is what you follow.
Frequently asked questions
How long must I keep bookkeeping records in Canada?
In general, six years from the end of the last tax year the records relate to. If you file a return late, the six years run from the day you file instead. Some situations differ, such as a dissolved corporation (two years after dissolution) or records kept indefinitely, so check the table above for yours.
Are electronic records enough for the CRA?
Yes, the CRA accepts paper records, electronic records or both. If your books live on a computer, the electronic version has to stay readable for the whole retention period, even when you also hold paper copies. Information Circular IC05-1 covers the electronic rules, and the CRA's Keeping Records publication covers the general ones.
What counts as a source document?
The CRA's own examples are invoices, vouchers, formal contracts, work orders, delivery slips, purchase orders and bank deposit slips. The point is that a stranger could pick up your books cold and rebuild a total from them, so each entry should point to one of these or carry a note explaining why not.
Where do I have to keep the records?
At your home or place of business in Canada, unless the CRA has agreed to another place. That applies to paper and electronic records alike, so a cloud server abroad is worth checking against the rule first. Destroying records early needs the CRA's written permission on Form T137.
Do I ever keep records longer than six years?
Yes. The CRA says records of long-term property, share registers and other history affecting a sale or wind-up are kept indefinitely. A late-filed return restarts the count from the filing date, and an objection or appeal extends it until the matter is settled and any further appeal period has passed.
- Dealing with the CRA: letters, audits and payments
Dealing with the CRA: what to do when a letter arrives, how a review differs from an audit, how My Account helps, and what to do if you can't pay