Updated Checked by the Tax-Services.ca editorial team How we check
The most common audit findings for a small business are books that don’t match the bank, personal spending run through the company, and income that looks low next to the owner’s lifestyle. The CRA doesn’t publish a ranked list of findings that we could find. What it does publish is the warning signs auditors look for, and they line up with those three.
What does the CRA look at in a small business audit?
Your books and records, checked against what you filed. That means ledgers, journals, invoices, receipts, contracts and bank statements. The CRA says it can also ask for the owner’s personal bank, mortgage and credit card statements, and the records of related people or companies, such as a spouse or a family corporation.
That last part surprises people. Your personal life isn’t off limits when the business’s numbers look thin.
Selection starts with the CRA’s risk-assessment systems, which flag returns and claims that look likely to contain errors. You usually hear by phone or mail, with a letter naming the years under review.
Which warning signs lead to a closer look?
The CRA lists them for indirect verification of income, the method it uses when your books can’t settle the question. The table pairs each sign with the bookkeeping habit that answers it.
| Sign the CRA names | What fixes it |
|---|---|
| Books prone to error, often one person doing most of the accounting | A second person reviews the month, or a monthly reconciliation you sign off |
| Business and personal accounts used interchangeably | A separate business account and card, and a clean owner’s draw record |
| Lifestyle doesn’t match reported income | Income you can trace from sales records to deposits |
| Business in a sector considered high risk for unreported income | Sales records that come from the till or the invoicing system, not a spreadsheet typed later |
| Income consistently lower than comparable businesses | A note explaining your margins, and the costs behind them |
The method the CRA calls the most common is the net worth approach. An auditor compares how your assets and debts changed over the years, adds personal spending, and checks if your reported income could have paid for it.
Here’s how that plays out for a small shop. Say a hair salon owner in Regina reports modest profit, yet the family bought a home and a truck in the same two years. The auditor isn’t accusing anyone. The numbers simply have to add up, and when they don’t, the owner needs a story the records can support, such as an inheritance or a loan.
What does one disallowed expense cost?
More than the expense itself, and here’s why. Say a sole proprietor in Ontario reports $80,000 of profit and the auditor removes $6,000 of personal costs that were written off as business. Profit becomes $86,000.
We ran both numbers through the income tax calculator with self-employment income only, 2026 federal and Ontario rates. Income tax rises from $13,234 to $14,894, a jump of $1,660. Contributions listed as CPP or EI in the same result rise by $400. So $6,000 costs about $2,060 before any interest or penalty.
We didn’t test penalties or interest, since we couldn’t confirm the current rates for your situation. Add them in your head, and know they make it worse. The self-employed tax calculator is a second way to check, though its deductions lower income tax but not CPP.
Where do GST/HST and payroll audits trip people up?
GST/HST claims need paperwork before you make them. To claim an input tax credit you should hold the supporting documents, and invoices need the supplier’s details and the tax amount. A bank statement alone isn’t proof. If you claim $5,200 of HST on a $40,000 Ontario purchase, which the GST and HST calculator confirms at 13%, the invoice has to be there.
Payroll is the other area. Withholding deductions from pay and not remitting them is the obvious trap, though the CRA pages we read don’t rank payroll findings. Use the payroll remittance calculator to check what a month should look like, and keep the pay records with your bank deposits.
What happens after the auditor finishes?
You will receive a proposal letter explaining the reason for the reassessment. You will have 30 days to agree or disagree with the proposal.
CRA, What you should know about audits (RC4188), canada.ca
The final letter says no change, reassessment for more tax, or a refund. You can object to an assessment, and the CRA says you may not have to pay the extra amount while it’s resolved.
So don’t panic at the first call. Do gather the years named, reconcile every account first, and answer with documents rather than memory. If you disagree with the proposal, say so inside the 30 days and send the paper that supports you. A quiet “I disagree” with no documents rarely moves anyone.
Mistakes to avoid and how long to keep records
Don’t rebuild books after the letter arrives. Late entries with today’s date look worse than gaps, and a missing receipt is better explained than replaced. Keep records for six years from the end of the last tax year they relate to. If you filed late, the six years start from the filing date.
And don’t throw records out early. Destruction without written permission on Form T137 can lead to prosecution, according to the CRA.
A better use of those weeks is a one-page cover note for each year under review. List where the sales records live, which bank accounts the business used, who did the bookkeeping, and how personal and business costs were separated. Auditors read a lot of messy files. A clear note up front tells them you know your own books, and it often shortens the questions that follow.
Our sources
The audit process, the record types, the warning signs and the 30 day proposal period come from the Canada Revenue Agency‘s business audit pages and its tips on small and medium business audits, plus the RC4188 booklet quoted above. Record retention comes from its record-keeping page. The tax figures come from this site’s calculators, using 2026 federal and Ontario data, and are examples rather than predictions.
Frequently asked questions
Does the CRA publish a list of the most frequent audit findings?
We didn't find a ranked list. It does publish warning signs it uses to decide when to verify income indirectly.
Can the CRA look at my personal bank statements?
Yes. It says it can ask for the owner's personal bank, mortgage and credit card statements, and the records of related people or entities.
How long do I have to respond to a proposed adjustment?
The CRA says the proposal letter gives you 30 days to respond before the audit is finalized.
Can I object if I disagree with the result?
Yes. You can object to an assessment, and the CRA says you may not have to pay the extra tax while the objection is being resolved.
How long should I keep my records?
Six years from the end of the last tax year they relate to. Records of long-term property and share registers have no end date.
- Dealing with the CRA: letters, audits and payments
Dealing with the CRA: what to do when a letter arrives, how a review differs from an audit, how My Account helps, and what to do if you can't pay