Updated Checked by the Tax-Services.ca editorial team How we check
Canadian law doesn’t hand every business one list of internal controls. What it does set is narrower: corporations under the Canada Business Corporations Act must get approved financial statements in front of shareholders, public companies must certify their controls over financial reporting, and the CRA expects records you can produce for six years. Everything else is a choice, and a good one saves you money.
Which internal control requirements are actually written down?
Three sources cover most of it, and they apply to different businesses.
| Source | Who it applies to | What it asks |
|---|---|---|
| Canada Business Corporations Act | Federally incorporated corporations | Directors approve and sign the financial statements, which go to shareholders at least 21 days before the annual meeting unless shareholders opt out in writing |
| National Instrument 52-109 | Reporting issuers (public companies) | The CEO and CFO certify disclosure controls and internal control over financial reporting; a venture issuer’s basic certificate leaves those parts out |
| CRA record keeping (RC188) | Every business | Keep records for six years from the end of the last tax year they relate to |
That’s the written part. If one of these applies to you, read the source itself before you build a compliance plan around a summary like this one, since the wording matters. Provincial corporate laws are separate and aren’t covered here.
What if you run a small private company?
Then no rule tells you to have a two-signature policy or a monthly bank reconciliation. That doesn’t make them optional in practice. A bank, an investor or a buyer will ask how you know the numbers are right, and the CRA can ask for records and receipts behind every line of a return.
So the useful question isn’t what the law forces. It’s where a mistake or a theft would hurt most, and what cheap step would catch it.
Which controls are worth having first?
Start where money leaves. Two ideas do most of the work in a small business: nobody should both approve a payment and record it, and somebody other than the person who handles the cash should look at the bank statement each month.
Take payroll. Two employees paid $3,000 each every two weeks in Ontario mean $1,922.06 to remit per pay period, using the payroll remittance calculator. If one person runs payroll, writes the cheque and reconciles the account, an error can sit for months. If the owner glances at that number against the bank each period, it can’t.
Sales tax is the same story. An Ontario invoice for $1,500 should show $195 of HST, so $1,695 in total, per the GST/HST calculator. Spot checks like that catch a wrong tax code before it repeats two hundred times.
Margins give you a warning system too. If the profit margin calculator says an item at $60 cost and $100 price should give 40% gross margin, and your monthly numbers show 30%, something leaked. Stock, discounts, a supplier price rise or a mispriced sale are all suspects.
What does a simple monthly routine look like?
Pick one afternoon a month, same day each time. Reconcile the bank account to the books. Scan the list of what customers owe for anything past due. Compare payroll on the books to what you remitted. Look at the three biggest expenses and ask whether each one makes sense.
That’s about two hours for a shop with a few dozen transactions a week, and it catches most of what goes wrong. If you’re the owner, do it yourself at least every quarter, even when a bookkeeper handles the rest. Think of it as the cheapest insurance you’ll buy.
How do you keep records that stand up?
The CRA counts computer records as records: accounting software, point of sale systems and tax software all count. Its guide Keeping Records says you must keep records for six years from the end of the last tax year they relate to, unless you have permission from the CRA to destroy them earlier. It also expects records held by third parties to be produced on request. So a control that works is a yearly export of your books and bank data that you store yourself, separate from your provider.
Write down who can do what in a page, not a manual. Who can approve a payment over a set amount? Who can change a supplier’s bank details? A call to a known number before you change them stops a common kind of fraud. Set your own limits, since the law doesn’t give you numbers.
Where do businesses trip?
The owner is the exception to every rule. They sign cheques, approve them and reconcile them, and that’s fine until a bookkeeper leaves and nobody knows the process. Another slip is trusting software to do it. Software records what you give it, and it can’t tell that a customer was billed the wrong tax.
The last is documents. Sending financial statements to shareholders is easy to forget in a small family corporation, and the 21 day period counts back from the meeting. Check your own bylaws and the Act’s section on opting out in writing.
How we checked the figures
Corporate duties come from the Canada Business Corporations Act (sections 155, 158 and 159) on the federal Justice Laws site. Certification rules come from the Ontario Securities Commission’s page for NI 52-109. Records rules come from CRA publication RC188. Tax and remittance figures come from our calculators, using 2026 data.
Frequently asked questions
Does a small private business have to have internal controls by law?
We found no single rule that sets a list for every business. Corporations must approve financial statements, and every business must keep records for six years.
What does NI 52-109 require?
Reporting issuers' CEOs and CFOs certify disclosure controls and internal control over financial reporting. A venture issuer basic certificate leaves out those representations.
Who must approve the financial statements of a federal corporation?
The directors approve them and the approval is signed. The statements go to shareholders at least 21 days before the annual meeting unless shareholders opt out in writing.
How long do I keep financial records?
Six years from the end of the last tax year they relate to, unless the CRA gives written permission to destroy them sooner.
What is the cheapest control to start with?
Split approving a payment from recording it, and have someone else read the bank statement each month.
All family and benefits calculators
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST