The CRA Audit Process, Step by Step

A Canada Revenue Agency audit is not a single event. It is a structured, evidence-based review of one or more tax years that moves through a predictable sequence of stages, each with its own deadlines and its own consequences. Understanding where you are in that sequence — and what comes next — is the difference between shaping the file early and reacting to a reassessment after the auditor's conclusions have hardened.

This guide walks through the full lifecycle of a CRA audit, from the moment a return is selected for review to the point where the file either closes or moves into the objection and appeal track. The earlier a taxpayer engages strategically, the more options remain open.

Stage 1: Selection

Before you ever hear from the CRA, your file has already been chosen for review. The CRA selects returns for audit through several channels: computer-driven risk scoring that compares your return against statistical norms for your income level and industry; third-party data matching (T-slips, supplier and customer records, real-estate registry data, foreign-account information exchanged under information-sharing agreements); referrals from other audits or from CRA programs; and, in a smaller number of cases, random selection used to calibrate the CRA's risk models.

Selection itself carries no implication of wrongdoing. Many audited returns are entirely correct. But selection does mean the CRA has decided your return warrants closer scrutiny, and the way you respond from the first contact onward shapes the entire file. For more on what causes a return to be flagged, see our guide on what triggers a CRA audit.

Stage 2: Initial contact and the audit query letter

The audit usually begins with a letter. The initial contact letter notifies the taxpayer that an audit has been opened, identifies the years and the issues under review, and typically includes a list of documents the auditor wants to see together with a deadline for production — most often 30 days.

For business audits, the initial contact may also propose a site visit to review books and records and to interview the taxpayer or a representative. The auditor will usually identify themselves, their team leader, and the scope of the review.

The information requested at this stage is the foundation of everything that follows. Some practical points to keep in mind:

• Read the letter carefully and confirm the scope. Which years? Which issues? Is this a full audit, a limited-issue review, or a GST/HST review? The answer governs how you should respond.
• Diary the deadline immediately. Extensions are sometimes available on request, but silence escalates the file. An auditor who hears nothing tends to assume the worst and document accordingly.
• Produce precisely what was asked for — no more. Voluminous, unstructured production tends to generate new audit issues rather than fewer. Tailored, organized production keeps the review focused.

Stage 3: Information gathering and audit queries

Once the auditor has the initial records, the review moves into information gathering. The auditor compares your returns and financial statements against supporting documents, bank statements, and third-party information. For business files, the auditor may examine the general ledger, trial balances, source documents, and the minute book, and may conduct a site visit.

As specific questions arise, the auditor sends written audit queries — questions about particular transactions, deductions, or income items. Each query carries an implicit deadline, usually 30 days. The quality of these responses matters enormously. A casual or speculative answer can become an "assumption of fact" that the taxpayer later has to disprove. A precise, evidence-backed response can close an issue before it grows.

A point that is easy to overlook: every communication with the CRA forms part of the audit file. Loose explanations, off-the-record remarks, and unprepared conversations with the auditor routinely reappear later in the auditor's working papers and, if the file proceeds, in Tax Court. Treating the audit as a record rather than a conversation is one of the most useful disciplines a taxpayer can adopt.

How long does information gathering take?

A straightforward personal audit may move through information gathering in a few months. A multi-year business audit, a GST/HST audit, or an audit involving several related entities can take much longer — sometimes 18 months to three years or more from the first letter to the final reassessment.

The auditor's information-gathering powers

The CRA's authority to obtain information during an audit is broad. Under section 231.1 of the Income Tax Act, an auditor may inspect a taxpayer's books and records and enter business premises. Under section 231.2, the CRA can issue a formal "requirement" compelling the taxpayer — or a third party such as a bank — to provide documents and information. In some circumstances the CRA can obtain an "unnamed persons" requirement to identify a group of taxpayers it has not yet named. The practical takeaway is that refusing to provide records the auditor can otherwise compel rarely helps; the more productive approach is to engage strategically and to consider the legal implications of each disclosure rather than treating cooperation, or refusal, as automatic. Our article on the unnamed persons search covers one of these powers in more detail.

The site visit

For business audits, the auditor may ask to visit the premises to review books and records and to observe the operation. Site visits are routine in many files, but they should be planned rather than improvised: who will be present, which records will be available, and what topics will and will not be discussed. Casual conversations during a site visit frequently generate assumptions of fact that the taxpayer later has to disprove, so a prepared, professional approach to the visit protects the file.

Stage 4: The proposal letter

Before issuing a reassessment, the auditor sends a proposal letter — sometimes called a "30-day letter." This is the most important document in the audit. It sets out the proposed adjustments, the legal basis for each, and any proposed penalties (often gross negligence penalties under subsection 163(2) of the Income Tax Act, which are 50% of the tax on the unreported amount).

The proposal letter is, in most files, the last clean opportunity to shape the evidentiary record before the auditor's position is locked into a reassessment. Many taxpayers make the mistake of waiting until reassessment to push back — by which point the audit team has already documented its conclusions and the CRA's position has hardened.

It is worth understanding why this stage carries so much weight. Once a reassessment issues, the dispute shifts onto the objection and appeal track, where the assumptions of fact in the assessment are presumed correct and the burden of displacing them sits with the taxpayer. At the proposal-letter stage, by contrast, the conclusions are still only proposed. New evidence introduced now can persuade the auditor to drop or narrow an adjustment before it ever hardens into a presumed fact. A document that closes an issue at the proposal stage is far more valuable than the same document produced a year later in an objection.

The proposal letter also tells you exactly what the auditor's theory of the file is — the provisions relied on, the amounts in dispute, and the basis for any penalty. That clarity is itself useful. It lets the response target the auditor's specific reasoning rather than guessing at it, and it reveals whether the file is heading somewhere routine or somewhere that warrants a more careful, privileged approach.

The response window is usually 30 days. Within that window, the taxpayer (or a representative) responds with submissions, evidence, and legal argument. A strong proposal-letter response is written as a legal submission: it states the relevant provisions, marshals the documents, and addresses each proposed adjustment and each proposed penalty on its own terms. Where the auditor's position is unsupportable, the response says so on the record. Where a meeting with the auditor and team leader would help, it requests one.

Stage 5: The response window — what to do with 30 days

Thirty days is short for a substantive file. A focused response in that window typically involves:

• Confirming the deadline and requesting an extension if needed. A reasonable extension request, made before the deadline, is often granted.
• Building the evidentiary record. Assembling documents, third-party records, and — where appropriate — independent valuations or an expert report from a valuator or forensic accountant.
• Framing the legal argument. Each adjustment is met with the applicable law and the supporting evidence stated plainly.
• Addressing penalties separately. Gross negligence penalties carry their own legal standard and the CRA bears the burden of proof on them. They are frequently defensible even where some of the underlying adjustment survives.
• Preserving objection and appeal rights. Ensuring that nothing in the response inadvertently prejudices the taxpayer's later position.

Stage 6: Reassessment

If the CRA proceeds after the proposal-letter stage, it issues a notice of reassessment. The reassessment crystallizes the auditor's conclusions into a tax debt, and from this point the file leaves the audit track and enters the objection and appeal track.

A few timing rules govern whether the CRA can reassess at all:

• Normal reassessment period. Generally three years from the date of the original notice of assessment for individuals and Canadian-controlled private corporations, and four years for other corporations and mutual fund trusts. For GST/HST, the basic period is generally four years.
• Beyond the normal period. The CRA may reassess outside the normal reassessment period where it can establish, under subparagraph 152(4)(a)(i), a misrepresentation attributable to neglect, carelessness, or wilful default, or fraud. This is how older years get pulled into an audit.

Stage 7: Next steps — objection and appeal

A reassessment is not the end of the road. The taxpayer can file a notice of objection, which sends the file to the CRA Appeals division — a function separate from the audit team, staffed by officers who review the file afresh.

The objection deadline is strict. For individuals, it is the later of 90 days from the date of the reassessment or one year from the filing-due date of the return for the year in question. For corporations, it is 90 days from the date of the reassessment. Missing the deadline can require a separate extension application, which is not always granted.

If the objection does not resolve the dispute, the next step is an appeal to the Tax Court of Canada. A disciplined audit defence plans for this possibility from the outset: building the record during the audit as if the file may end up in court tends to produce both better records and stronger outcomes. You can read more about these later stages on our pages for tax disputes and objections and the Tax Court of Canada.

Common mistakes during an audit

Across many files, the same avoidable errors recur. Recognizing them is half the battle:

• Treating the audit as a conversation rather than a record. Every response to the CRA forms part of the audit file. Off-the-record remarks and speculation routinely resurface in the auditor's working papers.
• Sending more than was asked for. Unstructured, voluminous production tends to create new audit issues rather than resolving the existing one. Production should be tailored to what was properly requested.
• Letting the taxpayer speak to the auditor without preparation. Casual conversations, especially in business audits, generate assumptions of fact the taxpayer later has to disprove.
• Missing the proposal-letter stage. Waiting until reassessment to respond cedes the most flexible moment in the file.
• Ignoring penalty exposure. Gross negligence penalties are common and frequently defensible, but only when the legal framing is built into the file early.
• Extinguishing a voluntary-disclosure option. The wrong audit response can foreclose a disclosure that was still available for years outside the audit's scope.

A note on voluntary disclosure

The Voluntary Disclosures Program allows a taxpayer to correct past errors or omissions before the CRA contacts them about the matter. Critically, once an audit has begun, the program is generally unavailable for the issues the auditor has already identified. There may still be eligibility for unrelated years or issues that fall outside the audit's scope — but the window can close quickly, and the wrong audit response can extinguish the option. This call is best made before responding to the auditor. See our overview of the Voluntary Disclosures Program.

Frequently asked questions

How long does a CRA audit take?

A simple audit can resolve in three to six months. Complex business audits, GST/HST audits, or audits spanning multiple years and entities can take 18 months to three years or longer.

Can the CRA audit prior years?

Generally the CRA can reassess within three years (individuals and Canadian-controlled private corporations) or four years (other corporations) of the original notice of assessment. Beyond that, it must establish a misrepresentation attributable to neglect, carelessness, or wilful default, or fraud, under subparagraph 152(4)(a)(i). For GST/HST the basic period is generally four years.

What happens if I miss an audit-query deadline?

Silence tends to escalate the file and may prompt the auditor to proceed on assumptions unfavourable to the taxpayer. A reasonable extension request, made before the deadline, is often granted; ignoring the deadline is rarely a good outcome.

Do I have to let the auditor into my business?

Site visits are routine for many business audits, and the CRA has statutory inspection powers. The visit should be planned rather than refused outright — who attends, which records are available, and what will be discussed.

How Barrett Tax Law approaches an audit file

Barrett Tax Law represents Canadian taxpayers and corporations through CRA audits. Our process follows a consistent framework whether the file is small or large: we confirm the scope and the statutory provisions in play; we diary every CRA, internal, and statutory deadline; we preserve objection and appeal rights at every step; we build the evidentiary record alongside the client and their accountant; we frame each response to the CRA as a legal submission; and we plan the file from the beginning as if it may end up in Tax Court.

One structural point is worth emphasizing. Communications between a taxpayer and a tax lawyer are protected by solicitor-client privilege; communications with an accountant generally are not. In files where the exposure is meaningful, that distinction can matter a great deal. For more on audit representation, see our audit representation page.

If you have received an audit letter, an audit query, or a proposal letter, the file is most flexible right now. Engaging early, before a reassessment issues, keeps the widest set of options on the table.