What Triggers a CRA Audit

Most CRA audits are not random. The Canada Revenue Agency reviews tens of millions of returns each year and audits only a fraction of them, so the agency relies heavily on risk scoring, data matching, and pattern analysis to decide where to look. Understanding the factors that draw attention helps taxpayers file accurately, document carefully, and avoid the kinds of inconsistencies that put a return at the front of the queue.

This guide explains the common audit triggers, the industries that tend to attract extra scrutiny, the difference between random and targeted selection, and practical steps that reduce risk. None of these triggers means a taxpayer has done anything wrong — they simply increase the statistical likelihood that the CRA takes a closer look.

How the CRA decides what to audit

The CRA's selection process combines several tools:

• Risk scoring. Software compares each return against statistical norms for the taxpayer's income level, occupation, and industry. Returns that deviate sharply from the norm are flagged for human review.
• Third-party data matching. The CRA receives information from employers, financial institutions, investment firms, foreign tax authorities, provincial registries, and many other sources. When the data on file does not match what was reported, the discrepancy can trigger a review.
• Audit referrals. An audit of one taxpayer often surfaces information about others — suppliers, customers, family members, business partners — whose returns are then examined.
• Sector and project audits. The CRA periodically focuses resources on particular industries or arrangements it considers higher-risk.
• Public and online information. The CRA can and does look at publicly available information, including social-media activity, when it is assessing whether a taxpayer's apparent circumstances line up with what was reported.

It is important to keep this in perspective. A single red flag rarely produces an audit on its own; the agency's systems look for combinations and for deviations from what is normal for a taxpayer's profile. The aim of this guide is not to make anyone anxious about filing an ordinary return, but to explain the patterns so that accurate returns are also well-documented returns.

Common red flags

Income that doesn't match third-party data

The single most reliable trigger is a mismatch between reported income and the slips and records the CRA already holds. Unreported T-slips, omitted investment income, and gaps between reported revenue and the deposits visible in bank records are among the first things the agency's systems catch. Because the CRA receives this third-party data directly from employers, financial institutions, and investment firms, a discrepancy is often visible to the agency before the taxpayer is even aware of it. Reconciling a return against every slip and every account before filing closes this gap entirely.

Expenses that are large relative to income

Business and employment expenses that are high in proportion to the revenue or income they support attract attention. Home-office claims, vehicle expenses, meals and entertainment, and management fees are recurring areas of scrutiny — not because they are improper, but because they are easy to overstate and hard to substantiate after the fact.

Repeated or large business losses

A business that reports losses year after year, particularly one with personal-enjoyment elements, can prompt the CRA to ask whether there is a genuine source of business income or whether the activity is really a hobby. Sustained losses against other income are a classic point of inquiry.

Round numbers and inconsistent records

Returns built on suspiciously round figures, estimates that change between years, or records that do not reconcile internally invite questions. Contemporaneous, consistent documentation is the antidote.

Real estate activity

Frequent property purchases and sales, the characterization of a gain as capital rather than business income, and claims for the principal-residence exemption are heavily monitored. The CRA receives real-estate transaction data and cross-references it against reported dispositions.

Cryptocurrency and digital income

Income from cryptocurrency trading, online platforms, content creation, and the gig economy is an area of growing focus. The CRA has expanded its ability to obtain platform and exchange data, and unreported digital income is increasingly visible to the agency.

Foreign assets and income

Failure to report foreign income, or to file the required foreign-asset disclosures (such as Form T1135 for specified foreign property over the reporting threshold), is a significant trigger. International information-sharing arrangements mean the CRA often already has data about offshore accounts.

Lifestyle inconsistent with reported income

Where a taxpayer's visible standard of living — property, vehicles, travel — appears inconsistent with reported income, the CRA may open an indirect-income review. These reviews reconstruct income from changes in net worth or from bank deposits. We cover them in detail in our guide to net worth audits and indirect-income assessments.

Cash-intensive operations

Businesses that handle significant cash are, as a category, audited more often, because cash transactions are harder to trace and easier to underreport. Strong record-keeping is especially important in these sectors.

Aggressive or unusual deductions and tax shelters

Participation in arrangements the CRA considers abusive — certain gifting tax shelters, loss-creation schemes, and similar structures — draws concentrated attention, and the CRA has dedicated resources to challenging them. Deductions or credits that are large, unusual for the taxpayer's profile, or tied to a promoted arrangement are more likely to be examined. A position that is genuinely supportable is not the problem; a position built on an arrangement the CRA has publicly signalled it is targeting is a different matter.

Shareholder transactions and management fees

Loans to shareholders, benefits conferred on shareholders, and management or consulting fees paid between related parties are recurring areas of inquiry. The CRA examines whether amounts characterized as loans are genuinely repayable, whether benefits have been properly included in income, and whether intercompany fees reflect real services. Clear documentation and consistent treatment year over year reduce the friction here considerably.

GST/HST mismatches

For registrants, input tax credits that are large relative to taxable revenue, GST/HST collected that does not reconcile with reported sales, and place-of-supply or zero-rating positions on exports are all monitored. GST/HST reviews can also surface director-liability exposure, which reaches individuals personally.

Industries that draw extra scrutiny

While any taxpayer can be audited, certain sectors recur in the CRA's project work, generally because of cash intensity, documentation challenges, or historical compliance patterns:

• Construction and the trades, including subcontractor arrangements.
• Restaurants, bars, and food service.
• Personal services such as salons and other appointment-based businesses.
• Real-estate investors, builders, and frequent flippers.
• Professionals operating through corporations.
• Ride-share, delivery, and other gig-economy work.
• Online sellers, content creators, and influencers.
• Cryptocurrency traders and investors.
• Staffing and employment agencies.

Inclusion on this list is not a verdict. It simply reflects where the CRA has historically directed audit resources. Our overview of common audit triggers covers additional examples drawn from the firm's files.

Random versus targeted audits

The CRA conducts both random and targeted audits, and the distinction affects how the file behaves.

Random audits are a small share of the total. They are used to calibrate the agency's risk models and to measure overall compliance. A taxpayer selected at random has not done anything to attract attention; the file simply happens to fall within a statistical sample. Random audits still require a full, organized response, but they do not carry the same presumption of an identified problem.

Targeted audits make up the large majority. These follow from risk scoring, data mismatches, referrals, or sector projects — the agency has identified something specific it wants to examine. Targeted files tend to be more focused on particular issues and benefit most from a precise, evidence-driven response.

There is also a spectrum of intensity within targeted reviews. At the lighter end are desk reviews and "matching" letters, where the CRA simply asks the taxpayer to support a particular claim — a donation receipt, a medical-expense total, a child-care deduction. These are not full audits, but they should still be answered promptly and with documentation, because an unsatisfactory response can escalate into a broader review. At the heavier end are full-scope business audits and indirect-income reconstructions, where the CRA reconstructs income from changes in net worth or from bank deposits. The same principle applies across the spectrum: a precise, well-documented response keeps the review proportionate to the issue.

How to reduce your audit risk

No taxpayer can eliminate the possibility of an audit, and accurate reporting should never be sacrificed to avoid attention. But several habits genuinely lower risk and, just as importantly, make any audit that does occur far easier to manage:

• Report all income, and reconcile to third-party data. Match your return against your slips and your bank records before filing. The most common trigger is also the most avoidable.
• Keep contemporaneous records. Retain receipts, invoices, mileage logs, and contracts as transactions happen — not reconstructed years later. Documentation created at the time is far more persuasive.
• Document family transactions. Gifts and loans between family members are legitimate and common, but undocumented, they are easily recharacterized as unreported income. Written agreements and payment records matter.
• File foreign disclosures correctly. Report foreign income and file the required foreign-property disclosures on time.
• Be consistent year to year. Large, unexplained swings invite questions. Where a genuine change occurs, keep the explanation and the supporting evidence on file.
• Get advice on grey-area positions. Where the characterization of an item is genuinely uncertain — capital versus income, the deductibility of a category of expense — documented, reasonable professional advice both improves the position and supports a penalty defence if the issue is ever challenged.
• Keep business and personal finances separate. Commingled accounts make it far harder to demonstrate which deposits are business revenue and which are personal transfers, gifts, or loans — a distinction that becomes central if the CRA ever runs a bank-deposit or net worth analysis.
• Respond to small CRA letters promptly. A matching letter or a request to support a single claim is not a full audit, but ignoring it or answering it poorly can turn a narrow review into a broad one.

What being audited does — and does not — mean

It bears repeating that an audit is not an accusation. The CRA reviews returns to verify them, and a large share of audited returns are confirmed as filed or adjusted only modestly. Selection means the agency wants a closer look, not that it has concluded anything. Equally, an audit is not something to face casually: the way a taxpayer responds from the first letter onward shapes the entire file, and small missteps early can create issues that take far longer to unwind than they would have taken to avoid. The right posture is neither panic nor indifference, but a careful, documented, well-advised response.

If an audit begins anyway

Even careful taxpayers get audited. If you receive an audit letter or query, the way you respond from the first contact shapes the whole file. Our guide to the CRA audit process, step by step walks through what to expect at each stage and how the deadlines work.

What to do if you spot a problem before the CRA does

Reviewing the triggers above sometimes prompts a taxpayer to realize that a past return contains an error or an omission — unreported income, a foreign account that was never disclosed, a deduction that cannot be supported. Where the CRA has not yet contacted you about the matter, the Voluntary Disclosures Program may allow you to correct it before it becomes an audit, often on more favourable terms than waiting to be found. The eligibility rules are specific and the timing is delicate, so this is a decision to make with advice rather than on instinct. Critically, once an audit has begun, the program is generally closed for the issues the auditor has identified — which is why acting early matters. See our overview of the Voluntary Disclosures Program.

Barrett Tax Law represents Canadian taxpayers and corporations through CRA audits, from pre-audit risk reviews to proposal-letter responses and the preservation of objection and appeal rights. A useful structural point: communications with a tax lawyer are protected by solicitor-client privilege, while communications with an accountant generally are not — a distinction that can matter where the exposure is significant. For more, see our page on audit representation.