Nine CRA audit red flags for small businesses, and how to stay off the list

CRA audits of small businesses are driven by risk scoring, not bad luck. A file is selected because something in it stands out against what the CRA expects from a business of that size in that industry: a ratio, a refund, a slip that does not match, a data feed from a platform or a land registry. Most of the triggers are visible in your own books long before the CRA sees them. Below are the nine we meet most often in Ontario small business files, what the CRA is actually looking at in each case, and what to do when a letter arrives.

The nine red flags

1. Ratios outside your industry benchmark

Every T2125 and T2 carries an industry code, and the CRA compares your gross margin, cost of sales, wage ratio and expense lines against the pooled returns of businesses under the same code. A restaurant with food cost far above the sector norm, or a consulting practice whose vehicle line looks like a courier company's, gets flagged. Outliers are not wrong by definition; a new location, a bad year or an unusual model explain many of them, but you need to be able to explain yours. A wrong industry code makes every ratio look strange, so we check the code before we check the numbers.

2. Losses year after year

A business that loses money for three or four consecutive years while its owner has employment or investment income to absorb the loss invites the question of whether it is a business at all. The CRA looks for a personal element, such as a hobby farm, a horse, a boat or a photography sideline, and can deny losses where the activity is not carried on in a commercial manner. Genuine start-ups lose money. A business plan, a pricing model and evidence of trying to turn a profit are what separate a deductible loss from a lifestyle.

3. Large or repeated GST/HST refunds

A net tax refund claim is reviewed before it is paid, and the review usually asks for the largest purchase invoices behind the input tax credits. Perpetual refund positions are legitimate for exporters, zero-rated suppliers and businesses in a build-out phase, but each refund is a fresh look at the file, and a run of refunds from a business selling taxable goods in Ontario is a strong signal. Invoices must meet the CRA's documentation rules, including the supplier's registration number once a purchase reaches $100, and credits on inputs used for exempt activities are not claimable at all. Our explainer on how input tax credits work covers the thresholds.

4. A cash-heavy sector

Restaurants, salons, contractors, convenience stores and taxis are audited more often because unreported cash is easier to generate in those trades. The CRA does not need your records to build a case: it can use indirect methods such as a net worth assessment, a bank deposit analysis or a projection from supplier purchases, and it examines point-of-sale data where sales suppression software is suspected. Daily sales reports that tie to deposits, and a POS whose history is retained, are the defence.

5. Personal expenses running through the business

Family travel booked as a conference, meals claimed at 100% instead of 50%, clothing, a home renovation coded to repairs, a cottage internet bill: these show up as expense lines out of proportion to revenue, and once an auditor finds one they look for the rest. The fix is structural rather than heroic. A separate business account and card, a real reimbursement process and a bookkeeper who queries anything odd will do more than any amount of explaining afterwards; see how to separate business and personal expenses.

6. Vehicle claims without a logbook

Vehicle expenses are among the most frequently disallowed deductions in a small business audit, and the reason is nearly always the same: no logbook. The CRA expects a full-year record of business trips with dates, destinations, purpose and kilometres for at least one base year; after that, a three-month sample log can support the claim if it lands within 10 percentage points of the base year. A claim of 90% or 100% business use on the household's only vehicle is a flag on its own. Our answer on tracking vehicle mileage for the CRA covers apps and the sample-log method.

7. Slip and information-return mismatches

The CRA's matching program compares what payers report about you with what you report about yourself. A T4A from a client that is missing from your business income, a T5018 filed by a general contractor that exceeds the revenue you declared, foreign investment income absent from a return that carries a T1135, a T5 from your own corporation that never reached your T1: each is an automatic query. Cross-border files are especially exposed because US slips such as the 1042-S and 1099 can reach the CRA under information-exchange arrangements. Our guides on the T1135 and T4A slips explain what is being matched.

8. Real estate flips and assignments

Land registry data reaches the CRA directly, so a property bought and sold within a short period is visible without any return being filed. Since January 1, 2023, a residential property held for fewer than 365 days is deemed to produce business income on sale, fully taxable and with no principal residence exemption, unless one of the listed life events applies. Assignment sales of new homes are subject to HST, and claiming the principal residence exemption on a property you never lived in is one of the CRA's stated enforcement priorities. Anyone building to sell or holding a rental portfolio should start with our real estate accounting hub.

9. Platform economy data

Since January 1, 2024, digital platforms have been required under Part XX of the Income Tax Act to collect and report their Canadian sellers' identities and income to the CRA, with the first reports covering 2024 filed in early 2025. Rideshare, delivery, short-term rental, marketplace and freelance platforms are all included. The CRA now sees gross platform income by seller, so earnings from Uber, Airbnb, Etsy or Upwork that never appear on a return are matched the same way a T4 is. It also brings the $30,000 GST/HST registration threshold into view for sellers who assumed nobody was counting.

What an audit letter looks like

An audit normally opens with a letter, sometimes preceded by a phone call, from a named auditor at a CRA tax services office. It states the program (income tax, GST/HST or payroll), the years or reporting periods under review, and the records to produce: general ledger, bank and credit card statements, invoices, receipts, contracts, payroll records and, often, the owner's personal bank statements. It gives a response date, typically about 30 days out, and says whether the audit will be handled by correspondence, at a CRA office or at your premises. A legitimate CRA auditor will never demand payment by gift card, e-transfer to a personal account or cryptocurrency; if anything about the contact feels off, call the CRA's business enquiries line to confirm the auditor before sending a single document.

Your rights during a CRA audit

The Taxpayer Bill of Rights applies throughout. The rights that matter most in practice are these: you may be represented by an accountant or lawyer and have all contact routed through them once an authorization is on file; you may ask what the auditor is looking for and why; you receive a proposal letter setting out intended adjustments and have 30 days to respond before a reassessment is issued; and once a Notice of Reassessment arrives you have 90 days to file a Notice of Objection. The CRA can normally reassess only within three years of the original assessment for individuals and Canadian-controlled private corporations, extended where there has been misrepresentation or where you signed a waiver. You are not obliged to sign a waiver, and we advise clients not to do so without understanding exactly why the auditor wants one.

How to prepare in the first 30 days

The single most useful thing to do before the auditor sees anything is to reconcile every bank and credit card account to the general ledger for the years in question and write a short memo explaining any large or unusual items. Auditors work from bank statements; when your books tie to them the audit tends to be short. When they do not, the CRA builds its own version of your income from deposits and you argue from behind. Our answer on what triggers a CRA audit and how to prepare has a records checklist.

If you find unreported income or an unfiled return before the CRA contacts you, the Voluntary Disclosures Program can remove penalties and part of the interest, but only while the disclosure is still voluntary. The CRA revised the program's terms in late 2025, so check the current conditions before deciding what to disclose and how.

When to bring in representation

For a correspondence review asking for a handful of receipts, an organised owner can often respond alone. Bring in a representative at the outset when the audit covers more than one year, pairs GST/HST or payroll with income tax, asks for personal bank statements, involves a cash-heavy business, or touches anything cross-border. The value of representation lies less in argument than in control of the process: a representative keeps answers precise, stops the scope creeping into years and issues that were never in the letter, and recognises when a proposed gross negligence penalty of 50% of the understated tax is being applied where it should not be. Clean, current books are what make representation cheap, and our bookkeeping service exists partly so that clients' files are already in order the day the letter comes.

Sources: CRA — Taxpayer Bill of Rights · CRA — Voluntary Disclosures Program.