CRA Audit Defense: What to Do When You Get the Letter
A letter from the Canada Revenue Agency lands in your mailbox, or a notification shows up in My Business Account, and your stomach drops. Before you do anything else, take a breath. A CRA audit is a process, not a verdict, and how you handle the first few days shapes how the whole thing goes.
Most of what people do wrong in an audit happens early — in the panic. They call CRA and start explaining. They email their bookkeeper a long, anxious account of everything they think might be wrong. They dig out a box of receipts and ship the whole thing over without looking at it. None of that helps, and some of it actively hurts.
This is a CRA audit defense playbook for the first 48 hours: what the letter actually means, what to do, what not to do, and the one rule about privilege that almost nobody outside the profession knows.
Key takeaways
A "review" is not an audit. CRA's matching program and processing reviews are routine accuracy checks; an audit is a deeper examination under sections 231.1 and 231.2 of the Income Tax Act. Read the letter to know which one you're facing.
There is no accountant-client privilege in Canada. Your accountant's working papers, file notes, and emails are compellable by CRA. Only communications with a lawyer are protected by solicitor-client privilege (section 232).
CRA normally can't reach back more than three years (four for non-CCPC corporations) from your notice of assessment under subsection 152(3.1) — unless there was misrepresentation due to neglect, carelessness, or fraud, in which case the window opens indefinitely.
Keep your records for six years from the end of the tax year they relate to (section 230(4)). If you can't produce them, CRA can estimate your income using indirect methods like a net-worth assessment.
You have 30 days (typically) to respond to a proposal letter before the audit is finalized, then 90 days to file a formal objection once a reassessment is issued.
First, figure out what kind of letter it is
CRA contact comes in three flavours, and they are not equally serious. Knowing which one you're holding tells you how to respond.
A review or matching letter is the lightest touch. CRA's matching program cross-checks your return against the slips third parties filed about you — T4s, T5s, T3s, T5008s — and flags mismatches. A processing review asks you to back up a specific claim (a donation, a medical expense, child-care costs) with receipts. CRA itself is explicit that a review "is not a tax audit." It's a clerical accuracy check, and it's usually resolved by mailing in the document they asked for. Don't over-react to one.
A desk audit (or office audit) is a step up. It's conducted from a CRA office, mostly by correspondence, and it's narrower in scope — a single deduction, a particular year, a specific line on the return. You'll be asked to send documents and answer questions in writing.
A field audit is the serious one. An auditor proposes to visit your home or place of business, examine records on-site, and look at the whole picture rather than one line item. CRA reserves field audits for more complex files — businesses, multiple years, situations where the numbers don't reconcile cleanly. If you've been selected for a field audit, this is the point to bring in your CPA before you respond.
Read the letter — slowly, twice
Before you reply, pin down two things from the letter itself: the deadline and the scope.
The deadline is usually printed plainly — a date by which CRA wants a response or documents. Calendar it immediately, and calendar a reminder a week before. If you need more time, you can almost always ask for an extension; auditors deal with this constantly and a reasonable request early is far better than a missed date.
The scope tells you what CRA is actually looking at — which tax years, which accounts, which issues. This matters because it sets the boundary of what you should hand over. An auditor reviewing your 2024 vehicle expenses is entitled to your 2024 vehicle records. They are not automatically entitled to a tour of every transaction in your business. Knowing the scope keeps you from over-disclosing.
The first 48 hours: what to do
Don't call CRA to "explain." A phone call where you talk through what you think might be wrong is the single most common early mistake. Anything you volunteer becomes part of the file. Acknowledge the letter if a response is required, confirm the deadline, and route substance through your representative.
Loop in your CPA before you respond. If you have an authorized representative on your CRA account, CRA can deal with them directly. A representative who has seen hundreds of audits knows what's normal, what's a fishing expedition, and what an answer implies.
Gather and organize — but review first. Pull the records for the years and issues in scope. Read them before anyone else does. If your bookkeeping is clean, this is straightforward; if it isn't, you want to know what's there before CRA does.
Answer the question that was asked — and only that question. Give CRA exactly what the scope covers, organized and labelled. Don't append your own commentary, don't include unrelated years, and don't editorialize.
Cooperating is not the same as conceding. You're required to give reasonable assistance and answer proper questions under subsection 231.1(1). You are not required to build CRA's case for it.
The privilege trap nobody warns you about
Here's the rule that surprises almost every business owner: in Canada, there is no accountant-client privilege.
People assume that whatever they tell their accountant is protected the way a conversation with a lawyer is. It isn't. The Federal Court of Appeal settled this in Tower v. M.N.R., 2003 FCA 307, refusing to extend privilege to tax advice from an accountant. The court's reasoning was blunt: an accountant operates knowing that the Minister has the power to compel disclosure. So your accountant's working papers, file notes, memos, and the emails you sent them are all fair game under CRA's information-gathering powers.
What is protected is solicitor-client privilege — confidential communications with a lawyer for the purpose of legal advice. The Income Tax Act recognizes it in section 232, though even there the law carves out a lawyer's accounting records (vouchers, cheques) from protection.
The practical implication: when a file is genuinely contentious — a position that could draw a penalty, an aggressive structure, a year you're worried about — the sensitive analysis should run through legal counsel, not sit in your accountant's working-paper file. An accountant acting as an agent or conduit for a lawyer (gathering facts so the lawyer can advise) can sometimes fall under the lawyer's privilege, but that has to be set up deliberately, before the audit, not improvised after the letter arrives.
What CRA can ask for — and what it can't
CRA's audit powers are broad. Under section 231.1, an authorized person can inspect, audit, or examine your books, records, and any document — including records belonging to other people that are relevant to your return. Under section 231.2, CRA can issue a formal written requirement demanding information or documents within a set time. Section 231.6 covers foreign-based information (with at least 90 days' notice), and section 231.7 lets CRA go to a judge for a compliance order, backed by contempt of court, if you stonewall.
Two limits are worth knowing. First, CRA generally needs your consent or a warrant to enter a dwelling-house. Second, the powers aren't unlimited in substance: in BP Canada Energy v. Canada, 2017 FCA 61, the Federal Court of Appeal held that CRA can't use its audit power for "general and unrestricted" access to a company's internal tax-risk working papers — it can't routinely make you hand over a roadmap of the soft spots in your own return.
This is also where record-keeping pays off. Section 230(4) requires you to keep your books and supporting documents for six years from the end of the tax year they relate to. If you can produce clean, organized records, the audit is a verification exercise. If you can't, CRA is entitled to estimate your income using indirect methods — the net-worth assessment being the classic one, where it reconstructs your income from changes in your assets and lifestyle. You almost never want CRA estimating your income for you.
Why was I selected? Common audit triggers
CRA doesn't publish a list that says "claim this and you'll be audited," and you should be skeptical of anyone who tells you it does. What CRA does say is that file selection runs on risk assessment and comparison to similar taxpayers — if your numbers look unusual next to others in your sector, your file scores higher.
From the practitioner's chair, the patterns that draw attention are consistent:
Income that reads low for the lifestyle — reported income that doesn't square with the house, the vehicles, or the spending. This is what invites a net-worth audit.
Year-after-year business or rental losses — a business or rental property that never seems to turn a profit invites a reasonable-expectation-of-profit look.
Cash-intensive businesses — restaurants, trades, salons, anywhere cash is easy to under-report.
Large or unusual deductions relative to revenue — outsized home-office, vehicle, or meals-and-entertainment claims.
Shareholder loans and owner draws that aren't cleaned up by year-end.
Foreign property — a late or missing T1135 foreign income verification is a known compliance focus.
None of these are illegal, and none guarantees an audit. They're risk markers. The defense against all of them is the same: documentation that supports the position you took.
How far back can CRA go?
For most taxpayers, CRA's reach is limited. The "normal reassessment period" under subsection 152(3.1) is three years from the date of your original notice of assessment for individuals and Canadian-controlled private corporations, and four years for other corporations. Once that window closes, the year is generally statute-barred and CRA can't touch it.
The exception is the one that matters. Under subparagraph 152(4)(a)(i), CRA can reassess beyond the normal period — with no time limit — where you made a misrepresentation "attributable to neglect, carelessness or wilful default," or committed fraud. Note how low that bar sits: it isn't limited to deliberate cheating. A careless error can re-open an old year. The flip side, in your favour, is that on a statute-barred reassessment, the burden is on CRA to prove the neglect or misrepresentation that justifies reopening the year.
You may also be asked to sign a waiver (Form T2029) near the end of the window when an audit isn't finished. Signing one trades away your statute-bar protection for the issues it names. Sometimes that's the right call to keep negotiations open; sometimes it isn't. It's a decision to make with advice, not under pressure — and a waiver can be revoked on six months' notice.
If you got it wrong before CRA noticed
If you already know something in a past return doesn't hold up, the time to act is before CRA contacts you. The Voluntary Disclosures Program (now governed by Information Circular IC00-1R7, in effect for applications received on or after October 1, 2025) lets you come forward and correct the record with relief from penalties and partial interest relief — and, importantly, protection from criminal prosecution.
Under the current rules, an unprompted disclosure that qualifies for general relief can mean 100% relief from penalties and 75% relief on interest. The catch is timing: the program is off the table once you're already under audit or investigation for the matter. The letter in your mailbox may mean that door has closed — which is exactly why the VDP is a tool for the period before the letter arrives.
What happens if you disagree
If the auditor proposes adjustments, you don't go straight to a reassessment. You'll get a proposal letter first, setting out the changes CRA intends to make and giving you a window — typically 30 days — to respond with representations and additional documents. This is your best, cheapest chance to change the outcome, because you're still talking to the auditor rather than fighting a finished assessment. Use it.
If you can't resolve it at the proposal stage, CRA issues a notice of reassessment, and the formal dispute clock starts: you have 90 days to file a Notice of Objection under section 165, which sends the file to CRA's Appeals area for an independent second look. For corporations especially, the objection process has its own rules, deadlines, and traps — including a collection wrinkle that catches large corporations off guard. We walk through all of it in our guide to filing a Notice of Objection as a corporation.
At Modern Axis, we often see owners try to handle the first letter alone and only call once a reassessment has landed — by which point the cheap, early options are gone. The single biggest lever you have in an audit is what you do in the first week.
If you've received a letter and you're not sure what kind of fight you're in, that's exactly the kind of thing a short call can sort out. Reach out to Modern Axis before you respond — getting the first move right is worth far more than damage control later.
Frequently asked questions
What is the difference between a CRA review and a CRA audit?
A review is a routine accuracy check — CRA's matching program compares your return to third-party slips, or a processing review asks you to support one specific claim with receipts. CRA states plainly that a review "is not a tax audit." An audit is a deeper examination under sections 231.1 and 231.2 of the Income Tax Act, often covering multiple issues or years.
How many years back can the CRA audit you?
CRA's normal reassessment period is three years from your notice of assessment for individuals and Canadian-controlled private corporations, and four years for other corporations, under subsection 152(3.1). It can reach back further — with no limit — only where there was misrepresentation due to neglect, carelessness, or fraud, under subparagraph 152(4)(a)(i).
Is communication with my accountant protected from the CRA?
No. Canada has no accountant-client privilege. As confirmed in Tower v. M.N.R. (2003 FCA 307), your accountant's working papers, notes, and emails can be compelled by CRA. Only confidential communications with a lawyer for legal advice are protected, under solicitor-client privilege (section 232 of the Income Tax Act).
What records do I need to keep for a CRA audit?
Keep your books, source documents, and supporting records for six years from the end of the tax year they relate to, under subsection 230(4). That includes receipts, invoices, bank and credit-card statements, contracts, and ledgers. Electronic and scanned records are acceptable if they're legible, accessible, and producible to CRA on request.
What happens if I ignore a CRA audit letter?
Ignoring it makes things worse. CRA can issue a formal requirement for documents under section 231.2, seek a compliance order from a judge backed by contempt of court under section 231.7, and reassess you using estimates if you can't produce records. Responding — calmly, on time, and through a representative — always beats silence.
Can I go to jail for a CRA audit?
An audit itself is a civil process, not a criminal one. The common downside is a reassessment plus interest, and possibly a gross negligence penalty equal to roughly 50% of the understated tax under subsection 163(2). Criminal tax evasion under section 239 is a separate matter requiring prosecution to the criminal standard, and is comparatively rare.
Should I get a lawyer or an accountant for a CRA audit?
For most audits, a CPA who knows the file handles it well. Bring in a tax lawyer when the file is genuinely contentious — a position that could draw a penalty, a possible reassessment of a statute-barred year, or anything where you want the protection of solicitor-client privilege over the analysis. The two often work together.
This article is for general information only and does not constitute professional tax, accounting, or legal advice. Every tax situation is different, and a blog post — no matter how detailed — cannot account for the specific facts that may change the analysis for you. Before acting on anything you've read here, speak with a qualified tax professional about your own circumstances.
Alex Ataman, CPA
Founder
Modern Axis CPA