A CFO we work with once described a tax review that was supposed to take two weeks.
The company had solid revenue, clean books, and a reputable accounting firm. Nothing unusual. Then the CRA auditor asked for supporting documents for several marketing expenses.
There were receipts, invoices, and payments, but none of them were connected in a way that made verification easy. What followed was six weeks of back-and-forth, reconstructed transaction histories, and hours spent digging through old email threads.
Nothing illegal had happened, but the lack of structured documentation turned a routine review into a drawn-out ordeal.
In 2025 and beyond, the stakes are meaningfully higher than they used to be as the CRA is increasing its audit activity.
CRA Initiatives
The CRA has never been better resourced or better equipped than it is right now. Budget 2024 introduced expanded audit powers that took effect in 2025, giving CRA auditors new tools that most business owners are not yet aware of.
Under proposed section 231.9 of the Income Tax Act, the CRA can now issue a Notice of Non-Compliance when a business fails to adequately respond to information requests, carrying penalties of $50 per day up to $25,000 for delayed or incomplete responses.
The agency has also introduced AI-driven audit selection systems, flagging unusual deductions, income patterns, and documentation gaps before a human auditor even sees your file. And for incorporated businesses, the CRA's focus has sharpened on specific areas: shareholder benefits and compensation, management fees, GST/HST input tax credits, and contractor payments.
In our experience, the businesses most caught off guard by escalated reviews are the ones that assumed routine compliance was still enough. Unfortunately, documentation standards that felt "good enough" a few years ago may not meet the bar today. The question is whether your records can tell a clear, traceable story because the CRA's tools for checking that story are far more sophisticated than they were.
Why Routine Reviews Expand
Audits start as a request for substantiation - can you show us where these numbers came from?
The CRA's audit process works smoothly when financial records create a clear chain: Tax return > financial statements > general ledger > source document. When that chain holds together, reviews stay routine. When it doesn't, auditors ask follow-up questions.
Each unanswered question is interpreted as a potential gap. Each gap justifies another request. Each request expands the scope. What began as a review of three transactions can become a review of three years.
The CRA also uses what it calls indirect verification of income - cross-referencing your reported numbers against bank deposits, third-party data, platform income (Airbnb, Shopify, PayPal, Uber), and industry benchmarks. If the story your return tells doesn't match the story those sources tell, the review escalates.
The Documentation Gaps We See Often
These are the patterns that come up repeatedly in the files we work on and in the Canadian accounting community.
1. The "Proof Exists Somewhere" Problem
A company spends $25,000 on a marketing campaign. The transaction is recorded correctly, but when the CRA requests supporting documentation, the evidence is scattered:
- The invoice is buried in a Gmail thread
- The payment is in Stripe
- The contract is in Google Drive
- The bookkeeping entry is in the accounting system
Individually, every piece exists. But because nothing is linked, the auditor cannot verify the transaction without multiple follow-up requests. Multiply that across dozens of similar transactions, and you have just added weeks to your review timeline.
The fix is consistency. Every significant transaction should have source documents attached directly to the ledger entry: invoice, payment confirmation, contract, and a note on business purpose. When your accounting system does that work by design, verification takes minutes instead of weeks.
2. Expenses Without Documented Business Purpose
There's a meaningful difference between having a receipt and having documentation. A receipt tells you what was purchased. Documentation tells you why it was a legitimate business expense, and the CRA expects both.
Consider this ledger entry:
Travel Expense - $4,850
The number may be accurate, but the CRA will want to know who traveled, for what business purpose, and whether the expense qualifies for a full deduction. Without that context documented at the time of the expense, even entirely legitimate deductions become contested.
This applies most directly to meals and entertainment, travel, home office claims, and vehicle expenses - the categories where personal and business use can overlap. The CRA's indirect income verification process looks specifically for personal expenses mixed into business records, and these categories are where it focuses first.
3. Contractor and Subcontractor Records That Don't Match
Contractor payments are one of the CRA's current enforcement priorities. The agency cross-references what you report against what your contractors report on their T4As, and a mismatch between those two numbers is one of the fastest ways to move from a correspondence review to an office audit.
This is more common than it should be. For example, contractors get added mid-project and are never formally documented. Or payments go out without a signed agreement. Or T4As are filed late or missed entirely. None of these are intentional, but they create paper gaps that look suspicious when reconciled against your reported expenses.
The CRA is also actively scrutinizing the employee vs contractor classification question. Misclassified workers - people who function as employees but are treated as contractors for tax purposes - carry significantly steeper penalties than a missed T4A.
- Maintain a simple contractor register: name, SIN, services rendered, payments made, T4As filed
- Get signed agreements before the first payment, even for short engagements
- Verify SIN and contact information up front, not during tax season
- Reconcile contractor payments against your GL at least quarterly
4. Misclassified Purchases
Growing companies frequently blur the line between capital assets and operating expenses. Equipment that should be capitalized and depreciated gets expensed in a single year. Vehicles are recorded incorrectly. Depreciation schedules go missing when systems change.
These issues matter because they directly affect taxable income. When the CRA identifies a misclassification, it doesn't just adjust the one transaction; it typically expands the review to assess whether the financial statements as a whole reflect proper tax treatment.
5. Records That Don't Cover the Full Retention Period
Under the Income Tax Act, Canadian businesses must retain financial records for a minimum of six years from the end of the tax year they relate to. For capital assets, the obligation runs six years from the year of disposition.
Most business owners know they need to keep records. Fewer know the specific retention rules or that the clock runs from the tax year end, not from the date of filing. So systems get migrated, old platforms get shut down, receipts never get digitized, and records quietly disappear.
When an auditor requests documentation for a period where records no longer exist, they are not required to accept your recollection. They can reassess based on their own estimates, and those estimates rarely favor the taxpayer.
6. Shareholder Loans and Owner Transactions Without Clear Paper Trails
For incorporated businesses, this is the documentation gap that causes the most serious problems. When an owner draws money from the company - as salary, dividend, or repayment of a shareholder loan - how that transaction is classified carries major tax implications.
The CRA scrutinizes shareholder loan accounts closely. Amounts owing to the corporation that aren't repaid or reclassified within the required timeframe can be deemed taxable income to the shareholder. And if the documentation doesn't clearly establish what each transaction represents and why, the CRA has significant latitude in how it characterizes them.
This is especially relevant for businesses that have grown quickly, where the complexity of owner transactions often outpaces the accounting.
The Hidden Cost
Most business owners assume the biggest risk of an audit is penalties or reassessment. In practice, the biggest cost is often time.
When documentation is not properly structured, finance teams spend weeks reconstructing payment histories, retrieving archived documents, exporting from old platforms, and rebuilding audit trails. In our experience, we have seen founders and CFOs spend 40 to 60 hours gathering documentation for reviews that should have taken much less time.
For growing companies, that kind of operational disruption is often far more expensive than the adjustment itself.
There is also a less obvious cost: the narrative. The CRA's newer audit powers mean that auditors are locking in facts earlier in the process - often before a company fully understands what is at stake. Answers given in early interviews shape the entire review. If your documentation is disorganized at the start, it's very difficult to reframe the story later.
What Audit-Ready Looks Like
Companies that move through CRA reviews quickly and cleanly tend to share three characteristics:
- A traceable audit chain: Every number in the tax return can be traced through a clear chain of records: Tax return > financial statements > general ledger > source document. There is no ambiguity about where the numbers came from, and no need for reconstruction.
- Transaction-level documentation: Transactions include context from the moment they're recorded - vendor information, business purpose, supporting invoice, and tax treatment. Auditors can understand the transaction without asking follow-up questions.
- Integrated financial systems: Accounting software connected to expense management tools, payment platforms, and document storage creates a digital audit trail where supporting documentation is attached directly to each transaction. Instead of hunting through email threads and Google Drive folders, everything is in one place.
This is the shift from reactive compliance to proactive compliance. The difference isn't that much work, but the timing matters enormously. Building these systems before a review request arrives costs a fraction of what reconstruction costs after one does.
One Final Thought
A well-documented set of records doesn't guarantee you'll never receive a CRA review notice. The agency conducts random reviews and industry-specific audits that have nothing to do with your compliance quality.
Documentation is the only thing that determines how a review ends. Business owners with organized, traceable records tend to close reviews quickly and with minimal adjustment. Those without them tend to find themselves in a longer, more expensive process with reassessments that often wouldn't have happened if the records had simply been there.
If you are not confident about the answer, that is actually the best time to find out, before anyone else asks.
We help Canadian founders, operators, and growing businesses build cloud-based accounting systems that are organized, integrated, and audit-ready, not just at tax time. If you have questions about your current documentation practices or want to know where your exposure is, we'd love to talk.
