CRA Reviews and Audits: What Firms Should Have Ready
review versus audit, six-year retention, responding to CRA letters
A CRA review is a routine request to support a claim on a filed return; an audit is a broader examination of books and records. Both turn on documentation. Businesses must generally keep records for six years from the end of the last tax year they relate to, and a request with no supporting record is a disallowed claim.
What is the difference between a review and an audit?
A review asks for support for a specific claim and is largely automated in selection. An audit examines books and records more broadly, usually with a named auditor. Treating a review letter as an audit wastes time; treating an audit as a review wastes credibility.
How long must records be kept?
Generally six years from the end of the last tax year to which the records relate. Some records — those relating to long-term acquisitions, share transactions and the wind-up of a business — must be kept longer. Going paperless does not shorten the schedule.
Responding to a CRA letter
Note the deadline in the letter and treat it as a real deadline with an owner. Send exactly what was asked for, organized and labelled to match the request. Volunteering unrelated documents lengthens the process without improving the outcome.
What makes a file audit-ready in advance
Source documents attached to transactions rather than filed separately; a signed engagement letter defining what the firm did and did not do; and a record of what was communicated to the client and when. All three are ordinary practice-management outputs, not special audit preparation.
Frequently asked questions
How long do businesses need to keep records in Canada?
Generally six years from the end of the last tax year the records relate to. Certain records — including those concerning long-term asset acquisitions, share transactions and the dissolution of a business — must be kept longer, and the CRA can require records to be kept beyond the normal period.
Is a CRA review the same as an audit?
No. A review is a targeted request for support for a specific claim on a filed return, and selection is largely automated. An audit is a broader examination of a taxpayer's books and records, typically conducted by a named CRA auditor with a defined scope.
What should I do when a client gets a CRA letter?
Record the response deadline as a tracked obligation with an owner, then send precisely what the letter requests, labelled to match. Responding late is the most common avoidable failure, and sending unrequested material tends to broaden rather than close a review.
Does going paperless change record retention?
No. Retention periods apply to the records themselves, regardless of format. Electronic records must remain readable and accessible for the full retention period, which makes storage format and export capability a real consideration when choosing software.
Related guides
How firms run this
Turn these dates into tickets.
SpidNums generates the work from each client's cadence and year-end, then ranks it by proximity.