CRA Audits and Reviews: How Far Back Can They Go?

If you’ve had a letter from the CRA, the first thing worth knowing is that it’s probably not an audit.

The CRA runs eight separate review programs — high-volume, largely automated checks that ask you to substantiate one or two line items on your return. An audit is a different thing entirely: a formal examination of your books and records. Most self-employed people who ever hear from the CRA get a review letter and never see an auditor.

The second thing worth knowing is the answer to the question everyone asks first. The CRA can normally reassess you three years from the date on your original notice of assessment — not from the date you filed, which is where most people go wrong, and not ten years, which is a different rule for a different purpose.

Key takeaways

• Three years from your notice of assessment is the normal reassessment period for an individual, a CCPC, or most trusts. Four years for other corporations. Four years for GST/HST.
• No time limit at all where there’s misrepresentation attributable to neglect, carelessness or wilful default, or fraud — but the CRA bears the burden of proving it.
• If you never filed, the clock never starts. That year stays open indefinitely.
• A review verifies a line item. An audit examines your books. They aren’t the same, and the letters look different.
• Platform income is now visible. Uber, DoorDash, SkipTheDishes, Amazon Flex and Airbnb file your gross income with the CRA by January 31 each year.
• You have 16 rights under the Taxpayer Bill of Rights, a free internal objection process, and access to relief. The Voluntary Disclosures Program was rewritten on October 1, 2025.

Review or audit? They aren’t the same thing

Most content online treats these as interchangeable. They aren’t, and the difference determines how worried you should be.

The review programs

The CRA runs eight: Pre-assessment Review, Processing Review, Request Verification, Refund Examination, Supplementary Examination, Matching, Special Assessments, and Identity Protection Services.

Three matter most to a self-employed filer.

Special Assessments is a more in-depth review looking for patterns of non-compliance, with requests going directly to the taxpayer.

What a review actually is: a letter asking you to substantiate a specific item. Send in receipts for a claimed expense, or explain a discrepancy. There’s a deadline, usually around 30 days. You respond by mail or through My Account, and that’s normally the end of it.

Why reviews are so common now: almost nobody attaches documents to a return anymore. Of 33,864,560 individual returns filed for the 2024 tax year, 31,484,480 — 93% — were filed electronically. The CRA assesses first and verifies afterwards, because there’s nothing attached to verify at filing time.

A review is not an accusation. It’s the system doing what it was designed to do.

An audit

An audit is a formal examination of your books and records under the CRA’s statutory inspection powers in sections 231.1 to 231.7 of the Income Tax Act. It’s broader in scope, longer, more formal, and can result in reassessment across multiple years.

Audits are selected. Reviews are routine.

How far back can the CRA go?

This is the question with the most search volume behind it, and the most misinformation.

The normal reassessment period

Under subsection 152(3.1) of the Income Tax Act:

And here’s the part people get wrong: the clock runs from the date the original notice of assessment was sent — not from the date you filed.

If you filed your 2025 return in April 2026 and your notice of assessment is dated May 12, 2026, the normal reassessment period expires May 12, 2029. Not April 2029. A later reassessment doesn’t restart the clock either.

When there’s no limit at all

Under subsection 152(4), the Minister may assess “at any time” where you made a misrepresentation attributable to neglect, carelessness or wilful default, or committed fraud.

No three years. No limit.

Two things matter here, and honest content should say both.

The CRA bears the burden of proving the misrepresentation. This isn’t a switch the CRA flips because it wants another look — it has to establish the neglect or carelessness.

And “misrepresentation” is a real threshold. An honest error on a genuinely arguable position is a different thing from a pattern of unreported income.

The six-year situations

Under paragraph 152(4)(b), the period extends by three additional years — six in total — for consequential assessments arising from another taxpayer’s assessment, transactions with a non-arm’s-length non-resident, loss carrybacks under subsection 152(6), and foreign affiliate matters.

If you never filed

The clock never starts. Subsection 152(7) lets the CRA assess even where no return was filed, and the normal reassessment period doesn’t begin until a return is assessed.

An unfiled year stays open indefinitely. That’s the single strongest practical argument for filing even a very late return — and our self-employed tax deadlines guide covers what the late-filing penalty costs you in the meantime.

Waivers

You can extend the period yourself by signing Form T2029, which waives the normal reassessment period for a specified matter. It has to be filed before the period expires and must specify the matter. You can revoke it with Form T652, effective six months after filing.

Signing one is sometimes sensible — it can keep a dispute open rather than forcing a protective reassessment — but it isn’t something to sign without advice.

The “ten years” confusion

You’ll read that the CRA can go back ten years. That’s a different rule.

Ten years is the taxpayer relief limitation — the window in which you can ask the CRA to cancel penalties and interest. It has nothing to do with how far back the CRA can reassess.

What actually triggers a review or an audit

Selection isn’t random for most files. The CRA applies risk assessment, and its own internal audit reporting confirms that its compliance branches have developed risk assessment and file selection processes to identify the highest-risk areas of non-compliance.

Three published selection methods:

1. Computer-generated risk assessment — scoring returns against the CRA’s models
2. Comparison to third-party data — the Matching Program, comparing your return against T4s, T5s, T4As and, increasingly, platform data
3. Audit projects — targeting specific sectors or issues

The CRA’s 2025–26 Departmental Plan describes expanding its use of data analytics, machine learning and AI to detect non-compliance.

Risk factors for the self-employed

• Expenses that are high relative to industry norms
• Repeated business losses year after year
• Large or unusual deductions relative to income
• Discrepancies against third-party data
• Cash-intensive businesses
• Large year-over-year swings without an obvious explanation

The underlying logic is consistency. A return that looks like other returns in its sector, and that reconciles to the data the CRA already holds, attracts less attention.

The CRA also runs a standing 2022+ Underground Economy Strategy built on three pillars — Identify, Prevent, Address — and it explicitly targets the digitalisation of commerce and online platforms. Which is the bridge to the next section.

Side hustles: why gig income is now visible

If you’ve noticed more discussion of gig workers and the CRA lately, there’s a concrete reason.

Part XX of the Income Tax Act — the Reporting Rules for Digital Platform Operators — received Royal Assent on June 22, 2023 and came into force January 1, 2024. It’s based on the OECD model rules.

Reporting platform operators must file an information return with the CRA by January 31 each year, and give you the same information. The first return, covering 2024, was due January 31, 2025.

So the CRA receives your Uber, DoorDash, SkipTheDishes, Amazon Flex, Airbnb and Etsy income directly, before you file. That data feeds the Matching Program.

The CRA also runs an Assisted Compliance Program, launched in February 2022, which it describes as an education-first approach offering support to small and medium businesses and self-employed individuals by explaining potential tax issues identified in their accounts.

The practical upshot: under-reporting platform income isn’t a matter of hoping it goes unnoticed anymore. The mismatch is automated.

And note what the platform reports — your gross earnings, not your deductions. The number the CRA sees is the big one. Your job is to substantiate the expenses that bring it down, which for most drivers is overwhelmingly the vehicle. Our Uber driver tax deductions guide covers what’s actually claimable, and the gig platform pay comparison covers how the platforms differ before tax.

What happens during a review or an audit

A review letter

It identifies the item under review, asks for supporting documents, and gives you a deadline — commonly 30 days.

Respond by the deadline, or call before it passes to ask for more time. The CRA is generally accommodating about extensions requested in advance. What doesn’t work is silence: if you don’t respond, the CRA reassesses on the assumption the claim isn’t supported, and the item is disallowed.

Quote the reference number, send copies rather than originals, and keep a record of what you sent.

An audit

The CRA’s powers are broad. Under section 231.1, officials may inspect, audit or examine any document — including the books and records of the taxpayer or any other person — examine property and processes, and require reasonable assistance and answers to proper questions.

Section 231.2 allows a formal written requirement to produce information or documents. Section 231.6 covers foreign-based information. Section 231.7 lets the CRA seek a Federal Court compliance order.

One limit worth knowing: entering a dwelling-house requires the occupant’s consent or a warrant.

The proposal letter. Before finalising, the CRA typically issues a proposal setting out the adjustments it intends to make and giving you an opportunity to respond. This is the point at which a well-organised response matters most — it’s far easier to prevent an adjustment than to object to one afterwards.

Then comes the notice of reassessment.

If your records are inadequate

Subsection 152(7) lets the CRA assess without being bound by your return. That’s the statutory basis for arbitrary assessments and for the net worth method, where the CRA estimates income from the change in your assets and lifestyle rather than from your books.

A net worth assessment is presumed valid, and the onus is on you to show it’s wrong. It’s described as a method of last resort, and it’s a genuinely difficult position to argue out of.

Which is the whole case for keeping records: not to win an argument, but to avoid one.

Penalties and interest, quantified

Worth knowing the actual numbers rather than imagining them.

Interest on overdue tax has been 7% for every announced quarter of 2026 — Q1, Q2 and Q3 — compounded daily. The rate is the basic prescribed rate plus four percentage points and is set quarterly, so confirm the current one. Interest is charged on unpaid penalties as well as unpaid tax.

On gross negligence: the CRA bears the burden of proof under subsection 163(3). It isn’t applied to ordinary errors or arguable positions.

On criminal prosecution: it exists, it’s handled by a separate Criminal Investigations Program rather than by auditors, and it’s reserved for evasion and fraud. It is not the ordinary outcome of an audit, and it shouldn’t be your working assumption if you receive a letter.

Your rights, and how to push back

This is the section most content skips, and it’s the one that changes how the process feels.

The Taxpayer Bill of Rights

Sixteen rights, introduced in 2007, plus five commitments to small business. They’re administrative rather than legislated, but the CRA holds itself to them and the Office of the Taxpayers’ Ombudsperson oversees eight of them.

Right 15 is the right to be represented by a person of your choice. You don’t have to deal with the CRA alone.

Objections

If you disagree with a reassessment, file a notice of objection — Form T400A, or online through “Register my formal dispute” in My Account.

The deadline for an individual is the later of 90 days from the date of the notice of assessment and one year after your return’s filing due date. For other taxpayers it’s 90 days. GST/HST objections are 90 days only — there’s no one-year extension. Miss it and you can apply under section 166.1 within one year of the deadline.

An objection goes to CRA Appeals, an internal review by an officer who wasn’t involved in the original decision. It’s free, and it resolves a great many disputes without going further.

Taxpayer relief

Form RC4288, under subsection 220(3.1). Three grounds, per Information Circular IC07-1R1:

1. Extraordinary circumstances — natural disaster, serious illness, a death in the immediate family
2. Actions of the CRA — errors, undue delays, incorrect information
3. Inability to pay or financial hardship

Relief covers penalties and interest only — never the underlying tax, and the Minister can only grant it for the ten calendar years preceding the year of the request.

The Voluntary Disclosures Program, rewritten October 2025

If you have something to correct before the CRA finds it, the VDP is the route. It was substantially rewritten effective October 1, 2025, so most guidance online is out of date. The old General and Limited structure is replaced by unprompted and prompted applications.

Documentation covers the most recent 10 years for foreign matters, 6 years for Canadian, and 4 years for GST/HST. The application form is now RC199.

You remain ineligible if you’re already under audit or investigation. That’s the point — it rewards coming forward first.

For service complaints, Form RC193 covers service feedback, escalating to the Office of the Taxpayers’ Ombudsperson.

What to do, and what not to

Do:

• Read the letter carefully and work out whether it’s a review or an audit
• Meet the deadline, or call before it passes to request an extension
• Provide exactly what’s asked for, keep copies, and note what you sent
• Get representation if it’s an audit rather than a routine review

Don’t:

• Ignore it. Non-response means assessment on the CRA’s assumptions.
• Send more than was asked for without thinking about it.
• Assume your accountant’s file is privileged. There is no accountant-client privilege in Canada — only solicitor-client privilege, with a lawyer.

Records: your actual defence

Everything above turns on documentation. Section 230 of the Income Tax Act makes it a statutory obligation, not a best practice.

The six-year rule

Keep records six years from the end of the last taxation year to which they relate. Records must be kept at your place of business or residence in Canada unless the Minister designates otherwise. Destroying them early requires written permission — Form T137.

Electronic records

Information Circular IC05-1R1 covers this, and two provisions matter.

Subsection 230(4.1) requires records kept electronically to be retained in an electronically readable format for the full period — even where a paper copy exists. Printing your bookkeeping and shredding the file doesn’t discharge the obligation.

And paragraph 9 of IC05-1R1: records kept outside Canada and accessed electronically from Canada are not considered to be records in Canada. That’s a real consideration if your bookkeeping lives on a foreign server. It doesn’t ban cloud software, but the authoritative copy needs to be accessible in Canada.

Vehicle records specifically

The business-use percentage is, in practice, the most commonly challenged figure on a self-employed return — because it’s a large multiplier resting entirely on a record most people don’t keep well.

For each business trip the CRA requires date, destination, purpose and number of kilometres, plus odometer readings at the start and end of the fiscal period. The simplified method lets you keep a full logbook for one 12-month base year, then a continuous three-month sample in later years, provided the sample-period percentage is within 10 percentage points of the same period in the base year.

What fails at review: vague destinations (“various clients”, “around town”), no business purpose recorded, missing odometer readings, and logs reconstructed after the fact. A log built in April from a calendar and credit-card statements looks exactly like what it is.

Our free CRA mileage log template has the required fields and the base-year worksheet, and the T2125 vehicle expenses guide covers how the percentage feeds line 9281. If you’re claiming depreciation on the vehicle as well, the capital cost allowance guide covers the records a Class 10, 10.1 or 54 claim needs.

Input tax credit documentation

If you’re GST/HST registered, supporting documents scale with the amount.

Purchase amount	What the document must show
Under $30	Supplier or intermediary name, date, total amount paid
$30 to $149.99	The above, plus the supplier’s GST/HST registration number and the tax amount
$150 or more	The above, plus your name, a description of the supply, and the terms of payment

The CRA has flagged a proposed increase of these thresholds to $100 and $500, framed as effective April 20, 2021 — but it remains described as proposed, so the enacted $30 and $150 figures are what to work to. Our GST/HST filing deadlines guide covers the rest of the registrant obligations.

Quebec: two agencies, two processes

Revenu Québec administers Quebec income tax and QST under the Tax Administration Act, with its own audit, assessment and objection processes.

One useful rule: if the disputed Quebec notice arose from information Revenu Québec obtained from the CRA, and you’ve already objected with the CRA, you don’t need to file again with Revenu Québec.

The two agencies share information, so a federal adjustment frequently prompts a Quebec one — and the reverse.

What most articles get wrong

• Conflating reviews with audits. Different processes, different consequences.
• Saying the reassessment period runs from your filing date. It runs from the notice of assessment.
• Saying the CRA can “always go back ten years.” That’s the taxpayer relief window, not an audit period.
• Presenting speculative trigger lists as CRA policy. Most such lists are professional inference, not published rules.
• Overstating how often individuals are audited. The CRA doesn’t publish a simple annual rate, and reviews are far more common than audits.
• Being out of date on the VDP, which was rewritten on October 1, 2025.

Frequently asked questions

How far back can the CRA audit an individual in Canada?

Three years from the date on your original notice of assessment, under subsection 152(3.1) of the Income Tax Act. Four years for corporations other than CCPCs, and four years for GST/HST. There's no limit where there's misrepresentation attributable to neglect, carelessness or wilful default, or fraud.

Does the three-year period run from when I filed or from my notice of assessment?

From the notice of assessment. This is the most common error in online guidance. If your notice is dated May 12, 2026, the normal reassessment period expires May 12, 2029 — regardless of when you filed the return.

What is the difference between a CRA review and a CRA audit?

A review verifies specific line items and is largely automated and routine — the CRA runs eight review programs. An audit is a formal examination of your books and records under the CRA's statutory inspection powers in sections 231.1 to 231.7. Most people who hear from the CRA get a review.

How many years can the CRA go back if I never filed a return?

Indefinitely. The normal reassessment period doesn't start until a return is assessed, so an unfiled year stays open. Subsection 152(7) lets the CRA assess anyway, without being bound by anything you filed.

Can the CRA reassess after the three years are up?

Yes, in defined circumstances: misrepresentation from neglect, carelessness or wilful default, or fraud — where there's no time limit and the CRA must prove it. Also where you signed a waiver on Form T2029, and in certain six-year situations involving non-arm's-length non-residents, loss carrybacks and foreign affiliates.

What is a CRA review letter and how long do I have to respond?

It identifies an item on your return and asks for supporting documents, usually with about 30 days to respond. You can reply by mail or upload through My Account. If you can't meet the deadline, call before it passes — extensions requested in advance are generally accommodated. Silence means the item gets disallowed.

What triggers a CRA audit for a self-employed person?

The CRA uses computer risk assessment, comparison against third-party data, and sector-specific audit projects. Commonly cited risk factors include expenses out of line with industry norms, repeated losses, unusually large deductions relative to income, discrepancies against slips, and cash-intensive operations. These are professional observations, not published CRA policy.

Does the CRA see my Uber, DoorDash, Airbnb or Etsy income automatically?

Yes. Under Part XX of the Income Tax Act, in force since January 1, 2024, reporting platform operators must file an information return with the CRA by January 31 each year and give you the same data. The first returns, covering 2024, were filed January 31, 2025. Note that platforms report gross earnings, not your deductions.

What are the penalties if the CRA reassesses me?

Late filing is 5% of the balance plus 1% per complete month to 12 months. Repeat late filing is 10% plus 2% per month to 20 months. Gross negligence is the greater of $100 and 50% of the understated tax. Interest on overdue amounts has been 7% through Q3 2026, compounded daily and charged on unpaid penalties as well as tax.

What is the gross negligence penalty and when does it apply?

The greater of $100 and 50% of the understated tax, under subsection 163(2). The CRA bears the burden of proof under subsection 163(3), and it isn't applied to ordinary errors or genuinely arguable positions.

What happens if my records are inadequate?

The CRA can assess without being bound by your return under subsection 152(7) — including by the net worth method, which estimates income from the change in your assets and lifestyle rather than from your books. That assessment is presumed valid and the onus is on you to show it's wrong.

Why is the vehicle business-use percentage the number most often challenged?

Because it's a large multiplier applied to a pile of otherwise well-documented costs, and it rests on a logbook most people don't keep contemporaneously. The CRA wants date, destination, purpose and kilometres per business trip, plus odometer readings at the start and end of the fiscal period. Vague destinations and after-the-fact reconstruction are what fail at review.

Can I object to a reassessment, and what is the deadline?

Yes, using Form T400A or the online dispute service in My Account. For an individual, the deadline is the later of 90 days from the notice and one year after your filing due date. GST/HST objections are 90 days only. Late applications can request an extension under section 166.1 within one year of the deadline.

What is the Voluntary Disclosures Program and what changed in 2025?

It lets you correct a return before the CRA finds the problem. It was rewritten effective October 1, 2025: unprompted disclosures get 100% penalty relief and 75% interest relief; prompted disclosures get up to full penalty relief and 25% interest relief. The form is now RC199, and you're ineligible if you're already under audit or investigation.

Do I need to hire someone if I get a CRA letter?

For a routine review asking about one deduction, usually not — send what's asked for by the deadline. For an audit, representation is worth considering, and Right 15 of the Taxpayer Bill of Rights entitles you to it. Note that Canada has no accountant-client privilege; only communications with a lawyer are privileged.