CRA Audit Triggers in 2026: What Gets You Flagged and How to Respond

The Canada Revenue Agency selects tax returns for audit using a combination of data matching, industry benchmarks, and third-party reporting. If your numbers fall outside the expected range for your industry or if your reported income does not match the T-slips on file, your return gets flagged for review.

At Tohme Accounting, we represent clients through CRA audits regularly, from sole proprietors with home office claims to cross-border filers with FBAR obligations. The patterns that trigger audits have not changed much year to year, but the CRA’s ability to detect them has. Automated data matching is faster and wider than it was five years ago, and the agency has added reporting requirements for crypto and bare trusts that create new points of comparison.

This post covers the most common CRA audit triggers in 2026, what happens during the audit process, and the specific steps you can take to reduce your risk.

How the CRA Selects Returns for Audit

The CRA uses an automated risk-assessment system to score every tax return filed in Canada. Returns that score above a certain threshold get routed for human review. The scoring draws on three main data sources: internal T-slip matching, NAICS industry benchmarks, and third-party information from banks, employers, and foreign tax authorities.

Under ITA section 231.2, the CRA has broad powers to request information from third parties. This includes financial institutions, payment processors, and cryptocurrency exchanges. When the income you report does not match what these sources have on file, your return moves up the priority list.

NAICS benchmarking compares your business expenses against the averages for your industry code. If you run a restaurant and claim a cost-of-goods-sold ratio 15 percentage points below the industry median, the system flags it. The CRA publishes some of these benchmarks internally through the Business Audit Manual (DCPB-13), though they are not made public.

Random selection also plays a role. The CRA audits a portion of returns each year at random, regardless of risk score. There is no way to avoid this category, but it accounts for a small share of total audits.

Tips and informants generate a significant number of audit referrals as well. The CRA maintains a leads program, and it does act on the information it receives. A disgruntled former employee, an ex-spouse, or a competitor can file a report online or by phone. The CRA evaluates each tip against the taxpayer’s filing history before deciding whether to proceed.

Budget 2024 also introduced a 10% penalty on the gross amount at stake for taxpayers who fail to cooperate during an audit, and gave the CRA the authority to conduct compelled interviews. These changes give auditors more leverage once a file is opened.

Income Reporting Mismatches

Income mismatches are the single most common audit trigger. The CRA receives copies of every T4, T4A, T5, T3, and T5008 slip issued in Canada. If the total income on your return does not match the total on those slips, the system catches it automatically.

This happens more often than people expect. A T4A from a one-time consulting contract, a T5 from a savings account at a bank you rarely use, a T5008 from a stock sale you forgot to report. Each of these creates a mismatch that the CRA can identify without opening your file.

Side income is another common gap. If you earned freelance income paid by e-transfer or cheque with no T4A issued, the CRA may still know about it through other channels. Payment processors like Stripe and PayPal now share transaction data with the CRA. If your reported income is $60,000 but your bank deposits total $95,000, the discrepancy raises questions.

For businesses, a gap between GST/HST collected (reported on the GST return) and revenue reported on the T2 or T1 business statement is a straightforward flag. The two numbers should be consistent, and when they are not, the CRA cross-references them routinely.

Foreign income is a growing area of focus. Under the Common Reporting Standard (CRS), over 100 countries share financial account information with the CRA. Unreported foreign bank interest, dividends, or rental income can trigger both an audit and penalties under the T1135 Foreign Income Verification Statement requirements.

Expense Red Flags That Draw Scrutiny

Certain expense categories draw more CRA attention than others because they are commonly overclaimed. Vehicle expenses, home office deductions, and meals and entertainment are the three areas we see flagged most often.

Vehicle expenses get scrutinized when the business-use percentage is high (above 80-90%) or when total claims are large relative to income. The CRA expects a detailed logbook under ITA section 67, and most taxpayers who get audited on vehicle claims do not have one. A $15,000 vehicle expense claim on $50,000 of self-employment income will get a second look.

Home office deductions are similar. The CRA compares your claimed home office percentage against the size and use of the space. Claims above 25-30% of total home costs often trigger questions, especially when the filer works outside the home regularly. We discuss the full calculation and the rules for self-employed filers in a separate guide.

Wages paid to family members are another trigger. The CRA checks whether the salary paid to a spouse or child is reasonable for the work performed. Paying your 14-year-old $40,000 a year for “office help” will not survive an audit.

Large one-time deductions, such as a $30,000 loss on a side business or a major bad-debt write-off, also attract attention if the amount is unusual for your filing history.

Cash Businesses and Contractor Misclassification

Cash-intensive businesses (restaurants, salons, construction, auto repair) are subject to higher audit rates because the CRA knows cash revenue is harder to verify. The agency uses net worth assessments under ITA section 231.2 to compare your reported income against your lifestyle and assets. If you report $40,000 in net income but own a $700,000 home and two vehicles, the CRA will ask how you afford your cost of living.

Net worth assessments are time-consuming and invasive. The CRA reviews your bank statements, mortgage, credit card spending, vehicle registrations, and property records to build a picture of your actual spending. When spending exceeds reported after-tax income by a meaningful amount, the CRA reassesses the difference as unreported income. For more on this topic, see our guide on filing a notice of objection.

Contractor misclassification is a separate but related issue. If you pay workers as independent contractors but they work fixed hours at your location using your tools, the CRA may reclassify them as employees. The test is outlined in CRA guide RC4110. Reclassification means you owe unremitted CPP, EI, and source deductions, plus interest and penalties.

Crypto and Digital Asset Reporting

The CRA has made digital assets a priority audit area since 2022. Starting in 2026, Canadian cryptocurrency exchanges must issue T5008-equivalent slips for dispositions. This means the CRA now receives a direct data feed of crypto sales, and any unreported dispositions create the same kind of mismatch as a forgotten T5 slip.

Common errors we see include failing to report crypto-to-crypto swaps (each one is a taxable disposition), ignoring staking and mining income, and using incorrect cost basis calculations. The CRA’s position, published in its guidance on cryptocurrency, is that all cryptocurrency transactions are either business income or capital gains, and every disposition must be reported.

The CRA has also partnered with international agencies through the Joint Chiefs of Global Tax Enforcement (J5) to share blockchain analytics data. If you used a foreign exchange and did not report your gains, the CRA may still be able to trace the transactions.

DeFi activity adds another layer of complexity. Liquidity pool transactions, token wrapping, and yield farming all generate taxable events that many filers overlook. The CRA has not issued specific guidance on every DeFi scenario, but its general position is clear: if you disposed of a digital asset or received new tokens, you have a tax obligation.

For detailed rules on record-keeping for crypto taxes, see our separate guide.

Cross-Border Filing Errors

US citizens living in Canada face a unique set of audit risks because they must file with both the CRA and the IRS. Errors in treaty claims, missed FBAR filings, and incorrect foreign tax credit calculations are among the most common triggers we see in our cross-border practice.

The Foreign Bank Account Report (FBAR, FinCEN 114) requires US citizens to report all foreign financial accounts with an aggregate balance exceeding $10,000 USD at any point during the year. For a US citizen living in Canada, this includes Canadian bank accounts, RRSPs, TFSAs, and even some corporate accounts. Failure to file carries penalties starting at $10,000 USD per violation, and wilful non-compliance can reach $100,000 USD or 50% of the account balance.

FATCA (Foreign Account Tax Compliance Act) adds another layer. Canadian financial institutions report account information for US persons directly to the IRS. If you hold accounts above the FATCA thresholds ($50,000 USD at year-end or $75,000 USD at any point for single filers) and have not filed Form 8938, the IRS knows.

Treaty misapplication is subtler. We see taxpayers claim exemptions under Article IV of the Canada-US Tax Treaty without meeting the residency tiebreaker tests, or claim pension relief under Article XVIII without the proper documentation. An incorrectly applied treaty provision can trigger an audit on both sides of the border.

If you are a US citizen in Canada and have not been filing both returns, our FBAR guide covers the catch-up options, including the IRS Streamlined Filing Compliance Procedures.

What Happens When the CRA Contacts You

A CRA audit typically begins with a letter requesting specific documents. The letter identifies the tax year under review, the items being examined, and a deadline for your response (usually 30 days). This is not a reassessment. It is a request for information.

The process from there depends on the type of audit. A desk audit (also called a processing review) is handled entirely by mail. The CRA asks for receipts, invoices, or bank statements to verify specific claims. If you provide satisfactory documentation, the file is closed with no changes.

A field audit is more involved. A CRA auditor visits your place of business or your accountant’s office to review records in person. Field audits typically cover multiple items and multiple tax years. They are common for businesses, GST/HST reviews, and cases where the CRA suspects significant underreporting.

If the auditor proposes changes, you receive a proposal letter outlining the adjustments and additional tax. You have the right to respond with explanations or additional evidence before a final reassessment is issued. This is the stage where having a CPA represent you makes the biggest difference. At Tohme Accounting, we respond to proposal letters on behalf of clients regularly, and the right documentation at this step can reduce or eliminate proposed adjustments.

Once a Notice of Reassessment is issued, you have 90 days to file a Notice of Objection under ITA section 165. This triggers a review by the CRA’s Appeals Division, which is separate from the audit team. If the objection is unsuccessful, you can appeal to the Tax Court of Canada.

The areas the CRA has been focusing its audits on in recent years include the real estate sector, the sharing economy, and the digital economy.

How to Reduce Your Audit Risk

The most effective protection against a CRA audit is complete, organized records. ITA section 230 requires every person carrying on a business to keep adequate records and books of account. “Adequate” means receipts, invoices, bank statements, contracts, and logbooks sufficient to verify every line on your tax return.

For vehicle expenses, keep a logbook that records the date, destination, purpose, and kilometres for every business trip. The CRA’s administrative policy allows a simplified logbook for one representative period if you have a full year as a baseline, but you need that baseline year first.

For home office claims, document the square footage of the workspace and the total home area. Keep receipts for utilities, rent or mortgage interest, property taxes, and insurance. Photograph the workspace.

Reasonable deductions matter. Under ITA section 67, any expense must be “reasonable in the circumstances” to be deductible. A $500 client dinner for two people at a steakhouse may be reasonable. A $5,000 dinner for two is harder to defend.

If you have unfiled returns or unreported income from prior years, consider the CRA’s Voluntary Disclosure Program before an audit finds the issue. A valid voluntary disclosure can eliminate penalties and reduce interest. We prepare and submit VDP applications at Tohme Accounting and cover the full process in our VDP guide.

Professional preparation is the last piece. Having a CPA review your return before filing catches the errors that trigger automated flags. During an audit, having representation means the CRA communicates with your accountant, not directly with you, which reduces the risk of providing information that expands the scope of the review. At Tohme Accounting, we handle both sides: pre-filing review to minimize audit risk, and full audit representation when the CRA comes calling. Contact us if you want your return reviewed before you file, or if you have already received a CRA letter.