Audit
Learn what an audit is, the types of audits, how a CRA audit works, and how to keep records audit-ready.
Published Thursday 23 July 2026
Table of contents
Key takeaways
- An audit is a detailed inspection of tax returns, financial records, internal processes, or operations to check for accuracy and compliance.
- Common types include tax audits by the Canada Revenue Agency (CRA), external audits by independent accountants, and internal audits run by your own team.
- A CRA audit can be triggered by random selection, discrepancies in your returns, or figures that don't match third-party information.
- You can stay ready by keeping accurate records and holding onto your tax records for at least six years.
What is an audit?
An audit is a detailed inspection of tax returns, financial records, internal processes, or operations to check for accuracy and compliance.
The term audit most often refers to tax and financial audits, but it also covers reviews tied to industry and statutory compliance. For a small business, an audit confirms that your numbers hold up and that you're following the rules that apply to you.
Most audits are handled by an independent, external party. You can start an internal audit to review your own processes, but an external party keeps the review objective.
Types of audits
Audits fall into a few main categories, each with a different focus and a different party in charge. Here are the ones you're most likely to come across:
- Tax audit: the CRA reviews your tax returns to check their accuracy, looking at returns, income statements, and deductions, so you'll need to back up the details you reported
- External audit: an independent group reviews your finances or operations, often to verify accuracy for a lender or investor, or to confirm you meet quality standards such as ISO (the International Organization for Standardization)
- Internal audit: your own team, or an external hire, reviews your processes and controls to spot weaknesses, check compliance, and find room to improve
You may also hear about financial audits, which verify the accuracy of your financial statements; operational audits, which check that your processes run as they should; and compliance audits, which confirm you meet specific legal or industry rules.
Who conducts an audit?
Who runs an audit depends on the type. Each kind of audit has a natural party behind it:
- The CRA handles tax audits, reviewing your returns and supporting records for accuracy
- Independent external accountants or chartered professional accountants (CPAs) carry out external and financial audits to keep the review objective
- Your own internal team runs internal audits to monitor day-to-day processes and controls
The audit process
Knowing the stages ahead of time makes an audit feel far less daunting. Most audits move through four steps:
- Planning: the auditor sets the scope of the audit and gets to know your business
- Gathering information: the auditor works with you, your manager, or your accountant to collect the records they need
- Evaluation: the auditor reviews the information to see whether your records and processes line up with the relevant standards and regulations
- Audit report: the auditor shares a detailed report with their findings and decision; with a tax audit, they either accept your return as filed or suggest changes, and you usually get a chance to dispute the findings and provide more information
What can trigger a CRA audit?
A CRA audit isn't always a sign that something's wrong, and it can start for a few different reasons. The most common triggers are:
- Random selection, where the CRA reviews a portion of returns as a routine check
- Discrepancies in your returns, such as figures that shift sharply from one year to the next
- Information that doesn't match third-party data, such as slips or amounts reported by others
Filing accurate returns and reporting your small business expenses correctly is the simplest way to lower your chances of a review.
Importance of audits
Tax and financial audits mainly confirm that your business meets its tax and legal requirements. They also help you catch accounting errors, detect fraud, and make the changes you need.
An audit can give you insights that sharpen your decisions, too. Audited records build credibility with investors, lenders, suppliers, and other stakeholders, and they show you're committed to transparency, quality, and accuracy.
Audit checklist
A few good habits make an audit smoother and less stressful. You can prepare by:
- maintaining accurate, well-organized records, using Hubdoc to capture data with less manual entry
- keeping tax records for at least six years from the end of the last tax year they relate to, and checking with the CRA about special situations where records may need to be kept for longer
- documenting and regularly updating the policies and procedures behind your operational and industry audits
- running periodic internal audits to monitor and improve your processes
- staying compliant with legal and accounting rules, and searching our advisor directory when you want expert support
Keeping your GST/HST returns filed and organized helps here as well, since those records often come up in a CRA review.
Stay audit-ready with Xero
Staying audit-ready comes down to accurate records you can pull up in a moment. Xero helps keep your finances organized in one place, so you can automate your tax prep and filing and find what an auditor asks for without the scramble. Get organized today and get one month free.
FAQs on audits
Here are answers to some frequently asked questions about audits for Canadian small businesses.
What triggers a CRA audit?
A CRA audit can start through random selection, unusual swings in your reported figures, or numbers that don't match third-party information. Accurate, consistent returns are the best way to reduce the risk.
How long do I keep records for a CRA audit?
Keep your tax records for at least six years from the end of the last tax year they relate to. Check with the CRA about special situations where you may need to hold them longer.
Who performs an audit?
The CRA performs tax audits, while independent external accountants or CPAs handle external and financial audits. Your own team can run internal audits on your processes and controls.
What happens after an audit, and can I dispute it?
You receive an audit report with the findings and a decision, such as accepting your tax return or suggesting changes. In most cases you can dispute the findings and provide more information before anything is finalized.
Related terms
Learn more about audits
Handy resources
Advisor directory
You can search for experts in our advisor directory
Xero Small Business Guides
Discover resources to help you do better business
Financial reporting
Keep track of your performance with accounting reports
Disclaimer
This glossary is for small business owners. The definitions are written with their requirements in mind. More detailed definitions can be found in accounting textbooks or from an accounting professional. Xero does not provide accounting, tax, business or legal advice.