What happens during a CRA audit, and how long does my client get to respond at each step?
As of October 2026, a CRA audit runs from a contact letter to a final letter. Under the CRA's AD-20-01 timelines, your client gets up to 30 days to produce the first records and 30 days to answer the proposal letter, each extendable. Changes arrive as a notice of reassessment, and only then can your client object.
How long does your client get at each step of a CRA audit?
The CRA publishes its standard deadlines in policy AD-20-01, Standard Timelines for Information Requests to Taxpayers for Audit Purposes. The auditor sets the first deadline, and anything past it needs the case manager or team leader to approve canada.ca.
| Request | First deadline (set by the auditor) | Extra time on a follow up | Maximum total |
|---|---|---|---|
| Preliminary request for books and records | Up to 30 days | Up to 60 days | Up to 90 days |
| Additional request, information readily available | Up to 15 days | Up to 30 days | Up to 45 days |
| Additional request, information not readily available | Up to 30 days | Up to 30 days | Up to 60 days |
| Additional request, not readily available with extenuating circumstances | Up to 60 days (team leader approves) | None | Up to 60 days |
| Response to the proposal letter | 30 days | Up to 30 days | Up to 60 days |
The policy says extra days must be granted for things outside your client's control, such as illness, death, a natural disaster or a change in representative. The follow up request is the last one: it warns that the CRA may seek a compliance order, and the policy says no further days are given after it canada.ca.
The CRA also commits to contacting your client or you within 30 days of receiving the requested information to explain the next steps canada.ca. If the proposal letter's follow up deadline passes with no reply, the auditor is told to go ahead with the reassessment as proposed.
What happens from the first call to the final letter?
The CRA's risk assessment systems flag a return as high risk, and an officer then decides whether it needs an audit canada.ca. Selection can also come from comparing a file to similar files or from information found in other audits or investigations
canada.ca.
| Step | What happens |
|---|---|
| Contact | The auditor usually phones, then sends a letter confirming the years and the details of the audit |
| Records request | Electronic records are usually requested before the meeting; paper records are reviewed on site or borrowed against a detailed receipt |
| Review | Usually at the business, your client's home or your office, otherwise at a CRA office, and the auditor may be outside your region |
| Findings | No change ends with a completion letter; proposed changes come in a proposal letter with 30 days to respond |
| Disagreement | Your client or you go back to the auditor, then to the team leader named on the correspondence |
| Final letter | No change, a reassessment with a balance owing, or a reassessment with a refund |
| Notice | A notice of reassessment, or a notice of redetermination where only a loss changes |
The table follows the CRA's business audit page and RC4188 canada.ca
canada.ca. The final letter can arrive by mail or through My Business Account or Represent a Client
canada.ca, so check the client's online mail if you're the authorized representative.
The auditor isn't limited to the business ledger. The request can reach the owner's personal bank, mortgage and credit card statements and the records of a spouse, family members, corporations, partnerships or trusts. When the books look unreliable or the owner's lifestyle doesn't match reported income, the CRA may use an indirect method, most often net worth, and related entities can be grouped and audited together as one economic entity canada.ca.
What can the auditor legally demand?
Subsection 231.1(1) lets an authorized person, at all reasonable times, audit your client's books and records, examine property, enter a place of business, and require your client to give reasonable assistance and answer proper questions, in person, by video or in writing laws-lois.justice.gc.ca. A dwelling house can be entered without the occupant's consent only under a warrant.
| Provision | What it does |
|---|---|
| ITA 231.1(1) | Audit records, examine property, enter business premises, require assistance and answers |
| ITA 231.2(1) | Formal requirement to provide information or documents within a reasonable time stated in the notice |
| ITA 231.7(1) | Court order compelling access, assistance, information or documents that were not provided |
| ITA 231.8 | Time spent contesting a 231.2 requirement or a 231.7 application is excluded from the reassessment period |
| ITA 238(1) | Failing to comply is an offence: a fine of $1,000 to $25,000, or the fine plus up to 12 months in prison |
A requirement under 231.2(1) is served personally or by registered or certified mail and states its own deadline laws-lois.justice.gc.ca. If your client still doesn't comply, the Minister can apply to a judge for a compliance order on five clear days' notice, and refusing that order is contempt of court. Documents protected by solicitor client privilege are excluded
laws-lois.justice.gc.ca.
Fighting a requirement doesn't run out the clock. Under 231.8, the time from a judicial review of a 231.2 requirement, or from opposing a 231.7 application, until it's finally disposed of isn't counted in the reassessment period laws-lois.justice.gc.ca. The offence in 238(1) covers sections 230 to 232, so the record keeping duty in section 230 is in scope too
laws-lois.justice.gc.ca.
When does each deadline fall in a 2023 CCPC audit that starts in October 2026?
Your client is a CCPC. Its 2023 T2 notice of assessment is dated June 1, 2024, so its three year normal reassessment period ends June 1, 2027. The contact letter is dated October 15, 2026.
| Step | Date | Deadline | How it is counted |
|---|---|---|---|
| Preliminary request for records | October 15, 2026 | November 14, 2026 | 30 days |
| Longest extension the policy allows | January 13, 2027 | 90 days in total | |
| Proposal letter | February 1, 2027 | March 3, 2027 | 30 days |
| Proposal letter with the full extension | April 2, 2027 | 60 days in total | |
| Notice of reassessment | April 15, 2027 | July 14, 2027 | 90 days to object, corporation |
| Late objection: last day to apply for an extension | July 14, 2028 | 1 year after the objection deadline |
Here the reassessment lands before June 1, 2027, so the year is still open. Push the records into late spring and the auditor has a problem: AD-20-01 tells auditors to set deadlines with the statute barred date in mind, and to shorten the timelines or deny a follow up where needed canada.ca. In practice that's when a T2029 waiver gets put in front of your client. If it's signed, limit it to the issue under audit.
An individual gets a longer objection window: the later of 90 days and one year after the filing due date. The full rules, and the extension under section 166.1, are on the notice of objection deadline page.
Why you can't object to the proposal letter
The proposal letter is the CRA's last informal step, not an assessment. An objection is filed against a notice of assessment or determination, and P148 warns that an objection filed before the notice is issued may be invalid canada.ca. So the 30 days on the proposal letter are for written representations to the auditor, backed with the documents that support your position.
If the auditor won't move, go to the team leader, whose contact details are on every letter canada.ca. Once the notice of reassessment issues, the objection and then the Tax Court appeal take over.
Interest keeps running on the reassessed amount while it's in dispute, and paying all or part reduces it canada.ca. Before the notice issues, the auditor can estimate what will be owed, and paying early helps avoid interest
canada.ca. The rate is on the CRA overdue interest page.
Collection is a separate question. For income tax, the CRA normally postpones collecting disputed amounts until 90 days after it sends its decision on the objection, but not amounts that were withheld and remitted, and a large corporation pays 50% of the disputed amount when it objects canada.ca.
Is a GST/HST audit run the same way?
Mostly, with two differences. Combined income tax and GST/HST audits have been discontinued, so a business is audited for one tax and may get only a brief compliance review of the other. And every GST/HST refund request is reviewed before it's paid, with some examined further before approval, by an examiner who may be anywhere in Canada canada.ca.
The response timelines in AD-20-01 cover GST/HST audits too: the follow up request warns of a compliance order under ETA section 289.1, the GST/HST counterpart of ITA 231.7 canada.ca. GST/HST runs on its own reassessment clock under the Excise Tax Act, set out on the reassessment period page.
Sources
Can the auditor ask for years outside the normal reassessment period?
Yes, but reassessing them is another matter. Section 231.1 lets the auditor look at any record that could bear on your client's obligations laws-lois.justice.gc.ca. Reassessing a year past its normal period needs an exception such as misrepresentation, fraud or a waiver, covered on the reassessment period page.
How do I confirm the auditor who called is really from the CRA?
Can my client email the records to the auditor?
No. Auditors can't receive files by email; send them through the CRA's secure online services, by mail, or to a tax services office canada.ca. Keep a copy of everything sent, and keep the records themselves for the retention period.
Does my client have to pay the reassessment before the objection is decided?
Usually not for income tax: the CRA normally holds off collection until 90 days after its decision, except for withheld amounts and a large corporation's 50% canada.ca. Interest still accrues the whole time, so paying the amount your client agrees with is often worth it.
General information for the tax year shown, not advice for a specific client. Confirm the facts before you file or remit.