CRA Payroll Audit: What Business Owners Need to Know

Receiving a letter from the CRA requesting a payroll review is unsettling — but it doesn't have to be. A CRA payroll audit is the agency's process for verifying that your business has correctly deducted, remitted, and reported source deductions for your workers. Understanding what triggers an audit, what the CRA examines, and how to respond puts you in a much stronger position than business owners who are caught unprepared.

What Is a CRA Payroll Audit?

A payroll audit (formally called a Source Deductions Audit or Trust Account Examination) is a review conducted by a CRA auditor of your:

• CPP contributions and EI premiums withheld from employees and remitted to the CRA
• Income tax withheld from employee pay
• T4 and T4A filings and their accuracy
• Worker classification decisions (employee vs. contractor)
• Payroll records, registers, and employment contracts

The audit may cover the current tax year, the prior two or three years, or all years for which records exist — depending on the scope of the CRA's concerns.

What Triggers a CRA Payroll Audit?

The CRA selects businesses for payroll audits through several different pathways:

• Random selection: The CRA conducts routine payroll compliance reviews across all industries. Your business may simply be selected as part of a random sample — this does not indicate suspected wrongdoing.
• Industry risk profile: Businesses in industries with high cash payments — restaurants, construction, nail salons, beauty services, taxi and rideshare — are reviewed more frequently due to known compliance issues around tips, unreported income, and casual labour.
• Tip and gratuity issues: If your business handles customer tips, the CRA may review whether tips have been properly included in employees' T4 income.
• Employee complaints: A current or former employee who files a complaint about not receiving proper source deductions can trigger an audit. The CRA takes these complaints seriously.
• Inconsistencies in filed documents: If the wages reported on your T4 Summary don't match the payroll amounts reflected elsewhere (GST returns, corporate T2, etc.), the CRA's systems may flag the discrepancy.
• Worker misclassification signals: If the CRA receives a CPT1 ruling request or notices patterns suggesting workers classified as contractors should be employees, a payroll audit often follows.

What Does the CRA Examine?

During a payroll audit, the CRA auditor will typically request and review:

• PD7A remittance statements: The history of what you remitted each period compared to what you should have remitted based on your payroll.
• T4 and T4A filings: All information slips filed for the audit period — the auditor checks whether amounts are complete and accurately categorized.
• Payroll journal and register: A detailed record of every pay run — employee names, gross pay, deductions, net pay — for each pay period in the audit period.
• Employment contracts and agreements: Written contracts for both employees and contractors, to assess the true nature of the working relationship.
• Worker classification: The auditor applies a multi-factor test (control, ownership of tools, chance of profit/risk of loss, integration) to determine whether each contractor should have been treated as an employee. See our guide on Employee vs. Contractor in Canada for the full analysis.
• Records of Employment (ROEs): ROEs issued when workers left — the auditor checks whether they were issued accurately and on time.

The Payroll Audit Process

Step 1: Initial Contact

The CRA sends a letter or calls to notify you of the audit. This initial contact will specify the audit period, the type of review (payroll/trust account), and a list of documents to prepare. Read the letter carefully — the deadline to respond is usually stated clearly, and missing it creates an adversarial starting point.

Step 2: Desk Audit or Field Audit

Most small business payroll audits are desk audits — you gather and send the requested documents (or upload them to a CRA portal), and the auditor reviews them remotely. For larger businesses or more complex situations, the CRA may conduct a field audit, where an auditor visits your place of business to review records on-site. Field audits are less common for small businesses.

Step 3: Review and Findings

After reviewing your documents, the auditor will provide findings. If no issues are found, you receive a clearance letter. If the auditor finds discrepancies — unreported income, missed deductions, misclassified workers — they will propose a reassessment with additional amounts owing, plus penalties and interest.

Step 4: Response and Appeal

You have the right to object to proposed reassessments. If you disagree with the CRA's findings, file a Notice of Objection within 90 days of the assessment date. You can also request an appeals officer review. A professional representative — bookkeeper or tax professional — can argue on your behalf during this stage.

The total timeline from initial letter to resolution typically runs 3 to 6 months for straightforward desk audits. More complex cases can take 12 months or more.

Penalties for Non-Compliance

If the audit reveals non-compliance, the CRA applies penalties on top of the amounts owing:

• Failure to deduct CPP and EI: 10% penalty on the unremitted amount. A second offence in the same calendar year triggers a 20% penalty.
• Late remittance penalties: 3% to 10% of the late amount depending on how many days late, escalating to 20% for repeat late remittances in the same year.
• Failure to file T4/T4A slips: Penalties of $100 to $7,500 per type of information return, depending on the number of slips and the length of the delay.
• Worker misclassification: If workers are reassessed as employees, the business owes both the employee and employer shares of CPP and EI for those workers, plus income tax that should have been withheld — retroactively, for the full audit period.

Director liability: Company directors can be held personally liable for unremitted payroll deductions. This liability survives business closure and personal bankruptcy in many circumstances.

How to Stay Audit-Ready

The best defense against a payroll audit is clean, organized records. Businesses that are audit-ready experience faster resolution and far fewer adjustments:

• Keep payroll records for at least 6 years from the end of the tax year to which they relate — this is the CRA's statutory requirement.
• Have written employment contracts for every employee, and written service agreements for every contractor you engage.
• Document worker classification decisions at the time of hiring — record which factors you applied and why you concluded the worker was a contractor rather than an employee.
• Reconcile your payroll remittances monthly — your PD7A should match your payroll journal to the penny.

Our payroll management service maintains audit-ready records as part of standard practice. And if you receive an audit notice, our CRA support service can help you respond, gather documents, and represent your position throughout the process.