Introduction
A corporation can receive a CRA information request not because of anything wrong with its own returns, but because a client, supplier, or related party is being audited and the CRA is seeking to verify transactions from the other side. This is a third-party audit information request — and while it is less alarming than a direct audit of the corporation, it requires a considered response.
Scenario: Northbrook Consulting Receives a Letter About a Former Client
Northbrook Consulting Corp provided project management services to a large general contracting firm in 2022 and 2023. In early 2026, Northbrook receives a letter from the CRA's audit division stating that the CRA is conducting an audit of the general contracting firm and requesting copies of all invoices issued to that firm in 2022 and 2023, along with bank records confirming receipt of the payments.
Northbrook is not being audited. Its own returns are not in question. But it is being asked to produce records as a third party to someone else's audit.
Is Northbrook Required to Comply?
Yes. The CRA has broad powers under section 231.2 of the Income Tax Act to require any person to provide information or documents relevant to an audit of another taxpayer. Failure to comply with a properly issued requirement to produce information can result in penalties.
The request is a legal demand, not a polite inquiry. Northbrook should not ignore it.
What Northbrook Should Do
Step 1 — Contact the CPA. Before producing any documents, Northbrook's CPA should review the request, confirm it is properly issued (it should identify the provision under which the requirement is made), and assess whether any of the requested documents raise concerns about Northbrook's own returns.
Step 2 — Gather the specific documents requested. Northbrook should produce exactly what is requested — the invoices issued to the client and the bank records confirming payment. It should not volunteer additional information beyond what is asked for.
Step 3 — Review Northbrook's own returns for consistency. The CRA will compare Northbrook's records against what the general contracting firm reported as subcontractor expenses. If Northbrook's invoices total $280,000 across the two years, the CRA will check whether the contracting firm claimed $280,000 in subcontractor payments — and whether Northbrook reported $280,000 in revenue.
If Northbrook's revenue for those years is consistent with the invoices, the third-party request confirms the other company's records and closes the loop. If there is a discrepancy — Northbrook issued invoices totalling $280,000 but only reported $240,000 in revenue — the CRA's audit of the client firm has just revealed a potential gap in Northbrook's own returns.
The Own-Return Risk
This is the most important practical dimension of a third-party audit request: it may reveal inconsistencies in the corporation's own T2 returns. Before responding to the CRA, a CPA should compare the documents being produced against what was reported on the corporation's own returns. Any discrepancy should be addressed — either through explanation or, if necessary, through the Voluntary Disclosures Program — before the documents are submitted.
When to Speak With a CPA
Immediately upon receiving any CRA communication requesting records, regardless of whether the corporation itself is the subject of the review. Third-party requests are lower-stakes than direct audits — but they are not zero-stakes if there are any inconsistencies in the corporation's own records.