Audit requirements in Canada depend on the type of entity, its governing legislation, and the jurisdiction in which it operates. Most private corporations can waive a statutory audit if all shareholders consent, while public companies, federally regulated entities, and non-profits above certain thresholds face mandatory independent audits. Understanding where your business sits in this framework is essential before you file annual financial statements or approach investors.
This guide explains who must be audited in Canada, which laws apply, how the process works in practice, and what the consequences of non-compliance look like. It covers federal and provincial rules, the distinction between audits and reviews, and the practical steps foreign founders and business owners need to take.
The obligation to undergo an independent audit in Canada is not universal. It flows from the legal form of the entity, the legislation under which it was incorporated or registered, and the nature of its activities.
Federally incorporated private corporations are governed by the Canada Business Corporations Act (CBCA). Under the CBCA, a non-distributing corporation - one that does not offer securities to the public - may dispense with an audit entirely if all shareholders unanimously agree in writing. This waiver must be renewed each financial year. If even one shareholder objects, a full audit is required.
Publicly listed companies have no such option. Any corporation that distributes securities to the public, whether listed on the Toronto Stock Exchange, the TSX Venture Exchange, or another Canadian exchange, must have its annual financial statements audited by a registered public accounting firm. The Canadian Securities Administrators (CSA) and provincial securities commissions enforce this requirement through National Instrument 52-109 and related instruments.
Provincially incorporated corporations follow the rules of their home province. Most provincial business corporations acts - including the Ontario Business Corporations Act (OBCA) and the British Columbia Business Corporations Act (BCBCA) - mirror the CBCA approach for private companies, allowing shareholder waivers. However, thresholds and procedural details differ, so founders should check the specific provincial statute.
Non-profit organisations and charities face a separate regime. Federally incorporated non-profits under the Canada Not-for-profit Corporations Act (CNCA) must have an audit if gross annual revenues exceed a prescribed threshold, or if at least ten percent of members request one. Registered charities that file T3010 returns with the Canada Revenue Agency (CRA) are also subject to audit or review requirements tied to their revenue level.
Federally regulated financial institutions - banks, insurance companies, and trust companies - must be audited annually under the Bank Act, the Insurance Companies Act, or the Trust and Loan Companies Act, regardless of size or shareholder consent.
Several overlapping bodies of law and regulation shape audit requirements in Canada. Knowing which instrument applies to your entity avoids costly compliance gaps.
The Canada Business Corporations Act is the primary statute for federally incorporated companies. It sets out the appointment, powers, and duties of auditors, the content of the auditor';s report, and the conditions under which the audit requirement can be waived. Auditors must be independent and must be members in good standing of a recognised provincial accounting body.
Securities legislation adds a further layer for public companies. The CSA';s National Instrument 52-107 prescribes the accounting standards that must be used - International Financial Reporting Standards (IFRS) for most reporting issuers - and National Instrument 52-108 requires that auditors of reporting issuers be registered with the Canadian Public Accountability Board (CPAB). CPAB is the independent oversight body that inspects and regulates public company auditors in Canada.
Provincial securities acts - such as the Securities Act (Ontario) and the Securities Act (British Columbia) - incorporate CSA instruments by reference and are enforced by provincial commissions including the Ontario Securities Commission (OSC) and the British Columbia Securities Commission (BCSC).
The Income Tax Act does not itself mandate audits, but the CRA has broad powers to audit any taxpayer';s books and records. This is a tax audit, distinct from a financial statement audit, and can be triggered by risk-based selection, industry campaigns, or random sampling. All businesses must maintain adequate books and records for at least six years under the Income Tax Act.
Accounting standards are set by the Accounting Standards Board (AcSB). Private enterprises may use Accounting Standards for Private Enterprises (ASPE) rather than IFRS, which affects the complexity and cost of an audit engagement.
A common source of confusion for foreign founders is the distinction between an audit and a review engagement. These are different levels of assurance, and the choice has significant cost and compliance implications.
An audit provides the highest level of assurance. The auditor examines financial statements in detail, tests internal controls, verifies balances with third parties, and issues an opinion on whether the statements present fairly, in all material respects, the financial position of the entity. An audit is required by statute for public companies and certain regulated entities.
A review engagement provides limited assurance. The practitioner performs analytical procedures and makes inquiries, but does not test controls or verify balances independently. The resulting report states that nothing has come to the practitioner';s attention to suggest the statements are materially misstated. Under the CNCA, non-profits with revenues below the upper threshold but above the lower threshold may satisfy their assurance requirement with a review rather than a full audit.
A compilation (formerly called a notice to reader) provides no assurance at all. The accountant assembles financial information provided by management without verifying it. This is acceptable for internal management purposes or for small private companies that have validly waived their audit requirement, but it does not satisfy any statutory audit obligation.
In practice, founders should consider what their stakeholders - lenders, investors, or government funders - actually require. A bank providing a significant credit facility will often insist on audited statements even if the statute does not require them. A private equity investor will almost always require audited financials before closing a transaction.
Understanding the mechanics of a Canadian audit helps founders plan timelines and budget realistically.
Appointment of the auditor is the first formal step. Under the CBCA, shareholders appoint the auditor at each annual general meeting (AGM). The auditor holds office until the next AGM. For public companies, the appointment is disclosed in the management information circular and is subject to shareholder vote. The auditor must confirm independence before accepting the engagement.
Planning and risk assessment typically begins several weeks before the financial year-end. The auditor assesses the entity';s business environment, identifies significant risks, and designs procedures to address them. For a first-year audit, this phase takes longer because the auditor must establish opening balances and understand the entity';s history.
Fieldwork involves testing transactions, confirming balances with banks and counterparties, reviewing contracts, and evaluating accounting estimates. For a straightforward private company, fieldwork may take one to three weeks. For a complex public company, it can extend over several months.
Completion and reporting follows fieldwork. The auditor issues a written report addressed to the shareholders. Under Canadian Auditing Standards (CAS), which are based on International Standards on Auditing (ISA), the report must include a clear opinion - unmodified, qualified, adverse, or a disclaimer - and must describe key audit matters for listed entities.
Filing deadlines vary by entity type. Public companies that are reporting issuers must file audited annual financial statements within 90 days of their financial year-end under National Instrument 51-102. Venture issuers have 120 days. CBCA corporations must send financial statements to shareholders before the AGM, which must be held within six months of the financial year-end.
A common mistake is underestimating the lead time required. Many founders assume an audit can be completed in a few weeks after year-end. In practice, auditors need to be engaged well before year-end, and the process from fieldwork to final report often takes six to ten weeks for a mid-sized private company.
If you need guidance on structuring your entity';s audit obligations correctly from the outset, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
Foreign businesses operating in Canada through a subsidiary or branch face the same statutory audit rules as domestic entities, but there are additional practical considerations.
A wholly owned Canadian subsidiary of a foreign parent is still a separate legal entity under Canadian law. If it is a CBCA or provincial corporation, the audit waiver rules apply in the same way as for any other private company. However, if the parent is publicly listed in another jurisdiction and consolidates the Canadian subsidiary, the parent';s auditors will typically require the subsidiary';s financial statements to be audited or at least reviewed to support the group audit.
Branch operations do not have separate legal personality, so there is no statutory audit requirement at the branch level. However, the foreign parent must still report Canadian-source income to the CRA, and adequate books and records must be maintained in Canada.
Transfer pricing is a significant compliance area for foreign-owned entities. The Income Tax Act requires that transactions between a Canadian entity and related non-resident parties be priced at arm';s length. The CRA can audit transfer pricing arrangements and impose penalties where documentation is inadequate. This is not a financial statement audit, but it requires the same quality of record-keeping.
A non-obvious requirement for foreign founders is that the auditor of a CBCA corporation must be a Canadian resident. Specifically, at least one auditor, or the majority of partners in an audit firm, must be members of a provincial accounting body and ordinarily resident in Canada. A foreign parent cannot simply send its home-country auditors to sign the Canadian report.
Scenario one: A German technology company sets up a CBCA subsidiary with two shareholders - the German parent and a Canadian minority partner. Because not all shareholders are the same person, and the minority partner does not consent to waiving the audit, a full annual audit is required under the CBCA. The German parent';s auditors can perform the work, but a Canadian-resident partner must sign the report.
Scenario two: A US-based private equity fund acquires a Canadian operating company with revenues above CAD 10 million. The fund';s limited partnership agreement requires audited financials for all portfolio companies. Even though the Canadian company is a private corporation and all shareholders could theoretically waive the audit, the fund';s constitutional documents override that option in practice. The company must be audited annually.
Failing to meet statutory audit obligations in Canada carries real consequences, ranging from regulatory sanctions to civil liability.
For public companies, failure to file audited financial statements by the prescribed deadline triggers cease-trade orders from the relevant provincial securities commission. A cease-trade order prevents trading in the company';s securities, which can effectively freeze capital markets activity and damage the company';s reputation severely. The OSC and BCSC publish lists of companies subject to cease-trade orders, which are publicly accessible.
For CBCA corporations, the Act gives any shareholder, director, or creditor the right to apply to a court to require the appointment of an auditor if the corporation has failed to do so when required. Courts can also order a corporation to comply with audit requirements and can impose costs on directors who have caused the failure.
For non-profits and charities, the CRA can revoke charitable status for persistent failure to file accurate T3010 returns, which include financial statements at the required assurance level. Revocation means the organisation loses its ability to issue tax receipts, which is typically fatal to its fundraising capacity.
Director liability is a practical concern. Directors of a CBCA corporation have a duty to ensure that financial statements are prepared and presented to shareholders. A director who knowingly approves financial statements that do not comply with the Act can face personal liability. Many underestimate this exposure when serving on the board of a Canadian subsidiary.
CRA tax audits are a separate but related risk. A business that cannot produce adequate books and records during a CRA audit may have its income estimated by the CRA using arbitrary methods, often resulting in higher assessments than the actual income would justify. Penalties for failure to maintain adequate records can be assessed under the Income Tax Act.
A common mistake among foreign founders is treating the audit waiver as a permanent solution without reviewing it annually. The waiver must be unanimous and must be renewed each year. If a shareholder transfer occurs and the new shareholder does not sign the waiver, the obligation reverts immediately.
What is the difference between a statutory audit and a CRA tax audit in Canada?
A statutory audit is an independent examination of a company';s financial statements by a licensed public accountant, required under corporate or securities legislation. It results in an auditor';s report addressed to shareholders. A CRA tax audit is an administrative review by the Canada Revenue Agency to verify that a taxpayer has correctly reported income and paid the right amount of tax. The two processes are entirely separate, involve different parties, and are triggered by different rules. A company can be subject to a CRA tax audit even if it has validly waived its statutory audit requirement. Both require well-maintained books and records, so the practical preparation overlaps significantly.
How long does a typical audit take and what does it cost in Canada?
For a straightforward private company, the audit process from engagement to final report typically takes between six and twelve weeks, assuming the company';s records are well-organised and management is responsive. For a complex public company or a first-year audit, the timeline can extend considerably. Costs vary widely depending on the size and complexity of the entity, the quality of internal records, and the firm engaged. Professional fees for a small private company audit generally start from the low thousands of Canadian dollars, while a mid-market public company audit can run into the hundreds of thousands. State and registration-level charges are minimal, but the professional fee is the dominant cost driver.
Can a private company in Canada avoid an audit entirely?
Yes, under most Canadian corporate statutes, a private company that does not distribute securities to the public can waive the statutory audit requirement if all shareholders consent unanimously in writing each year. However, this waiver does not protect the company from a CRA tax audit, does not satisfy lender or investor requirements for audited financials, and does not apply to federally regulated entities such as banks or insurance companies. Non-profits above certain revenue thresholds cannot waive the requirement at all. In practice, many private companies that are eligible to waive still choose to have an audit or review engagement because their commercial relationships demand it.
Audit requirements in Canada are shaped by entity type, governing legislation, shareholder structure, and the nature of the business. Public companies and regulated financial institutions face mandatory annual audits with no exceptions. Private corporations have more flexibility but must manage the waiver process carefully each year. Foreign-owned entities face the same rules as domestic ones, with additional considerations around group audits and residency of the signing auditor.
VLO Law Firms advises international clients on audit requirements in Canada. We can assist with assessing your statutory obligations, structuring shareholder waiver arrangements, coordinating with Canadian auditors, and ensuring your entity meets all filing deadlines. To request a consultation, contact: info@vlolawfirm.com