Data Room for CRA Audits and Information Requests (2026)

How it works in Canada

CRA audits begin with a contact letter and a list of records the auditor wants to see. Under section 231.1 of the Income Tax Act, an authorized person may inspect books and records and ask questions; section 231.2 lets the CRA issue formal requirements for information. Large businesses and multinationals face ongoing audits, often with transfer pricing and international tax specialists involved.

The company’s tax team, external CPA firm and tax counsel work together on responses. Some documents are privileged legal advice and must stay out of what is produced, while accountants’ working papers generally are not privileged in Canada. A clear split between internal analysis and outbound responses reduces risk. The CRA can also ask for records held outside Canada under section 231.6, so foreign affiliates’ files sometimes join the room.

The same structure suits the Voluntary Disclosures Program. Since October 1, 2025, the CRA’s updated VDP gives broader relief for unprompted applications and partial relief for some prompted ones. Advisers assemble the amended returns, supporting records and Form RC199 in one controlled space before filing. Having the full set ready before filing matters, because a CRA contact letter arriving first can change how an application is treated.

Best data rooms for cra audits

Our five criteria, re-weighted for this use case, plus a small bonus for providers built around it.

1 Ellty ~C$211/mo
9.1 Visit Ellty
2 iDeals Quote
8.7
3 Datasite Quote
8.7
4 Firmex Quote
8.6
5 Intralinks Quote
8.6
6 Ansarada Quote
8.6
7 Drooms Quote
8.4
8 SmartRoom Quote
8.3
9 Citrix ShareFile ~C$78/mo
8.1
10 Box ~C$21/user/mo
8.0

Privacy 29%Workflow 17%Control 25%Usability 15%Cost 14%

What goes in the data room

CRA audits: index

01
01 CRA correspondence
Contact letter, auditor requests, requirements and the response log with dates.
02
02 Returns under review
T2 returns, schedules and notices of assessment for each year in scope.
03
03 Financial statements and GL
Statements, trial balances and general ledger exports for the audited years.
04
04 Transfer pricing
Contemporaneous documentation, intercompany agreements and T106 filings.
05
05 GST/HST and QST
Returns, input tax credit support and reconciliations, with Revenu Québec items separate.
06
06 SR&ED claims
Project descriptions, timesheets and expenditure support for claimed years.
07
07 Payroll and benefits
T4 and T4A summaries, taxable benefit calculations and remittance records.
08
08 Responses sent
Exact copies of every package delivered to the CRA, stamped by date.
09
09 Privileged advice (counsel only)
Tax counsel opinions and strategy memos, never produced.
10
10 VDP application
Form RC199, amended returns and supporting records if a disclosure is made.

Canadian rules that apply

Income Tax Act ss. 231.1 and 231.2

Section 231.1 lets CRA officials inspect, audit and examine books and records and require reasonable assistance. Section 231.2 allows formal requirements for information or documents. Failure to comply can lead to compliance orders and penalties, so track every request and deadline.

Solicitor-client privilege, s. 232

Section 232 of the Income Tax Act protects solicitor-client privileged documents from CRA demands. The Supreme Court of Canada has held this privilege must be strongly protected. Keep tax counsel’s advice in a separate area so it is never sent by mistake.

Voluntary Disclosures Program

The VDP lets taxpayers correct past non-compliance with relief from penalties and part of the interest. The program was updated on October 1, 2025, with relief generally covering up to the 10 most recent years for unprompted applications. Applications use Form RC199.

Books and records retention

Records generally must be kept for six years after the end of the last tax year they relate to, and longer while an objection or appeal is pending. The room helps with the audit but the company must keep its own permanent records.

Features to insist on

Data room	Activity log	2-step login	Dynamic watermarks	Bulk upload
Ellty	Yes	Yes	Yes	Yes
iDeals	Yes	Yes	Yes	Yes
Datasite	Yes	Yes	Yes	Yes
Firmex	Yes	Yes	Yes	Yes
Intralinks	Yes	Yes	Yes	Yes
Ansarada	Yes	Yes	Yes	Yes
Drooms	Yes	Yes	Yes	Yes
SmartRoom	Yes	Yes	Yes	Yes

Activity log. Per-user history of opens, prints and downloads with timestamps, which you can export for the closing binder.
2-step login. Logins need a one-time code or authenticator approval on top of the password.
Dynamic watermarks. The reader's identity and the date are printed across every page, which discourages screenshots and identifies the source of a leak.
Bulk upload. Upload an entire set of nested folders at once, with the index numbers kept as they were.

How to set it up

1
Log every CRA request
Create a request register as the first folder: what the auditor asked for, the deadline and who owns it. Add each new letter as it arrives so the team can see open items at a glance.
2
Split internal and outbound areas
Keep working files where the tax team and advisers prepare answers, and a separate outbound folder holding only what is actually sent to the CRA. That avoids sending drafts or internal notes.
3
Protect privileged advice
Put tax counsel’s opinions and memos in a counsel-only folder. Remember that accountants’ working papers are generally not privileged in Canada, so involve counsel early if a dispute looks likely.
4
Deliver and record
Send responses through the CRA’s accepted channels, such as the auditor’s secure portal or My Business Account submissions, and store a dated copy in the room. The room is the company’s record of exactly what was given.
5
Prepare for objection
If a reassessment follows, the room already holds the full record of requests and responses. Tax counsel can use it to prepare a notice of objection within 90 days of the notice of reassessment.
6
Keep the record
After the audit closes, export the room and keep it with the company’s tax records for at least the statutory retention period, longer if an appeal to the Tax Court of Canada is possible.

Common mistakes

Sending the auditor a whole folder that includes internal emails or draft analysis.
Mixing counsel’s privileged advice with accountants’ working papers.
Missing a requirement deadline because the request was never logged.
Applying to the VDP after CRA contact without checking whether the application will be treated as prompted.

FAQ

Can we give the CRA auditor access to our data room?

You can, but many advisers prefer to deliver packages through the CRA’s own channels and keep the room internal. If you grant access, limit it to an outbound folder with final responses only, and keep logs so you know what the auditor viewed.

Are our accountant’s working papers privileged?

Generally no. Canadian law does not recognize a general accountant-client privilege. Advice from a lawyer is protected, and work done at counsel’s direction for litigation may be. Bring tax counsel in early if the audit could lead to a dispute.

What changed in the Voluntary Disclosures Program in 2025?

From October 1, 2025, the CRA divides applications into unprompted and prompted. Unprompted applications can get full penalty relief and most interest relief for up to 10 years; some prompted applications can get partial relief. Check the current CRA guidance and Form RC199 before filing.

Data room for CRA audits and information requests