Anonymised, illustrative composite. A routine bank reconciliation — not a forensic audit — is what surfaced a target whose reported revenue never matched what actually hit its bank account.
At a glance
A regional operator was two weeks from signing a definitive agreement to buy a three-location specialty-retail chain. The seller had provided three years of financial statements and a set of corporate tax returns that matched them line for line — on paper, a clean, consistent business with $2.8 million in average annual revenue and steady margins.
As part of standard financial due diligence, the buyer’s accountant asked for three years of the business’s own bank statements directly from the seller’s bank, with the seller’s written consent, rather than relying on the summarized figures in the financial statements. Deavo’s guidance to first-time buyers flags exactly this category of risk in general terms: “a gap between what is reported on the financial statements and what was filed with the CRA or reported for GST/HST… is worth understanding rather than dismissing.” Three years of bank records were still available to request because the seller’s own retention obligation under the Income Tax Act runs six years past the relevant tax year — section 230(4)(b) requires records and vouchers to be kept “until the expiration of six years from the end of the last taxation year to which the records… relate”, so nothing about the request was unusual or unreasonable.
The reconciliation was simple arithmetic: total deposits into the business operating account, per year, against total revenue reported in the financial statements for that same year. They should have matched, less any timing differences at year-end. They did not.
Reported revenue averaged $2,800,000 a year across the three fiscal years reviewed. Total bank deposits into the operating account averaged $3,150,000 a year over the same three years — a gap of $350,000 a year, or 12.5% of reported revenue. The gap was not a one-time anomaly in a single year; it recurred, within a narrow range, in each of the three years the buyer pulled statements for. It also matched, almost to the dollar, the revenue figure reported on the corresponding corporate tax returns — meaning the shortfall had not been reported to CRA in any of the three years either.
The finding did not turn on any single document being falsified. It turned on the fact that money moving through a bank account is verifiable in a way a summarized financial statement is not, and a persistent, multi-year gap between deposits and reported revenue is not something a buyer can normalize away as a timing difference. A single quarter’s discrepancy might be explained by a delayed deposit; a $350,000 gap repeating identically across three separate fiscal years, matched by the tax filings rather than contradicted by them, describes unreported cash revenue, not an accounting quirk.
The consequence for a buyer matters most on a share purchase specifically: buying the shares of a corporation does not reset its history. The corporation itself — the entity that filed the returns — remains the taxpayer after the sale, so any future CRA reassessment, interest, or penalty tied to those three years of unreported revenue lands on the business the buyer now owns, not on the individual who sold it.
The exposure is also not time-boxed in the way a buyer might assume. A Canadian-controlled private corporation’s “normal reassessment period” ends three years after the original notice of assessment under Income Tax Act s.152(3.1)(b) — but s.152(4)(a)(i) permits a reassessment after that period where the taxpayer “has made any misrepresentation that is attributable to neglect, carelessness or wilful default”. Three years of revenue omitted from filed returns sits squarely in that exception, so the three-year window is not a ceiling. The same structure governs the GST/HST on those sales: Excise Tax Act s.298(4)(a) allows an assessment “at any time” where the person has made a misrepresentation attributable to neglect, carelessness or wilful default, notwithstanding the four-year limit s.298(1) otherwise sets. That is precisely why the buyer could not size the liability: neither the amount nor the deadline was bounded.
The buyer did not proceed to a definitive agreement on the terms as offered. Confronted with the reconciliation, the seller acknowledged a portion of daily cash sales had not been consistently deposited or reported. The buyer walked away from the deal rather than attempt to structure around an exposure of unknown depth — a corporation with three years of demonstrably unreported revenue carries a reassessment risk that a purchase price adjustment cannot cleanly quantify, because neither party can predict what CRA would ultimately assess, or when.
The same discipline — testing what is presented against an independent, harder-to-manipulate number — is what caught a different distortion on the cost side of a distributor’s books in the rebate cheque that inflated gross margin. For how a DSCR screen can end a deal on financing terms alone, see walking away in week two on a single number.
Had the buyer skipped the bank reconciliation and closed on the reported $2,800,000 revenue figure, it would have paid a multiple on a business that was, on the numbers that actually moved through its bank account, materially larger and materially riskier than represented — while inheriting a corporation with an undisclosed, unquantified CRA exposure sitting inside it. A reassessment reaching back three years, plus interest and penalties, could easily exceed any purchase-price adjustment the buyer might have tried to negotiate instead of walking away.
The tell was not the revenue figure itself — $2.8 million for a three-location retail chain was entirely plausible on its face. It was that the number was consistent across three years of financial statements and three years of tax filings, which sounds reassuring but is exactly what a business with a stable, undisclosed cash-skim pattern also looks like from the outside. A number that never moves against an independent source — the bank — is worth checking precisely because it looks clean.
A 30-minute call is enough to tell you whether AI pays for itself here.
