A “payroll audit” in a trades business is really three different reviews wearing one name. CRA looking at source deductions and T5018 filings, WSIB looking at clearance and premium classification, and an Ontario Ministry of Labour officer looking at hours, wages and records — each with its own trigger, its own paper trail, and its own way of turning a paperwork gap into real liability.
Key takeaways
It’s easy to prepare for the audit a firm expects and be blindsided by the one it doesn’t. A CRA review is concerned with whether source deductions were correctly withheld and remitted and whether T5018 subcontractor payments were properly reported. A WSIB review looks at whether the firm registered on time, whether its clearance certificate stayed valid, and whether workers were classified into the correct premium rate group for the work they actually did. An Employment Standards Act investigation, triggered by a complaint or a proactive inspection blitz, looks at hours of work, overtime, minimum wage compliance and whether the required records exist at all. A firm that only ever thinks about “the CRA audit” can pass that review cleanly and still be exposed on the other two.
The Contract Payment Reporting System is built around ITR 238. Subsection 238(2) requires an information return — the T5018 — from “every person or partnership that pays or credits, in a reporting period, an amount in respect of goods or services rendered on their behalf in the course of construction activities,” where the payer’s business income for that period is derived primarily from construction activities. Subsections 238(3) and (4) set the mechanics: the reporting period runs on either a calendar-year or fiscal-period basis — whichever is chosen first can’t be changed for later years without the Minister’s authorization — and the return has to be filed within six months of the reporting period’s end. The regulation defines “construction activities” broadly: erection, excavation, installation, alteration, modification, repair, improvement, demolition, destruction, dismantling or removal of a building, structure, or surface or sub-surface construction. For an auditor, a mismatch between what a firm reports paying its subs on T5018s and what those subs report earning is one of the more visible red flags in the whole review, precisely because both sides of that transaction are independently reported to CRA.
The retention rules aren’t identical across the three review types, which is exactly why a single filing habit doesn’t cover every risk. ITA s.230(4)(b) requires books and records to be kept “until the expiration of six years from the end of the last taxation year” they relate to, and s.230(4.1) requires electronic records to stay in an electronically readable format for that same period. The ESA’s own record-keeping rule runs on a shorter, narrower clock for a different purpose: three years on the dates and times an employee worked, three years on wage statement information, and three years on any written agreement permitting excess hours or overtime averaging, measured from the last day that agreement was in effect. A firm that only satisfies the six-year CRA clock and lets its hours-of-work records lapse after a year has a real gap the moment an ESA officer, rather than a CRA auditor, comes asking.
Before any of the retention or reporting rules matter, there’s a threshold question: was the person a contractor or an employee in the first place. CRA’s own test, as summarized by treadstonelaw, weighs four factors — control over how, when and where the work gets done; whether the worker supplies their own tools and equipment or uses the payer’s; whether the worker bears a genuine risk of profit or loss from their own business decisions; and whether the work is integrated into the payer’s core, ongoing operations in a way that looks like staff work rather than an outside engagement. A written agreement calling someone an “independent contractor” is, in treadstonelaw’s framing, “a relevant piece of evidence — but it isn’t determinative.” CRA runs a substance-over-form analysis on how the relationship actually operated, which means a contract that says one thing and a working relationship that behaves like another gets decided on the behaviour, not the paperwork.
The consequence isn’t abstract. If CRA reclassifies a worker from contractor to employee, the payer becomes responsible for the income tax, CPP and EI that should have been withheld and remitted from that worker’s pay all along — retroactively, for the period under review. Separate ESA back-pay exposure follows on top of that, since a reclassified worker may be found to have been owed vacation pay, overtime and statutory notice the entire time, regardless of what the original paperwork said. This is precisely why the classification question deserves attention before an audit forces it, not during one: a firm reviewing its subcontractor relationships against the four-factor test on its own schedule can fix a genuine misclassification with far less exposure than a firm that has CRA make the determination for it after the fact.
Related reading: another payroll mechanic that gets conflated with something it isn’t, the record-keeping habit that keeps this review from becoming a scramble, how the same WSIB and record-keeping obligations apply to a TFW hire and the return’s formal definition.
Common triggers include a mismatch between a firm’s reported T5018 subcontractor payments and what those subs report earning, patterns that suggest worker misclassification, or a routine compliance review. There is no single published trigger list — the classification test and the T5018 filings are the areas most worth reviewing proactively.
Under ITA s.230(4)(b), tax and payroll books and records must be kept for six years from the end of the tax year they relate to. Separately, Ontario’s ESA requires three years of retention specifically for hours-of-work and wage-statement records — both clocks apply, and they aren’t the same length.
The payer becomes liable for the income tax, CPP and EI that should have been withheld and remitted from that worker’s pay, retroactively for the reviewed period. Separate ESA exposure — overtime, vacation pay, notice — can follow on top of that.
It helps as evidence but is not determinative on its own. CRA applies a substance-over-form test based on how the work actually happened — control, tools, risk of loss and integration — and a contract label that doesn’t match the real working relationship won’t control the outcome.
A 30-minute call is enough to tell you whether AI pays for itself here.
