Six years, and you are still responsible: What Canadian record-keeping rules actually require
Six years from the end of the last tax year they relate to. That is the retention period the Canada Revenue Agency applies to business records, and it is a legal obligation rather than a recommendation.
Most business owners know roughly that number. Far fewer know the second rule, which is the one that catches people out: outsourcing the bookkeeping does not outsource the responsibility.
What counts as a record is broader than you think
The statutory definition is expansive. A record includes an account, an agreement, a book, a chart or table, a diagram, a form, an image, an invoice, a letter, a map, a memorandum, a plan, a return, a statement, a telegram, a voucher, and any other proof containing information, in writing or in any other form.
That last phrase does a lot of work. It captures things most businesses do not think of as records at all: the messaging thread where a scope change was agreed, the spreadsheet used to allocate an expense, the screenshot of a payment confirmation.
CRA describes the requirement as keeping records of all transactions sufficient to support your income and expense claims, and it does not prescribe a particular system. There are many bookkeeping approaches and the agency does not endorse one.
Where a bookkeeper earns the fee
Given all of the above, the value in a good bookkeeping relationship is less about data entry than about the discipline around it.
Firms working on cloud-based systems, including online practices such as Plyo Bookkeeping, are generally structured so the client retains direct access to their own records rather than depending on a monthly report landing in an inbox. That structure matters specifically because of the responsibility rule above: the arrangement that keeps you compliant is one where you can reach your records without asking anyone.
The other thing worth paying for is someone noticing when something is missing, before the year end rather than during it.
Two layers, and businesses usually have one
Records fall into two categories, and the second is where most gaps appear.
The first is the summary layer: the books recording income and expenses, the general ledger, the financial statements. Software handles this well and most businesses have it in reasonable shape.
The second is the proof layer: the source documents showing each number corresponds to something real. Sales invoices, receipts issued, fee statements, contracts on the income side. Receipts and bills, bank and credit card statements, cancelled cheques on the expense side.
A tidy set of books with no supporting documents is a set of assertions. It is the proof layer that survives a review.
The rule about outsourcing
Here is the part that surprises people who have just hired a bookkeeper or moved to a cloud service.
CRA’s guidance on your responsibilities associated with records you must keep is explicit that you are responsible for protecting your records even if you hire a third party to hold them for you. You are also responsible for making them available when CRA asks, for ensuring that you, an employee, or your third-party record keeper is present when officials examine records at the address where they are kept, for making sure your representative cooperates and answers questions about the business, and for allowing officials to make or receive copies of what they need.
Read that carefully and the practical implication is clear. A provider relationship that leaves you unable to produce records promptly is your problem, not theirs, and the agency will look to you.
This is general information rather than tax or accounting advice, and requirements change. Anyone with a specific situation should confirm current rules on canada.ca and speak to a qualified professional.
Questions worth asking a provider
That responsibility rule turns into a short and useful due diligence list.
Can you export everything, in a usable format, without the provider’s cooperation? If the answer depends on their goodwill or their continued existence, you have a single point of failure sitting on a legal obligation.
Where are the records held, who else can access them, and what happens if the engagement ends? Providers who have thought about this answer immediately. Ones who have not will improvise, which tells you something.
How quickly can a specific document from three years ago be produced? Not in principle, in practice, measured in hours.
The separation problem
The most common structural weakness in small business books is not fraud or incompetence, it is mixing.
CRA does not legally require sole proprietors to hold a separate business bank account, but running personal and business transactions through one account creates work at every stage: reconstruction at year end, unreliable GST/HST tracking, and a considerably harder conversation if the file is ever reviewed.
Opening a dedicated business account and a dedicated card is close to free and eliminates a category of problem entirely. It is the single highest-return administrative decision most small businesses can make.
Digital records are fine, with conditions
Electronic records are acceptable and are what nearly everyone uses. The conditions attached matter.
Records must remain readable and accessible throughout the retention period, which is longer than the lifespan of a lot of software. A file format that requires an application you no longer license is a compliance problem waiting to surface.
Scanned images of paper documents are acceptable provided they are legible and retrievable. Backups belong somewhere separate from the primary copy.
And CRA can request records during a review or audit at any point within the retention window, so accessibility means now rather than after a migration project.
When the clock restarts
The six-year period is not always six years from the date you assume.
It runs from the end of the last tax year the records relate to. File a return late, or have a year reassessed, and the period effectively runs from that event instead. In practice the safe approach is keeping records longer rather than shorter when there is any doubt.
There is a formal route to destroying records early, which requires written permission from CRA obtained by application to your tax services office with reasons. Most businesses will never use it, and it is worth knowing it exists rather than simply disposing of things.
Free help most businesses do not use
One resource worth knowing about: CRA runs a Liaison Officer service, free to small business owners and self-employed individuals, to help them understand their tax obligations.
The service is confidential, and what is discussed is not shared with other areas of the agency. For a business owner who is uncertain rather than in difficulty, it is a considerably better first step than guessing, and it costs nothing.
The short version
Keep both layers, the books and the proof. Separate business from personal. Make sure electronic records stay readable for six years and can be retrieved today. And check that you, not just your provider, can actually reach them.
The retention rule is well known. The responsibility rule is the one that determines what happens when someone asks.