The CRA can audit up to four years after the notice of assessment, or longer in case of suspected fraud.
