Financial Audit Trail — CRA ITA s.230 Ready

A financial audit trail is a chronological, append-only record of every financial action taken in your accounting system. Each entry captures who performed the action, what changed, when it happened, and a cryptographic hash to prove the record has not been altered. It provides a complete chain of evidence from the original transaction to the final financial statement.

Under the Income Tax Act section 230, every person carrying on a business in Canada must keep records and books of account for at least 6 years from the end of the last tax year they relate to. In practice, the CRA recommends 7 years to cover the filing year plus the 6-year retention period. iBill automatically retains all audit trail records for 7 years to ensure full CRA compliance.

SHA-256 generates a unique 64-character fingerprint for each financial document. If even one character in the original record is changed, the hash changes completely. iBill computes a SHA-256 hash at the time of each transaction and stores it in the audit log. During a CRA audit, you can verify that no record has been tampered with by recomputing the hash and comparing it to the stored value.

ITA section 230 requires every business to keep adequate books and records at their place of business or designated location. Records must include invoices, receipts, bank statements, journal entries, and any supporting documents. The records must be sufficient for the CRA to determine taxes payable. iBill's audit trail satisfies these requirements by logging every invoice, payment, void, credit memo, and correction with timestamps, user IDs, and document hashes.

iBill lets you export your complete audit trail in three formats: CSV for spreadsheet analysis, JSON for programmatic processing, and XML for formal compliance submissions. Each export includes the action type, timestamp, user ID, document hash, and before/after values. You can filter by date range, action type, or user to provide exactly what the CRA auditor requests.