Guides · Rules

Accountant in Quebec: a practical compliance checklist

An accounting firm juggles rules from the CRA, Revenu Québec, the professional order and privacy law. Here is a practical checklist, drawn from official sources, to see what should be in place. This is general information, not legal advice: always validate with your professional order or your advisor.

Before touching the file: engagement and authorizations

A firm must have authorization before accessing a client's online account with the Canada Revenue Agency (CRA), through the Represent a Client service, and with Revenu Québec, the provincial tax authority. Before starting the work, it is therefore worth requesting or renewing the authorization.

In the same spirit, have a clear engagement letter signed (scope, fees, client responsibilities) and keep proof of the signature. Source: the CRA's page on representative authorization.

Signed engagement letter on file.
CRA online access authorization active, where needed.
Revenu Québec online access authorization active, where needed.
For each client, the authorization status (none, CRA, Revenu Québec, both) is recorded.

Deadlines to validate for each client type

Individuals file and pay by April 30; self-employed workers file by June 15, but payment is still due April 30 (CRA). A corporation must file its CO-17 income tax return within six months after the end of its fiscal year, online; if the deadline falls on a weekend or holiday, it is extended to the next business day (Revenu Québec).

An employer must file Relevés 1 no later than the last day of February, online, or penalties apply (Revenu Québec). GST/QST reporting periods depend on each client's filing frequency.

Client type and fiscal year-end on file.
Filing date and payment date calculated separately for each client.
GST/QST frequency (monthly, quarterly, annual) recorded.
A clear note that payment is not deferred for self-employed workers.

Law 25: protecting personal information

According to the Quebec government, Law 25 requires a business to keep a confidentiality incident register, designate a person in charge of personal information protection, and notify the Commission d'accès à l'information (CAI, Quebec's privacy regulator) and the people affected where there is a risk of serious harm.

In practice, limit what you store: no full Social Insurance Number in the tracking tool, only the last three digits to tell apart two clients with similar names. Encrypt attachments, log access and use a secure portal rather than ordinary email.

Confidentiality incident register in place.
Person in charge of personal information protection designated.
Procedure for notifying the CAI and the people concerned.
Minimum information kept; the full SIN stays in the tax software.

Vendors and tools: a written contract

You may entrust information to a service provider without the client's consent if it is necessary for its mandate, provided this is done in writing and the contract states the measures protecting confidentiality (s. 18.3). Before information is communicated outside Quebec, a privacy impact assessment is required (s. 17).

An assessment is also needed for any project to acquire or develop an information system that involves personal information (s. 3.3). Ask any vendor in writing, Zenitech included, where your data travels. A document sent to the wrong person is an incident: the business must take reasonable steps to reduce the risk and, if the risk is serious, notify the CAI and the people concerned (s. 3.5).

Professional secrecy and confidentiality

A chartered professional accountant is bound by professional secrecy: they may not reveal their client's confidences, except with the client's authorization or where the law expressly requires it (CPA Code of Ethics). The Professional Code also requires professionals to respect the secrecy of any confidential information they learn in the practice of their profession (s. 60.4).

In practice, no client information goes to a third party without an authorization recorded on file, and messages contain no amounts or tax data. If you belong to a professional order, this secrecy follows you in your choice of vendors.

Text messages and emails to clients

Under Canada's Anti-Spam Legislation, a request for documents for an ongoing engagement does not require prior consent (s. 6(6)(b)), whereas a promotion does (s. 10(9)(a)). Deadline reminders should identify the firm and offer a way to stop receiving them.

Leo follows these habits: it never says what to declare and answers no tax question. The accountant validates every substantive reply. This guide is general information; it does not replace the advice of your order, your legal advisor or the Commission d'accès à l'information.

A good checklist makes compliance visible file by file. Have it validated by your order or advisor, and let Leo prepare the reminders while you decide.

General information, not legal advice. Check with your professional order or the official source.

Try Orvel free for 7 days The Leo agent

Questions

Is this checklist legal advice?

No. It is general information drawn from official sources. For your specific situation, consult your professional order or your legal advisor.

Can I store clients' full SIN in a tracking tool?

The principle used here is to limit the information kept: only the last three digits for identification, with the full SIN staying in the tax software.

What if a document goes to the wrong person?

It is a confidentiality incident. The business takes reasonable steps to reduce the risk and, if the risk of harm is serious, notifies the CAI and the people concerned, then records it in the register.

Official sources

More guides for this trade

Take action

Let's talk for 15 minutes?

A Zenitech expert will call you back within 24 hours to see what Orvel can do in your day. No obligation.

Phone · 581 748-7017Head office · 895, rue Raoul-Jobin, Québec (Québec) G1N 1S6