Our largest audit coverage is with large corporations. Of the large corporations we audit, virtually all of their tax returns are filed on a biannual basis, so every second year we'll audit two years' worth of corporate tax returns. We do this taking into account the complexity of the transactions large corporations enter into, because of the dollar amount involved, because of the frequent legislative changes that affect large corporations. It's an area we've identified as high risk, and one we look at very closely.
In doing so, we bring a team of tax avoidance and international specialists to bear on it in order to identify the kinds of triggers that would require further action. Whether it's a transfer pricing type of issue or a particular arrangement or scheme we might find offensive, we bring folks to bear on it.
The large number of small and medium-sized enterprises is where risk assessment and risk management is critical for us. We risk assess and risk score each and every one of the some 24 million individual returns that are filed, each of the two million business returns that are filed, and all five million to six million GST returns that are filed. Over the years we've developed a series of indicators—I don't think I have the exact number, but it's in the ballpark of about 200 different indicators—that are in the computer system to assist us in risk scoring a particular return to try to identify particular risk factors.
To take a relatively simple example, if you live in a certain neighbourhood that is well beyond the income you report, that will be one trigger that will show up. If you have a certain business where your gross operating profit or margins are significantly different from what is the norm for that particular industry, that is another risk factor that will show up.
There are other reasons we'll do an audit. We might do a follow-up audit on a previous audit we've done, just to ensure that in fact there is compliance. We have a leads and assistance program, so sometimes we receive leads from external sources. We will look into those where it's warranted. We have a core audit program as well, and we have a small number of people—around 50 or so—who do a series of random audits. We do that just to benchmark our risk assessment systems in order to ensure that they are as effective as possible.
So there are many reasons why we would carry out an audit, but generally speaking it's all risk-based.