Answering a Supplier's Records Request Without Handing Over Everyone Else

The situation

Wei's plan for the year had been ordinary enough. She ran a small hairdressing business out of a rented storefront in Sioux Lookout, kept her own books with help from a part-time bookkeeper, and split her attention between the salon and a separation from her spouse, Zeynep, that had started that spring. The separation was amicable as these things go, with the two of them still splitting pickups for their children and speaking most weeks, but it added a layer of complication to a year that was already going to involve dividing property and sorting out support.

Wei's business itself was simple. She bought hair colour, styling products, and salon supplies from a regional distributor, and among her regular retail customers was Elif, a longtime friend who had been coming to Wei for haircuts since before either of them had children. Elif also ran a small side business reselling specialty hair products to other salons in the area, and bought some of her stock through Wei's account with the distributor, an informal arrangement the two of them had never really formalized on paper.

That arrangement became relevant when Elif's own tax filings came under review. The reviewing officer wanted to verify what Elif had actually purchased and resold, and traced some of those purchases back to Wei's supplier account. What arrived at Wei's salon was a formal request for records, the kind of legally binding request that compels a business to produce documents by a set deadline, addressed to Wei as the account holder and asking, in broad terms, for records of all purchases and sales activity connected to that supplier account over a multi-year period.

Wei's first reaction was to want to be as cooperative as possible, partly because she had never dealt with anything like this before, and partly because she did not want the request to strain her friendship with Elif any further than an audit already had. Her instinct was to hand over her entire supplier ledger, figuring that giving more than was asked would make the problem go away faster. That instinct, reasonable as it felt, was exactly the wrong one, because Wei's supplier account did not only reflect purchases connected to Elif. It reflected every product Wei had ever bought for her own salon and resold, in small quantities, to dozens of other retail customers who had nothing to do with Elif's audit at all.

What the documents showed

Once we sat down with Wei's records, the shape of the problem became clear. Her supplier ledger was organized by purchase order, not by customer, which meant that isolating the transactions connected to Elif required going through years of entries and cross-referencing them against Wei's own retail sales records to figure out which product batches had actually been resold to Elif rather than used in the salon or sold to someone else entirely. Mixed into that same ledger, in the very same columns, sat purchase and resale information tied to roughly forty other regular customers, none of whom had any connection to the audit that had prompted the request.

The request itself, read literally, asked for records of the account's full purchase and sale history, which on its face would have captured all of it. But a formal information request, even a legally binding one, is not a blank invitation to produce everything in a file that happens to touch the account in question. The authority to compel records is tied to what is relevant to the matter actually under review, in this case Elif's purchases and resales, not the unrelated commercial activity of every other person who happened to buy supplies through the same account over several years.

That distinction mattered practically, not just legally. If Wei had simply handed over the full ledger, she would have disclosed the purchase habits, pricing, and business volumes of dozens of her own customers, none of whom had consented to that disclosure and none of whom were part of any review. Several of those customers were, like Elif, small operators who resold specialty products informally, arrangements that were nobody's business but their own unless and until they themselves came under review. Handing over their information would not have made Wei more compliant. It would have made her the source of a much larger privacy problem than the one she was trying to solve.

There was also a narrower, more immediate concern specific to Elif and Zeynep. Because Elif was a mutual friend of the separating couple, and because Wei's own financial life was under a magnifying glass that year as the separation moved toward a property settlement, any appearance of Wei being loose with financial records, even records belonging to someone else, risked complicating her own separation file if it ever came up. The safest path, for Wei's business and for her personal life both, was the narrow one: answer exactly what had been asked, and nothing more.

What we did

1. Read the request against its actual legal scope before touching Wei's records, confirming what a formal information request can and cannot compel. This told us that the request needed to be answered fully and on time, but that its reach was limited to information relevant to Elif's file, giving us a defensible basis to narrow the response rather than produce the entire ledger out of caution.
2. Isolated the Elif-specific transactions within Wei's supplier ledger, working with her bookkeeper to trace which purchase orders had actually been resold to Elif, using invoices, delivery notes, and the informal notes Wei kept on the arrangement. This took several passes because the ledger was organized by purchase order rather than by customer, but it produced a clean, defensible subset of the records rather than a rough guess made under time pressure.
3. Documented the basis for excluding the rest of the ledger in a short cover letter accompanying the response, explaining plainly that the remaining transactions involved other customers unrelated to the matter under review, so the reviewing officer would understand the response was complete on its actual scope, not evasive or incomplete, and would not need to follow up with a second, broader request.
4. Redacted customer-identifying details from any records that unavoidably referenced other buyers in the course of showing Elif's purchase history, such as batch numbers shared across multiple customers' orders, so that even the narrowed production did not incidentally expose third parties who had nothing to do with the review and had never been asked to consent to any disclosure. This extra pass caught several batch references that would otherwise have identified other customers by name, even though those customers were not the subject of the records being produced at all.
5. Confirmed the deadline and delivered the response early rather than waiting until the due date, since a request answered ahead of schedule, with a clear explanation of its scope, tends to be read as good-faith cooperation rather than resistance, which mattered given how much Wei wanted to avoid escalating the matter or drawing further attention to her business. Delivering it early also left a buffer of a few days to fix anything if the reviewing officer flagged a gap.
6. Advised Wei separately on the personal dimension of the request, given that Elif was a mutual friend and the timing overlapped with Wei's separation from Zeynep, counselling her to keep the two matters entirely apart on paper and in conversation, so that nothing in the records response could later be characterized as connected to her own family law file or used as leverage in either matter.
7. Prepared Wei for the possibility of follow-up questions by walking her through what a reasonable second request might look like and how she should respond if one arrived, so she would not feel caught off guard or tempted to overshare again if the reviewing officer came back with a narrower, more specific ask, and so she would know to call us before answering rather than replying on her own.
8. Followed up after the response was delivered to confirm the reviewing officer had what was needed and had no follow-up questions, closing the file cleanly rather than leaving an open request that might have resurfaced later with a broader scope attached to it, and putting the confirmation in writing so Wei had something concrete to point to if the matter ever came up again.

The outcome

The narrowed response was accepted without objection. The reviewing officer did not push back on the scope, did not ask for the fuller ledger, and confirmed the request was satisfied within a few weeks of the response being delivered. Because the exposure in dispute involved Elif's own resale activity, valued in our review at somewhere between $15,000 and $50,000 depending on how certain purchases were characterized, and because that figure belonged entirely to Elif's file rather than Wei's, Wei herself faced no assessment, no penalty, and no further inquiry connected to the request at all.

What Wei avoided was not a tax bill of her own, since she never had one, but a much messier problem: the exposure of dozens of other customers' private purchase records to a review that had nothing to do with them, and the reputational cost that would have followed once word got around a small town that a local salon had handed over everyone's business to settle someone else's audit. That kind of damage does not show up on an assessment notice, but it would have outlasted the audit by years, in a community where clients and suppliers cross paths regularly and a reputation for carelessness with records travels fast.

The friendship between Wei and Elif survived the audit largely intact, helped along by the fact that Wei's response never put Elif in a position of feeling exposed by a friend who had access to her purchase history. Elif's own review continued separately and was resolved on its own terms, without Wei's business being drawn any further into it.

Wei's separation from Zeynep continued on its own track afterward, unaffected by the request, which was the outcome we had been managing toward from the beginning: two overlapping personal situations kept properly apart, so that neither one made the other worse. Wei also came away with a cleaner way of organizing her supplier ledger going forward, tagging purchases by customer as they happened rather than reconstructing that link only when a request forced the issue, which should make any future inquiry, hers or someone else's, considerably faster to answer.

What you can learn from this