The corporate investigation process in Canada should be proportionate to the allegation. A missing receipt, a harassment complaint and a suspected procurement fraud do not need the same team or the same evidence plan.

What they share is a basic structure: triage the concern, define the mandate, preserve and collect evidence, interview the right people, analyze the record and report the findings fairly. Skipping one of those steps can create gaps that are difficult to repair later.

This guide explains that process for Canadian organizations. Specific obligations vary by province, industry and subject matter, so legal advice may be required.

What can trigger a corporate investigation?

A formal investigation may begin with:

• an employee, customer or whistleblower complaint;
• an audit exception or unexplained transaction;
• suspected conflict of interest or vendor collusion;
• loss of confidential information or company property;
• workplace harassment, discrimination or violence concerns;
• a regulator, insurer, lender or board request;
• litigation or a credible threat of litigation;
• information found during due diligence.

Not every concern needs a full investigation. Some can be resolved through routine management, accounting correction or an informal process. Triage determines which response fits the risk.

Stage 1: Triage the allegation and immediate risk

Record the complaint or triggering event in neutral language. Identify what is alleged, who may be involved, when it occurred and which records may exist.

Then assess immediate issues:

• Is anyone at risk of harm?
• Is money, data or property still being lost?
• Can relevant records be changed through normal access or retention?
• Does the allegation involve a senior leader or the usual decision-maker?
• Is police, regulator, insurer or legal notice required?
• Could an interim measure affect fairness or employment rights?

Immediate action should be targeted. Secure the exposed system or record without destroying evidence or treating an allegation as a proven fact.

Stage 2: Define the scope and investigator

A written mandate keeps the investigation focused. It should identify:

• the allegations or issues to be determined;
• the relevant period and business units;
• the policy, contract, law or other standard that may apply;
• the investigator’s authority to access records and interview people;
• the person receiving updates and the final report;
• any questions expressly outside the scope.

Choose an investigator who is independent of the events and decision-makers. External help may be appropriate where senior management is involved, internal expertise is missing, the matter is highly sensitive or credibility with a regulator or court is important.

If counsel is involved, agree on reporting lines and privilege expectations at the beginning. Retaining an investigator through a lawyer does not make every document privileged automatically.

Stage 3: Preserve evidence

Preservation should happen before broad interviews or document review. The organization may need a legal hold or another written instruction to stop normal deletion of relevant records.

Common sources include email, chat, shared drives, access logs, financial systems, HR files, CCTV, building access, phones and company laptops. Record the owner or custodian, date range, system and person responsible for collection.

Do not ask employees to gather records informally if that could alter metadata or leave obvious gaps. Digital-forensics support may be needed for device imaging, deleted files or compromised accounts.

Stage 4: Collect and review the records

Collect the least amount of personal information needed to answer the defined questions. Access should be limited to people with a role in the investigation.

Build a chronology while reviewing the evidence. A useful chronology links each event to its source and flags conflicts, missing records and alternative explanations. Avoid filling a gap with assumption simply because the leading theory seems likely.

Privacy law in Canada is divided by sector, jurisdiction and activity. PIPEDA applies to federally regulated employers and many commercial activities, while provincial laws and workplace duties may also apply. Before covert monitoring or review of personal information, confirm the organization’s lawful authority and whether a less intrusive method would answer the question.

Stage 5: Conduct fair interviews

There is no single correct interview order for every corporate investigation. The Canadian Human Rights Commission notes that some investigators begin with the principal party and others with the responding party. The approach depends on the allegations, circumstances and available information.

What does not change is procedural fairness. The Commission’s workplace-investigation guidance emphasizes impartiality and a process consistent with the applicable law, policy and collective agreement.

Good interview practice includes:

• explaining the investigator’s role and the purpose of the meeting;
• avoiding promises of absolute confidentiality;
• using open questions before testing specific evidence;
• giving a person a meaningful opportunity to answer material allegations;
• keeping accurate notes and confirming important details;
• following up when new evidence changes the issues.

Recording rules and workplace rights vary. Decide in advance how interviews will be documented and whether a representative may attend.

Stage 6: Analyze the evidence

The investigator should assess each issue against the standard set in the mandate. Many internal and workplace investigations use the balance of probabilities, meaning whether the event was more likely than not. The applicable standard should be confirmed for the particular process.

Credibility is not a contest of confidence or likability. Consider consistency, opportunity to observe, contemporaneous records, corroboration, motive to misstate and whether the account makes sense when tested against objective evidence.

The investigator should also identify where the evidence is insufficient. “Not substantiated” does not necessarily mean the complaint was false. It may mean the available evidence did not meet the required standard.

Stage 7: Prepare the investigation report

A useful corporate investigation report normally includes:

• the mandate and scope;
• the investigator’s role and any conflicts considered;
• the policies, legal standards or terms of reference applied;
• the evidence and interviews reviewed;
• a clear chronology where helpful;
• findings for each issue with reasons;
• limitations, missing evidence and unresolved questions;
• recommendations only where the mandate asks for them.

The report should not make criminal findings or legal conclusions outside the investigator’s expertise. Management or counsel decides what action follows.

Stage 8: Decide and close the file

The organization should separate factual findings from the decision on discipline, remediation, control changes or legal action. That keeps the investigator’s role clear and allows decision-makers to consider employment agreements, past practice and proportionality.

Communicate the outcome to the people entitled to receive it, while limiting unnecessary disclosure of personal information. Preserve the final report, source records and decision documents according to legal advice and the organization’s retention obligations.

Finally, address the system that allowed the issue to arise. The most useful investigation may reveal weak approvals, poor access controls, unclear policies or a reporting channel employees did not trust.

When to contact police or a regulator

Call 9-1-1 for immediate danger or a crime in progress. Suspected fraud or other criminal conduct should be reported to the appropriate local police service. Regulatory, privacy, occupational health and safety, securities or professional-reporting obligations depend on the matter.

A private investigation should not be used to delay a required report. At the same time, preserve the internal records and coordinate with police or the regulator so the organization does not compromise their process.

Frequently asked questions about corporate investigations

How long does a corporate investigation take in Canada?

Timing depends on urgency, number of witnesses, volume of records and availability of the parties. A focused matter may take weeks. A multi-entity fraud or large document review can take much longer.

Who should conduct an internal corporate investigation?

Use someone impartial who has the required subject-matter and interview experience. An external investigator may be preferable where leaders are involved, internal conflicts exist or specialized evidence is required.

Are corporate investigation reports privileged?

Not automatically. Privilege depends on the purpose, retainer, communications and surrounding facts. Ask counsel to structure the engagement where legal advice or litigation is involved.

What is the standard of proof in a workplace investigation?

Many workplace investigations use the balance of probabilities, but the mandate, law, collective agreement or policy may require a particular approach. Confirm the standard before the evidence is assessed.

Should the respondent always be interviewed last?

No. There is no universal interview order. The sequence should protect fairness and evidence while giving the respondent a meaningful opportunity to answer the material allegations.