Corporate Due Diligence Investigation: A PI's Guide

A corporate due diligence investigation is an independent inquiry into a target company’s ownership structure, financial history, litigation record, and principal integrity — conducted before an acquisition or merger. In Canada, that inquiry is shaped by federal statutes including the Canada Business Corporations Act (CBCA), the Investment Canada Act, the Competition Act, and PIPEDA.

Canadian Anti-Fraud Centre data records $643.7 million in fraud losses in 2024, with actual losses estimated to exceed $6 billion once under-reporting is factored in — and business-acquisition fraud is among the typologies embedded in that figure. This guide explains what a PSISA-licensed investigator covers, what federal statutes govern the process, how a Canada-specific investigation unfolds across five documented stages, and what makes the final report decision-ready for transaction counsel.

What is a corporate due diligence investigation

A corporate due diligence investigation is an independent, evidence-based inquiry into a target company’s ownership structure, financial history, litigation record, and principal integrity, conducted before an acquisition, merger, or major transaction. It differs from the buyer’s own legal or financial review: it goes beyond what documents the seller provides, using open-source research, registry searches, and field intelligence to verify claims that cannot be self-certified.

The investigation does not replace legal review of contracts and permits (the solicitor’s role), audited financial statements (the auditor’s role), or actuarial and environmental assessments. Those mandates belong with specialist advisors. The investigative layer occupies a distinct position: verifying what the seller represents, and surfacing what the seller has not represented.

Canadian corporations incorporated federally under the CBCA must maintain a register of individuals with significant control (the ISC register) under section 21.1 — recording each ultimate beneficial owner’s name, residential address, citizenship, and the date and manner by which they exercise control. A due diligence investigation verifies that register against independent sources, because the CBCA imposes the record-keeping duty on the corporation itself, not a neutral third party.

What law governs corporate due diligence investigations in Canada

Several federal statutes create the legal scaffold that shapes how a corporate due diligence investigation must be conducted and what regulatory exposure the buyer faces if it is skipped.

• Canada Business Corporations Act (CBCA), R.S.C. 1985, c. C-44 — corporate records baseline. Federally incorporated companies must keep at their registered office: articles and bylaws, minutes of shareholder meetings, a securities register, and accounting records going back at least six years (CBCA s. 20). The ISC register of ultimate beneficial owners (s. 21.1) is the documentary baseline that an investigation is designed to independently verify.

• Investment Canada Act — mandatory notification and net-benefit review. Acquisitions of Canadian businesses by non-Canadians may be reviewable under the Investment Canada Act. Non-Canadians must file a notification under section 12 within 30 days of closing any acquisition of control not otherwise exempt. A pre-closing net-benefit review applies under sections 14–14.1 once a financial threshold is met. Those thresholds are indexed annually by Innovation, Science and Economic Development Canada: for 2026, a direct acquisition by a WTO investor that is not a state-owned enterprise is reviewable at $1.452 billion in enterprise value, while direct acquisitions of a cultural business or by non-WTO investors are reviewable at $5 million in book value of assets. A pre-transaction investigative review confirms the target’s asset composition and ownership chain before either the notification or the threshold test is applied.

• Competition Act, R.S.C. 1985, c. C-34 — merger notification. A merger can require mandatory pre-notification to the Competition Bureau under Part IX of the Competition Act. Two thresholds must both be met: a size-of-parties test — combined Canadian assets or revenues exceeding $400 million (s. 109) — and a size-of-transaction test set at $93 million for 2026 (s. 110, reviewed annually, held at $93 million since 2021). A due diligence investigation that surfaces undisclosed subsidiaries, affiliated revenues, or hidden asset values can directly affect whether and when a transaction must be notified — making ownership-structure verification a regulatory prerequisite.

• PIPEDA — privacy obligations when investigating named individuals. When a corporate due diligence investigation involves collecting personal information about executives, directors, shareholders, or ultimate beneficial owners, that activity is a “commercial activity” subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, s. 4(1). Under section 5(3), organizations may only handle personal information for purposes a reasonable person would consider appropriate in the circumstances. Section 7(1) permits collection without the subject’s consent where it is used to investigate potential contraventions of a law.

• PSISA licensing — Ontario-based investigators. In Ontario, any firm conducting the investigation for remuneration must hold a valid licence under the Private Security and Investigative Services Act, 2005, S.O. 2005, c. 34, s. 6. The Office of the Privacy Commissioner has confirmed that an organization cannot simply invoke a PIPEDA section 7 exemption without documenting the analysis that makes the disclosure reasonable (OPC PIPEDA Findings #2014-018). The same documentation standard applies to investigators collecting personal information about corporate principals.

What a corporate due diligence investigation covers — and what it does not

The investigative scope covers five core areas, each anchored to the statutory framework:

• Ownership and UBO verification. Confirming the ISC register under CBCA s. 21.1 against independent registry and OSINT sources — verifying that the beneficial ownership chain matches what the corporation has self-reported.

• Corporate-record integrity. Articles, shareholder agreements, and meeting minutes as required by CBCA s. 20 — checking whether the documents produced in the data room are complete and consistent with publicly available registry records.

• Litigation and regulatory history. Court filings, Competition Bureau enforcement actions, and provincial securities commission orders — a structured search for past or active proceedings against the entity or its principals.

• Principal-integrity review. Verifying the credentials, employment history, and public-record background of key executives and directors. Management-team misrepresentation is a documented pre-transaction risk (see the next section).

• Reputational and adverse-media analysis. Structured analysis of the target entity and its principals against a defined date range — surface-level adverse indicators that warrant deeper investigation before a buyer commits.

What the investigation does not cover: legal review of contracts, permits, and title (the solicitor’s role); audited or reviewed financial statements (the auditor’s and accountant’s role); and actuarial or environmental assessments. These are specialist mandates that sit alongside the investigative review, not inside it. For the registry-search component specifically — incorporation documents, registered address, director names from the Ontario Business Registry — see the companion guide to corporate background checks, which covers the records-only approach.

Why Canadian acquisitions fail without investigative due diligence

The risk that a pre-acquisition investigation is designed to detect is not hypothetical. The Canadian Anti-Fraud Centre recorded $643.7 million in fraud losses in 2024 — but since only 5 to 10 percent of fraud is ever reported, actual annual losses likely exceed $6 billion across Canada. Business-fraud typologies, including falsified financials, misrepresented ownership structures, and undisclosed liabilities, are routinely embedded in acquisition targets before a deal closes. For the complete breakdown of Canadian fraud losses by type and trend, see the research compilation of fraud statistics in Canada.

The risk extends to the management team, not only the financial records. HireRight’s 2025 Global Benchmark Report found that over 75 percent of employers worldwide discovered at least one candidate discrepancy during background screening in the prior year — a detection rate that translates directly to the M&A context, where target executives’ credentials and employment histories are rarely independently verified before deal close. For the cross-survey compilation of resume misrepresentation data, see the analysis of resume lie statistics.

Both risk vectors — financial-record fraud and principal misrepresentation — are addressed by the investigative due diligence layer. Neither is reliably detected by legal contract review or financial audit alone, because both disciplines rely on the accuracy of documents the seller produces. An investigator’s mandate is to verify against sources the seller does not control.

How a corporate due diligence investigation typically unfolds

A typical corporate due diligence investigation in Canada unfolds across five stages:

1. Scope definition. The buyer’s counsel or transaction advisor commissions the investigation and defines the target entities and named principals. The scope memo documents the purpose, the specific information categories to be collected, and the proportionality rationale required under PIPEDA s. 5(3).

2. Registry and public-record searches. The PI firm searches the federal CBCA records, Ontario Business Registry, PPSA registry, and court-file indices for litigation and enforcement history. This stage produces the evidentiary baseline against which all subsequent findings are measured.

3. OSINT and adverse-media review. Structured open-source research on the target entity and its principals against a defined date range. Sources are documented with URLs and retrieval dates so every finding can be re-checked by transaction counsel.

4. UBO verification. Cross-referencing the seller’s disclosed ISC register against independent sources to confirm or challenge the beneficial ownership chain. Where the register and independent sources diverge, the discrepancy is documented in the report with attribution to both.

5. Reporting. A written findings report, formatted for use by transaction counsel, that attributes every material finding to a verifiable primary source. The report records not only what was found, but why each information-collection step was proportionate and necessary — meeting the PIPEDA s. 5(3) standard so the output can be relied on without residual privacy-law exposure.

Each stage is documented from the outset to meet the PIPEDA proportionality standard: collection limited to what is necessary and appropriate for the transaction purpose.

What makes a due diligence investigation report decision-ready

A decision-ready report satisfies three tests for each material finding:

• Attribution. Every factual assertion is traced to a named primary source — a registry record, court filing, published decision, or OSINT source with a URL and retrieval date. Assertions without attribution cannot be relied on by transaction counsel and do not belong in a decision-ready report.

• Proportionality documentation. Collection of personal information about named principals is documented against the PIPEDA section 5(3) “reasonable person” standard. The Office of the Privacy Commissioner’s PIPEDA Findings #2014-018 confirms that organizations applying privacy exemptions in an investigative context must document their analysis — not simply assert the exemption. A decision-ready report records why each information-collection step was proportionate and necessary, so counsel can rely on the findings without residual privacy-law exposure.

• Threshold completeness. If the Investment Canada Act review threshold or the Competition Act merger-notification threshold turns on asset composition or ownership structure, the report addresses those parameters directly rather than leaving them to inference. Where the threshold analysis requires data the investigation was not scoped to collect, the report says so explicitly — giving counsel the information needed to confirm scope with the investigator before closing.

What this means for your transaction

As licensed PSISA investigators operating across Ontario, we conduct corporate due diligence investigations that are structured from the outset for use by transaction counsel: every ownership finding is traced to a primary registry or OSINT source, every principal-integrity review is scoped to what PIPEDA section 5(3) permits, and the final report is formatted so that counsel can attach it as an exhibit without re-verifying the underlying sources. Our mandate is the investigative layer — verifying what the seller represents, surfacing what the seller has not represented, and giving the buyer’s legal and financial teams a factual foundation they can rely on.

To discuss whether a corporate due diligence investigation fits your transaction, call +1 (888) 680-0036 or visit our corporate investigations service page.

Licensed · Insured · Bonded.