Internal Fraud Investigation in Ontario: A PI's Guide

When an Ontario employer suspects an employee of fraud, the most consequential decision is not whether to act — it is who conducts the investigation. Under Section 6 of Ontario’s Private Security and Investigative Services Act, 2005, any person who conducts investigative services for remuneration must hold a valid provincial licence issued by the Ministry of the Solicitor General. An unlicensed investigator’s findings risk evidentiary challenges at the termination hearing or in civil proceedings.

This guide covers what an internal fraud investigation is, which statutes govern it, what a licensed PI can lawfully gather, how the investigation typically unfolds, and what the evidence standard means for Ontario employers pursuing just-cause termination or civil recovery.

What is an internal fraud investigation

An internal fraud investigation is a structured, evidence-gathering process commissioned by an employer to document suspected insider misconduct — including asset misappropriation, false invoicing, payroll fraud, expense fraud, kickbacks, and secret commissions. In Ontario, the investigation is typically conducted or overseen by a licensed private investigator operating under the Private Security and Investigative Services Act, 2005, ensuring the resulting evidence record can withstand scrutiny in dismissal proceedings, civil litigation, or a referral to police.

An internal fraud investigation differs from a general workplace conduct review. A general review may satisfy HR governance obligations. An internal fraud investigation is specifically designed to produce evidence capable of supporting a just-cause termination, a civil recovery action, or a criminal referral — each of which requires a different evidentiary threshold and a documented chain of custody.

Before any confrontation with the employee takes place, the investigation maps the suspected conduct to one or more Criminal Code provisions. The most commonly engaged are Section 380(1) (fraud by deceit or falsehood that causes financial loss), Section 426 (secret commissions, covering an employee who corruptly accepts a reward from a third party in connection with the employer’s affairs), and Section 336 (criminal breach of trust). Mapping the alleged conduct to these provisions early shapes the scope of evidence collection and the structure of the final report. These are the insider’s offences that the investigation may substantiate — not the employer’s own exposure.

What law governs internal fraud investigations in Ontario

Three layers of law govern what a licensed private investigator can lawfully do during an internal fraud investigation in Ontario.

The first layer is the Private Security and Investigative Services Act, 2005. The PSISA requires every person conducting investigative services for remuneration to hold a valid provincial licence. Unlicensed investigative work is a statutory offence under Section 6. Penalties under Section 45(1) reach up to $25,000 or one year imprisonment for an individual, and up to $250,000 for a corporation. A licence is not a procedural preference — it is a legal precondition for the investigation’s output to carry evidentiary weight.

The second layer is the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA governs the lawful collection of an employee’s personal information during the investigation. Under Section 7(1)(b) of PIPEDA, an organization may collect personal information without the employee’s knowledge or consent when it is reasonable to expect that giving notice would compromise the availability or accuracy of the information, and the collection relates to investigating a breach of an agreement or a contravention of the laws of Canada or a province. Section 5(3) adds a proportionality standard: any collection must serve purposes a reasonable person would consider appropriate in the circumstances. This second condition limits the scope of covert investigation to what is genuinely necessary.

The third layer is the Canada Evidence Act, R.S.C. 1985, c. C-5. The Canada Evidence Act sets the authentication and admissibility standards for the electronic records and surveillance footage the investigation produces. Sections 31.1 through 31.3 specify how a proponent establishes that a digital document is what it purports to be — and how the integrity of the system that stored it is proved.

Beyond these three statutes, the Office of the Privacy Commissioner of Canada’s 2009 Guidance on Covert Video Surveillance in the Private Sector sets a four-part test for any covert employee monitoring: (1) there must be a demonstrable, evidentiary need — not mere suspicion; (2) the surveillance must be reasonably likely to produce relevant information; (3) the privacy intrusion must be proportionate to the legitimate business objective; and (4) covert surveillance must be the least intrusive means available. Satisfying all four conditions is the benchmark that separates lawful internal investigation from unlawful surveillance.

What types of employee fraud a licensed PI investigates

A PSISA-licensed investigator in Ontario investigates the following fraud typologies, each mapped to the Criminal Code provisions most commonly engaged:

• Asset misappropriation: theft or misuse of company funds, inventory, or property by an employee with access or signing authority. Typically engages Criminal Code Section 380(1) (fraud over or under $5,000) or Section 336 (criminal breach of trust where the employee holds a fiduciary position).
• False invoicing and procurement fraud: submission of fictitious vendor invoices, inflated purchase orders, or payments to controlled entities. Engages Section 380(1) (fraud by falsehood causing financial loss) and, where a kickback arrangement exists, Section 426 (secret commissions).
• Payroll and expense fraud: creation of ghost employees, falsified timesheets, or submission of personal expenses as business costs. Engages Section 380(1) for the financial-loss element; Section 380.1 for aggravating factors at sentencing where the scheme is sustained, involves multiple victims, or exploits a position of trust.
• Kickbacks and secret commissions: an employee who corruptly accepts any reward from a supplier or third party in connection with the employer’s affairs commits an offence under Section 426 of the Criminal Code, which carries a maximum of five years imprisonment on indictment. The investigation focuses on demonstrating the corrupt agreement and the benefit received.
• Criminal breach of trust: where the employee holds a position of fiduciary or trustee authority (a finance officer, signing authority, or company director) and converts corporate funds, inventory, or confidential data with intent to defraud, Section 336 applies. The maximum sentence is 14 years imprisonment, reflecting the severity of the trust violation.

Each typology requires a different evidence strategy. Procurement fraud turns on document trails and vendor-relationship analysis. Secret commissions often require surveillance and financial-flow mapping. Asset misappropriation by a director requires establishing the trustee relationship before the diversion can be proven.

How an internal fraud investigation typically unfolds in Ontario

An Ontario internal fraud investigation typically follows a six-stage sequence designed to preserve evidentiary integrity throughout:

1. Initial scoping: the employer documents the suspicion, engages a PSISA-licensed investigator, and defines the investigation mandate under PIPEDA’s proportionality standard. The mandate identifies the suspected conduct, the Criminal Code provisions potentially engaged, the evidence categories to be pursued, and the ultimate intended use of the report (dismissal, civil recovery, or police referral).
2. Records preservation: financial records, payroll data, purchase orders, invoices, and communications records relevant to the alleged conduct are secured before the employee is aware of the inquiry. Preserving records before the subject can alter or delete them is the single most time-sensitive step in the sequence.
3. Covert surveillance or undercover observation: where justified, covert monitoring must satisfy the OPC’s four-part test under PIPEDA Section 7(1)(b) before it commences. The investigator documents the justification for each covert step in the mandate file.
4. Witness interviews: conducted by the investigator or by counsel, on the record. Interview scope is defined by the mandate and kept strictly within the proportionality boundary set by PIPEDA Section 5(3).
5. Evidence compilation: all electronic records (emails, system access logs, device metadata, financial transaction records) are handled in accordance with Canada Evidence Act Sections 31.1 through 31.3 to support an authentication chain. The authentication standard requires evidence capable of supporting a finding that the electronic document is what it purports to be.
6. Written report: delivered to the employer and, where applicable, to litigation counsel. The report attributes every finding to a primary source, documents the authentication basis for each digital exhibit, and confirms the proportionality rationale for each collection step — so the employer’s counsel can rely on it in proceedings.

For employers evaluating an outside corporate investigation before a deal closes, our guide on corporate due diligence investigation in Canada explains how pre-transaction principal-integrity review differs from the post-incident internal investigation described here.

What evidence an internal fraud investigation can lawfully gather

A PSISA-licensed investigator in Ontario can lawfully gather the following categories of evidence:

• Documentary evidence: financial records, purchase orders, invoices, bank statements, payroll data, and vendor contracts. These are obtained from the employer’s own systems or through lawful third-party requests.
• Digital evidence: emails, system access logs, device metadata, and electronic transaction records. These are collected in accordance with Canada Evidence Act Sections 31.1 through 31.3 to preserve the authentication chain.
• Physical surveillance: observation of an employee in public or semi-public spaces, where there is no reasonable expectation of privacy.
• Covert workplace video surveillance: permissible inside the workplace where the OPC four-part test under PIPEDA Section 7(1)(b) is satisfied (demonstrable need, relevant likelihood, proportionality, and least-intrusive means).
• Open-source intelligence (OSINT): public social-media profiles, corporate registry records, court indices, and publicly available financial disclosures.

There are also clear boundaries. A licensed investigator cannot intercept private communications without lawful authority under Criminal Code Section 184. A licensed investigator cannot access protected computer systems without authorization under Criminal Code Section 342.1. Health information falls outside the investigative scope except under the applicable provincial health-privacy regime.

The Canadian Anti-Fraud Centre’s 2024 Annual Statistical Report recorded $643.7 million in total reported fraud losses in Canada in 2024. Since only 5 to 10 percent of fraud is reported, actual annual losses are estimated to exceed $6 billion. Employee and internal business fraud represents a significant share of that exposure. For the full typology breakdown and year-over-year trend data, see our fraud statistics in Canada research compilation.

Is evidence from an internal fraud investigation admissible in Ontario proceedings

Admissibility in Ontario proceedings depends on how the evidence was gathered and authenticated — not simply on whether it is factually accurate.

Under Sections 31.1, 31.2, and 31.3 of the Canada Evidence Act, R.S.C. 1985, c. C-5, electronic documents — surveillance footage, email logs, and financial transaction records — are admissible when the proponent establishes their authenticity and the integrity of the system used to record or store them. Section 31.1 places the authentication burden on the party seeking to admit the record. Section 31.2 satisfies the best-evidence rule on proof of system integrity, or where a printed copy has been manifestly relied upon as the authoritative record. Section 31.3 provides three pathways for proving system integrity: evidence the system was operating properly, that the record was stored by an adverse party, or that it was stored in the ordinary course of business.

The admissibility question is not confined to criminal proceedings. In the employment context, the evidence standard for a just-cause termination is governed by the contextual approach established in McKinley v. BC Tel, 2001 SCC 38. The Supreme Court of Canada held in McKinley that whether an employee’s dishonesty justifies dismissal without notice requires a contextual assessment: the court must consider whether the misconduct violates an essential condition of the employment contract, breaches the faith inherent to the work relationship, or is fundamentally inconsistent with the employee’s obligations to the employer. An internal fraud investigation produces the evidence record that allows the employer and its counsel to make that assessment — and to defend it at a wrongful dismissal hearing.

Evidence obtained in violation of PIPEDA may also be challenged in civil proceedings on proportionality grounds. The McKinley contextual test, PIPEDA’s proportionality standard, and the Canada Evidence Act’s authentication requirements together mean that a factually accurate finding is not, by itself, sufficient. The evidence package must be procedurally sound from the first step of the investigation.

What this means for Ontario employers

For Ontario employers, the practical consequence of the legal framework is this: a fraud investigation handled exclusively by HR or management — without a PSISA licence, without a documented PIPEDA proportionality rationale, and without an evidence chain meeting the Canada Evidence Act standard — may produce findings that are factually correct but legally unusable.

Evidence obtained without satisfying PIPEDA Section 7(1)(b) may be challenged in civil proceedings. A just-cause termination without a properly documented evidence record exposes the employer to wrongful dismissal liability under the McKinley contextual test. A criminal referral without a complete, authenticated evidence package may not be accepted by police or may not withstand preliminary proceedings.

Retaining a licensed investigator is not a procedural formality. It is the mechanism that converts a suspicion into an evidence package the employer’s litigation counsel can use.

At Discreet Investigations, our licensed Ontario investigators document internal fraud investigations within a structured evidence protocol — from initial scoping through covert surveillance authorization, digital records handling, and written report delivery — formatted for use by the employer’s litigation or employment counsel. To discuss whether an internal fraud investigation fits your situation, call +1 (888) 680-0036 or visit our corporate investigations service page.

Licensed · Insured · Bonded.