TL;DR: Corporate fraud investigations require a methodical, documented approach from the first suspicion to the final report. The Canadian Anti-Fraud Centre recorded $643.7 million in reported fraud losses in 2024, with actual losses estimated at over $6 billion once unreported cases are factored in. A well-conducted corporate fraud investigation produces an evidence record that supports discipline, dismissal, civil recovery, criminal referral, or regulatory disclosure, depending on what the facts and legal strategy require. Proceeding without that structure produces a result that is difficult to use.
Corporate fraud is not discovered in a single moment. It unfolds over time, through a pattern of conduct that leaves traces in records, systems, and behaviour. Recognising it and proving it are different disciplines. The investigation turns suspicion into documented, defensible fact. This post explains how a professional corporate fraud investigation works, what it produces, and how to approach it correctly.
What is corporate fraud?
Corporate fraud is the use of deception or dishonesty for financial gain within a business context. It takes many forms: internal theft and expense fraud; financial statement manipulation; procurement fraud and kickbacks; vendor fraud and billing schemes; payroll fraud; intellectual property theft; and fraud by external parties such as contractors, suppliers, or customers.
The criminal law foundation is section 380 of the Criminal Code of Canada, which defines fraud broadly to include deceit, falsehood, or other fraudulent means used to defraud any person or the public of property, money, or a valuable security. Civil remedies run in parallel, and in many corporate fraud matters, the civil recovery action is as important as, or more important than, any criminal referral.
Why does a corporate fraud investigation require a defined process?
The temptation when fraud is suspected is to act immediately: confront the suspected employee, secure the records, change the access permissions. That instinct is understandable and almost always counterproductive.
An uncoordinated response alerts the subject, who may then destroy evidence, enlist co-conspirators, or take legal steps that complicate recovery. It also creates problems with the chain of custody for evidence already in hand.
A defined investigation process starts with containment, moves to evidence preservation, then to investigation, and then to action. The sequence matters because the action taken at the end is only as defensible as the record that supports it.
What does a corporate fraud investigation involve?
Scoping and counsel engagement. Before investigation begins, the mandate is defined with precision: what is suspected, what records need to be secured, who is implicated, and what legal framework governs the response. Engaging legal counsel at the outset determines how privilege applies to investigative work product and shapes the evidentiary approach.
Evidence preservation. Relevant records are identified and secured before anyone is alerted. This includes financial records, communications, system logs, and physical materials. The order and method of preservation follows a chain-of-custody protocol.
OSINT and records research. Open-source and records research builds a picture of the suspected fraud’s scope, the individuals involved, and any external connections relevant to tracing misappropriated assets.
Financial tracing. Where funds or assets have been diverted, tracing those movements through available financial records, property records, and business registries is a central investigative task.
Witness and interview management. Identifying who has knowledge, planning the sequence of interviews to prevent contamination of accounts, and documenting what is said: this phase is where many investigations are won or lost.
Report and legal strategy support. The investigation delivers a written report that the legal team can use. Depending on the outcome, that supports dismissal, civil recovery, or a criminal referral to police.
What are the legal considerations in a corporate fraud investigation?
Privacy. In BC, PIPA governs an employer’s collection of employee information. An investigation must be scoped to collect only information that is reasonably necessary for the investigation.
Privilege. If the investigation is conducted at the direction of legal counsel, the work product may be protected by solicitor-client privilege. This affects how the report is prepared, who receives it, and how it is stored.
Employment law. Termination based on a fraud investigation must be supportable. If the matter proceeds to a wrongful dismissal claim, the employer’s conduct of the investigation and the adequacy of the evidence are directly at issue.
Criminal referral. A fraud investigation that surfaces evidence of criminal conduct creates a decision point: whether to refer to police, proceed civilly, or do both. Each path has strategic implications that counsel and the investigator should consider together.
What does a well-documented fraud investigation produce?
At minimum: a chronological narrative of the suspected conduct, supported by documentary evidence organised to a standard counsel can use; a financial analysis of what was taken and how; identification of all parties implicated; a chain-of-custody record for all evidence reviewed; and a clear, objective report that states facts and avoids editorial characterisation.
Frequently asked questions
What is the most common type of corporate fraud in Canada?
The most common types include expense fraud, procurement fraud, payroll fraud, and billing or vendor schemes. Financial statement fraud is less common but carries the most severe legal consequences.
What should I do if I suspect fraud in my organisation?
Engage legal counsel and an experienced investigator before taking any action visible to the suspected individual. Do not confront the person, change their access permissions, or discuss the matter widely.
How does a private investigator help with corporate fraud?
A licensed private investigator conducts the structured investigation: evidence preservation, financial tracing, records research, and documentation. This produces a record that counsel can use to advise on discipline, dismissal, civil recovery, or criminal referral.
Can fraud by a former employee still be investigated?
Yes. A fraud investigation can proceed after the individual has left the organisation. Evidence may be more difficult to secure, but financial records, third-party accounts, and documentary trails remain available.
How is corporate fraud different from theft?
Fraud involves deception; theft involves the direct taking of property. The distinction matters for criminal law purposes but less so for the civil recovery action, which may proceed on either basis. Many corporate fraud matters involve both.
Fraud left unaddressed costs more than the fraud
The direct financial loss from corporate fraud is the obvious cost. The less obvious costs, legal exposure from a poorly conducted response, the precedent for future misconduct, and the time spent managing the consequences rather than the business, are often larger. A well-conducted investigation, started correctly and documented throughout, contains all of those costs. To discuss a matter in confidence, request a confidential enquiry. The science of integrated investigations.
About the author: Denis Gagnon is President of BCSI Investigations Inc. and a former RCMP officer with more than 33 years of investigative experience. BCSI is a licensed private investigation firm headquartered in West Vancouver.
