TL;DR: A corporate investigation is a structured, lawful process for establishing what happened inside a business, and documenting it to a standard that survives legal scrutiny. The Association of Certified Fraud Examiners reports that the typical organisation loses about 5 per cent of revenue to occupational fraud each year, that the median case runs 12 months before anyone detects it, and that 57 per cent of victim organisations recover nothing at all. Time is the multiplier. So is method. The businesses that protect their interests are the ones that scope the work properly, preserve evidence before confronting anyone, and engage a licensed investigator through counsel rather than improvising internally.
Most businesses discover a problem long after it started. A supplier invoice that never matched a delivery. A departing employee who took more than their belongings. A partner whose financial position turned out to be a story rather than a fact. By the time the concern reaches a boardroom, the question is rarely whether something happened. It is whether the organisation can prove it, act on it, and withstand the challenge that follows. BCSI Investigations Inc. works at exactly that point, building documented, litigation-ready evidence for organisations and the counsel who advise them.
What is a corporate investigation?
A corporate investigation is a defined process for resolving a factual question inside a business, conducted lawfully and documented for a decision-maker who may have to defend that decision later. It is not a security audit, and it is not an informal enquiry run by whoever happens to be available.
The distinction matters more than it sounds. An internal enquiry produces impressions and recollections. A corporate investigation produces an evidentiary record: preserved source material, verified documents, a chain of custody, interviews conducted in a defensible sequence, and a written report that sets out findings against the evidence supporting them. The first supports a conversation. The second supports a dismissal, a civil claim, an insurance filing, a regulatory response, or a criminal referral.
The organisations that benefit most are those facing consequences either way. Acting on a suspicion without evidence carries risk. Ignoring a credible suspicion carries more.
What does corporate fraud actually cost a business?
More than most executives assume, and for far longer than they expect. The Association of Certified Fraud Examiners, in its 2024 Report to the Nations, examined 1,921 real occupational fraud cases across 138 countries. It found that the typical organisation loses roughly 5 per cent of its annual revenue to occupational fraud, that the median loss per case is US$145,000, and that the median case continues for 12 months before detection.
The most instructive figure in the study is the relationship between duration and loss. Frauds caught within six months carried a median loss of US$30,000. Those that ran two to three years carried a median loss of US$250,000. The scheme does not usually change. The exposure compounds because nobody has established the facts.
The recovery data is more sobering still. The same study found that 57 per cent of victim organisations recovered nothing, 30 per cent achieved a partial recovery, and only 13 per cent recovered in full. In the United States and Canada region, 59 per cent recovered nothing. That is the practical argument for early investigation: money that is traced quickly can sometimes be followed, and money that is not traced usually cannot.
The Canadian picture is consistent. The Canadian Anti-Fraud Centre recorded 108,878 fraud reports and $643.7 million in reported losses in 2024, and estimates that reported losses represent only 5 to 10 per cent of the true total, which places actual losses above $6 billion. Statistics Canada, in its 2023 survey of cyber security and cybercrime, found that 16 per cent of Canadian businesses were affected by a cyber security incident, rising to 30 per cent among large businesses, with scams and fraud the most common method reported. Only 13 per cent of affected businesses reported the incident to police, and 55 per cent resolved it internally.
That last figure is the one worth sitting with. Most business fraud in Canada is never reported to anyone, which means the organisation itself is usually the only party in a position to establish what happened.
When should a business bring in an external investigator?
There is no single trigger, but there are reliable signals. Consider engaging an external investigator when:
- The subject is senior enough that internal reporting lines are compromised.
- Human resources or management could be perceived as having an interest in the outcome.
- The matter is likely to reach a court, a tribunal, an insurer, or a regulator.
- The work requires financial tracing, digital forensics, or lawful surveillance the organisation does not have in-house.
- A dismissal for cause is possible and the employer will carry the burden of proving it.
Independence is not a formality. When an employer’s findings are challenged, the credibility of the person who gathered them becomes part of the case. An investigation conducted by a licensed, external firm with no stake in the conclusion is materially harder to characterise as predetermined than one conducted by a colleague of the complainant or a manager who had already formed a view.
There is also a timing argument. The instinct on discovering a suspected fraud is to confront the person. That instinct is almost always wrong. Confrontation alerts the subject, invites the deletion of records, and ends any cooperation the organisation might otherwise have secured. So does asking internal IT staff to look through a suspect device, which risks altering metadata and handing the other side an argument about contamination. The correct first moves are quieter: preserve, restrict access, engage counsel, and scope the work before anyone is spoken to.
What can a corporate investigation cover?
A corporate investigation is scoped to the specific question in dispute, not to a service menu. In practice, the mandates that most often protect a business interest include the following.
Internal fraud and employee theft. Expense, procurement, payroll, and billing schemes, with financial tracing to establish the scale and route of any loss. This is the core of corporate fraud and internal theft work.
Employee misconduct and workplace investigations. Conducted so that findings can support discipline or dismissal and withstand review by a tribunal or a court.
Due diligence before a decision. Verifying what a prospective partner, vendor, acquisition target, or executive hire has represented, rather than accepting it. See due diligence and pre-employment screening.
Digital evidence and information leakage. Departing-employee data theft, unauthorized access, and misuse of systems, handled to preserve metadata and chain of custody. This spans technology based crimes and computer forensics.
Brand protection and counterfeiting. Unauthorized use, diversion, and counterfeit goods, an area where Canadian trade secrets rest on common law protections that are lost once information becomes public.
Asset tracing and locates. Where funds, property, or a person relevant to a claim have been moved or concealed.
The methodology behind these mandates is consistent regardless of subject matter: scope the work with counsel, preserve evidence and establish chain of custody, conduct records and open-source research, carry out financial or forensic analysis where relevant, interview witnesses and then the subject, and deliver a written report that separates what is established from what is inferred. Interviewing the subject last is not a courtesy. It is what allows the account to be tested against verified documents rather than the other way around.
Is it lawful to investigate an employee in British Columbia?
Yes, within defined limits, and the limits are the point.
Private investigation in British Columbia is regulated under the Security Services Act, in force since September 2008 and administered by the Registrar of Security Services. One structural feature of that Act deserves attention from anyone retaining an investigator: an individual investigator cannot contract directly with a client. Only a security business licensed by the Registrar may be engaged, and individual investigators must be employees of a licensed firm. Verifying that the firm holds a current licence is a basic and often skipped step.
British Columbia’s Personal Information Protection Act governs how personal information is collected, used, and disclosed. Consent is the default, with an exception permitting the collection, use, and disclosure of employee personal information without consent where it is reasonable for establishing, managing, or terminating the employment relationship, subject to advance notice of the purposes. A separate and narrower investigation exception permits collection without consent and without that notice where seeking consent could reasonably be expected to compromise the availability or accuracy of the information, and where the collection is reasonable for an investigation or a proceeding. That exception is what makes a discreet workplace investigation lawful. It is also easy to overstate, which is why scope should be settled before collection begins rather than justified afterwards.
The Office of the Information and Privacy Commissioner for British Columbia has been consistent that employees retain a reasonable expectation of privacy at work. Its guidance indicates that intrusive, ongoing collection should be restricted to targeted investigations supported by reasonable grounds, and used only after less privacy-intrusive measures have been exhausted. The Commissioner has also cautioned that information gathered from social media rarely meets the standard of being reasonable for managing an employment relationship.
A word on boundaries. Lawful investigation is targeted, proportionate, grounded in a specific concern, and documented. It is not general monitoring of a workforce, and a firm operating properly will decline work that cannot be conducted within these constraints.
Why does the structure of the engagement matter?
Because privilege does not attach automatically, and losing it can turn an organisation’s own investigation into the other side’s best evidence.
Solicitor-client privilege applies where legal advice is sought or given. It does not arise simply because a lawyer was in the room, and a lawyer acting purely as a fact-finder may not attract it at all. Litigation privilege protects material created for the dominant purpose of contemplated or ongoing litigation, the standard set out by the Supreme Court of Canada in Blank v. Canada (Minister of Justice), 2006 SCC 39.
The practical consequence is that how the investigation is commissioned determines whether the resulting report is protected. Where the investigation is retained through counsel, with the mandate and dominant purpose stated in the retainer, and where the findings serve to support legal advice, the position is far stronger. Where an organisation investigates first and consults counsel afterwards, privilege is not created retroactively. Canadian appellate authority is clear on that point.
This is a straightforward argument for sequencing. Counsel first, investigator retained through counsel, then collection.
What happens when an investigation is done badly?
It costs more than doing nothing would have. Canadian courts have held that there is no free-standing legal duty to investigate before dismissing an employee for cause, a point confirmed in McCallum v. Saputo, 2021 MBCA 62. That is a narrower comfort than it appears. Just cause remains the highest threshold in employment law, and the employer carries the entire burden of proving it. An employer that cannot discharge that burden at trial faces wrongful dismissal damages, and where the process itself was unfair, further exposure.
The case law is instructive. In Doyle v. Zochem Inc., 2017 ONCA 130, a cursory investigation contributed to an award of aggravated damages. In Elgert v. Home Hardware Stores Ltd., 2011 ABCA 112, an investigation conducted by an untrained investigator supported punitive damages.
The pattern across these decisions is not that employers investigated and lost. It is that the manner of the investigation became a separate liability, distinct from the underlying allegation. A disciplined process protects the organisation twice: once by establishing what happened, and again by demonstrating that the conclusion was reached fairly.
Frequently asked questions
What is a corporate investigation?
It is a structured, lawful enquiry into a factual question inside a business, such as suspected fraud, employee misconduct, information theft, or the true position of a counterparty, documented to a standard suitable for legal, regulatory, or insurance proceedings.
When should a business hire a corporate investigator?
When the matter may reach a court, tribunal, insurer, or regulator, when internal parties could be perceived as interested in the outcome, when the subject is senior, or when the work requires financial tracing, digital forensics, or lawful surveillance capabilities the organisation does not hold.
Is it legal to investigate an employee in British Columbia?
Yes, within the Personal Information Protection Act and the Security Services Act. PIPA permits collection without consent where seeking consent could compromise the availability or accuracy of the information and the collection is reasonable for an investigation. Employees retain a reasonable expectation of privacy, so the work must be targeted and proportionate.
Do I need a licensed private investigator in British Columbia?
Yes. Under the Security Services Act, only a security business licensed by the Registrar of Security Services may be retained, and individual investigators must be employees of a licensed firm. Confirm the firm’s licence before engaging it.
Can the findings be used in court?
Relevant evidence gathered lawfully is generally admissible in Canadian civil proceedings, subject to the court’s assessment of how it was obtained. Evidence collected improperly or disproportionately can be excluded and can attract a separate privacy complaint, which is why method matters as much as content.
Do we need a lawyer involved, and how does privilege work?
Privilege does not attach automatically. Where the investigation is retained through counsel, with the dominant purpose recorded in the retainer and the findings supporting legal advice, the report is far more likely to be protected. Consulting counsel after the fact does not create privilege retroactively.
What should we do first if we suspect fraud?
Preserve rather than examine. Secure devices and records without allowing internal staff to search them, restrict system and financial access, engage counsel, and scope the investigation before speaking to the subject. Confronting the subject early is the most common and most costly mistake.
How long does a corporate investigation take, and what does it cost?
Both depend entirely on scope, the volume of records involved, and whether financial tracing or forensic analysis is required. A responsible firm will define scope, sequence, and cost in writing before starting rather than quoting a figure blind.
A note for business owners and counsel
Fraud and misconduct are rarely solved by discovery alone. They are solved by documentation. The organisations that limit their losses are the ones that establish the facts early, lawfully, and in a form that a court, an insurer, or a regulator will accept, which is precisely what the recovery figures reward and what improvised internal enquiries rarely produce. If you are weighing how to approach a matter, our guide to choosing the right corporate investigator sets out what to look for.
To discuss a matter in confidence, request a confidential enquiry. The science of integrated investigations.
About the author: Denis Gagnon is President of BCSI Investigations Inc. and a former RCMP officer with more than 33 years of investigative experience. BCSI is a licensed private investigation firm headquartered in West Vancouver.
