The expression due diligence is widely used in business, employment, investment, procurement and professional services. Yet it is often misunderstood.
Some regard it as little more than an online search or background check. Others treat it as an exercise in collecting as much information as possible about a person or organization.
Neither interpretation is complete.
Due diligence is a structured and proportionate process of identifying risk, verifying material facts and resolving inconsistencies before an important decision is made. Its purpose is not to guarantee a particular outcome. It is to reduce avoidable uncertainty and ensure that a decision rests on reasonably reliable information.
When is due diligence required?
Due diligence may be appropriate when:
- hiring someone for a position of trust;
- selecting a contractor or supplier;
- entering a business partnership;
- acquiring or investing in a company;
- appointing a senior executive;
- evaluating a prospective tenant;
- extending credit;
- purchasing a significant asset; or
- awarding a public or private contract.
The required depth of inquiry depends on the nature of the decision and the consequences of getting it wrong.
Selecting a routine service provider does not ordinarily require the same investigation as acquiring a company or appointing someone who will control money, confidential information or critical infrastructure.
Defining the scope
A sound due-diligence process begins with four questions:
- What decision is being made?
- What could materially go wrong?
- Which facts must be independently verified?
- What level of inquiry is proportionate to the risk?
These questions keep the investigation relevant and prevent unnecessary collection of personal or commercially sensitive information.
A clearly defined scope might require verification of identity, professional qualifications, employment history, corporate ownership, financial stability, regulatory standing or previous litigation. It may also require an examination of undisclosed relationships, conflicts of interest or adverse information affecting the proposed decision.
Techniques used in due diligence
Depending on the purpose, a due-diligence inquiry may involve:
- identity and credential verification;
- corporate registration and directorship searches;
- ownership and relationship analysis;
- court, insolvency and regulatory-record research;
- sanctions and watch-list screening;
- adverse-media research;
- financial and commercial assessment;
- interviews and reference checks;
- social-media and open-source intelligence;
- timeline reconstruction;
- geolocation or metadata analysis; and
- comparison of information across independent sources.
No single search result should ordinarily determine the conclusion.
Names may be shared by several people. Corporate records may be outdated. Online profiles may be incomplete or misleading. News reports may contain allegations rather than proven findings. Even official records must be interpreted in their proper context.
For this reason, reliable due diligence distinguishes between:
- facts confirmed by dependable evidence;
- assessments supported by credible but incomplete information;
- discrepancies that remain unresolved; and
- allegations that have not been established.
The purpose is not merely to find information. It is to evaluate its accuracy, relevance and significance.
A Canadian example: ArriveCAN
The Auditor General of Canada’s 2024 examination of ArriveCAN provides a useful example of why due diligence must include documentation, verification and continuing oversight.
ArriveCAN was introduced to collect health and travel information during the COVID-19 pandemic. The Auditor General’s examination went beyond the application itself and considered the management of its development and implementation.
The audit examined procurement practices, contractor selection, financial controls, documentation and accountability. It concluded that the Canada Border Services Agency, the Public Health Agency of Canada and Public Services and Procurement Canada repeatedly failed to follow sound management practices.
The absence of reliable documentation made it difficult to establish who had authorized certain decisions, which contractors had completed particular work and precisely how much the application had cost.
The Auditor General estimated the cost at approximately $59.5 million but reported that the exact amount could not be determined because adequate financial records had not been maintained.
The ArriveCAN case illustrates an important principle: due diligence does not end when a contract is signed.
Continuing due diligence should include:
- verifying each contractor’s capabilities and responsibilities;
- examining subcontracting arrangements;
- documenting how and why a supplier was selected;
- identifying actual or potential conflicts of interest;
- confirming that invoices correspond with completed work;
- monitoring costs and contractual performance; and
- preserving an auditable record of decisions.
A supplier may appear suitable at the beginning of an engagement, but circumstances, relationships and performance can change. Effective oversight therefore requires continuing verification rather than a one-time review.
The legal and ethical framework
Due diligence must be conducted lawfully, fairly and proportionately.
In Canada, the applicable framework may include federal or provincial privacy legislation, human-rights protections, consumer-reporting requirements, employment law, contractual obligations and sector-specific regulations.
In Ontario, an inquiry may engage legislation such as the Ontario Human Rights Code, the Consumer Reporting Act and, depending on who conducts the work and how, the Private Security and Investigative Services Act. Federal privacy requirements may also apply to personal information handled during commercial activities.
The exact requirements depend on the purpose of the inquiry, the nature of the information, the organization conducting it and the jurisdiction involved.
Consent may be required for particular searches or reports. Personal information should be collected for a legitimate and identified purpose, limited to what is reasonably necessary, kept accurate, protected from unauthorized access and retained no longer than required.
Publicly accessible information is not automatically unrestricted information. The fact that information can be found online does not necessarily mean that it may be collected, analyzed or used for any purpose.
Investigators and decision-makers must also avoid conclusions based on protected personal characteristics or information unrelated to the decision being considered.
Context matters
Due diligence must be approached with care.
A lawsuit does not automatically prove misconduct. A criminal charge is not the same as a conviction. A historical financial difficulty may have little relevance to a person’s present circumstances. A discrepancy may indicate deception, but it may also result from an innocent mistake, an outdated record or a difference in terminology.
Fair analysis requires context, corroboration and, where appropriate, an opportunity for the subject to explain a material inconsistency.
A professional report should separate facts from analysis and clearly identify its limitations. It should not present an allegation as an established fact or create a level of certainty that the available evidence cannot support.
The value of a defensible process
Due diligence cannot eliminate every risk. It can, however:
- reveal information that was not initially disclosed;
- test whether important claims are supported by evidence;
- identify conflicts, dependencies and warning signs;
- expose gaps in records or internal controls;
- support informed negotiation and risk mitigation; and
- create a defensible record of how a decision was reached.
The ultimate value of due diligence lies not in the volume of information collected, but in the quality of the questions asked, the reliability of the evidence obtained and the care with which conclusions are drawn.
It is, fundamentally, the discipline of verifying before deciding.
Source: Office of the Auditor General of Canada, Report 1—ArriveCAN, 2024.
https://www.canada.ca/en/auditor-general/our-work/audit-reports/parl-oag-202402-01-e.html
This article provides general information and does not constitute legal advice.
