Conducting a Compliance Self-Audit for Your Ontario Small Business

A compliance calendar tells you what's coming up. A compliance self-audit is different — it's a point-in-time check on whether the business is actually meeting its obligations today, including the ones that don't have a specific due date at all, like whether your minute book reflects reality or your termination clauses would actually hold up. Most Ontario small businesses have never done one, and most that do find at least a small gap worth fixing.

This article walks through a practical self-audit organized by category, so you can work through it methodically rather than guessing where to start.

1. Corporate Structure and Records

• [ ] Is the minute book up to date — articles, by-laws, resolutions, and registers of directors, officers, and shareholders?
• [ ] Has the annual return been filed, with current directors, officers, and registered address on file with the registry?
• [ ] Has an annual shareholders' meeting been held, or is there a valid written resolution in place instead?
• [ ] Does the shareholders' agreement — if one exists — still reflect how the business is actually being run today, or has practice drifted from what's on paper?

An out-of-date minute book is one of the most common gaps that surfaces when a business seeks financing or goes up for sale, largely because nobody treats it as something to check periodically.

2. Employment Compliance

• [ ] Have termination clauses in employment contracts been reviewed recently? Ontario courts have struck down many employer termination clauses over technical wording issues, so a clause that worked when it was drafted may not hold up today.
• [ ] Is WSIB coverage registered and current for all workers who require it?
• [ ] Are required workplace postings current and visible?
• [ ] Do your working relationships with contractors actually reflect the label in the contract? Ontario recognizes employee, independent contractor, and an intermediate "dependent contractor" category, and the label a contract uses isn't determinative on its own — what matters is the substance of the relationship.

3. Tax and Payroll

• [ ] Does your GST/HST registration status match your current revenue — registered if required, or a confirmed and monitored position if you're relying on the small-supplier exception?
• [ ] Are payroll source deductions and remittances current?
• [ ] Has Employer Health Tax exposure been assessed if your Ontario payroll is significant?
• [ ] Have recent corporate filings been reviewed with your accountant, not just your lawyer?

4. Licensing and Permits

• [ ] Have all required municipal, provincial, and sector-specific licences been identified and confirmed current?
• [ ] Have any recent operational changes — a new location, a new activity, a new service line — been checked against licensing requirements, rather than assumed to be covered by an existing licence?

5. Privacy and Data Handling

• [ ] Is a specific person clearly designated as accountable for privacy compliance under PIPEDA?
• [ ] Does a basic privacy policy exist, and does it actually reflect what the business collects today?
• [ ] Have vendor contracts involving personal information — payment processors, marketing platforms, and similar tools — been reviewed?

6. Contracts and Intellectual Property

• [ ] Are key contracts — leases, supplier agreements, customer terms — in writing and current? (Most business contracts don't legally need to be in writing to be enforceable, but the practical risk of relying on a verbal agreement is proving its terms later, not that it's meaningless.)
• [ ] Is the business's name, and any brand assets it relies on, protected to the extent the business actually needs?
• [ ] Are any personal guarantees the owner or directors have signed known and tracked? These create personal exposure that exists separately from — and despite — the corporation's own limited liability.

How Often Should You Do This?

There's no fixed legal requirement to conduct a formal compliance self-audit. It's simply good practice to revisit these categories periodically, and especially before a major event — seeking financing, hiring your first employee, renewing a lease, or preparing the business for sale. Waiting until one of those moments forces the question is the most common way gaps get discovered at the worst possible time.

When a Self-Audit Turns Up a Problem

Some gaps are simple fixes — updating a register, filing an overdue return, posting a current poster. Others, like a termination clause that likely wouldn't survive a court challenge, or a licence at real risk, benefit from legal review before they turn into a bigger problem. The value of a self-audit is catching the difference between the two before a regulator, lender, or buyer does it for you.

Frequently asked questions