- A large share of investigations start with someone telling the regulator something is wrong, not the regulator finding it independently.
- Some regulatory attention has nothing to do with a complaint at all.
- Certain events create a legal obligation to report, which puts the business directly on a regulator's desk: - A workplace injury serious enough to require reporting under the OHSA framework.
Most Ontario businesses never think about what triggers a regulatory investigation until a letter or an inspector shows up. By then, it can feel like it came out of nowhere — but investigations almost always start from somewhere specific: a complaint, a routine inspection, a paper trail, or a report the business itself was legally required to file.
Understanding where investigations actually come from doesn't make a business immune, but it does make the risk manageable. Most of the common triggers are predictable, and most of them are avoidable with reasonably diligent day-to-day compliance.
This article walks through the main sources of regulatory scrutiny for Ontario businesses and what tends to follow once one of them fires.
Complaints Are the Most Common Trigger
A large share of investigations start with someone telling the regulator something is wrong, not the regulator finding it independently.
- Employee complaints — a current or former employee contacting the Ministry of Labour about unpaid wages, unsafe conditions, or a termination they believe fell short of the Employment Standards Act, 2000.
- Customer complaints — about misleading pricing, false advertising, or a product safety issue.
- Competitor complaints — to the federal Competition Bureau about deceptive marketing or anti-competitive conduct under the Competition Act.
- Privacy complaints — an individual asking how their personal information was collected or used, potentially triggering a PIPEDA inquiry.
A single complaint doesn't guarantee an investigation follows, but regulators generally have to at least assess whether one is warranted.
Routine and Proactive Inspections
Some regulatory attention has nothing to do with a complaint at all. It's simply part of a regulator's ordinary oversight function:
- Workplace safety inspections under the Occupational Health and Safety Act, which can happen without advance notice and without any specific trigger.
- WSIB compliance reviews of payroll reporting and premium classification under the Workplace Safety and Insurance Act, 1997.
- Sector-specific sweeps, where a regulator focuses proactive attention on an industry that has drawn broader concern.
Because these don't require a complaint, "we haven't done anything wrong that anyone's reported" is not the same as "we're not at risk of an inspection."
Reportable Events That Start the Clock Themselves
Certain events create a legal obligation to report, which puts the business directly on a regulator's desk:
- A workplace injury serious enough to require reporting under the OHSA framework.
- A material change in directors, officers, or registered address that isn't reflected in the corporation's filings under the Corporations Information Act — inconsistent public records are the kind of thing that draws attention during an unrelated review.
- Financial irregularities that surface during an unrelated audit or a lender's due diligence.
Paper Trails and Data Matching
Regulators increasingly cross-reference information rather than waiting for a tip. Mismatches between what one government body has on file and what another shows — payroll reported to one agency not lining up with a WSIB return, or a corporation's registry information going stale — can flag a file for a closer look even without any complaint at all.
What Tends to Happen After a Trigger Fires
| Stage | What it typically looks like |
|---|---|
| Initial contact | A letter, phone call, or unannounced visit requesting records or an explanation |
| Information gathering | Document requests, employee interviews, or a site visit |
| Findings | A compliance order, a warning, a fine, or a finding of no further action |
| Response window | Usually a defined, often short, period to respond or comply — always confirm the exact deadline stated on any notice you receive |
Not every investigation ends in a finding against the business. Many close with no action once the regulator confirms the concern doesn't hold up.
Reducing Your Exposure
- [ ] Keep employment records, minute books, and corporate filings current rather than reconstructing them under pressure.
- [ ] Address employee complaints internally and promptly — an ignored internal complaint often becomes an external one.
- [ ] Review marketing and advertising claims before they go out, not after a competitor objects.
- [ ] Keep privacy practices consistent with what you actually tell customers you do with their information.
- [ ] Treat any regulator letter as time-sensitive from the moment it arrives.
Frequently asked questions
Can a business be investigated without knowing a complaint was made?
Yes. Regulators generally don't have to disclose who complained, and some investigations start from routine inspections or data review with no identifiable complainant at all.
Does being investigated mean the business did something wrong?
No. An investigation is a fact-finding process, not a finding of fault. Many investigations conclude with no violation found, particularly where the business responds promptly and cooperatively.
How quickly do I need to respond to a regulator's first letter?
Response deadlines vary by regulator and by the type of notice, and they are often shorter than businesses expect. Read the notice carefully for the specific deadline and treat it as firm rather than assuming there's flexibility.
Should I get a lawyer involved before responding to a regulator?
For anything beyond a routine, low-stakes request, it's worth having a lawyer review your response before it goes out. What you say — and don't say — in an initial response can shape the rest of the process.
This is a corporate question
Start a file online — flat, published fees, reviewed by a licensed Ontario lawyer before a dollar is owed.