Ministry of the
Solicitor General

Investigative Techniques

Private Security & Investigative Services

Training & Testing

Private Investigator Test Preparation Guide

Section 5 - Investigative Techniques

Private investigators should have a thorough knowledge of research techniques, surveillance techniques, interviewing techniques, industry specific equipment and how to collect and preserve evidence. It is also imperative that private investigators understand how to take proper and complete notes. This section represents generally accepted practices throughout the private investigation industry.

Important Note:
In this section a number of activities are discussed which are generally accepted as good practices for someone working as a private investigator. Practices may vary from one private investigation company to the next so in addition to understanding the requirements of the legislation and regulations it is important the private investigator is also familiar with the policies of their employer and not to rely solely on subjects covered in this guide or the Ministry Curriculum.

Ontario Evidence Act and Canada Evidence Act - Evidence Handling Techniques

Private investigators may come across evidence that may be used in court, and should know how to collect and preserve evidence while preventing the evidence from becoming contaminated. They should also know how to present admissible evidence in court. The six core steps for containing evidence are collect, secure, preserve, identify, ensure continuity, and log.

Care and Control of Evidence

All evidence should be treated as though it could potentially be used in a trial. When physical evidence is presented at a trial, a chain of custody of the uninterrupted control of evidence must be clearly shown; the evidence must be properly identified and must be relevant to the case before the court. If the private investigator must collect the evidence, the bag in which it is contained should be marked with the private investigator’s initials and the time and date when gathered. It is important to limit the number of individuals who handle the evidence to the smallest number possible and properly document each transfer in order to maintain the chain of custody.

These practices also apply to evidence that is not physical in nature. For example, if an electronic communication is intercepted by an investigator (with the consent of one of the parties involved), and is then saved on a USB drive, the drive should be treated as evidence, and should be stored in a secure location.

Basic Locator Techniques

Basic locator techniques and pre-investigation are the basis for all investigations. For example, it would not be possible to conduct surveillance without knowledge of the subject’s address.

This type of investigation has the potential to require an investigator to access and analyse a substantial amount of information. Therefore, it has the potential to pose the most concern to the individual being investigated and/or members of the general public. For this reason, basic locating and pre-investigative work should be conducted in the most thorough and responsible fashion possible.

Before beginning an investigation of this nature it is essential that the investigator take the time to properly identify with the client a justifiable mandate for conducting the investigation. Questions that should be asked include (but are not limited to): “What is the specific information/service being requested?”; “For what purpose does the client require this information?”; “Is the request for information justified, or would it be considered ‘frivolous’?”; “Is obtaining this information lawful according to federal, provincial or municipal laws (e.g. PIPEDA)?”

The investigator should always keep detailed documentation referencing the reason for the investigation. In some cases, investigation into the claims and background of the client would be a necessary and responsible approach.

Once a case is accepted and a justifiable mandate has been identified, it is the investigator’s responsibility to conduct initial searches to double-check the accuracy of the information supplied.

An investigator may be asked to locate a person. For example, this could be for the service of legal documents, or because the person has gone missing. When initial searches of maps are completed with the subject’s address not identified, a simple postal code search may provide an accurate address or vicinity of the residence.

In many cases, the information provided for these files can considerably out of date and public searches are often required to locate the individual. In cases where all previous address and contact information is no longer valid, it may be necessary to conduct an extensive background search. The investigator can make use of public databases and Internet sources in an attempt to locate the subject. Searches at the public library may also assist in confirmation of the outdated contact information and provide other resources to search. If none of these searches yields results, the investigator as a last resort may place an advertisement in the local newspaper with the last known address in hopes of finding the missing person or others that may have kept in touch with the person.

To keep the search as non-intrusive as possible, it is preferable for the investigator to avoid overt investigative techniques. Internet searches on the subject’s address or employment record may offer insight in an insurance surveillance, but an investigator should not, without lawful authority, attempt to obtain documents such as credit records, income tax or bank records.

Research Techniques

Private investigators must be capable of conducting research to assist their investigations, and should be familiar with fundamental research techniques including how to conduct a full background/due diligence check and how to cross reference. They should also know how to use available sources of information and research tools.

The Internet contains a vast wealth of information in online databases with records updated regularly. These online tools enable investigators to conduct searches utilizing the subject’s name that may provide business and personal profiles. They may also provide confirmation of residential address and telephone number. General information with regard to activities, likes, dislikes etc. may also be found. The validity of this information is only as reliable as those who have entered it. Thus if the subject has an online profile, he or she is likely the source of the information and the accuracy of the information must be determined.

Public libraries stock many useful publications and directories including telephone books, business indexes, trade magazines and yearbooks. Criss-cross directories of cross-referenced telephone numbers can also be found at a library, with telephone numbers listed in numerical order and associated with the subscriber’s name. These sources of information can be particularly useful in cases where the available information is out-of-date. Newer information can be found through online databases that are updated more frequently.

Public libraries also have old newspaper stories, public notices and advertisements which may contain information on crimes and accidents, notices of bankruptcy, marriage, engagement and birth as well as obituaries, memorials and probate notices. Most libraries keep back issues of newspapers either on microfiche or CD-ROM.

A Personal Property Security Registration (PPSR) search may identify a lien associated with subject. This may also be linked to a business or collateral that is shown as a security for payment of a debt. A lien may be placed on that property by the secured party and registered with the PPSR. These searches are available to the public.

Bankruptcy records, divorce records, land registry databases and corporate searches may also provide insight when conducting background inquiries. Civil, Small Claims and Family Court files searched geographically may also be of use. The focus for all searches should be identified in the investigator’s instructions and relative to the purpose of the investigation. This will enable the investigator to only conduct the searches deemed necessary to complete the assignment.

Principles of Surveillance and Other Private Investigator Functions

The purpose of covert surveillance is to observe persons, places or things without being detected, and to observe the subject in their natural and true state. Usually surveillance results in documenting the subject’s activities by capturing them on video or photographs, which are considered to be illustrative evidence.

Purpose of Surveillance

The purpose of surveillance may be but is not limited to the following:

  • To locate persons by observing the places they frequent or their associates.
  • To obtain information about someone’s activities or the status of their health.
  • To locate hidden/stolen property.
  • To prevent the commission of an act or to apprehend a subject in the commission of an act.
  • To obtain information prior to conducting an interview.
  • To obtain evidence for use in court.

Typically, the following details should be obtained about the subject before beginning the surveillance:

  • Name
  • Date of birth
  • Address
  • Phone numbers
  • Employment information
  • Places frequented
  • The purpose of the surveillance

Other pertinent information will depend on the needs of a particular surveillance. Should an investigator find that any of this information is missing, they should consult the file to locate it or contact their office to confirm if the information is known and may have been overlooked.

A private investigator should not try to access restricted information such as bank records, tax information or credit information, without a signed release and without lawful authority.

Generally speaking, private investigators must comply with all federal, provincial and municipal laws when conducting surveillance. For example, a private investigator who is following a subject in their vehicle should abide by the Highway Traffic Act at all times, even if the subject commits a violation (such as speeding or running a red light).

If the investigator is aware that the subject is represented by a lawyer, general practice is for the investigator to avoid having any verbal contact or interaction with the subject.


(the following is standard equipment, but may vary from one assignment to the next)

  • Suitable vehicle, i.e. SUV, van, nondescript vehicle of muted colours
  • Camera – video, covert, equipped with night-shot capability
  • Still camera with a zoom lens
  • Note pads
  • Pens
  • Binoculars
  • Duffle bag with change of clothing, including gym clothes, bathing suit, business attire, work clothes, etc.
  • Money
  • Two-way radio
  • A digital tape recorder for note taking
  • Any other props that may assist an investigator in blending into their surroundings.
Detection of Surveillance

Investigators should be aware of their surroundings and also of the actions of the persons under surveillance for any signs that the surveillance may be compromised. There is a delicate balance between an investigator’s “paranoia” and actual reasons to believe the surveillance may have been detected.

Private investigators most commonly work alone on most surveillance cases, however in some cases two or more investigators may be assigned to work together.

Reasons for this may include the subject’s aggressive driving nature, multiple points of exit from a given location, or the subject’s ability to run counter surveillance.

Investigators conducting surveillance alone should try to keep a constant eye on the subject whenever possible.

When working in a surveillance team, it is important to stay in constant communication with other team members, so that all investigators are aware of the subject’s actions and location.

Team surveillance allows for a variety of surveillance techniques to be employed including the caravan method, leapfrogging, and parallel coverage.

Interview Techniques

A private investigator may be called upon to perform interviews and take witness statements. Some good sources for information include former spouses, relatives, neighbours, business competitors, employees, employers, business associates, landlords, etc.

Investigators may be hired to interview witnesses, caregivers, service providers, employers and neighbours. The key to a successful interview is to know the purpose for the interview.

When conducting an interview, private investigators should keep the following common practices in mind:

  1. Be prepared. Review the information you have already obtained and determine what kind of information you want to gather. Prepare questions; bring a notebook, pens, an audio recorder, adequate audio tapes and new batteries to record the entire interview. It is important to remember never to record a conversation without the knowledge and consent of one of the parties involved in the communication. It is a criminal offence to monitor or record the conversation of two people, if you are not a party to the conversation, when consent has not been provided.
  2. When appropriate, and a witness is expected to be cooperative, an appointment should be made, but under some circumstances, a "cold call" may be advisable. Be professional and courteous. State your business truthfully without revealing any confidential information.
  3. When you begin the interview, greet your subject cordially. Identify yourself and show your private investigator licence. Your approach may be formal or informal, depending on the person you are interviewing.
  4. Once the individual has started to talk, do not interrupt them. Take notes, but don’t be too obvious. Control your emotions, and never react.
  5. Take your time ending the interview. When it is apparent that the interview is over, be courteous and close the conversation. An expression of courtesy creates a favorable impression and ensures future cooperation.
  6. Immediately after an interview, always write your investigative report. In this report, you should include all pertinent information.

The key purpose of taking a statement from a witness is to ensure an accurate record of the recollection of an event exists.

Statement protocols vary from company to company, dependent upon the policy in place. General good practice is for statements to include the following:

  • Full name of the witness, date of birth, identification
  • Employment of the witness and contact information
  • Address of the witness, location of statement
  • Date of interview
  • Time commenced and concluded
  • Name of private investigator and company who took the statement
  • An introduction paragraph including day’s events and observations
  • Verbatim (word for word) transcription of the witness’ recollection of the events
  • Closing paragraph that ends the statement.

For example, the closing statement can read:

“I, (witness name), have read the above six-page statement and find it to be accurate to the best of my recollection. I have been advised that I could omit, delete or change any part of the statement prior to signing it.”

As this example indicates, the private investigator should give the witness the opportunity to review the statement and ask for changes to be made before they agree to sign it. If a change is requested, a line should be drawn through the item being removed, with the initials of both the witness and the private investigator at the beginning of the correction and the end.

Furthermore, each page should be initialed or signed, to confirm that no further information was added. On the final page of a statement, after the signatures, common practice would be to draw an “x” through the remainder of the page to indicate that there is no further information on this page.

When giving a statement, the witness may drift from subject to subject without following a specific structure. The investigator may wish to prepare a questionnaire that will keep the witness on track during the interview, which ultimately will be conveyed in the statement.

It should also be recorded in the handwritten or typed statement that the witness gave the information of their own free will.

If the statement being taken can be considered a confession, it is important that no form of threat or promise of immunity be made. Confessions that are coerced will be challenged and found inadmissible.

Investigators should bear in mind that the lawyers are afforded the right to cross-examine each witness during a trial to test whether or not the witness is telling the truth; it is therefore important that statements reflect the truth.

In a situation where an investigator is taking a statement of a youth under the age of 18, industry practice is for the investigator to contact the parents or legal guardians to obtain permission to conduct the interview. The investigator should allow the parents to be present during such interviews.

When assessing a witness statement, the most important factor to document is the value, credibility and honesty of the information provided. According to the Ibrahim Rule, for a statement to be admissible, it must be taken under oath and clear of duress.

Report Writing

Private investigators regularly complete written reports of occurrences, duties performed and comprehensive descriptions of their tasks/observances. They need to create reports that are objective and standardized. They should be familiar with the different types of situational reports (e.g. legal or insurance) as well as basic report writing protocols such as: date, time, location, actions/behaviours, description of individuals, observations, time of completion, etc. In addition, they should be aware of the legal implications of reports (e.g. for auditing or evidence purposes).

Investigators should make sure notes and observations are recorded as soon as possible. A digital recorder may assist in retaining information until the notes can be made, but the recorder should not solely be relied on as batteries drain and malfunctions may occur.

Upon reviewing his or her notes, if an investigator should realize that a critical piece of information has been omitted, the investigator should enter it at the time of their recollection. If there is an error discovered in the notes, the investigator should draw a line through it and initial the error.

Final reports should be made from the personal notes and any video taken should be reviewed to ensure the accuracy of the day’s events.

Standard surveillance reports should always include identifying information at the beginning of each report as follows:

  • Subject’s name
  • File number
  • Date and time
  • Other key information as per company policy, such as weather conditions, description of video equipment, description of the neighbourhood where the surveillance was conducted, etc.
Reports as Evidence

Private investigators may receive a subpoena and be called upon to testify in court in relation to a case they dealt with, and may therefore be asked to recall specific details about the case, so it is imperative for the investigator to keep thorough and accurate notes. When on the witness stand, the private investigator may, with the court’s permission, be permitted to refer to his or her notes. However, the notes should serve as a memory aid only: if the notes are clear, they will help the private investigator recall details about a situation, but the investigator should not have to read directly from the notes. As such, prior to appearing in court, the investigator should carefully review all notes and try to remember as many details about the situation as possible.

Undercover Operations

Generally the undercover operation is the last resort after all other investigative techniques have been exhausted or are not applicable. Other techniques may include assessments, interviews, interrogations, surveillance and camera installations.

Typically, private investigators will go undercover when they are required to investigate workplace-related issues. For example, a client may ask the investigator to pose as an employee in order to investigate possible theft being committed by another employee.

The undercover operator should be briefed on:

  • The environment
  • Who the supervisors are
  • Who the suspects are if known
  • What infractions they are looking for
  • What will be expected of them as a legitimate employee
  • Where suspects may congregate within the workplace and outside

A private investigator should be confident after reviewing the background material provided on the organization that he or she will fit in. For example, if the company employs primarily individuals of a certain ethnic background or who speak a certain language, the investigator should be selected based on how well he or she would fit in this environment.

According to the Canada Revenue Agency, a fake name should not be used on a resume.

Supervisors normally manage the undercover operator to ensure their safety, to be debriefed in person at the end of each shift, to receive any evidence seized, to ensure reports are accurate, to watch for any signs of “burn out” on the part of the operator, and to liaise with the client.

A client may target specific infractions for the operator to observe and collect evidence of, however the operator may observe infractions the client is not aware of, and should therefore observe and report on all possible infractions or criminal acts observed, company policies that are breached or health and safety infractions.

As previously explained, the undercover operator must not record any conversations they are not directly a party to.

Camera installation may be required in areas of high risk. These cameras should not be placed in any washroom area where people have a reasonable expectation of privacy.

Undercover operators should avoid being seen with targets in public places by people who know the true identity of the operator.

Undercover operators must maintain their credibility for court purposes and not jeopardize an investigation through any conduct which will bring their credibility in question, even if such conduct would assist them in gaining the trust of targets or in establishing their undercover persona. Examples of this are taking drugs or drinking alcohol. Investigators should not approach employees and offer them money to steal something.

Generally speaking, the undercover operator should not encourage, demand or assist in any contravention of any law, policy, or company rule, or enlist others to do so.

The undercover operator may accept the client’s stolen property but should as a general rule not take part in any theft. However, in some cases the client may choose to authorize the private investigator to participate in the theft if this tactic is deemed appropriate. The stolen merchandise may be used at a later date for evidence in the investigation.

Typically, it is the client’s responsibility to determine if the police are to be informed.

The police will lay any charges they see fit with the evidence supplied to the client.

Monitoring of email

According to established Canadian practice, the monitoring of employees’ email without notification to the employee is acceptable if it is monitored on the company’s server or network, as these are the company’s properties.

However, the practice may also be for employees to sign a release acknowledging that their computer activities may be monitored, whether the programs to do so are installed on the server or on individual computers that are connected to a company network.

If the investigator finds that an employee has been misusing a company computer, or using it to conduct illegal activities, the best way to protect the evidence is to isolate the unit and make sure no one else uses it.

On the other hand, if the employee is committing a violation through their personal/home computer (e.g. storing the company’s intellectual property on a personal computer), it is best to simply have the client notify their counsel.

Rules of Civil Procedure and Document Service

Generally speaking, any individual can serve documents. For this purpose, there is no requirement to be licensed as a private investigator. However, private investigators are often called upon by law firms, companies or individual citizens to assist with the service of documents. This may occur as part of an investigation where the intention is to locate the residence of individuals or subjects. Therefore, private investigators should be familiar with the Rules of Civil Procedure.

Civil law involves legal issues between private citizens or businesses. Ontario’s Rules of Civil Procedure set out the rules for service of documents that may be utilized by the courts, and the manner in which cases proceed through the civil courts.

A private investigator may deal with civil matters that involve the Superior Court of Justice, small claims and family courts.

Criminal matters are dealt with in criminal courts and are not subject to the Rules of Civil Procedure.

Generally, there are two sides to a civil matter. The person or entity initiating an action is known as the plaintiff and the person or entity being sued is the defendant. Other entities which could become part of the action, usually named by the defendant, are known as third parties.

The Rules of Civil Procedure have disclosure requirements that require one party to disclose their relevant documents to the other party. Documents involved in civil proceedings include Statements of Claim, Petitions for Divorce or Motions Brought before the Court. An Affidavit of Service is completed when these documents are served; it proves that a document has been delivered to the individual or entity named.

Another example of a document which a private investigator is often retained to serve is a Summons to Witness along with Conduct Money. This document could be issued by either party to compel an individual to appear in court to testify. If a witness is found to be absent, reluctant or evading, the private investigator may be required to make further attempts of service to the witness at various times throughout the day, as a summons has to be served on the witness personally.

The Rules of Civil Procedure set out the standards for service of documents. A private investigator should follow these rules accordingly. It is usually the responsibility of the private investigator to ensure that the proper method of service is followed and that the correct Affidavit of Service is used under the Rules of Civil Procedure, or as required under some other act. Often the client or client’s lawyer will instruct the private investigator fully as to the expectations for service and the completion of the Affidavit of Service.

A document must be served in the manner prescribed by the Rules of Civil Procedure. Unless an application for substituted service is completed, the document must be served personally upon the individual named where the rules require personal service. Service is affected once the person serving the document hands it to the person named, whether or not they actually accept the document. In a situation where the named party on the document refuses to open the door, the best action for the private investigator is to contact the client and advise of the situation. The lawyer or client will then make the necessary applications for substituted service.

It is crucial to identify clearly the person that is being served, both at the time of service and by affirming it in the Affidavit. Most often this is done verbally by having the person identify themselves by name. In some instances, such as when a Petition for Divorce must be served, the lawyer may request that the respondent provide a signature affirming the receipt of the documents. In this case, personal service is applicable and the private investigator must attempt to have the named party sign for the documents. In some instances, the investigator may need to have the named party show identification. The full instructions for such service of documents are often supplied directly by the client or their lawyer.

There are also times when a person may be uncooperative and try to avoid service. If this is the case, other methods for identifying the person may be utilized, such as asking coworkers, neighbours or other reliable sources that can be consulted to confirm the person’s identity.

When a document is served, all applicable laws must be complied with. There is no justification for committing a criminal offence. For example, when serving a document to an individual in an apartment building where the investigator must gain access into the building, the investigator must comply with the Trespass to Property Act.

When a private investigator has completed serving a document on the named party, an Affidavit of Service must be sworn in the presence of a lawyer or commissioner of oaths.

It is important to note the “swearing” of an Affidavit must be done by the private investigator that served the documents. Any errors discovered before swearing to the accuracy must be corrected. When an error has been discovered before swearing an Affidavit, the investigator is required to inform the commissioner or person taking the oath, make the necessary correction, initial the changes and then swear the Affidavit is accurate.


Ontario Evidence Act

Canada Evidence Act

Rules of Civil Procedure

Saskatchewan Justice – Corrections, Public Safety and Policing: Private Investigator and Security Guard Training Manual (2012)

  • Chapter 7 – Note Taking, Reports and Evidence