Payroll services bureau due diligence

Due diligence on a payroll services bureau is a search for exactly one kind of problem: anything that suggests the bureau’s central promise — flawless, on-time remittances and filings for every client, every run — has ever actually failed. That search looks different from diligence on most small businesses, because the real risk here is not physical or environmental, it is compliance and continuity risk sitting inside client files, banking arrangements and a mountain of highly sensitive personal data belonging to people who are not even party to the sale. A buyer who works through that risk methodically, document by document, ends up with a very different picture than one who accepts a seller’s summary at face value.

Start with the remittance and filing record itself

Request the bureau’s own remittance and filing history with the Canada Revenue Agency, along with any correspondence the CRA has sent about a specific client account, and treat any documented late remittance, penalty notice or reassessment as a serious finding rather than a minor administrative note. A single late remittance is evidence the operational safeguards that are supposed to prevent exactly that failure did not hold at least once, and a buyer needs to understand whether that was a one-off human error or a symptom of a process gap that will resurface under new ownership.

Test every client contract, not just the largest ones

Build a client-by-client schedule showing contract status, term, notice period and — critically — whether the agreement addresses assignment or continuation on a change of ownership at all. A contract silent on assignment is not automatically void on a sale, but it does leave the client free to treat the change as grounds to walk, and a buyer should weight informally held revenue and silent-on-assignment revenue very differently from revenue that is contractually locked in. Concentration matters here too: a handful of large clients accounting for a disproportionate share of billings changes the risk profile even when the overall book looks diversified on paper.

Data security is its own diligence track

A payroll bureau holds employees’ social insurance numbers, banking details and compensation history for every person on every client’s payroll — a scale of sensitive personal information that most small businesses never touch, and one that brings federal privacy obligations directly into the deal. Diligence should confirm how that data is stored and secured, whether there has ever been an unauthorized access incident, and how access is controlled internally, because a data-security failure here is not a reputational inconvenience — it is a potential breach of obligations under federal privacy law affecting every one of the bureau’s clients simultaneously.

Specific findings and what they actually mean

• A late remittance or filing found in CRA correspondence signals the compliance process has already failed at least once, not just a theoretical risk
• A software vendor relationship or reseller status held personally by the seller means that access does not automatically continue after closing and must be renegotiated
• Banking pre-authorized-debit setups tied to the seller’s personal signing authority mean every client relationship needs individual re-authorization, not a single bulk transfer
• A client roster heavy in informal, no-notice arrangements means the revenue the deal is priced on is less certain than it appears on the income statement
• Any past unauthorized access to client payroll data is a federal privacy-law issue that can create liability well beyond the immediate client affected

Corporate and registry checks still matter

Alongside the payroll-specific items above, standard corporate diligence still applies — confirming the corporation’s good standing, checking for registered security interests against its assets, and reviewing any professional liability or errors-and-omissions coverage the bureau carries, since a claims history there can flag exactly the kind of past error a seller might otherwise prefer not to highlight. None of these checks are unique to payroll bureaus, but skipping them because the payroll-specific risks feel more urgent is a common and avoidable gap in an otherwise thorough review.

Check the client churn history, not just the current roster

A snapshot of today’s client list understates risk if it does not show who has left recently and why. Ask for a schedule of clients gained and lost over the past several years, including the stated reason for each departure — a fee dispute reads very differently from a client leaving after a missed remittance, and several departures clustered around a specific date can point to an operational problem the current client list alone would never reveal. A bureau that has quietly lost several clients to service issues in the past year is a different purchase than one whose churn is limited to ordinary business closures or acquisitions, even if the current revenue total looks identical. Where possible, corroborate the seller’s stated reason for a departure with the client directly rather than relying solely on the seller’s account, since this is one of the few diligence steps that can surface a service problem the financial records will never show.