Financial Risk Management for Ottawa Business Owners: The Risks That Actually Bite
Most conversations about risk management in small business go abstract very quickly: identify, assess, mitigate, monitor. That framework is fine, and it is also why so many owners never do anything with it.
The useful version is narrower. For an owner-managed business in Ottawa, a small number of specific risks account for most of the damage that actually happens, and each of them has a concrete, checkable control. This article names them.
The risks that land first
| Risk | What actually happens | The control |
|---|---|---|
| Unremitted source deductions | CRA assesses the corporation, then the director personally | Remit on the assigned schedule, from a separate account |
| Unremitted GST/HST | Same personal exposure, often larger | Move the tax out of operating cash as it is collected |
| Single client concentration | One contract ends, revenue halves | Track revenue by client monthly, act at 40% |
| No documentation trail | A defensible position is disallowed anyway | Keep records six years, contemporaneously |
| Owner incapacity | Nobody else can sign, invoice or access accounts | A second signatory and a continuing power of attorney |
| Cash held above coverage | Deposits beyond the insured limit at one institution | Split across categories or institutions |
Everything below explains one of those rows.
Director liability is the exposure most owners underrate
If you are a director of your own corporation, you are personally on the hook for amounts the corporation failed to withhold and remit. This covers payroll source deductions and GST/HST, and it survives the corporation’s insolvency. That is the entire point of it.
The CRA sets out the mechanism in IC89-2R3, Directors’ Liability. Three conditions gate an assessment: the CRA must have been unable to collect from the corporation, the assessment must be issued within two years of the date you last ceased to be a director, and you must be unable to show due diligence.
Two practical consequences follow, and both are routinely missed.
Due diligence means steps taken before the failure, not after. Explaining at the assessment stage that you always intended to catch up is not a defence. Evidence of a system, a remittance calendar, a separate account, a bookkeeper with a standing instruction, is.
Resigning does not end the exposure immediately. The two-year clock runs from the date you last ceased to be a director, and it runs from a properly documented resignation, not from the day you stopped showing up. If you are leaving a board, get the resignation recorded.
The mechanics of assessment and defence are covered in more depth in director liability and the CRA.
The remittance penalty is steeper than people expect
The penalty for late payroll remittances is not a flat late fee. It escalates with how late you are:
| How late | Penalty on the amount |
|---|---|
| 1 to 3 days | 3% |
| 4 or 5 days | 5% |
| 6 or 7 days | 7% |
| More than 7 days, or not remitted | 10% |
| Second or later failure in a calendar year, knowingly or through gross negligence | 20% |
The CRA sets this out under late remitting and failure to remit. Generally the penalty applies only to the portion above $500, but where the failure was knowing or grossly negligent it applies to the whole amount.
Note the shape of that table: the difference between three days late and eight days late is not a rounding error, and interest runs on top. The control is mechanical, not motivational: source deductions and collected GST/HST leave the operating account the day they are withheld or collected. If the money is not sitting in the operating balance, it cannot be spent. The same discipline is what makes payroll survivable when you hire, see hiring your first employee in Ottawa.
Concentration risk is a financial risk, not a sales problem
A consulting business with one client that provides 60% of revenue is not a business with a strong client, it is a business with a single point of failure that happens to be paying right now. Ottawa’s professional services market makes this common, since a single federal contract or a single anchor client can plausibly carry a whole practice.
Two things follow. Financially, model the quarter after that client leaves and see whether the business survives it: the method is in cash flow forecasting for small business. And for tax, concentration on one payer raises a separate question about whether you are caught by the personal services business rules, which deny the small business deduction and most expense deductions.
Documentation risk: the position you cannot support
In a CRA review the burden is on the taxpayer. A deduction that was entirely legitimate is disallowed if you cannot produce what supports it, and the normal reassessment period runs three years for individuals and Canadian-controlled private corporations, with no limit at all where there has been misrepresentation attributable to neglect, carelessness or wilful default.
The CRA requires records to be kept six years from the end of the last tax year they relate to, and longer for some property records. The failure mode is not usually a missing receipt, it is a missing explanation: no note of why a payment was a business expense, no board minute for a management fee, no valuation behind a related-party transfer. What a review actually asks for is set out in CRA audit triggers and preparation.
Liquidity and the risks worth insuring
Two controls sit under everything above.
A cash buffer you do not touch. Penalties, interest and forced decisions almost always trace back to a business with no slack. The sizing question is covered in an emergency fund for business owners.
Insurance for the losses you cannot absorb. Insure severity, not frequency: a professional liability claim, a disability that stops you billing, the death of the one person who holds the client relationships. Small predictable losses are cheaper to self-fund than to insure. The categories and where they apply are in insurance for small business in Canada.
On the cash side, note that deposit insurance is not unlimited. Coverage is capped per depositor per insured category at each member institution, and the categories and limits are set out by the Financial Consumer Agency of Canada. A corporation holding a large operating balance at one bank should know where it sits against that.
What to do this quarter
- Confirm your remittance frequency and put the dates in a calendar with a reminder two days early.
- Open a separate account for source deductions and collected GST/HST, and move the money the day it arises.
- Pull revenue by client for the last twelve months, and write down what happens if the largest one stops.
- Confirm your corporate records are complete: minutes, resolutions, and support for any related-party transaction.
- Check that a second person can access banking and payroll if you cannot, and write down what they would have to do, which is the whole of a business continuity plan small enough to use.
None of this is complicated. It is just the part that gets deferred until the quarter it stops being optional.
If you want a second pair of eyes on where your business is actually exposed, a review of the remittance and documentation side is usually a short conversation, and it is far cheaper before an assessment than after one.
Written by