A recent decision from the Ontario Court of Appeal highlights the devastating financial consequences of inadequate internal controls, confirming a massive damages award against a rogue employee.
Foster v. Prado (2026 ONCA 277)
In Foster v. Prado, an office manager exploited her employer’s trust to steal over $1.1 million over a two-year period. The theft was executed through 31 unauthorized e-transfers, 17 forged cheques, and over $560,000 in unauthorized credit card purchases for luxury goods, cosmetic treatments, and business class flights.
The employer, a wealthy individual who entrusted the manager with access to his personal accounts, only discovered the fraud when a new assistant flagged a suspicious transaction.
Punitive Damages Confirmed
The Court of Appeal upheld the lower court’s decision ordering the employee to repay the stolen funds, plus an additional $100,000 in punitive damages. The Court noted that the employee was in a fiduciary relationship with her employer and had fundamentally breached that trust.
The case also involved the employee’s spouse, with the court allowing claims of “knowing receipt” of stolen funds to proceed to trial, noting that the couple’s lifestyle was clearly funded by the misappropriated money.
Employer Takeaway
Trust is not an internal control. No matter how long an employee has been with your organization, never grant unilateral, unmonitored access to company or executive finances. Implement mandatory dual-authorization for large transfers and conduct regular, independent audits of all accounts.
Source: canlii.org/en/on/onca/doc/2026/2026onca277/2026onca277.html
