In other words, the department and the agency are responsible for carrying out the investigation with their own resources, and if they don't have them, they contract a private company to do that. I would have thought that if there was a security concern within PHAC, they would have contacted Government of Canada authorities such as CSIS or the RCMP to conduct the investigation rather than hiring a private contractor to do the work and gather the information.
On April 8th, 2024. See this statement in context.