Contract Risk Management

Contract risk management is the identification, assessment and treatment of risks associated with a procurement or contract. It includes selecting a contracting strategy, using appropriate authorities and clauses, and monitoring risks through contract performance.

Canadian federal audit guidance describes it as the risk assessment the contracting authority conducts during the tendering and award phase. The term is used across public-sector acquisition, contracting and contract administration, and NATO guidance uses the related term contracting risk management. You can read the audit wording in a PWGSC audit publication.

How federal audits describe the tendering and award phase

Public Works and Government Services Canada (PWGSC) audit guidance treats contract risk management as part of the contracting authority's work during tendering and award. PWGSC developed a Procurement Risk Assessment Tool to support procurement in accordance with contracting policies and regulations. The tool supports procurement-risk assessments and the development of procurement strategies.

A joint audit of Health Canada and PWGSC applied this approach to major procurements. It recorded risk assessments for procurement "waves" and linked them to the procurement strategy. The same audit source sets out the tendering and award focus.

The Treasury Board risk process and its treatments

Treasury Board procurement training places contract risk management inside a broader risk-management process. That process covers identifying risks, assessing them, reviewing options, implementing a treatment and evaluating the result. The Treasury Board training material lists standard clauses, specific authorities and additional approvals as possible treatments.

Adding clauses to a request for proposals (RFP) and to the resulting contract is one way to put a selected treatment into effect. The training covers the full range of federal contracts, from low-risk commodity purchases to highly specialized, high-risk contracts that involve significant public-interest concerns.

NATO guidance takes a similar approach. It directs contracting officers to assess proposed procurements early and to formulate a contracting strategy that minimizes risk, as set out in the NATO contracting guidance.

Contract-level risk practices at DND and CCC

Department of National Defence (DND) audit material identifies cost, schedule and performance risks at the contract level. For major maintenance and in-service-support contracts, it discusses risk-management plans, risk registers, contingency plans, quantified risks and formal risk reporting. These practices appear in a DND audit report.

The Canadian Commercial Corporation (CCC) implemented a Contract Risk Management Framework that covers all CCC contracts. It divides risks into strategic, operational and transactional categories. It applies identification, assessment, response, control and monitoring to each. The framework is described in a CCC publication.

What contract risk management means for a supplier bidding on Canadian public contracts

Where a solicitation or contract requires it, a supplier is expected to meet the risk obligations the buyer has set. The federal material supports the following:

• Comply with risk-related clauses added to the RFP and the resulting contract.
• Provide a risk-management plan or risk reports where the contract specifies them.
• Take part in monitoring, mitigation and reporting during contract performance.

These requirements are not universal. One DND audit criticized a contract because the vendor was not required to report risks or provide a risk-management plan. It recommended that follow-on contracting require vendor risk reporting. Bid teams should read each solicitation closely to see which risk requirements apply and price and plan for them before submitting a bid.