Risk Assessment

Risk assessment is the process of identifying, analysing and evaluating risks so that decisions can be made about how those risks should be treated or controlled. ISO places it inside risk management, which also includes treatment, monitoring and communication of risk. ISO 31000:2018 sets out that process as general principles and guidelines.

In Canadian public procurement, the term covers several related exercises. Buyers assess the complexity of a procurement, assess the security risk of what they buy and who supplies it, and review whether procurement practices put fairness, openness and transparency at risk. NATO uses a more specific form, security risk assessment, for information and communications security.

How ISO 31000 and IEC 31010 define the process

ISO defines risk as the effect of uncertainty on objectives. ISO 31000 describes a process that covers identification, analysis, evaluation, treatment, monitoring and communication.

IEC 31010:2019, Risk management: Risk assessment techniques, focuses on the assessment step itself. It gives guidance on selecting and applying techniques for assessing risk where there is uncertainty and a decision to be made. The ISO committee description lists the main activities:

• defining the scope and purpose of the assessment;
• identifying risks and their causes;
• understanding consequences and likelihood; and
• reporting the results.

Procurement risk assessment and complexity levels on CanadaBuys

CanadaBuys uses the term procurement risk assessment in its buyer guidance on procurement complexity. The guidance assigns each procurement to one of five complexity levels. Higher levels involve high uncertainty, untested procurement strategies, multiple stakeholders, transformational requirements and detailed or unpredictable contract administration.

The page describes the buyer's classification criteria. It does not impose a universal deliverable on suppliers. The assessed level can still shape how a buyer plans, governs, evaluates and manages a solicitation and the resulting contract.

Supply-chain security assessments in Government of Canada guidance

Government of Canada supply-chain-security guidance tells organizations to assess three things:

• the security risk associated with what is being procured;
• the risks associated with potential vendors and subcontractors; and
• appropriate mitigation measures.

The assessment can consider whether a supplier or subcontractor will have access to sensitive information, information and communications technology infrastructure, metadata or personal data, and what the impact would be if that information were compromised. The guidance explains the approach. It does not set one standard clause for every procurement.

Fairness reviews and NATO security risk assessment

The Office of the Procurement Ombudsman applies risk assessment when reviewing federal procurement practices. Its review-plan methodology measures risk by the likelihood and impact of events that could affect fairness, openness or transparency. Areas that can be assessed include solicitation, bid evaluation and selection plans, contract amendments, debriefings and contract execution.

NATO defines security risk assessment as identifying security risks, determining their magnitude and identifying areas requiring countermeasures. The NATO security document frames the process around the assets at risk, the threats and vulnerabilities, and the consequence if a vulnerability is exploited. The result supports the choice of security countermeasures.

What risk assessment means for a supplier bidding on Canadian public contracts

Risk assessment is mostly done by the buyer, but its results show up in what suppliers are asked to do. Depending on the solicitation, that can include security requirements, limits on access or data handling, subcontractor controls, mitigation measures, or detailed contract-management and reporting terms.

Read each solicitation and its security instructions closely, and meet the controls it specifies. The sources describe how buyers assess risk. They do not show that every Canadian or NATO-related solicitation carries the same supplier obligations, so treat each document as the authority for that bid.