Risk Mitigation

Risk mitigation in Canadian public procurement means selecting and putting in place measures that reduce the likelihood or the consequences of risks that could prevent a procurement from achieving its objectives. It sits inside the wider discipline of risk management, which the Treasury Board of Canada Secretariat describes as a process of risk identification, assessment or analysis, development and selection of options, implementation, and evaluation or review.

Mitigation is the response step. Once a contracting authority has identified a risk and assessed it, it chooses how to deal with it. In federal procurement that choice is carried out through standard clauses, specific authorities, approvals and other contractual measures, as set out in the Treasury Board risk management guidance.

How federal procurement frames risk management

The Treasury Board procurement framework requires contracting authorities to monitor and manage the procurement risks identified during planning. They must also update those risks as they change throughout the procurement process. The requirement is set out in the Treasury Board procurement policy instrument.

The supporting guidance describes the sequence in practical terms. Authorities identify risks and assess their probability and consequences. They then review response options and implement the selected option through authorities, approvals, RFP provisions or contract clauses.

Common mitigation measures in solicitations and contracts

Once a risk is assessed, federal buyers have several responses available:

• accepting the risk;
• using standard contractual clauses;
• adding specific requirements to a solicitation or contract;
• obtaining special approvals;
• transferring or allocating the risk to the party best able to manage it; and
• requiring contingency, security or other control measures.

Approvals are themselves a mitigation tool. Treasury Board concurrence is required for certain non-competitive contracts and contractual arrangements with an overall medium-risk classification, including arrangements involving Public Services and Procurement Canada and the Defence Investment Agency. The conditions are found in the Treasury Board contracting authorities instrument.

Risk allocation and contractor liability

Federal contracts are expected to state that each party is responsible for the risks under its control. Each party also accepts responsibility for risks it can manage or mitigate. This principle appears in the Treasury Board requirements on contractor liability and indemnification.

Where a procurement may involve a substantive transfer of risk from the contractor to the Crown, the contracting authority must conduct a risk assessment. It must also consult legal services before pursuing alternatives. Risk allocation is therefore a deliberate mitigation decision, and it is reviewed when the Crown would absorb more than the usual share.

Mitigation in security, supply-chain and ethical procurement

Government guidance on supply-chain security uses a three-step approach. Buyers assess the risk in what is being procured, assess the risk associated with potential vendors, and then determine appropriate mitigation measures. Examples include enhanced security measures, incident-response plans and data encryption. See the supply chain security risk profile guidance.

The Canadian Centre for Cyber Security says vendor diversification can reduce vulnerabilities caused by dependence on a single vendor or a dominant technology stack.

Ethical procurement carries its own mitigation activities. PSPC identifies measures to prevent or reduce adverse impacts involving suppliers and other business relationships, including risks of human trafficking, forced labour and child labour. These are described in the PSPC page on identification, mitigation and remediation.

What risk mitigation means for a supplier

Mitigation measures reach suppliers through the solicitation and the resulting contract, so read both closely. Depending on the procurement, the measures can include:

• accepting the risks allocated to you;
• complying with security or privacy controls;
• providing risk-management or contingency plans;
• meeting supply-chain requirements; and
• supplying the evidence or certifications the contracting authority requests.

Requirements differ from one procurement to the next, so check each bid on its own terms. Build your response around the specific risks the buyer has named and show how your approach manages the risks you control.