Procurement Risk Assessment (PRA)

A Procurement Risk Assessment (PRA) is a documented assessment used to identify the risks tied to an individual procurement, determine the Government of Canada's exposure when it enters into a contract, and establish mitigation strategies. A PSPC audit of land, aerospace and marine procurement describes the PRA in exactly these terms (PSPC audit).

The PRA is an internal document prepared by the buyer. In PSPC buyer guidance, it must be completed according to the procurement's predetermined complexity level, included with the approval document, and kept on the procurement file (CanadaBuys approval processes). Suppliers do not file it, but its conclusions shape the solicitation they respond to.

What a PRA contains in a federal approval package

The approval document that carries the PRA must set out risk statements. Each statement describes the potential harm, the likelihood that it occurs, and its severity. The document also records the proposed risk responses and the residual risk that remains after mitigation (CanadaBuys approval processes).

This structure means the PRA is more than a checklist. It records what could go wrong, how the buyer plans to respond, and what risk the Crown accepts anyway. Approvers use it to decide whether the procurement can proceed as planned.

How complexity levels drive the assessment

Each requisition is assessed to determine its procurement-complexity level and the appropriate process stream (CanadaBuys: determining complexity). The PRA is then completed to match that level.

Higher-complexity procurements can involve innovative or developmental requirements, substantial uncertainty, untested procurement strategies, and extensive or unpredictable contract administration (CanadaBuys: complexity characteristics). Treasury Board guidance adds that procurement activities typically increase cost and scope management complexity and risk in a project (Treasury Board guidance).

Related risk tools used by other federal bodies

• Shared Services Canada: The Office of the Procurement Ombudsman describes SSC's Procurement Strategic Risk Assessment (PSRA) as a planning-stage form. It records strategic considerations, procurement-process risks, mitigation strategies and decisions that support management review and approval (Procurement Ombudsman review).
• Supply-chain security: Innovation, Science and Economic Development Canada assesses risk based on what is being procured and who may provide it, then selects mitigation measures (ISED supply chain security).

These tools share the PRA's logic: identify the risk, judge its significance, and decide on a response before a contract is awarded.

What a PRA means for a supplier bidding on Canadian public contracts

The PRA is a buyer-side document, not a standalone supplier submission. You will not be asked to complete the buyer's PRA, but its outcomes can appear in what you are asked to deliver. These include requirements, risk controls, security conditions, contract terms, and delivery or capability evidence written into the solicitation or contract.

• Read mandatory criteria and contract terms as signals of risks the buyer has identified.
• Expect more scrutiny of your capability and delivery plan on complex or developmental requirements.
• Where a solicitation addresses security or supply-chain concerns, be ready to show who supplies the components and services you propose.
• Address likely risks in your proposal before the buyer has to ask.