Risk Control

Risk control is a measure, process, or safeguard used to identify, reduce, avoid, prevent, or otherwise mitigate risk. In Canadian public procurement, it describes the steps buyers and suppliers take to keep harm from a purchase, a supplier, or a supply chain at an acceptable level.

The concept comes from risk management, including procurement risk management, internal control, cybersecurity, and supply-chain security. Government of Canada sources use the term in this broad sense and apply it through several separate tools rather than one universal contract clause. What counts as a risk control therefore depends on the solicitation and the department buying. The CanadaBuys buyer's guide sets out how risk responses are documented at the approval stage.

Risk controls inside the Procurement Risk Assessment

Public Services and Procurement Canada (PSPC) buyers must complete a Procurement Risk Assessment (PRA) according to the procurement's predetermined complexity level. The buyer retains it on the procurement file and includes it with the approval documentation. Approval authorities may require the procurement strategy or risk factors to be reviewed, or may ask for another risk assessment.

Approval documents describe three linked items:

• Risk statements that identify what could go wrong.
• Risk responses, which are the actions taken to mitigate risk, including reduction, avoidance, and prevention measures.
• Residual risk, which is the risk remaining after the responses have been applied.

Risk controls are the practical measures behind the risk responses. The residual risk shows what the buyer is still accepting once those measures are in place. These points are drawn from the CanadaBuys approval processes page.

Supply-chain and security controls in solicitations

Government of Canada research-security guidance recommends assessing two things: the risk in what is being purchased and the risk associated with the prospective supplier. Buyers then select mitigation measures that fit the findings. See the guidance on assessing your supply-chain risk profile.

The same guidance recommends including security considerations in the request for proposals as bidder evaluation criteria, so that requirements can be assessed before contract award. It also recommends contract clauses that set required protections or minimum standards. These can include rights to review the security and integrity of goods and services and to conduct security audits after procurement. Details are in the guidance on developing security criteria for your procurement.

That guidance names three frameworks for assessing supplier security alignment:

• ITSG-33, the Government of Canada's information-technology security risk-management framework.
• NIST SP 800-161 Rev. 1.
• ISO/IEC 27036-1:2021.

The Canadian Centre for Cyber Security treats supply-chain risk management as a set of cybersecurity controls that mitigate risks within an organization's supply chain. See its supply chain risk management guidance.

Internal controls departments apply across the procurement lifecycle

Departmental audits describe internal controls that run from approval through to tracking. These include budget review, purchase-order authorization, review-board oversight, and documentation. One example is the Correctional Service Canada procurement audit.

The Canadian Coast Guard's procurement audit identifies procurement-review-board review, procurement triage, and a mandatory Security Requirements Check List as controls for managing procurement risks. Its audit report is available on publications.gc.ca.

The Canadian Mortgage and Housing Corporation (CMHC) runs a centralized Vendor Risk Management Program. It includes Outsourcing and Supplier Risk Assessment procedures to identify, assess, treat or control, and monitor vendor risks. This is set out in the CMHC procurement policy.

What risk control means for a supplier

For a supplier, the practical obligation depends on the solicitation and the contract. Read the evaluation criteria and security provisions closely, because risk controls usually show up there. Depending on the buyer, a supplier may need to:

• satisfy security or supply-chain criteria included in the solicitation;
• demonstrate alignment with an accepted security or risk-management framework;
• protect specified information, systems, goods, or technologies;
• accept security-review or audit provisions; and
• provide the information a buyer needs for its supplier-risk assessment.

Bid teams that document their own controls in advance can answer these requirements faster and with fewer clarification rounds.