Risk Management Process

The risk management process is the systematic way an organization identifies, assesses and controls risk. It includes selecting measures to avoid, mitigate, transfer or accept each risk. The process is used in NATO security, force-protection, capability and project-management work, and in Canadian federal procurement governance and supply-chain security.

NATO describes risk management as the identification, analysis, assessment and control of unacceptable risk, or its avoidance, minimization or elimination. For suppliers, the practical point is that buyers run this process before and during a contract, and solicitation documents often reflect its results.

How NATO defines the risk management process

NATO defines risk management as the identification, analysis, assessment and control, or the avoidance, minimization or elimination, of unacceptable risk. The definition appears in a NATO report.

NATO security guidance applies the same logic to protecting assets. It describes a process that identifies assets, threats, vulnerabilities and consequences, then reviews risks and recommended countermeasures. Decision-makers choose among risk avoidance, mitigation and acceptance, as set out in the NATO security guidance.

The four stages in NATO force-protection doctrine

NATO force-protection doctrine identifies four stages of the risk management process:

• Avoidance: removing the activity or exposure that creates the risk.
• Transference: shifting the risk to another party.
• Mitigation: reducing the likelihood or the consequences of the risk.
• Acceptance: knowingly retaining the risk that remains.

These stages are described in AJP-3.14 Force Protection.

The security risk-management report

NATO security guidance calls for a security risk-management report. The report documents the assessment scope, asset value, a summary of threats and vulnerabilities, the countermeasures selected, the residual risk and the processes for ongoing risk management. Residual risk is what remains after countermeasures are applied, and the report records it so that it can be accepted and monitored on purpose. The process does not end when the report is issued, because the guidance includes continuing risk management.

Risk management in Canadian federal procurement

The Treasury Board of Canada Secretariat builds risk into procurement control. Its Directive on the Management of Procurement requires a risk-based system of internal controls. Those controls must be maintained, monitored and reviewed to give assurance that transactions comply with the applicable framework, laws, regulations and policies.

Government of Canada research-security guidance applies the process to supply chains. Organizations assess the risk of what is being procured, assess the risk of the prospective supplier and determine mitigation measures. Where the risk is significant enough, an alternative vendor can be selected.

Federal contracting functions also use risk assessments and risk registers to identify, mitigate and monitor procurement risks. A Canada Border Services Agency audit describes risk management as identifying and analysing risks, deciding how they should be managed, and considering changes in the internal and external environment.

What it means for a supplier bidding on Canadian public contracts

The buyer runs the risk management process, and the supplier is assessed within it. A prospective supplier is itself a subject of risk assessment, so the quality and completeness of the information you provide can affect how your bid is viewed.

The specific obligation depends on the solicitation or contract. Where procurement documents set security, supply-chain, information-assurance or risk-control requirements, suppliers can be asked to provide information for the risk assessment, implement specified controls or countermeasures, and support monitoring and continuing risk management. No single supplier obligation applies to every Canadian procurement, so read each solicitation's security and risk clauses closely and answer them directly in your bid.