Risk Statement

A risk statement is a concise description of a risk. It identifies the risk itself, the potential harm, the likelihood that the harm will occur, and the impact or severity if it does. CanadaBuys uses this structure in its guidance for federal buyers on procurement approval processes.

The term is not an abbreviation. In Government of Canada procurement and risk-management documents, a risk statement expresses a material uncertainty in a structured form. It is kept separate from a risk response, which describes the actions taken to mitigate, avoid or prevent the risk. Treasury Board business-case guidance describes a formal risk statement as setting out a risk's trigger and impact.

What a Procurement Risk Statement Contains

CanadaBuys guidance names four elements in a procurement risk statement:

• The risk: the event or condition that could affect the procurement.
• The potential harm: what would go wrong if the risk occurred.
• The likelihood: how probable that harm is.
• The impact or severity: how serious the harm would be.

The statement describes the problem only. The response, which covers mitigation, avoidance or prevention, is recorded separately, along with the residual risk that remains once the response is in place.

Risk Statements in PSPC Approval Documents

CanadaBuys instructs Public Services and Procurement Canada (PSPC) buyers to document procurement risks in approval documents. That documentation must include risk statements, risk responses and residual risks. Buyers complete a Procurement Risk Assessment (PRA) according to the procurement's predetermined complexity level, include it with the approval document and retain it on the procurement file. The full requirements are set out in the CanadaBuys approval processes guidance.

Risk Statements in Treasury Board Submissions

A detailed risk assessment is required at the procurement-strategy stage. For complexity levels 1 to 3, the buyer completes a PRA and consults the Risk Management and Acquisition Services function. For complexity levels 4 and 5, the buyer completes a custom risk assessment with that function.

The Treasury Board submission guidance requires a risk-and-mitigation strategy section. For each material risk identified in the narrative, the submission must include a risk statement, a response strategy and a description of the residual risk.

How Other Departments Use the Term

Risk statements also appear in departmental planning and audit material. Shared Services Canada (SSC) presents "key risks and risk statements" in its 2025-26 departmental plan. In its 2024-25 departmental plan, SSC identifies an IT procurement risk: changing global socioeconomic or political conditions and current procurement approaches may prevent the department from acquiring the products and services it needs.

The Canada Border Services Agency sets out risks in risk statement form in its contracting and procurement audit material. Examples include possible misalignment between procurement capacity and operational needs, and the vulnerability of procurement processes to conflicts of interest, collusion or corruption.

What a Risk Statement Means for Suppliers

The federal guidance presents the risk statement as a buyer's document used for planning, approval, risk assessment and Treasury Board decisions. It does not establish a general rule that suppliers must submit a document called a risk statement.

A supplier's obligations depend on the solicitation or contract. A tender may ask for a risk-management plan, a security measure, insurance, a transition plan or another mitigation deliverable. Bid teams should read each requirement closely and answer the risks the buyer has signalled. Understanding how a buyer frames a risk, including its harm, likelihood and impact, helps a supplier propose mitigation that addresses the buyer's actual concern.