Ask ten procurement leaders in Ontario what their top risk is and you will get ten different answers \u2014 supply disruption, fraud, non-compliance, cyber, delivery delay, price volatility. That is not a sign of good risk management. That is a sign that the function is driven by whatever risk made the news last quarter.<\/p>\n
Real procurement risk management starts with a framework that works in the background of every sourcing decision. This post outlines that framework and how to apply it in the Ontario broader public sector (BPS) context.<\/p>\n
Procurement risk is any event or condition that could stop your organisation from getting the right goods or services, at the right price, at the right time, from a compliant source. That definition sounds simple but it covers more ground than most teams realise: strategic, operational, financial, compliance, reputational, and ESG-related risks all fit under it.<\/p>\n
The BPS Directive, CFTA, and \u2014 for construction \u2014 the Construction Act create a compliance layer that private-sector risk frameworks don’t have to think about. A bid that looks commercially strong can still be legally unworkable if the documentation trail doesn’t hold up. That makes compliance risk an always-on concern, not a once-a-year audit issue.<\/p>\n
Most risk registers we see are either too short to be useful or too long to be maintained. The sweet spot is usually 15 to 25 active risks, each with four fields: description, likelihood, impact, and mitigation owner. Anything more complex than that tends to stop being updated within a quarter.<\/p>\n
Review the register quarterly, not annually. Quarterly review is what turns the register from a document into a habit.<\/p>\n
A single supplier holding more than 25% of your spend in a category is a structural risk \u2014 not because the supplier is bad, but because your bargaining position and continuity plan depend on a single counterparty. The fix isn’t always a second supplier (that has its own costs). Sometimes the fix is a tested continuity plan, a named backup supplier pre-qualified through an RFP, or a strategic contract clause that gives you ramp-down protection.<\/p>\n
AI won’t replace the judgment calls, but it does three things well: it flags contract clauses that deviate from your standard, it surfaces outlier bids in an RFP evaluation, and it scans supplier performance data for early warning signs. For most Ontario organisations, the path in is narrow and practical \u2014 pick one use case, prove value, then expand.<\/p>\n
Translate. Executives don’t want a risk register \u2014 they want to know what could stop the organisation from delivering its mandate. Frame risks around service outcomes (“this could delay X program by Y weeks”), not around procurement process metrics.<\/p>\n