The risk and compliance process
Deputy heads have numerous and varied accountabilities and responsibilities articulated in legislation and Treasury Board policy related to the administration of their organizations. This includes, but is not limited to:
- authorities to manage the people, resources, activities and security of their institutions toward the objectives set out in legislative mandates and Treasury Board policy
- legal obligations as accounting officers to Parliament under the Financial Administration Act (FAA)
In June 2025, the Treasury Board of Canada Secretariat (TBS) launched the Risk and Compliance Process (RCP) to help deputy heads meet these accountabilities. The RCP provides an annual mechanism to assess compliance, performance and risk in key areas of administration.
The RCP also serves as an additional tool to help TBS maintain the effectiveness of its policy suite.
On this page
The assessment process
The RCP is an annual exercise, divided into three phases:
- Organizational self-assessments
- TBS analysis and review
- Engagement on results
Phase 1: organizational self-assessments
The RCP includes two self-assessments to help deputy heads understand how well their organizations are managing in key areas of administration:
- Self-assessment of compliance and performance
- Self-assessment of risk
Taken together, the self-assessments will help identify areas of strength and opportunities for enhancement where potential areas of concern can be proactively addressed.
Organizations are required to respond to questions in specific areas of focus, determined by TBS. Areas of focus represent management areas that are critical to effective public sector administration such that compliance and performance in these areas would have a significant impact on the functioning of an organization and potentially the enterprise.
Areas of focus are linked to legislative requirements or Treasury Board policy and seek to provide information not collected through other mechanisms.
The RCP has 11 areas of focus:
- data
- financial and expenditure management
- grants and contributions
- performance management
- procurement
- real property
- security
- service
- technology
- values and ethics
- workplace health
Each deputy minister is responsible for determining what evidence they require to accurately and confidently attest to their self-assessments. Organizations are not required to provide this information to TBS.
Self-assessment questions for each of the 11 areas of focus.
Risk exists in every organization. Responsible management involves the identification of risk and the implementation of appropriate mitigation measures. The risk component of RCP helps deputy heads annually assess their organization’s risks and response strategies.
Organizations are required to complete a self-assessment that looks at risk from two different perspectives – corporate risks and area of focus risks.
Corporate risks
Corporate risks are those that could affect the organization’s ability to achieve its objectives and results. They are associated with impacts that are typically high visibility, potentially affecting the whole or a major part of the organization.
Area of focus risks
Area of focus risks are those that could affect ongoing business objectives, activities, programs, services, initiatives or enabling functions. They may be operational in nature and specific to the functional area in question.
Internal review of results and deputy head attestation
Deputy heads are required to attest to the results of their organization’s self-assessments before providing those results to TBS. Submitting an organization’s RCP results to TBS in absence of a signed attestation will be considered as not having complied with the terms of the RCP.
Prior to deputy head attestation, organizations are expected to engage their internal senior executive governance structures to review the draft results of the self-assessments, including their Departmental Audit Committee (DAC) where a DAC is established.
This approach is intended to bring awareness across the organization about the results and to provide an opportunity for a robust challenge function in support of deputy head attestation of results.
Phase 2: TBS analysis and review
In Phase 2, TBS will review organizational self-assessments and other data sources to identify organizations that may benefit from a discussion about their RCP results with the Secretary of the Treasury Board.
The RCP will also provide an additional source of information that TBS can use to inform decisions about its policy suite and associated activities.
Phase 3: engagement on results
Deputy heads remain accountable for addressing instances of non-compliance with legislative and Treasury Board requirements, in accordance with the Framework for the Management of Compliance. Accordingly, they are responsible for determining, implementing and monitoring appropriate actions that respond to RCP results, using existing mechanisms such as their Departmental Audit Committee.
In Phase 3, discussions between the Secretary of the Treasury Board and deputy heads of organizations identified in Phase 2 are an opportunity for those deputy heads to present actions they are taking or planning to take, to address any AoFs where there is non-compliance or weakness. Discussions also allow TBS to share information about the actions and practices of stronger performing organizations with organizations that may have gaps in a particular AoF.
At the same time, these discussions allow TBS to receive feedback about its policy suite and potential opportunities to better help organizations meet their associated obligations.
While the discussions are intended to be collaborative, they are also a key mechanism for signaling expectations around management excellence and continuous improvement. Non-compliance identified through the RCP should be addressed as soon as possible and areas of weakness should be strengthened where appropriate. Implicit in this expectation is the acknowledgement that solutions to some issues may require an extended period of time.
When subsequent RCP self-assessments or other mechanisms demonstrate that previously identified issues are not being addressed as planned, TBS may take a range of actions as outlined in the Framework for the Management of Compliance. These actions, commensurate with risk and context, may include outreach by functional leads (e.g., Chief Human Resources Officer, Comptroller General, Chief Information Officer), the imposition of corrective actions or the restriction of authorities or responsibilities. As well, the relative effectiveness of an organization’s response to their RCP findings may inform the deputy head’s performance assessments.
Reporting results
Departmental results report
Organizations will be required to provide an annual summary of their RCP self-assessment and any actions being taken to respond to findings in their Departmental Results Report. Organizations that do not publish a Departmental Results Report are expected to include this information in a suitable annual reporting mechanism.
Government-wide report
Each year, TBS will prepare a government-wide report that includes aggregate results from participating organizations. This report will be posted to Canada.ca.
RCP accountabilities
Deputy heads are responsible for taking action to address non-compliance, poor performance or what they consider to be unacceptable levels of risk identified through the RCP or other means.
In their capacity as accounting officers, deputy heads need to be cognizant of all applicable legal and policy requirements incumbent upon their institutions, above and beyond what falls within the RCP.
TBS, through its policy suite, sets the strategic direction and requirements for the management of people, assets, finances, information, security, technology and service delivery. In addition to maintaining policy instruments, TBS provides organizations with guidance. The RCP supports this role by providing TBS with information about enterprise-wide compliance and performance, and risk.
Participation in the RCP
Organizations listed in Schedule I, I.1, or II of the FAA and with more than 150 full-time equivalents (FTEs) are required to participate in the RCP. In addition:
- regional development agencies are required to participate regardless of the number of FTEs in their organization
- agents of Parliament are accountable directly to Parliament and are therefore excluded from the RCP
Participating organizations will complete self-assessments in relevant areas of legislative, Treasury Board policy and operational applicability.
For example, organizations named in Schedule V of the FAA (that is, separate agencies) are not subject to the Treasury Board Policy on People Management, so would not need to complete self-assessments of compliance and performance in this area. Similarly, only organizations that are real property custodians would complete self-assessments in that RCP area of focus.
At the beginning of each RCP cycle, TBS will inform organizations which RCP areas of focus (or specific questions) they are required to respond to. Organizations may choose to participate in any area they are not required to self-assess.
List of participating organizations
- Administrative Tribunals Support Service of Canada
- Agriculture and Agri-Food Canada
- Atlantic Canada Opportunities Agency
- Canada Border Services Agency
- Canada Economic Development for Quebec Regions
- Canada Energy Regulator
- Canada Revenue Agency
- Canada School of Public Service
- Canadian Food Inspection Agency
- Canadian Grain Commission
- Canadian Heritage
- Canadian Human Rights Commission
- Canadian Institute of Health Research
- Canadian Northern Economic Development Agency
- Canadian Nuclear Safety Commission
- Canadian Radio-television and Telecommunications Commission
- Canadian Space Agency
- Canadian Security Intelligence Service
- Canadian Transportation Agency
- Communications Security Establishment Canada
- Correctional Service Canada
- Courts Administration Service
- Crown-Indigenous Relations and Northern Affairs Canada
- Employment and Social Development Canada
- Environment and Climate Change Canada
- Federal Economic Development Agency for Northern Ontario
- Federal Economic Development Agency for Southern Ontario
- Finance Canada
- Financial Consumer Agency of Canada
- Financial Transactions and Reports Analysis Centre of Canada
- Fisheries and Oceans Canada
- Global Affairs Canada
- Health Canada
- Housing, Infrastructure and Communities Canada
- Immigration and Refugee Board of Canada
- Immigration, Refugees and Citizenship Canada
- Impact Assessment Agency of Canada
- Indigenous Services Canada
- Innovation, Science and Economic Development Canada
- Justice Canada
- Library and Archives Canada
- National Defence
- National Film Board
- National Research Council Canada
- Natural Resources Canada
- Natural Sciences and Engineering Research Council of Canada
- Office of the Registrar of the Supreme Court of Canada
- Office of the Secretary to the Governor General
- Office of the Superintendent of Financial Institutions Canada
- Pacific Economic Development Agency of Canada
- Parks Canada
- Parole Board of Canada
- Prairies Economic Development of Canada
- Privy Council Office
- Public Health Agency of Canada
- Public Prosecution Service of Canada
- Public Safety Canada
- Public Service Commission of Canada
- Public Services and Procurement Canada
- Royal Canadian Mounted Police
- Shared Services Canada
- Statistics Canada
- Social Sciences and Humanities Research Council of Canada
- Transport Canada
- Transportation Safety Board of Canada
- Treasury Board of Canada Secretariat
- Veterans Affairs Canada
- Women and Gender Equality Canada
Annual review of assessed organizations
TBS will review the list of participating organizations on an annual basis and add or remove organizations based on the parameters for participating in the RCP, as appropriate.
For organizations whose FTE count fluctuates above or below 150 FTEs, participation in the next cycle of the RCP will be based on a five-year average of FTEs. Generally, the average will be calculated using data that organizations report in their Departmental Results Report or equivalent reporting mechanism.
TBS will consult with organizations in question before any changes are made with respect to their participation in the RCP.
Enquiries
For enquiries, contact the RCP team at RCP_PRC@tbs-sct.gc.ca.
Page details
- Date modified: