2024–25 to 2026–27 Corporate Risk Profile - Impact Assessment Agency of Canada

July 2024

© His Majesty the King in Right of Canada, as represented by the Minister of Environment and Climate Change, 2024.

This publication may be reproduced for personal or internal use without permission, provided the source is fully acknowledged. However, multiple copy reproduction of this publication in whole or in part for purposes of redistribution requires the prior written permission from the Impact Assessment Agency of Canada, Ottawa, Ontario K1A 0H3, or information@iaac-aeic.gc.ca.

Catalogue Number: En104-31E-PDF

ISSN: 2818-3827

This document has been issued in French under the title: Profil de risque organisationnel de 2024-2025 à 2026-2027

On this page

• Glossary
• Introduction
• Context
  • Strategic Objectives and Expected Results
  • Operating Environment
• 2024–25 to 2026–27 Corporate Risk Summary
  • Risk Matrix
• Corporate Risk Profile
• Risk Monitoring and Reporting
• Conclusion
• Annexes
  • Annex 1: Approach and Methodology
  • Annex 2: Risk Taxonomy
  • Annex 3: Likelihood and Impact Scales
    • Likelihood Scales
    • Impact Scales

Glossary

Corporate Risk Profile (CRP)

A consolidated document providing a snapshot in time of risks facing the organization, used to communicate risk information and to inform planning.

Corporate Risk

An event that may have an effect of uncertainty on the achievement of organizational objectives.

Integrated Risk Management

A continuous, proactive, and systematic process to understand, manage, and communicate risk from an organization-wide perspective. It is about making strategic decisions that contribute to the achievement of an organization’s overall corporate objectives.

Risk Control

The means (i.e., process, policy, device, practice) by which an organization reduces the likelihood of a risk occurring or its impact.

Risk Driver

An internal or external condition that can contribute to or modify a risk.

Risk Impact

Assessment of the potential outcome of a risk event, either negative or positive.

Risk Likelihood

An assessment of probability or frequency of a risk materializing.

Risk Mitigation

The most common strategy to address risks; involves developing and implementing a specific course of action to decrease the likelihood and/or impact of risks.

Introduction

The Impact Assessment Agency of Canada (IAAC) operates in an environment that is in constant evolution and growth. As a result, managing risks requires a high degree of oversight, agility, and capacity. The core approaches, methodologies, and processes must reflect the risk environment and contribute to improved decision-making, better allocation of resources and, ultimately, better results for Canada.

As part of IAAC’s integrated Enterprise Risk Management (ERM) approach, the 2024–25 to 2026–27 Corporate Risk Profile (CRP) is a tool that provides an objective assessment of the current exposure to key risks that may affect the achievement of IAAC’s objectives and results.

Context

IAAC is a federal body that reports to the Minister of Environment and Climate Change. Under the Impact Assessment Act (IAA), IAAC is the lead federal organization responsible for conducting and administering environmental and impact assessments. In leading impact assessments, IAAC is responsible for assessing the positive and negative environmental, economic, social, and health effects of designated projects. IAAC is also the Crown Consultation Coordinator for Indigenous consultations on designated projects.

In 2023, following a reference case brought to the Supreme Court of Canada by the Province of Alberta, the Court found the Act was partially unconstitutional but affirmed the right of the Government of Canada to put in place impact assessment legislation and collaborate with the provinces on environmental protection. The Government announced that it would respect the Court’s opinion and work quickly and diligently on targeted and meaningful amendments to the IAA.

Beyond its legislative mandate and responsibilities, IAAC contributes to advancing various government-wide initiatives such as, but not limited to, the Government of Canada’s 2030 Emissions Reduction Plan, Net-Zero by 2050, Clean Canada, the United Nations Declaration on the Rights of Indigenous Peoples Act, Gender-based Analysis Plus, and Canada’s Climate Actions for a Healthy Environment and a Healthy Economy.

Strategic Objectives and Expected Results

The preamble in the IAA, which created IAAC, sets forth a list of strategic objectives that provide its legislative mandate. These objectives are condensed in its core responsibility (Impact Assessment) as follows:

“To foster sustainability, the Agency undertakes high-quality federal assessments of proposed projects based on scientific information and Indigenous Knowledge to assess health, social, economic, and environmental effects, and impacts on Indigenous Peoples and rights. These assessments inform government decisions on whether proposed projects are in the public interest. The Agency conducts compliance and enforcement activities to ensure proponents adhere to the legislation, including the conditions in decision statements.”

By delivering this core responsibility IAAC intends to achieve four departmental results on which IAAC reports publicly, on an annual basis, through its Departmental Plans and Departmental Results Reports to parliamentarians and Canadians:

The risks identified in this CRP will be monitored, and updated as needed, to reflect any major changes in the operating environment. Strategies to mitigate risk exposure outside of IAAC’s tolerance will be pertinent to the achievement of departmental results.

Text version

These block list diagrams represent visually the Departmental Results Framework, in one, and the Program Inventory of record for 2024–25. The Departmental Results Framework consists of IAAC’s Core Responsibility: Impact Assessment, and four departmental results, each of which have at least one indicator so that progress can be measured and monitored. The first Departmental Result is Designated projects that proceed foster sustainability. The indicator measuring it is the Percentage of projects for which reporting indicates that the vast majority of mitigation measures set out in the Decision Statement effectively address adverse effects of the project. The second Departmental Result is Stakeholders and Indigenous groups meaningfully participate in the assessment process. The indicator measuring it is the Percentage of stakeholders and Indigenous groups participating in assessment-related engagement / consultation activities who agree they were engaged meaningfully in the assessment process. The third Departmental Result is Scientific and evidence-based information, and Indigenous Knowledge on key health, social, economic, and environmental effects are available to inform project assessment processes, including impact assessment reports, decisions and conditions. The indicator measuring it is the Percentage of stakeholders and Indigenous groups who agree that scientific and evidence-based information and Indigenous Knowledge on key health, social, economic, and environmental effects are accessible. The last Departmental Result is Impact assessment processes respect the rights and culture of Indigenous Peoples, and Canada’s commitment to partner with them. The indicator measuring it is the Percentage of Indigenous groups who agree they have a productive and collaborative relationship with IAAC. The Core Responsibility and all three departmental results are supported by IAAC’s Internal Services.

The Program Inventory of record for 2024–25 consists of two programs: Assessment Administration, Conduct, and Monitoring and Indigenous Relations and Engagement.

Operating Environment

IAAC operates in an increasingly complex environment as a result of the rapid evolution of many internal and external drivers, notably, a rapidly changing global economic landscape and other geo-political events, increasing demands and expectations for projects, and the accelerating global race to build net-zero economies and the industries of tomorrow. This in turn has required IAAC to be agile in the way it operates to respond to evolving challenges and changing circumstances.

Since 2019, when the IAA came into effect, IAAC has continually faced many pressures (foreseen and unforeseen) that have shifted the operational realities and culture that were once the foundation of the organization. Externally driven pressures continue to challenge the scope of IAAC’s mandate, while internal workforce challenges are creating new constraints to effectively respond to the need for surge capacity in an agile manner.

IAAC continues to face new pressures arising from government-wide policy and commitments, ongoing litigation, evolving expectations and complexity of projects, and the ongoing commitment to establish and maintain effective partnerships with Indigenous Peoples, federal partners, provinces, and territories. Related to this, IAAC is supporting the Minister in responding to the October 2023 opinion of the Supreme Court of Canada by developing legislative amendments that will enable IAAC to conduct thorough, timely, and high-quality assessments within federal jurisdiction. Until these amendments are in place, IAAC will continue to advance assessments collaboratively in accordance with the Statement on the Interim Administration of the Impact Assessment Act Pending Legislative Amendments.

IAAC also supports the efforts of the Ministerial Working Group on Regulatory Efficiency for Clean Growth Projects, which was established to address the Budget 2023 commitment to improve the efficiency of the impact assessment process and permitting processes for major projects. This includes collaborating with other federal departments to enhance regulatory coordination federally and with other jurisdictions, clarify and reduce timelines, and mitigate inefficiencies in the regulatory system.

Budget 2024 reinforced the need for significant and sustained private sector investment in clean electricity, critical minerals, and other major projects to put Canada on a path to net zero. In addition to several measures to help drive clean growth and reduce regulatory timelines for major projects, the Government of Canada recognizes the immediate need for regulatory certainty around impact assessments of major projects.

Given the nature of IAAC’s work, there is a strong relationship with global and domestic economic performance. This impacts IAAC’s operations, including the number of designated projects and the ability of Indigenous Peoples and stakeholders to participate in IAA-related processes. Internally, IAAC is continuing to face various unexpected pressures from an increasingly competitive skilled labour market to adjusting to the culture of a hybrid work environment.

At the core of the IAA, consultation and engagement with Indigenous Peoples is fundamental. It is only through these actions that it is possible to capture perspectives, identify issues, assess impacts, and follow-up to evaluate the effectiveness of mitigation measures. As such, IAAC is continually focusing efforts to build innovative, transparent, and effective consultation and engagement mechanisms; while respecting the rights and cultures of Indigenous Peoples and Canada’s commitment to continuing to strengthen relationships.

The following table highlights some of the major and systemic risk drivers that have significantly influenced or contributed to the occurrence and/or severity of the corporate risks identified in this CRP:

As such, IAAC is proactively adopting an integrated approach to its risk management practices to ensure existing and emerging risks are effectively managed, understood, and embedded into how the organization works towards achieving common goals and identifying priorities.

2024–25 to 2026–27 Corporate Risk Summary

The following table provides a summary of the top five risks to IAAC achieving its objectives, as of April 2024.

Risk Matrix

A first risk assessment workshop was held on July 12, 2023 during which, Senior Management identified the likelihood of a risk occurring and the impact if it did. On November 8, 2023, following the Supreme Court of Canada opinion on the IAA reference case, IAAC updated the legal and strategic risks (denoted 1 and 2) and performed a risk assessment refresh. The result of which is illustrated in the matrix below.^Footnote 1

Text version

This matrix chart represents the assessment by IAAC’s senior management of the likelihood of a risk being realized and the impact this would have on IAAC’s work if the risk were to happen. On the vertical axis, likelihood is divided into five categories from bottom to top: Exceptionally unlikely, unlikely, possible, likely, and almost certain. On the horizontal axis, the impacts are also divided into five categories from left to right: low, low to moderate, moderate, moderate to high, and high impacts. The matrix is divided into three regions representing the overall risk level of each risk, based where the likelihood and impact ratings intersect. From the chart’s origin point to the diagonal line, a green colored triangle is formed to identify lower-level risks. A risk in this area means that IAAC accepts the risk and will monitor it. The only lower-level risk identified in this area is Risk 4: Information Management and Information Technology Security and Management. A diagonal section from the top left to the bottom right of the matrix is colored yellow to signify medium-level risks that IAAC will manage and monitor. The medium-level risks include Risk 3: Retaining a skilled, capable, agile, and diverse workforce and Risk 5: Cost recovery and uncertain financial framework are in this region. Above the yellow diagonal is an area shaded in red. A risk in this area is a higher-level risk that IAAC will respond to and implement measures to mitigate against it. Two risks fall in this area. These are Risk 1: Delivery of Essential functions and Risk 2: Maintaining Public Trust and Engagement.

Corporate Risk Profile

Theme 1: Legal

Risk 1: Delivery of Essential Functions

Risk 1 - Text version

This matrix chart represents the assessment by IAAC’s senior management of the likelihood of a risk being realized and the impact this would have on IAAC’s work if the risk were to happen. On the vertical axis, likelihood is divided into five categories from bottom to top: Exceptionally unlikely, unlikely, possible, likely, and almost certain. On the horizontal axis, the impacts are also divided into five categories from left to right: low, low to moderate, moderate, moderate to high, and high impacts. The matrix is divided into three regions representing the overall risk level of each risk, based where the likelihood and impact ratings intersect. A diagonal section from the top left to the bottom right of the matrix is colored yellow to signify medium-level risks that IAAC will manage and monitor. Above the yellow diagonal is a region shaded in red for the higher-level risks where Risk 1 is shown. A risk in that region means that IAAC will respond and mitigate it.

Risk Statement: There is a risk that IAAC may not be able to carry out its essential functions in a timely, sustainable and effective manner.

Risk Champion or Office of Primary Interest:
Vice-President, Operations

Risk Support or Office of Secondary Interest:
Vice-President, Corporate Services and Chief Financial Officer
Vice-President, Indigenous Relations
Vice-President, Strategic Policy and Programs

Key Risk Drivers

Current Controls

The following key controls have been implemented to manage the risk:

• Developing and implementing new policy instruments to improve efficiencies across the impact assessment process, including planning and post-assessment activities
• Providing funding to support Indigenous capacity to maximize leadership in assessments
• Using a horizontal and risk-based governance structure (i.e., Assistant Deputy Minister Impact Assessment and Deputy Minister Impact Assessment Committees)
• Implementing a five-year financial planning and budget cycle
• Implementing cost recovery and flexible collection mechanisms to offset costs
• Using various resource management applications, such as the Assessment Management System (AMS) to track projects and report on statutory requirements and time tracking for human resource planning
• Proactively implementing new methods and approaches to reduce barriers to engaging with proponents and stakeholders to understand their issues and concerns with IAAC’s processes, and taking these into account when managing projects
• Establishing Memoranda of Understanding and bilateral cooperation instruments to harmonize the assessment process with various partner organizations, provinces, and territories
• Coordinating the Canadian Impact Assessment Registry (Registry), while publishing project records and managing its online public engagement feature and web-mapping interface, which enables users to explore, visualize, and analyze assessment data for greater transparency, navigation, and accessibility
• Leveraging digital/virtual abilities, when and where possible, including digitized human resource forms
• Implementing a Grants and Contributions center of excellence that monitors financial compliance, support funding initiatives and explores efficiencies and options to optimize program delivery

Potential Impacts

If the risk was realized, IAAC may experience the following impacts:

• Unclear mandate and authority to start new impact assessments or continue existing impact assessments under IAA
• Increased and ongoing litigation efforts and pressures hindering the Agencies capacity and the ability to fulfill essential functions and achieve strategic objectives
• Inability to meet other statutory requirements (i.e., Modern Treaties, The Canada–United States–Mexico Agreement (CUSMA) Environment Chapter), policies, regulations, and commitments (i.e., Indigenous Reconciliation Framework, Call for Justice for Missing and Murdered Indigenous Women and Girls)
• Loss of stakeholder and partner trust, engagement and collaboration, including but not limited to provinces and territories, federal departments and agencies, industry, the public, proponents and other key national and international partners
• Inability to produce and approve impact assessments in a timely manner, which may affect national/regional economic health
• Adverse changes to the environment and to health, social, or economic conditions
• Failure to adequately engage and consult with Indigenous Peoples and the public

Risk Assessment

Risk Response

Based on the assessment and existing controls in place, management considers this risk to be unacceptable and will mitigate it in the coming year.

Action Plan & Owners

Theme 2: Strategies and reputation

Risk 2: Maintaining public trust and engagement

Risk 2 - Text version

This matrix chart represents the assessment by IAAC’s senior management of the likelihood of a risk being realized and the impact this would have on IAAC’s work if the risk were to happen. On the vertical axis, likelihood is divided into five categories from bottom to top: Exceptionally unlikely, unlikely, possible, likely, and almost certain. On the horizontal axis, the impacts are also divided into five categories from left to right: low, low to moderate, moderate, moderate to high, and high impacts. The matrix is divided into three regions representing the overall risk level of each risk, based where the likelihood and impact ratings intersect. A diagonal section from the top left to the bottom right of the matrix is colored yellow to signify medium-level risks that IAAC will manage and monitor. Above the yellow diagonal is a region shaded in red for the higher-level risks where Risk 2 is shown. A risk in that region means that IAAC will respond and mitigate it.

Risk Statement: There is a risk that IAAC may not be able to maintain public and partner trust and engagement in the delivery of the federal impact assessment regime.

Risk Champion or Office of Primary Interest:
Vice-President, Strategic Policy and Programs

Risk Support or Office of Secondary Interest:
Vice President, Corporate Services and Chief Financial Officer
Vice-President, Indigenous Relations Vice-President, Operations

Key Risk Drivers

Current Controls

The following key controls have been implemented to manage the risk:

• Established co-development processes for the framework for Indigenous cooperation agreements, including regulations
• Increased partnership, engagement, and collaboration with Indigenous groups including designing new mechanisms to enhance engagement and relationship-building
• Increased proactive engagement and collaboration with federal partners, other levels of government, communities, and stakeholders
• Implementation of open and transparent communication channels for internal and external access and use (i.e., the Registry)
• Establishment and maintenance of robust tools (i.e., AMS), processes and mechanisms to support the impact assessment cycle, engagement and proactive consultation with stakeholders

Potential Impacts

If the risk was realized, IAAC may experience the following impacts:

• Failure to deliver IAAC’s strategic objectives and priorities and the achievement of broader Government of Canada and international obligations and commitments
• Loss of credibility with IAAC stakeholders and partners, such as Indigenous groups, federal departments and agencies, provinces and territories, industry, the public, proponents, and other national and international partners
• Inability to meet the Government of Canada’s commitment to reconciliation
• Increased barriers to interdepartmental collaboration and co-development efforts

Risk Assessment

Risk Response

Based on the assessment and existing controls in place, management considers this risk to be unacceptable and will mitigate it in the coming year.

Action Plan & Owners

Theme 3: Operations

Risk 3: Retaining a skilled, capable, agile and diverse workforce

Risk 3 -Text version

This matrix chart represents the assessment by IAAC’s senior management of the likelihood of a risk being realized and the impact this would have on IAAC’s work if the risk were to happen. On the vertical axis, likelihood is divided into five categories from bottom to top: Exceptionally unlikely, unlikely, possible, likely, and almost certain. On the horizontal axis, the impacts are also divided into five categories from left to right: low, low to moderate, moderate, moderate to high, and high impacts. The matrix is divided into three regions representing the overall risk level of each risk, based where the likelihood and impact ratings intersect. A diagonal section from the top left to the bottom right of the matrix is colored yellow to signify medium-level risks that IAAC will manage and monitor. Risk 3 is shown in this region.

Risk Statement: There is a risk that IAAC will be unable to attract, hire, and retain an appropriately skilled, capable, agile and diverse workforce to deliver on its mandate and priorities.

Risk Champion or Office of Primary Interest:
Vice-President, Corporate Services and Chief Financial Officer

Risk Support or Office of Secondary Interest:
Vice-President, Indigenous Relations
Vice-President, Operations
Vice-President, Strategic Policy and Programs

Key Risk Drivers

Current Controls

The following key controls have been implemented to manage the risk:

• Enhancement of the overall talent management approach, leveraged IAAC recognition program and increased IAAC presence, both online and in-person, at recruitment events
• Establishment of an Equity Diversity and Inclusion Action Plan, Accessibility Plan, and draft Reconciliation Framework
• Application of a new hybrid work model and supporting policies to meet IAAC needs, while ensuring alignment with TBS requirements
• Establishment of governing committees to oversee and advise on matters related to ethics, value, health and safety, diversity, equity, inclusion and accessibility
• Development, implementation, and ongoing maintenance of mechanisms that effectively promote a diverse, equitable and inclusive workforce
• Implementation and maintenance of human resources policies, directives and guidelines to ensure standard, fair, and equitable processes are being applied across all staffing activities
• Signing of a three-year service-level agreement with the Accessibility, Accommodations and Adaptive Computer Technology program to enhance the accessibility of digital content for all employees
• Development of a succession planning strategy for similar jobs across IAAC
• Increased use of targeted and strategic recruitment activities for IAAC positions
• Exploration of new technologies, including automation solutions, to increase the efficiency of staffing processes and operational capabilities

Potential Impacts

If the risk was realized, IAAC may experience the following impacts:

• Inability to deliver on IAAC’s requirements as a result of loss/hindered capacity
• High turnover and loss of skilled personnel and corporate knowledge
• Decline in employee morale due to increasing workload, hindering work-life balance
• Failure to establish a diverse, equitable, inclusive, and accessible workforce

Risk Assessment

Risk Response

Based on the assessment and existing controls in place, management considers this risk to be unacceptable and will manage and monitor it in the coming year.

Action Plan & Owners

Risk 4: Information Management and Information Technology Security and Management

Risk 4 -Text version

This matrix chart represents the assessment by IAAC’s senior management of the likelihood of a risk being realized and the impact this would have on IAAC’s work if the risk were to happen. On the vertical axis, likelihood is divided into five categories from bottom to top: Exceptionally unlikely, unlikely, possible, likely, and almost certain. On the horizontal axis, the impacts are also divided into five categories from left to right: low, low to moderate, moderate, moderate to high, and high impacts. The matrix is divided into three regions representing the overall risk level of each risk, based where the likelihood and impact ratings intersect. A diagonal section from the top left to the bottom right of the matrix is colored yellow. From the chart’s origin point to the diagonal, the region forms a green colored triangle for the lower-level risks where Risk 4 is shown. IAAC will respond to it by accepting the risk and monitoring it.

Risk Statement: There is a risk that IAAC will not have the appropriate mechanisms and measures in place to maintain the confidentiality, availability, and integrity of data and information.

Risk Champion or Office of Primary Interest:
Vice-President, Corporate Services and Chief Financial Officer

Risk Support or Office of Secondary Interest:
Not Applicable

Key Risk Drivers

Current Controls

The following key controls have been implemented to manage the risk:

• Engagement with Environment and Climate Change Canada (ECCC) and Shared Services Canada for monitoring and logging, firewalls, data encryption, regular data backups as well as Intrusion Detection and Prevention Systems (IDPS)
• Development of, and updates to, policies and guidelines regarding business continuity and disaster recovery, security incident reporting and escalation, and data classification and handling
• Engagement with ECCC’s IT enabling services and facilities to seek access to Government of Canada’s Secret Infrastructure (GCSI) for sensitive information
• Implementation and maintenance of information management and information technology systems for access control, secure remote access, patch management, secure email, and messaging and data encryption
• Implementation and maintenance of practices for secure software development, application security testing, identity and access management (IAM), data disposal and destruction, security audits and assessments, vendor security management, mobile device management (MDM)
• Ongoing maintenance and delivery of training on information management and information technology, including cyber security awareness training
• Increased internal capacity related to cyber security

Potential Impacts

If the risk was realized, IAAC may experience the following impacts:

• Exposure or loss of sensitive and/or secret information and potential impacts to markets
• Stakeholders lack of trust in IAAC’s ability to handle sensitive information, which could damage IAAC’s reputation and relationships
• Inability to comply with applicable laws, policies, and regulations with regard to the privacy of information and confidentiality, which could lead to legal actions and reputational damage
• Disruption of normal operations as systems may need to be shut down, investigated, and restored. This can lead to downtime, decreased productivity, financial and operational losses and/or delay, and increased costs for recovery

Risk Assessment

Risk Response

Based on the assessment and existing controls in place, management considers this risk to be acceptable and will monitor it in the coming year.

Action Plan & Owners

Risk 5: Cost recovery and uncertain financial framework

Risk 5 -Text version

This matrix chart represents the assessment by IAAC’s senior management of the likelihood of a risk being realized and the impact this would have on IAAC’s work if the risk were to happen. On the vertical axis, likelihood is divided into five categories from bottom to top: Exceptionally unlikely, unlikely, possible, likely, and almost certain. On the horizontal axis, the impacts are also divided into five categories from left to right: low, low to moderate, moderate, moderate to high, and high impacts. The matrix is divided into three regions representing the overall risk level of each risk, based where the likelihood and impact ratings intersect. A diagonal section from the top left to the bottom right of the matrix is colored yellow to signify medium-level risks that IAAC will manage and monitor. Risk 5: Cost recovery and uncertain financial framework is in this region.

Risk Statement: There is a risk that IAAC will be unable to adequately fund IAAC activities and surge capacity requirements in a sustainable and effective manner.

Risk Champion or Office of Primary Interest:
Vice-President, Corporate Services and Chief Financial Officer

Risk Support or Office of Secondary Interest:
Vice-President, Strategic Policy and Programs

Key Risk Drivers

Current Controls

The following key controls have been implemented to manage the risk:

• Continuous and proactive engagement with central agencies to ensure the status and capabilities of IAAC are communicated and well understood across all parties
• Implementation and maintenance of a sound financial management control system to reduce risks in organizational processes, such as financial planning, budgeting and reporting
• Ongoing maintenance of strategic relationships with key central agencies, federal and provincial partners, Indigenous groups, and the public

Potential Impacts

If the risk was realized, IAAC may experience the following impacts:

• Inability to proactively plan and effectively deliver on all programs, projects, and commitments of IAAC
• Inability to remain within the cost recovery levels agreed upon with central agencies
• Operational delays and increased pressure on existing human capital

Risk Assessment

Risk Response

Based on the assessment and existing controls in place, management considers this risk to be unacceptable and will mitigate it in the coming year.

Action Plan & Owners

Risk Monitoring and Reporting

The risks (including risk drivers) identified in this CRP will be monitored on an annual basis, and the CRP updated as necessary, to ensure all enterprise risks maintain relevance and reflect the changes in IAAC’s operating environment and organizational objectives on a year-to-year basis.

Conclusion

IAAC’s 2024–25 to 2026–27 CRP provides an Agency-wide overview of risks to inform effective risk-based decision-making and planning across IAAC. The risks identified in this document represent the greatest potential barriers to the realization of IAAC’s mandate and its ability to fulfill its core responsibilities and priorities from 2024–25 to 2026–27. These risks were reviewed and approved by IAAC’s senior management in March 2024.

Monitoring of IAAC’s enterprise risk management activities helps to maintain a clear, up-to-date understanding of key corporate risks and their status. Potential emerging risks that require senior management attention should be escalated, as and when necessary. Ongoing senior management engagement, together with an inclusive and rigorous methodology, as identified in this CRP, will result in a focused and principled approach, sending clear signals of the importance of risk management within IAAC.

To ensure clearer accountability and action in response to each risk, the 2024–25 to 2026–27 CRP has identified an office of primary interest to provide oversight and management of each risk and report annually on the status and effectiveness of each associated mitigation action.

Annexes

Annex 1: Approach and Methodology

The CRP was developed using the approach and methodology:

1. Environmental Scan: To commence the development of the Corporate Risk Profile, an environmental scan was conducted to obtain an in-depth understanding of the current context and environment by which IAAC operates. Considering the various drivers (internal and external) and business conditions, IAAC’s risk register and subsequent drivers and impacts was updated.
2. Risk Identification & Analysis: Leveraging the risk register and risk taxonomy (see Annex 2), a working session with IAAC’s operational management team was facilitated to openly discuss and brainstorm enterprise-level risks. The scope of the conversation focused solely on risks that may impact the achievement of IAAC’s objectives and priorities. Identified risks [including potential causes (drivers) and impacts] were validated, clearly documented, and grouped into categories. After validation and discussion, the risks were finalized through additional conversations with the Senior Leadership team, focusing on the most critical ones, which then became the basis for the subsequent risk assessment and mitigation planning, fostering a proactive approach to risk management.
3. Risk Assessment: The list of enterprise risks was then assessed by the Senior Leadership team, based the likelihood and impact scales (see Annex 3). Based on the overarching risk exposure score, risks were then ranked and prioritized (highest score = highest risk exposure level). Methodology for calculating likelihood, impact and risk exposure is defined below.
   1. Average Likelihood Score = Sum of Likelihood Scores / Number of Voters
   2. Average Impact Score = Sum of Likelihood Scores / Number of Voters
   3. Risk Exposure = Average Impact Score * Average Likelihood Score
4. Risk Mitigation and Control: Controls (mitigation mechanisms currently in place to reduce risk) were highlighted across each risk profile. In any cases where risks exceed IAAC’s tolerance thresholds, specific actions may be identified.
5. Risk Communication: Comprehensive documentation was maintained throughout the process and was leveraged to develop the CRP. The CRP captures the strategic and corporate risks and associated risk drivers within the organization, along with the consequence of these risks, an assessment of risk exposure, mitigation activities and accountabilities.

Annex 2: Risk Taxonomy

The following table describes a standard and stable set of risk categories to facilitate risk identification exercises.

Annex 3: Likelihood and Impact Scales

Risk is the possibility of an event occurring (positive or negative) that will have an impact on the achievement of objectives. It is the expression of the likelihood and impact of an event with the potential to affect the achievement of the organization’s objectives. The tables below outline the criteria and scales for assessing both the likelihood of an event occurring as well as the potential impact on the organization, should the event occur.

Likelihood Scales

Impact Scales