Risk-based management approach

Institutions are encouraged to consider a risk-based approach when developing and managing their portfolio of CFI-funded projects. Using a risk-based…

Institutions are encouraged to consider a risk-based approach when developing and managing their portfolio of CFI-funded projects. Using a risk-based approach can help to improve decision-making and lead to a more effective and efficient management and oversight framework, as well as optimal use of institutional resources.

Some of the risk-based practices implemented by institutions include:

  • Considering and documenting project-related risks: Project-related risks are considered at an early stage, often at the proposal development and internal review stages. The internal vetting process ensures that project risks that may hinder success have been identified (e.g. potential for significant delays and cost escalations or insufficient capital and operating funds) and that mitigating measures, including any oversight activities, have also been discussed.

    Some institutions have a formal process in place for documenting risks and any required actions (e.g. in a registry), and for making this information available to key stakeholders (e.g. to internal review and selection committees and oversight committees).
  • Tailoring the nature and extent of oversight practices: Many institutions tailor their monitoring and oversight activities to the complexity and scale of each project, and to the nature of project transactions. For example, additional oversight committees are put in place to carefully monitor large initiatives to ensure that budgets, timelines or other significant risks are properly managed. Another example is the high level of scrutiny often in place to review and monitor in-kind contributions, which may represent significant matching funds and as such be considered a higher risk area for institutions. Eligibility of expenditures is another area where some institutions have adopted a risk-based approach and tailored their review procedures to the risk at the transaction level. By reducing the extent of oversight in lower risk areas and focusing efforts in areas of greater risk and importance, institutions may benefit from a more effective and efficient management framework and use of resources.
  • Ongoing monitoring: Project-related risks are monitored throughout the project’s lifecycle. The various oversight activities allow the institution to reassess risks and ensure that mitigating measures in place are still appropriate and commensurate with the level of risk. In the case of multi-institutional projects, some institutions include clauses in the inter-institutional agreements to mitigate risks and provide recourse.

    Also, a review of the overall approach to manage its portfolio of CFI-funded projects allows the institution to reassess institutional risks and identify opportunities for increased efficiencies, and possibly find ways to reduce some of the administrative burden.

Here’s how some institutions have implemented these practices.

University of Victoria

During the proposal development stage, a risk assessment is created for each project at the University of Victoria. The risk assessment is updated throughout the life cycle of the project and included in any requests for university approval to submit proposals, finalization forms, amendment requests, etc. All projects initiated in recent years have a risk assessment on file that highlights key risk areas and the mitigation measures in place to address each risk. During project implementation, control and monitoring of project expenditures is completed by the Office of Research Services at the time of procurement. Ongoing support for projects is also provided by members of the Research Services Operations Advisory Group.


Jill Taylor
Manager, Institutional Programs
Office of Research Services
Telephone: 250 853-3847
Email: cfimanager [at]

University of Ottawa

The university has put in place general procedures to minimize risk on its portfolio of CFI-funded projects. It has invested time and effort to implement measures to identify, prevent and monitor significant risks. The nature and extent of the university’s oversight activities are tailored to the risks of each project. For example, various meetings are held by the Strategic Project Management Group to review and monitor project status and major milestones, paying particular attention to projects that have been previously identified as higher risk projects. Steering committees are put in place and project managers are assigned to manage larger and more complex projects. For example, in the case of the Advanced Research Complex (ARC), an enhanced oversight structure was put in place to monitor the project, namely the ARC Steering Committee, which reported directly to the university’s administration committee. The risk management office was also involved in the oversight of this project.

The university reviews its processes and practices regularly to ensure that they continue to be appropriate and commensurate with the level of risk.


Brigit Viens
Director, Office of Strategic Development Initiatives
Research Services
Telephone: 613 562-5800 ext. 3405
Email: bviens [at]


Related topics

Tailoring your proposal development and review process
Oversight for expenditure eligibility and infrastructure changes
Timely project implementation
Additional oversight for large or complex projects