Risk management in public sector research: approach and lessons learned at a national research organization

As the Canadian federal government's main research body and a public sector agency, the National Research Council (NRC) must manage numerous strategic as well as operational risks, including those at the project, program and portfolio levels. Such risks might arise from political and other stakeholder interests, intellectual property ownership and policy, funding structures, public perceptions of science and technology, occupational health and safety, management of highly qualified personnel, availability of receptor capacity for research being undertaken, and unknown markets for very new research areas, to name a few. Varying risk management practices have existed across NRC institutes and programs in the past as a result of the relative autonomy afforded to these groups. In seeking a more systematic approach, driven by both external and internal interests, NRC researched best practices, models and frameworks for risk management. NRC needed an appropriate model and approach for managing risk that could be applied throughout different levels and within the various arenas of its activities. The approach selected is based on the concept of enterprise risk management, allowing NRC to look not only at specific areas of risk but the larger picture – effectively assessing, controlling, exploiting and monitoring risks from all sources that might threaten the achievement of its goals. At the same time, such an approach also ensures that potential opportunities that could facilitate achievement of its goals are not missed. This paper shares some of NRC's findings of its research (including best practices), describes its current framework and approach, as well as some of its challenges.