Effective Date: January 29, 2026
1. Policy Statement
The Canadian Bar Association (CBA) is committed to sound risk management practices to safeguard the Association’s ability to fulfill its mandate, serve its members, protect its reputation, and ensure its sustainability. This policy provides a structured approach to identifying, assessing, and managing risks that could impact the CBA’s strategic objectives, operations, financial stability, reputation, and legal compliance.
2. Definitions
Risk: The effect of uncertainty on the achievement of the CBA’s strategic and operational goals. This effect may be positive (opportunity) or negative (threat).
Enterprise Risk Management (ERM): A systematic, organization-wide approach to identifying, assessing, managing, and monitoring risks that could impact the CBA’s ability to achieve its objectives.
Risk Appetite Statement: a statement that identifies and states how much risk is acceptable to the CBA for each category as it pursues its objectives. In the case of CBA, it has an overall appetite of “low”, with a cautious appetite in those areas that support operations, advocacy and member services, but with a very minimal level of tolerance for risks that could impact financial stability, legal compliance or reputation.
3. Purpose
CBA recognizes that risk management is an essential component of good governance and operational excellence. This policy ensures that its ERM is integrated into all aspects of the Association’s activities, including strategic planning, financial management, program delivery, and advocacy.
4. Scope
This policy applies to Board and Committee members and all executives, employees, staff, and volunteers.
5. Roles and Responsibilities
Board Of Directors
Oversees the implementation and oversight of the risk management process including:
- Ensures alignment with the CBA’s strategic plan.
- Reviews and approves risk management policies and procedures including its Risk Appetite Statement.
Audit and Risk Committee
- Reviews and recommends risk management policies and procedures including its Risk Appetite Statement to the Board for approval.
- Reviews the risk register periodically.
- Reviews significant risks and mitigation strategies
- Reports to the Board periodically, but at least annually, on the management of those risks for which oversight has been delegated by the Board to the Audit and Risk Committee pursuant to the ERM program.
Chief Executive Officer (CEO)
- Responsible for the implementation of the ERM Framework.
- Identifies, evaluates, and manages risks related to strategic initiatives, operations, and financial management.
- Ensures emerging risks are brought to the Committee’s attention.
- Ensures all claims and incidents are reported promptly and escalated in accordance with this policy.
Chief Financial Officer (CFO)
- Develops and maintains the ERM framework and ensures ongoing compliance throughout the organization.
- Advises on risk assessment methodologies and mitigation strategies.
- Maintain a centralized risk register documenting identified risks, ratings, mitigation strategies and monitoring actions.
- Ensures compliance with financial and operational risk policies and manages insurance programs.
- Receives and manages claims and incident reports and ensures periodic reporting to the Audit and Risk Committee and Board.
Senior Management Team
- Monitor and manage risk in their respective areas of responsibility.
- Report emerging risks and incidents to the CEO or CFO.
CBA Staff & Volunteers
- Adhere to risk management protocols.
- Report potential risks or incidents to the CEO or CFO.
6. Risk Management Framework
The CBA adopts an ERM framework that sets out:
- Risk Identification: Systematic assessment of potential risks across all areas of the organization.
- Risk Evaluation: Analysis of the likelihood, impact, and mitigation measures.
- Risk Appetite: Statement outlining the amount and type of risk that the CBA is willing to take in order to meet its objectives.
- Risk Mitigation: Strategies to avoid, reduce, transfer, or accept risks; Risk mitigation thresholds must align with the Financial Signing Authority Policy to ensure proportional financial oversight.
- Monitoring & Reporting: Review of risks and updates to its risk register should take place at least annually.
7. Risk Assessment Process
The ERM process is integrated with the CBA’s strategic planning cycle. The CEO and CFO conduct a periodic risk assessment to identify key enterprise risks and report findings to the Audit and Risk Committee of the Board.
8. Risk Financing & Insurance
To protect against potential liabilities and financial losses, the CBA shall: maintain adequate insurance coverage for risk areas including financial, strategic, and operational risks; require proof of insurance from third parties; and establish financial reserves for unforeseen risks.
9. Contractual Risk Management
All contracts above the Director-level approval threshold defined in the Financial Signing Authority Policy must be reviewed by the CFO or CEO, who may seek external legal advice when necessary. High-value or high-risk contracts require special scrutiny.
10. Claims & Incident Reporting
Potential legal claims, regulatory proceedings, or financial exposures must be reported immediately to the CEO and CFO.
11. Review & Continuous Improvement
This policy will be reviewed at least annually, or sooner if needed due to regulatory or operational changes or if deemed necessary by the Board of Directors.
12. Contact Information
For inquiries related to this policy, contact the CEO or CFO.
13. Related Policies & References
Principles of Conduct, Financial Signing Authority Policy, Operating and Capital Reserves Policy, CBA Governance Framework, Transparency, Conflict and Anti-Corruption Policy, Whistleblower Policy.