The question of whether a board needs a dedicated risk committee represents one of the more consequential structural decisions in contemporary governance. Unlike audit committees, which legislation frequently mandates for certain organizations, risk committees remain largely optional under Canadian corporate and not-for-profit law. This discretionary nature makes the decision to establish one—or not—a genuine governance choice rather than a compliance exercise. The choice reflects how an organization understands its risk profile, the sophistication of its risk management practices, and the capacity of its full board to exercise meaningful oversight over threats and opportunities that could determine the organization's future.
Canadian legislation provides boards with considerable flexibility in organizing their committee structures. The Canada Not-for-profit Corporations Act, as of the date of authorship, requires certain corporations to have an audit committee but remains silent on risk committees, leaving their establishment to the discretion of the board through bylaws or board resolution. Provincial business corporations acts across British Columbia, Alberta, Saskatchewan, and Ontario similarly mandate audit committees for distributing corporations or public companies while treating risk oversight as a matter for board design rather than statutory prescription. Quebec's approach under the Civil Code of Quebec and the Quebec Business Corporations Act likewise emphasizes the board's general duty of prudence and diligence without specifying particular committee structures for risk oversight. This legislative silence should not be mistaken for indifference—legislators assume that competent boards will organize themselves appropriately for their circumstances, including determining whether dedicated risk committees add value or merely add bureaucracy.