That could work well.
When we did it, we had somebody from the Ministry of Finance. We had to build the internal capability to look at risk differently, so we had them engaged, almost designated, on our team. We'd involve them right from the beginning around the inception of the solution. If it was the Privacy Commissioner, it meant various risk things, and we involved them from the beginning.
The other thing kind of connects with the two points here. It is that the governors—the MPs, the cabinet, Treasury Board—need to agree to what the outcomes are up front, and then allow the team to get there. They need to say, “Okay, here are the goalposts, and you have to come in between them. We empower you, as long as you stay between these two goalposts. Come back and tell us when it's done.” They won't have to go back and forth. You have very robust discussions up front about what the risks are, what the goalposts are that they're comfortable in. Then the team is delegated with all the right people to make it so, and then they come back and report how they're going to track that going forward. However, they don't have to come back. As long as they stay within the parameters that are agreed to up front, they're empowered to deliver.