The problem isn't unique to the Department of National Defence. This is a generalized problem in the Canadian government. The government doesn't like risk, and it avoids it at all costs. Why? When mistakes are made, as was the case with ArriveCAN, the entire system blows up. Then they say that we need more regulations, more procedures and more officials to oversee everything.
There's a culture in the Canadian government that leads people to avoid risk at all costs. As the general said, if you want to buy equipment quickly and have capabilities quickly, you have to accept a certain level of risk.
There's a notion that when you fail very quickly, you can fix things right away. That culture doesn't exist in the Canadian government, since they want to avoid risk at all costs, even if they're able to rectify the situation.