Yes. What we point out in the chapter is that not only is it important to establish criteria for determining the risks, and then having a risk-rating scale and doing it, but there has to be some form, as you say, of a challenge function.
Just to highlight that a little bit, if you had a good scale and maybe one individual in a department rating these different agreements, the risk is that if it gets rated on a Friday afternoon, it might not be as rigorous as if it were rated in the middle of the week. It's important within departments to have some form of challenge function to say, “Are we doing it well?”
We did see a variety of different scales. Some departments were certainly stronger than others. In fairness to the departments, though, it's important to note that there wasn't really a lot of guidance on what should be provided, in terms of a risk-rating scale. That's why we made the recommendation to the Treasury Board that this was an area where it should be providing guidance.