This is something that is part of an oversight system, but I think it's fair to say that in general the companies want to maintain their safety record. They have business losses and people losses and certainly reputation losses if they have even minor accidents, so this is something that the companies presumably have a strong interest in doing on their own. But even if they don't, they have a regulatory requirement, and this is something that Transport Canada oversees.
At the end of the day, however, the responsibility in the regulation is for the company to understand their business and understand what kinds of risks are being created by their specific type of business, the way they operate, and where they operate, and bring that into account. So it does seem reasonable that the company is best placed to do that risk assessment. Transport Canada looks at that risk assessment and asks whether it's adequate or effective, and whether sufficient mitigation steps are being taken.