Information Advisory CER IA 2026-001 – 2025-2026 Canada Energy Regulator – Management System Audits

Information Advisory CER IA 2026-001 – 2025-2026 Canada Energy Regulator – Management System Audits [PDF 678 KB]

File 6362510
24 August 2026

Please find attached the Canada Energy Regulator (CER) Information Advisory (IA) CER IA 2026-001 that summarizes the findings of six management system audits conducted by the CER during 2025-2026. The audits evaluated regulated companies’ compliance with the Canadian Energy Regulator Onshore Pipeline Regulations (SOR/99-294) with a focus on the following areas:

• emergency management; and
• facility integrity management.

The CER is sharing these findings to support continual improvement across all regulated companies. CER-regulated companies are expected to proactively identify, assess, and manage hazards and risks to prevent harm to people, property, and the environment. We encourage all companies to review their management systems in light of the issues identified in this advisory and take any necessary corrective actions.

The CER will incorporate these learnings into future compliance and oversight activities, including audits.

If you have any questions or require further clarification, please contact the CER through our toll-free number at 1-800-899-1265.

Information advisories are published on the CER website.

Best regards,

Signed by

Chris Loewen
Executive Vice President, Regulatory

Information Advisory
CER IA 2026-001
24 August 2026

Canada Energy Regulator – 2025-2026 Management System Audits

Introduction

Every year, the Canada Energy Regulator (CER) conducts management system audits on the companies we regulate. We share the results publicly to promote learning and continual improvement. Last year, the CER completed six management system audits: three on emergency management and three on facility integrity management. Each audit assessed a different company.

A management system is an inter-related set of instructions that organizations use to help achieve their goals. The Canadian Energy Regulator Onshore Pipeline Regulations (SOR/99-294) (OPR) outline the specific management system requirements that regulated companies must meet, to support the goals of protecting people, property, and the environment. The OPR requires a company’s management system be applied to the following programs:

• emergency management;
• integrity management;
• safety management;
• security management;
• environmental protection; and
• damage prevention.

While the results of the emergency management audits were strong overall, CER auditors identified several non-compliances. Auditors found there was a lack of distinction between hazard identification and risk assessment, as well as undocumented communication processes. Some contingency plan processes were only recently approved for use by the company's senior management and therefore did not meet the CER's three-month time requirement for fully established and implemented processes. Document control also needed to be improved.

Some findings from the 2025-2026 emergency management audits, such as document management deficiencies, were consistent with those identified in the 2024-2025 emergency management audits, while others differed. For example, previous audits identified gaps in the comprehensiveness of hazard identification and hazard inventories, while this year’s audit found that hazards and risks were not clearly distinguished. These findings reinforce the value of companies reviewing information advisories and applying lessons learned to strengthen their own management systems.

The CER also audited the integrity of facilities and identified non-compliances such as incomplete coverage (e.g., deactivated facilities), gaps in hazard and risk processes, controls that were too vague to implement, weak links between inspection and monitoring results and corrective action learning, and inconsistent change management. This was the first time that the CER audited companies in this aspect of pipeline integrity management.

Emergency management audits

Auditing emergency management programs is one of several oversight activities the CER uses to assess a company’s readiness to respond effectively if there is an emergency.

This is the second year that the CER has audited this topic and two of the three companies performed very well, with one company achieving a score of 100 percent.

Below are some of the non-compliances the CER’s auditors observed.

• Hazards and risks were used interchangeably. As a result, the company assessed risk before properly identifying hazards. Hazards and risks have different meanings and different requirements under the OPR. This non-compliance is compounded because the same company had a similar finding in a previous audit.
• The process for communication was not documented. While companies carried out activities to communicate to internal and external audiences, some companies lacked the documented processes to support those activities. Instead, the companies appeared to rely on the knowledge and abilities of individual employees to ensure appropriate communication.
• Contingency plan processes were not fully established and implemented. Some companies had processes for contingency plans and were following them. However, the processes were in draft form until one month after being notified of the audit. The CER requires processes to be finalized and approved for at least three months to be considered established.
• Several deficiencies related to improper document management. Some documents had not been authorized by senior management and were out of date.

Facility integrity management audits

The CER has previously conducted integrity audits focusing on control rooms and pipelines, but this is the first time the CER has audited the integrity of facilities. This includes pumps, prime movers, tanks, pressure vessels, piping system, electrical components and instrumentation within the boundaries of a facility.

CER auditors assessed three companies’ facility integrity management. While the companies demonstrated that facility integrity management is integrated into their integrity management programs and overall management systems, auditors observed several non-compliances.

• The management system was not comprehensive. One company had established and implemented processes for its active facilities, but not for its deactivated facilities.
• Gaps in hazard identification and risk assessment. These gaps mostly related to processes that did not include enough information either at the corporate level, and/or at the more detailed level for individual facilities. For example, some processes did not describe how hazards are systematically identified, analyzed, and managed. Sometimes, multiple tools and processes were intended to work together, but the processes did not specify how. CER auditors also noted the same types of gaps in the risk assessment processes.
  
• Controls to address hazards and risks were too vague to be operationalized. Some controls were not specific enough, were not clearly operationalized, or linked to the hazards and risks they were intended to mitigate. Other controls were described at such a high‑level that they were ineffective. It was also unclear how some controls were meant to apply to different types of assets, operating conditions, or failure modes.
• Insufficient linkage between inspection and monitoring processes and other processes. For example, some companies did not indicate how inspection and monitoring results would inform how the company evaluated the adequacy and effectiveness of its facility integrity management program or how those results would be used to implement corrective and preventive actions. The CER expects companies to use learnings from compliance activities to drive continual improvement.
• Management of change was inconsistently applied. Some changes were managed via a set of project management processes, which were not properly aligned with the management of change processes. The project management approaches did not address all the associated hazards and risks that could arise from the change.

Next Steps

The CER expects all regulated companies to review their management systems in light of the deficiencies noted in this information advisory and take any necessary corrective actions. The CER will incorporate these learnings into its future compliance and oversight activities, which may include audits in these areas.

To learn more about management system audits, please visit the Industry Performance section on the CER website. Here you will find audit reports, the audit protocols used to assess the OPR’s management system requirements, and a management system audit guide.

Date modified:

2026-08-21