CATSA Screening Contractor Management System Standard (2015)

Public Works and Government Services Canada Canadian General Standards Board Travaux publics et Services gouvernementaux Canada Office des normes générales du Canada CATSA Screening Contractor Management System Standard (2015) Airport Screening Services Agreement (ASSA) Pre-Qualification Program Requirements Checklist Experience and excellence Expérience et excellence

CONTENTS Introduction.. ii Qualification Requirements Part 1 Management team commitment 1 Part 2 Financial and general capability. 2 Part 3 Human resource optimization. 2 Part 4 Service delivery excellence.. 4 Part 5 Performance measurement and continuous improvement. 6 Part 6 Continuous Improvement 7 Relationship of the Standard to ISO 9001:2015 8 i

INTRODUCTION Once your organization has applied to the CGSB Qualification Program for the Airport Screening Service Agreement (ASSA) Pre-Qualification Program, the next stage in the process will be to submit your management system documentation that identifies the processes used to meet the requirements in the Standard. The Qualification Requirements Checklist must accompany the documentation. The CGSB requires this checklist to be completed by the applicants to aid in both the document review and the on-site field audit. The checklist is a breakdown of the CATSA Screening Contractor Management System Standard and is designed to map the applicant's documentation to the individual elements. For each element or statement, please indicate in the "Reference and Revision" column, your applicable documentation (policy, procedure, etc.) where this requirement is met. The "Critical" column indicates elements that the CGSB auditor deems critical to the management system. Note this column is for the use of the CGSB auditor, and does not require the applicant's input, but may act as a guide to the applicant as to areas of higher importance. As this is a new program these elements were designated based on the CGSB knowledge and experience of other management systems, and throughout the implementation phase of the program these "critical" elements may change. Applicants are required to meet all elements, not only the critical ones. The other columns under "Document" and "Use" are for CGSB use only and do not require input by the applicant. Within these columns there are various reference notes to aid the applicant. These notes include examples of the type of documentation required by the CGSB to demonstrate the management system meets the particular element. The "Objective Evidence Assessed" box at the bottom of the page is again for CGSB use only. Please submit a completed checklist as well as the referenced documentation to the attention of the CGSB. ii

Part 1 - Management team commitment 1.1 Management team commitment Does the organization define and demonstrate its processes and resources used to affirm the management team s commitment to the development and implementation of its management system and continual improvement of its effectiveness? At a minimum: a) Can the directors and the management team provide evidence of a clear criminal record check from a Canadian policing authority or have they obtained secret clearance from the Government of Canada? b) Is the management team committed to communicating the mission, vision and values and a code of ethics to its employees? Are these documented and promoted throughout the organization? c) Are levels of management responsibility and authority defined appropriately for the mandate, size and complexity of the organization (up-to-date organizational chart required)? Are they documented and promoted throughout the organization? d) Is the management team committed to communicating the importance of meeting customer as well statutory and regulatory requirements? Is the importance of meeting such requirements documented and promoted throughout the organization? e) Is the management team committed to the importance of management team reviews to ensure that the organization s management system continues to meet or exceed customer as well as statutory and regulatory requirements? Do procedures and evidence exist? f) Does the management team define and endorse a risk management policy that is aligned with the organization s mission and values, and ensures legal and regulatory requirements? Are the necessary resources allocated within the organization and is the policy communicated throughout the organization? Does the management team identify: i) Risk owners who have the accountability and authority to manage risk? ii) Those accountable for the development, implementation and maintenance of the framework of managing risk? iii) Other responsibilities of people within the organization for the risk management process? C 1) 3) C 4) 1) A copy of the security clearance authorization forms for all top management members or their applications for clearance should be obtained before the on-site audit. 2) A copy of the organization s code of ethics and personnel awareness session report (information notice to personnel) should be available. 3) The organizational chart, job descriptions and facilities list should be obtained during the on-site audit. 4) Management team reviews agenda and minutes are required. Objective evidence assessed 1 mi: Minor corrective action - : Not applicable - : Not evaluated

Part 2 - Financial and general capability 2.1 Financial statements Does the organization provide audited financial statements for the previous three years? If audited financial statements are not available, does the organization provide: a) documentation detailing both current and long-term credit or borrowing instruments (e.g. line of credit, loans)? b) documentation from the organization s lending institutions verifying that the organization is not currently in breach of any of the lending institution s banking covenants? Part 3 - Human resource optimization 3.1 Capability Does the organization define and demonstrate a planning process for ensuring it has the capability to meet the human resource challenges presented by national, regional and local employment markets and conditions? 3.2 Motivated workforce Does the organization define and demonstrate programs or activities designed to foster an organizational culture that results in a motivated workforce? 3.3 Human resource information system Does the organization define and demonstrate a human resource information system and procedures that, at a minimum: a) track relevant employee information, including training status, availability and language capabilities (see personnel file)? b) track current employee status and planned intervals for updating and maintenance of records? c) can be modified or customized to add and maintain new requirements for employee information? 3.4 Information security system Does the organization define and demonstrate an Information Security system and procedures that provide, at a minimum: C 1) C 1) C 1) C a) A documented policy or strategy for performing an information security risk assessment a planned intervals or when significant changes are proposed or occur? b) To control planned changes, review the consequences of unintended changes, and take action to mitigate any adverse effects? c) Any outsourced processes are determined and controlled? C d) Implement a security risk treatment process to: i) Select the appropriate security risk treatment options, C ii) Determine all controls required to implement, C iii) Implement, and monitor results. 2 mi: Minor corrective action - : Not applicable - : Not evaluated

Part 3 - Human resource optimization (continued) 3.5 Payroll system Does the organization define and demonstrate a payroll system and procedures that result in on-time delivery of accurate employee compensation? 3.6 Staff recruitment and retention Does the organization define and demonstrate its recruitment and retention processes to fill and maintain the categories of human resources required at the management and non-management levels, including at a minimum: C 3) a) a documented attraction policy and/or strategy? 1) b) a documented retention policy and/or strategy? c) a documented career development policy and/or strategy? d) a documented compensation and benefits program? e) programs for improving employee engagement and commitment to work? f) an employee assistance program? g) a reward and recognition program? h) a skills and knowledge-based training program? i) a pre-employment qualifications assessment process, with criteria used for testing suitability for customer service? j) a reference-checking process? 2) 3.7 Management of personnel represented by a union resources necessary to manage employees providing service to a third party where those employees are represented by a union, including: a) the person(s) responsible for labour relations with demonstrated competency and experience (e.g. binding arbitration, grievance resolution, alternative dispute resolution, collective bargaining, resource transition management)? b) corporate experience with and understanding of: i) the administration of a collective agreement (i.e. the ii) iii) resolution of workplace disputes through the grievance and arbitration process) by providing copies of collective agreements? the negotiation of collective agreements? (Is there a documented policy and/or strategy?) the management of legal and illegal labour disruptions by employees? (Is there a documented policy, strategy and/or contingency plan to maintain operations?) 1) A copy of financial statements for the previous three years or relevant documents should be obtained before the on-site audit. 2) Training and proficiency personnel records, including annual human resource deployment, should be maintained and available. 3) A salary rating sheet and employee compensation monitoring (information notice to the personnel) should be available. 3) 3) 2) 3 mi: Minor corrective action - : Not applicable - : Not evaluated

Objective evidence assessed Part 4 - Service delivery excellence 4.1 Service delivery resources necessary to determine: a) customer requirements (stated and not stated by the customer) for service delivery and post-service delivery activities? b) statutory or regulatory requirements related to the service? c) how contract amendments are resolved and implemented? d) and implement effective communication with customers in relation to service delivery information, including contract amendments? 4.2 Employee scheduling Does the organization define and demonstrate an employee scheduling process for the deployment of human resources that meet client and service requirements, including: a) a procedure for dealing with fluctuating requirements that include part-time, split-time and full-time employees? b) current and previous work schedules? 4.3 Administrative management Does the organization define and demonstrate its administrative management processes, e.g. those meant to ensure the timely and accurate flow of information, including at a minimum: a) billing details? 4) b) cost substantiation? 4) c) work and billing authorizations? 4) d) the existence of an automated employee time recording system? e) organizational policies and procedures for the completion and approval of time sheets? f) reporting and control features of the time recording system? 5) g) the process used to reconcile the labour distribution with the payroll register and supporting documentation? 1) Comment on what has been presented (documented procedures, flowcharts, manuals, etc.). 2) A list of applicable statutory and regulatory requirements should be available. 3) The employee workload planning and individual work schedule (daily, weekly or monthly) should be available. 4) An invoices file, including relevant documents and a list of approval authorities, should be maintained and available. 5) Adequate equipment for employee time recording and a maintenance program for this equipment should be in place. 1) 3) 5) 4) 4) 4 mi: Minor corrective action - : Not applicable - : Not evaluated

Part 4 - Service delivery excellence (continued) 4.4 Service delivery control resources necessary to plan and carry out service delivery under controlled conditions, including at a minimum: a) the availability of readily identifiable work procedures/instructions, as necessary? b) a procedure for disseminating new and updated work procedure to employees that is timely and tracked? c) management oversight and monitoring to verify compliance to work instructions and procedures? d) the availability and use of equipment and measuring devices used to verify compliance? 4.5 Customer property resources necessary to care for customer property while it is under the organization s control or being used by the organization? 4.6 Emergency control resources necessary to plan and carry out emergency planning and preparedness in the service delivery environment? 1) 2) 3) C 4) 1) A list of work instructions could be included in the management system standard documentation. 2) A list of equipment and measuring devices, including the maintenance program, should be available, where applicable. 3) A Customer Working Area inspection and incident report should be maintained and available. 4) The emergency program and testing plan, including records of testing activities, should be available. Objective evidence assessed 5 mi: Minor corrective action - : Not applicable - : Not evaluated

Part 5 - Performance measurement and continuous improvement 5.1 Key contractual performance indicators report Does the organization define and demonstrate its ability to report 1) on key contractual performance indicators and the way in which it measures the achievement of key performance indicators (current and previous performance management reports)? 5.2 Service delivery monitoring and measurement data Does the organization define and demonstrate how it collects appropriate data for monitoring and measurement of delivery service processes, including at a minimum: a) customer satisfaction reports? 1) b) employee attrition rates reports? 1) c) conformity to service requirements reports? 1) 5.3 Service delivery analyzing and evaluating data Does the organization define and demonstrate how it analyses and evaluates appropriate data for monitoring and measurement of the service delivery processes, including at a minimum: a) Ensure conformity to service requirements? b) Assess and enhance customer satisfaction? c) Assess the performance of external providers? d) Ensure conformity and effectiveness of management system, and determine the need or opportunities for improvements? 5.4 Internal audits resources to conduct internal audits at planned intervals in order to provide information on whether the management system; a) Conforms to the requirements of this standard? 3) b) Conforms to its own requirements for its management 4) system? c) Is effectively implemented and maintained? 4) 1) Metrics of key contractual performance indicators and their performance results (customer satisfaction survey, employee appraisal results, service delivery performance, etc.) should be available. 2) Evidence of nonconformities managed (identification, disposition, notification, etc.) and relevant records should be available. 3) A customer complaints log should be maintained. 4) A preventive and corrective action file should be maintained and available. 5) The status of the review of corrective and preventive action could be included in a management review meeting (see Part 1.1c)). Objective evidence assessed 6 mi: Minor corrective action - : Not applicable - : Not evaluated

Part 6 Continuous Improvement 6.1 Control of a nonconforming service Does the organization define and demonstrate the controls and related responsibilities and authorities for dealing with a nonconforming service and to ensure that any service which does not conform to service standards is discontinued? 6.2 Nonconformities Does the organization define and demonstrate the processes used to eliminate the cause of nonconformities in order to prevent recurrence and potential nonconformities, including at a minimum, a documented procedure: a) for reviewing nonconformities (including customer complaints)? C 1) b) for determining the cause of nonconformities? 1) c) determining and implementing action needed? 1) e) recording the results of action taken? f) Reviewing corrective action? 6.3 Continuous improvement resources to implement continuous improvement, including at a minimum: C 1) a) Consider the results of analysis and evaluation, and management review to confirm if there are areas of underperformance or opportunities that shall be? b) Select and utilize applicable tools and methodologies for investigation of the causes of underperformance and for supporting continual improvement? Objective evidence assessed 7 mi: Minor corrective action - : Not applicable - : Not evaluated

Relationship of the Standard to ISO DIS 9001:2015 For organizations following the ISO DIS 9001:2015 (2014) approach to quality management, the table below crossreferences, from CATSA s perspective, the Screening Contractor Management System Standard to ISO DIS 9001:2015 (2014). Additionally, the CGSB will apply their experience and understanding of management system assessment at their discretion. ISO 9001 Ref. elements directly correlating with the CATSA standard, ( ) tenuous link Section Headings Page Number ISO 9001 Ref. Part 1 Management team commitment 6 1.1 Management team commitment 5.1 1, 5.1.2, 3,7.3, 9.3.1 Part 2 Financial and general capability 6-2.1 Financial statements - Part 3 Human resource optimization 6-3.1 Capability 7.1.1, 7.1.2 3.2 Motivated workforce 7.2, 7.3 3.3 Human resource information system 7.1.3 3.4 Payroll system 7.1.3, 7.1.4 3.5 Staff recruitment 7.1.6, 7.2 3.6 Management of personnel represented by a union 8.2.2 Part 4 Service delivery excellence 7 4.1 Service delivery 8.2.2, 8.6 4.2 Employee scheduling 8.1 4.3 Administrative management 8.4 4.4 Service delivery control 8.5.1 4.5 Customer property 8.5.3 4.6 Emergency control 7.1.5 Part 5 Performance measurement and continuous improvement 5.1 Key contractual performance indicators report 9.1.3 5.2 Service delivery monitoring and measurement data 9.1.1 5.3 Service delivery analyzing and evaluating data 9.1.1 5.4 Internal Audits 10.2 Partie 6 Continuous improvement 8 6.1 Control of a nonconforming service 10.2.1 6.2 Nonconformities 10.2.1 6.3 Continuous improvement 10.3 8 8