Risk management is embedded into strategic decision-making and resource allocation within CATSA, allowing the organization to make informed decisions at the corporate and operational levels.
CATSA manages its corporate risks through an Enterprise Risk Management framework and maintains a comprehensive overview of its corporate risks through the risk profile, including descriptions of key operational and financial risks, risk ratings as measured by likelihood and impact of risk occurrence, and risk mitigation strategies.
CATSA’s overall risk attitude is conservative and flexible.
Conservative: CATSA generally focuses effort more heavily on the active management of medium, medium-high, and high risk, and the acceptance of low risk.
Flexible: CATSA’s environment is highly dynamic, and influenced by two key partners, namely Transport Canada and the Government of Canada more broadly. From a risk management perspective, the unique nature of CATSA’s environment requires flexibility and discretion in the application of risk attitude.
CATSA actively evaluates, manages and mitigates the following corporate risks:
Mandated Services Risk
Detection capabilities and maintaining care and control of screening checkpoints
The dynamic aviation security environment continues to evolve, creating risks relating to new or emerging threats that require careful oversight and adaptation. If these risks are not effectively managed, there could be significant impacts on the integrity of the civil aviation system. Strong operational management practices, informed by continuous assessment of emerging threats and regular oversight of mitigation measures, support CATSA’s response to this environment.
Capacity Risk
Adequacy of government funding
There is a risk that the organization's funding envelope may not fully keep pace with evolving requirements and cost pressures. CATSA actively manages this risk through strong financial governance, monitoring of resource needs, and engagement with government partners. Sustained funding pressures could affect the organization’s capacity to deliver its mandate effectively.
Resource capability and skills availability
Evolving organizational needs and labour markets can place pressure on the availability of key capabilities and expertise. CATSA manages this through effective leadership, workforce planning, and oversight of organizational capacity.
Service Delivery Through Third Parties Risk
Legal and illegal labour disruption
CATSA relies on third-party screening contractors to deliver services across the country. Labour disruptions, whether driven by labour relations dynamics or broader labour market conditions, could affect CATSA’s ability to sustain expected service levels. Active oversight of service delivery arrangements, engagement with partners, and contingency planning support service continuity. Disruptions may result in longer wait times for passengers and negatively affect public confidence and stakeholder relations.
Dependence on outsourced screening services, equipment maintenance services or major suppliers
CATSA relies on external service providers and suppliers to support the delivery of screening operations and the maintenance of critical equipment. Disruptions in the availability or performance of these services could affect service delivery. CATSA manages this exposure through active oversight of contractual arrangements, supplier engagement, and measures to support continuity of operations.
Partner and Client Relations Risk
Reputational risk
There is a risk that CATSA may encounter events which the organization is not able to effectively manage, which may cause damage to its reputation with its partners or clients, resulting in loss of public trust in CATSA and/or confidence in air transportation security. Significant failures in this regard could undermine confidence in the air transportation security system. CATSA works to maintain public trust and confidence in aviation security through proactive issue management and ongoing engagement with partners.
IT Risk
Cyber attacks
CATSA operates critical IT and operational technology in a constantly evolving cyber threat environment. While CATSA has strong controls and a cybersecurity program aligned with federal guidance, no organization can fully eliminate cyber risk. Residual cyber risk is actively monitored and managed through CATSA’s governance and enterprise risk processes.