The IRCC has risk indicator packages developed by CBSA and CSIS. The officer is responsible for determining whether or not a referral for a comprehensive security screening is required. Then the IRCC officer is responsible for the final decision on that application.
On September 19th, 2024. See this statement in context.