APEGA Professional Practice Standard
APEGA Professional Practice Standard
APEGA Professional Practice Standard
Authenticating Professional
Work Products
Authenticating Professional Work Products
CONTENTS
DOCUMENT HISTORY
January 2013 3.1 Initial issue for membership use. Original title was Practice
Standard for Authenticating Professional Documents
PREFACE
An APEGA professional practice standard describes the level of performance expected of
licensed professionals. Although practice standards are not specifically legislated, Part 8 (General)
of the General Regulation under Sections 58 and 59 allows APEGA to publish guides that define
the expectations and professional obligations of APEGA permit holders and licensed professionals.
Licensed professionals must follow practice standards, which establish acceptable practice.
The differences between a professional practice standard, a practice guideline, and a practice
bulletin are as follows.
• A professional practice standard sets the minimum standard of practice permit holders and
licensed professionals must comply with in their professional practice. APEGA’s statutory
boards will assess a permit holder’s or licensed professional’s practice and conduct against
practice standards.
CONTRIBUTORS
APEGA thanks the following members for their time and commitment in revising this
practice standard:
1.0 OVERVIEW
This practice standard replaces the Practice Standard for Authenticating Professional Documents
version 3.1 from January 2013. It provides detailed direction for licensed professionals and permit
holders on how to authenticate professional work products (PWPs) as directed in the following
sections of the Engineering and Geoscience Professions Act (the Act):
Authentication serves the public interest by providing a clear and unique indicator that an APEGA
licensed professional has completed or reviewed the work.
• defining professional work products (PWPs) and clarifying how licensed professionals can
assess which products need authentication
• setting the requirements for authenticating PWPs imported into, or exported from, Alberta
For clarity and conciseness, several topics from the previous version of this standard related to
best practices versus minimum standards have been removed. These will be considered for a
future update.
1.1 PURPOSE
This professional practice standard helps APEGA licensed professionals and permit holders comply
with the statutory requirements of authenticating PWPs. It also helps the public understand the
obligations of APEGA licensed professionals in authentication and the use of the APEGA stamp.
Given the diversity and complexity of the practices of engineering and geoscience in Alberta, it is
impossible for this standard to address all authentication questions that may arise. Licensed
professionals must use due diligence and professional judgement to ensure their professional
practice conforms with the intent of this standard. Permit holders and their Responsible
Members are expected to adequately document their authentication processes and protocols
in their Professional Practice Management Plans. They must clearly define the permit holder’s
expectations regarding which outputs of engineering and geoscience require authentication and
validation, and they must describe the internal controls for the authentication and validation
processes.
1.2 SCOPE
This practice standard details the requirements for authenticating PWPs.
The procedures outlined apply to:
• all PWPs used in Alberta, regardless of where they were produced
• all PWPs produced by, or for, permit holders, even if for internal use only. The Act does
not differentiate between PWPs prepared by an engineering or geoscience consultant for
an external client or those prepared by licensed professionals for their employer’s
internal use
• all PWPs produced by licensed sole proprietors or any entities practising engineering or
geoscience but are not mandated by legislation to have an APEGA Permit to Practice
1.3 DEFINITIONS
For the purposes of this standard, the below terms and definitions apply. These terms are italicized
throughout the text.
APEGA or Regulator
The Association of Professional Engineers and Geoscientists of Alberta
Certificate Authority
A trusted, third-party organization that provides digital certificates used to create a digital
signature. The certificate authority (CA) must have a relationship with the regulator to access
member identities and continued professional status. See Appendix 4 for APEGA’s CA
requirements.
Date
The date format must be unambiguous with no confusion between the recorded month,
day, or year.
Digital Certificate
An encrypted, digital attachment that allows a sender to send, or a recipient to read, a digital
signature for digital authentication. A digital certificate must be provided by a certificate authority
(see Certificate Authority).
Discipline
A specific field of practice within a profession (e.g., electrical engineering, mechanical engineering,
geophysics, geochemistry).
Due Diligence
The level of judgement, care, forethought, and determination a person reasonably uses to avoid
harming oneself, other people, property, or the environment.
Engineered Goods
Any goods designed, used, or produced using engineering services, falling into one of two
categories:
1. Commercially engineered goods or commercial off-the-shelf engineered goods
These are commercial goods for which there is public confidence of them being designed
by competent and qualified persons and manufactured in compliance with recognized
Canadian or international regulations, codes, or specifications. They are certified by a
recognized technical, regulatory, or legal body (e.g., CSA Group standards). Commercially
engineered goods are usually packaged with a complete user manual, specifications, and
assembly and safety instructions. If a commercially engineered good is used in a way that
deviates from the published specifications, it becomes a customized engineered good.
2. Customized engineered goods
These are goods, designed by licensed engineers, for which no applicable Canadian or
international regulations, codes, or specifications govern the entire design or manufacture
of the product. The designer usually provides a user manual with specifications, and safety
and assembly instructions.
Permit to Practice
An APEGA licence given to permit holders to practise engineering or geoscience in Alberta.
Permit to Practice Number (or Permit Number)
The unique registration number provided to a permit holder licensed by APEGA to practise
engineering, geoscience, or both.
Professional Services
For APEGA’s purposes, professional services are provided by licensed professionals and permit
holders to clients, or by employees to an employer. The products of professional services are
called outputs. In this practice standard, there are two types of professional services:
1. engineering services provided by a licensed engineering professional
(as defined in Section 1(q) of the Act)
2. geoscience services provided by a licensed geoscience professional
(as defined in Section 1(r) of the Act)
Professional Services Output (or Output)
A professional services output is any product created by a licensed professional or anyone
under the licensed professional’s direct supervision and control. For the purpose for this practice
standard, outputs can be physical, electronic, or digital and can be delivered through traditional
methods, such as by mail, or electronically through computers, tablets, personal digital assistants,
cell phones, voicemails, emails, teleconferencing, videoconferencing, or SMS (text). Not all outputs
require authentication and validation.
Professional Work Product
A professional work product (PWP) is an output that requires authentication and validation.
Defined in the General Regulation as “…plans, specifications, reports, or documents of a
professional nature,” a professional work product (PWP) is any output of professional services with
technical information relied upon by others, internally or externally, to make a decision or to take
action. A PWP can be physical (e.g., paper, plastic film), electronic (e.g., electronic document,
image), or digital (e.g., software, modelling, simulation, or any other computer application that
cannot be reproduced in a physical or electronic format). See the authentication test in Section 3.1
when assessing whether an output is a PWP.
Responsible Member
As specified in Part 7, Section 48(1)(c) of the General Regulation, a Responsible Member is an
APEGA licensed professional who is responsible for direct personal supervision of the practice
of engineering or geoscience by the permit holder. A Responsible Member must be qualified
by education and experience in the field of engineering or geoscience in which the partnership
corporation or other entity intends to engage, must be designated in writing by the permit holder,
and must be registered with APEGA as a Responsible Member.
The Responsible Member must have a sufficiently close relationship with the permit holder to
undertake the roles and responsibilities associated with acting as a Responsible Member.
A Responsible Member can be:
• a full-time, permanent employee of the permit holder;
• a member of the permit holder;
• a sole practitioner; or
• an individual providing professional services to the Permit Holder through a contractual
arrangement or as a part time employee.
The permit holder’s Responsible Members direct, supervise, and control all or part of a permit
holder’s professional practice in accordance with the permit holder’s Professional Practice
Management Plan and all relevant legislation, regulations, and codes.
Signature
Signatures are traceable and individualized permanent marks attached to stable information.
All manuscript signatures, or electronic images of handwritten or manuscript signatures, must be
in full. Initials are not acceptable.
2. Digital Signature: A valid digital signature contains information specifying the signed
product was created by a known sender (authentication), the sender cannot deny having
sent the message (non-repudiation), and the message was not altered in transit (integrity).
A digital signature can only be used by the holder of a digital certificate. It cannot be
reproduced by anyone who does not have access to the protected digital certificate.
Sole Proprietor
Within Alberta, a sole proprietorship exists when an individual is the sole owner of a business and
makes no legal distinction between the individual and the business (i.e., the business does not
exist as a separate entity). A sole proprietorship may have multiple employees.
A licensed professional practising as a sole proprietor does not need a Permit to Practice since the
sole proprietor is not practising engineering or geoscience through a corporation, partnership,
or association.
Many APEGA permit holders have kept the legacy Permit to Practice stamp, which is used by a
permit holder’s Responsible Member. The Permit to Practice stamp is an acceptable way for a
Responsible Member to validate a professional work product.
Technical Information
Technical information differentiates a professional work product from an output. Technical
information is an all-encompassing term for any content or data derived from the practice of
engineering or geoscience as defined by the Act. Technical information includes advice, analyses,
assessments, calculations, designs, evaluations, inputs (e.g., to planning or to modelling and
simulation), interpretations, notes, opinions, recommendations, and process descriptions.
3. the date the Responsible Member validated the PWP, either handwritten or inserted
electronically or digitally
APEGA’s Code of Ethics and Rules of Conduct are in the General Regulation and identify the key
principles for professional conduct:
• authenticate only PWPs that they have prepared directly, that were prepared under their
direct supervision and control, or that were prepared by others, but they have thoroughly
reviewed
• authenticate all PWPs for which they are legally obligated to accept professional
responsibility as required by the Act and the General Regulation
forward authenticated PWPs to their Responsible Member for validation if working for
•
a permit holder
• get the physical or electronic stamp from APEGA only and not modify it in any way without
APEGA’s express written approval
• secure and store the physical or electronic stamp to prevent loss or use by anyone other
than the professional named on the stamp
• return the physical stamp to APEGA or confirm the electronic stamp’s permanent deletion
upon removal from the register, suspension, or registration cancellation. The stamp is the
property of APEGA and not of the individual
• get a digital certificate from a provider that meets APEGA’s requirements for an acceptable
digital certificate authority (see Appendix 4)
• secure the sign-in credentials for a digital certificate to prevent theft or use by anyone
other than the individual to whom the digital certificate was provided
The Responsible Member’s validation does not mean the Responsible Member has taken
professional responsibility for the technical details in an authenticated PWP. The validation only
means the Responsible Member has reviewed the authenticated PWP, and in the Responsible
Member’s professional judgement:
• the quality control and assurance procedures outlined in the permit holder’s PPMP
were followed to review the technical content of the PWP before authentication
• the PWP was developed according to APEGA’s Code of Ethics and Rules of Conduct
Answer the three questions in Figure 1 to determine whether an output is a PWP that requires
authentication. If there is still doubt after applying the authentication test, APEGA’s Director of
Professional Practice can answer any questions.
Is there
another
Does the output legal requirement
(e.g., a building code) Authentication
contain technical required
information? that demands
authentication?
Is the
technical
information complete Authentication
not
for the final intended
required
purpose of the
output?
Will
others rely on the
technical information Authentication
not
related to the output’s required
intended
purpose?
Authentication
required
• the commercially engineered good is part of a larger engineered system (e.g., a turbine in
a mechanical system, a pump in a fire-suppression system, a prefabricated beam or truss
in a structure, or a commercial software application for a building control system). The
licensed professional responsible for the design of the larger system must authenticate
the PWP, confirming the commercially engineered good is integrated adequately into the
overall engineered system and can achieve the intended purpose.
• the user of a commercially engineered good plans to use the good in a way that deviates
from the designer’s or manufacturer’s published specifications. In such cases, the
engineered good is considered a customized engineered good, and a licensed
professional must assess if the intended use is safe, and if so, must provide an
authenticated PWP that documents this.
• outputs of professional services provided for review or comment only (e.g., drafts).
Such outputs are considered incomplete, and they should be clearly marked as such.
• outputs that do not contain technical information (e.g., contracts, checklists, cost
estimates, construction schedules, progress claims, payment verifications, correspondence,
and brochures) except if required by legislation (e.g., schedules required by safety codes
officers under the Alberta Building Code).
The licensed professional’s stamp and authentication are only valid for engineering or
geoscience PWPs.
1. physical
2. digital
These methods are not normally combined. If a permit holder combines these methods of
authentication in a single PWP, the permit holder’s PPMP must define the procedure that protects
the integrity of the authentication.
• PWPs signed by another person on behalf of the licensed professional identified on the
stamp
4.4.1 Authentication
Authentication includes the following criteria depending on the authentication method.
• Physical authentication:
o an ink impression or electronic image of the licensed professional’s stamp,
• Digital authentication:
o a digital signature supplied by a provider independently verified by a third party as
meeting APEGA best practices
o the licensed professional’s digital signature and an electronic image of the licensed
professional’s handwritten signature, and
o the authentication date included with the digital signature and inserted as an
electronic image.
The licensed professional must not combine methods in an individual authentication (i.e., picking
and choosing which elements of the authentication will be physical and which will be digital).
When appropriate, each authentication must include a note near the authentication describing
any boundaries or limitations of the authentication.
For physical authentication, licensed professionals must apply their stamp, handwrite their
signature, and insert the date. They may allow a person under their direct supervision and
control—and who is authorized in writing to do so—to apply the stamp and insert the date,
but licensed professionals must always personally sign it.
For digital authentication, which is a one-step process, licensed professionals must apply the
digital signature themselves. The digital signature cannot be delegated, even to those under the
licensed professional’s direct supervision and control.
4.4.2 Validation
Validation is performed by a permit holder’s Responsible Member. Validation occurs after the PWP
has been authenticated by a licensed professional and consists of:
• the Responsible Member’s full signature—initials only are not acceptable; and
• the date the Responsible Member signed the PWP, which may be different than the date it
was authenticated.
If using physical validation, Responsible Members must insert all required information manually or
use an ink impression of the APEGA Permit to Practice stamp.
If using digital validation, Responsible Members must apply their digital signature, including the
validation date, and insert electronic images of their handwritten signature.
The stamp impression, signature, and date must be clear, legible, and placed in a prominent, easily
visible location on each PWP. For example, original reports and letters can be authenticated next
to the authenticator’s name on the signature block. Attachments that can be distributed
separately must be authenticated separately. Each original drawing must be authenticated
(e.g., in a designated stamp box on the drawing).
Validation must include the Permit to Practice number and the permit holder’s name as part of the
letterhead or title block of a PWP. The validation must be close to the authentication for
increased visibility.
If multiple licensed professionals in the same discipline work together on a PWP, it is acceptable
for only one authentication to be applied. The authentication must be provided by the licensed
professional taking responsibility for the entire PWP in that discipline.
If multiple licensed professionals within the same single discipline share responsibility for and
authenticate their portions of the PWP individually, the boundaries and limitations of each
authentication must clearly show which licensed professional is taking responsibility for which
part of the PWP.
The Responsible Member must validate that all multi-discipline PWPs have been reviewed,
authenticated, and coordinated, in accordance with the permit holder’s quality control and
assurance procedures using one of the methods described in Section 4.4.2.
A PWP that involves engineering and geoscience must be validated by a Responsible Member
licensed to practise engineering and a Responsible Member licensed to practise geoscience.
Licensed professionals and permit holders must develop appropriate strategies to ensure proper
authentication and validation when using existing and emerging technologies.
Electronic and digital PWPs must be authenticated and validated, and the permit holder must
describe the policies and procedures for doing so in its Professional Practice Management Plan
(PPMP).
4.11.2 Digital Professional Work Products (e.g., Code, Software, and Modelling
and Simulation)
The licensed professional and permit holder are responsible for authenticating and validating any
digital PWPs resulting from the practices of engineering or geoscience. The permit holder’s PPMP
must describe how the permit holder will determine whether any code, software, or modelling
and simulation is a digital PWP.
If classified as digital PWPs, the original or modified versions of the program or code (whether
physical, electronic, or digital) and any control philosophy, trip or logic diagrams, logic functional
descriptions, cause-and-effect diagrams, Scientific Apparatus Makers Association diagrams, control
narratives, commissioning plans, and commissioning results must be authenticated as described
in the permit holder’s PPMP. The licensed professional and the Responsible Member must ensure
authentication and validation occur when the PWP is complete.
Licensed professionals making and authenticating revisions to an original PWP must distinguish
them from the original authenticated PWP and must identify who is assuming professional
responsibility. Unless all revisions are captured on a new, authenticated PWP at project
completion, all revised and authenticated PWPs must be kept.
The permit holder’s PPMP must describe how revisions to authenticated PWPs will be carried out
and controlled.
The permit holder must evaluate if the authentication process will cause an impractical delay
considering the situation’s urgency or potential risk to people, the environment, infrastructure, or
operational reliability. If the Responsible Member decides action must be taken before
authentication, the Responsible Member must ensure, at minimum, the following information
is documented before acting:
The change or revision must be formalized and authenticated as soon as possible after
implementation, and the timeline must be defined, justified, and documented by the licensed
professional and permit holder in the context of the professional services provided. The permit
holder must be able to justify its actions and prove that its licensed professionals and Responsible
Members exercised due diligence.
The permit holder’s PPMP must include authentication policies describing how the permit holder
controls authentication for continuous operations using design revisions, change orders, field or
operational instructions, or field reviews.
When setting the requirements for professional services, the licensed professional or permit
holder and the client must clearly define the expectations involving original, authenticated PWPs,
including whether copies are provided physically, electronically, or digitally, and if any copies are to
include authentication.
Copies of PWPs must be clearly marked as such to ensure any physical changes are properly
captured in revisions that can be authenticated.
The permit holder’s PPMP must include policies describing how PWP copies will be controlled.
Professional Engineer
P LE PLE PLE
SA M SA M SA M
PLE
SA M
PLE
SA M
Professional Geoscientist
PLE
SA M
PLE
SA M
Professional Geologist
PLE
PLE SA M
SA M
Professional Geophysicist
P LE P LE PLE
SA M SA M SA M
PLE
PLE SA M
SA M
Physical authentication consists of a stamp impression, a handwritten signature, and the date in physical
form or in electronic form with a digital signature. Regardless of format, the signature and date must be
clear and legible, and the APEGA licensed professional’s stamped name must not be covered by the
handwritten signature.
When a digitally authenticated professional work product is printed or viewed, an image of the stamp with
a signature and the date must appear.
Handwritten
The name of the Responsible Member must be easy to read. If the handwritten signature does not clearly
identify the name, the Responsible Member’s membership number or printed name must be added.
For APEGA to confirm the integrity, security, and authenticity of documents authenticated digitally, the
following must occur.
1. APEGA professionals must apply a digital signature supplied by a digital signature provider
independently verified by a third party as meeting APEGA’s best practices. APEGA must
confirm the verification documents.
• have the resources, technical support, and systems in place to provide continued service
for the foreseeable future.
• have protocols ensuring only APEGA licensed professionals are granted the authority to
own and use an electronic image of their stamp with their personalized digital certificate.
• have a platform that offers flexibility and ease of use for a wide range of purposes and
applications (e.g., compatibility with different file formats).
• have a digital certificate compliant with the International Telecommunication Union X.509
V3 standard.
• maintain the digital certificate under the sole control and possession of an APEGA licensed
professional.
• allow the digital certificate to be stored on the medium of the APEGA professional’s choice
(e.g., hard drive or memory stick).
• provide interfaces between the technology and the software used by APEGA licensed
professionals so the image of the APEGA stamp with signature and date appears when
printing or viewing the professional work product.