BACKGROUND checks in general:
There are three formal clearances:
-- RCMP criminality clearance
-- CSIS security clearance
-- GCMS check
GCMS is done by IRCC. The GCMS check is done REPEATEDLY. Last we knew internal procedure, the GCMS check is required EACH and EVERY TIME there is ANY ACTION TAKEN on the application. Thus, at minimum, IRCC should conduct the GCMS check at least three times in the course of processing the application. There will be a GCMS check not long before the oath is taken.
The RCMP criminality and CSIS security checks are done by the RCMP and CSIS respectively. On referral (usually in large batches). And sometimes IRCC requires an updated clearance.
While some applicants have more complicated histories than others, and can indeed encounter longer waiting times for either of these clearances, the vast majority of applicants should not encounter much if any delay due to these.
I strongly suspect that IRCC call agents, based in part on GCMS DEFAULT codes (same seen in the reports generated for client disclosure), report that the next step in processing is waiting on a clearance when in fact the application is merely sitting in queue waiting for a processing agent to take another action. That is, that the application is not on hold, not really waiting for a clearance from RCMP or CSIS, but is in queue waiting for a processing agent to act on it.
Similar to gap between date courier delivers app to Sydney and AOR date, and possibly (my speculation) the gap between IP and delivery to local office and date local office takes some action (even if just to log the application for future action), it is quite possible that there is a gap between the date when clearances are submitted to IRCC by RCMP and CSIS respectively, and the later date when a responsible processing agent formally logs completion of the clearances into the file . . . such that any inquiries into status in the meantime (ATIP or call centre agent) show clearances as not yet complete EVEN IF in effect they are.
Sure, this is largely speculation on my part. But for qualified applicants who accurately and properly completed their applications, who have provided accurate and complete information, and who have no reason to have criminal or security clearance snags, this seems like a rather likely explanation why a call centre agent will say the application is waiting on clearances.
In particular, the vast majority of applicants have no criminality or security concerns. None. Those checks, the RCMP and CSIS clearances, are NO problem, NO cause for delay.
In the meantime, the bigger, more pervasive, more extensive BACKGROUND checking is done by IRCC. The nature and scope of this probably varies considerably. For most applicants there are minimal concerns, minimal reasons to dig much into the applicant's background.
But for some, sure, IRCC is going to go digging, digging beyond comparing the details in the application and the applicant's immigration history.
The GCMS search, for example, can go well beyond the applicant's personal records. IRCC can run a GCMS search for any telephone number, address, or employer listed in the application, checking to see whether there are any notes or alerts for the particular phone number, address, or employer, checking to see if the phone number, address, or employer has been listed by other immigrants, and especially checking to see if any of these have popped up in a suspicious case in the past.
IRCC does make telephone calls. Sometimes to the applicant (I got one). Sometimes to an employer.
IRCC can conduct collateral inquiries, searching open sources on the Internet. For example, it appears that LinkedIn and Canada411 are among the most common sources researched for information about applicants. As I have discussed elsewhere, IRCC may do a LinkedIn query regarding Robert M. Applicantguy by also searching for records or information for a Robby or Rob or Roberto Applicantguy, Bob or Bobby Applicantguy, R.M. Applicantguy, among many other variations.
The information uncovered in any such research may trigger additional inquiries. We have seen officially published decisions in actual cases in which IRCC relied on LinkedIn information posted for a name only similar to the immigrant's name, and required the immigrant to prove it was NOT her, which she failed to do so far as IRCC and the Court determined. Thus, the employment information in that account which contradicted the immigrant's information was held against her (I do not recall if this was a PR loss of status case or a denial of citizenship case).
Again, most applicants are not going to encounter such extensive investigation of their background. Some will. With a lot of variation in-between.