usage of CMAKE_SYSROOT and CMAKE_INSTALL_PREFIX when cross-compiling

I’m trying to build packages for a cross-build environment (QNX), and I’m slightly confused by the use of the CMAKE_SYSROOT and CMAKE_INSTALL_PREFIX variables.
I would expect my generated (debian) package to contain installed files somewhere under
<sysroot>/<prefix>/, but it doesn’t seem like the CMAKE_SYSROOT variable is being used during packaging. For simple files I can of course define the CMAKE_INSTALL_PREFIX variable to incorporate the sysroot, but I expect a number of cases where that would result in the wrong behaviour.
Notably, the install prefix is often built into the generated executables to look up runtime resources. The sysroot should never be exposed to the runtime environment, as it only has meaning as part of the SDK. To take a specific example, the RPATH can conveniently be generated from the CMAKE_INSTALL_PREFIX, but that approach would obviously fail if the latter were to include the sysroot.

So, what is the right way to build SDK packages to be used in a cross-compilation environment with CMake ?