Department of Homeland Security
 

Customs and Border Protection's 


Office of Regulatory Audit 


OIG-12-117 September 2012
 
 

 

 OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

 Washington, DC 20528 / www.oig.dhs.gov

 SEP 7 2012 

MEMORANDUM FOR: Allen Gina

Assistant Commissioner for International Trade 

U.S. Customs and Border Protection 

FROM: 

SUBJECT: AuditfoffCustomsfandfBorderfProtection’sfOfficefoff

RegulatoryfAuditf

ff

Anne L. Richards 

Assistant Inspector General for Audits 

Attached for your action is our final report, AuditfoffCustomsfandfBorderfProtection’sf

OfficefoffRegulatoryfAudit.ffWe incorporated the formal comments from the Customs 

and Border Protection’s (CBP) Office of Regulatory Audit in the final report. 

The report contains five recommendations aimed at improving CBP’s Office of 

Regulatory Audit. Your office concurred with all five recommendations. Based on 

information provided in your response to the draft report, we consider the 

recommendations resolved. Once your office has fully implemented the 

recommendations, please submit a formal closeout letter to us within 30 days so that 

we may close the recommendations. The memorandum should be accompanied by 

evidence of completion of agreed-upon corrective actions and of the disposition of any 

monetary amounts. 

Consistent with our responsibility under the InspectorfGeneralfAct, we are providing 

copies of our report to appropriate congressional committees with oversight and 

appropriation responsibility over the Department of Homeland Security. We will post 

the report on our website for public dissemination

 

Please call me with any questions, or your staff may contact Mark Bell, Deputy Assistant 

Inspector General for Audits, at (202) 254-4100. 

Attachment 

 
TableofContents

Executive Summary ............................................................................................................. 1
 

Background ........................................................................................................................ 2
 

Results of Audit ................................................................................................................... 2
 

Audit Process .......................................................................................................... 2
 

Audit Selection Process ......................................................................................... 10 

Guidance for Collaborating with Collection Officials ............................................ 12 

Recommendations ................................................................................................ 13 

Management Comments and OIG Analysis .......................................................... 14 

Appendixes

Appendix A: Objectives, Scope, and Methodology............................................ 17 

Appendix B: Management Comments to the Draft Report............................... 19 

Appendix C: Major Contributors to This Report ................................................ 23 

Appendix D: Report Distribution ........................................................................ 24 

Abbreviations

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

CBP U.S. Customs and Border Protection 

DHS Department of Homeland Security 

FY fiscal year

GAO Government Accountability Office 

GAGAS Generally Accepted Government Auditing Standards 

OIG Office of Inspector General

ORA Office of Regulatory Audit 

PTI Priority Trade Issue 

SOP Standard Operating Procedures

www.oig.dhs.gov OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

ExecutiveSummary

U.S. Customs and Border Protection’s (CBP) Office of Regulatory Audit advises collection 

officials of revenue underpayments and importer noncompliance. The Office of 

Regulatory Audit conducts diverse audits, including audits to ensure the protection of 

U.S. Government revenues and compliance with customs laws, as well as audits to 

protect the rights of the public transacting business. To ensure compliance with 

customs laws, the Office of Regulatory Audit selected importers to determine whether 

they have accurately declared the value and classification of their merchandise for entry 

into U.S. commerce. In 2010, CBP provided oversight for more than $30 billion in 

revenue to the U.S. Government. The Office of Regulatory Audit is part of CBP’s 

oversight function. Senator Charles Grassley expressed concerns about alleged 

deficiencies in CBP’s revenue collection program and requested an audit of the entire 

oversight process. 

Our audit objectives were to determine whether the Office of Regulatory Audit is 

conducting audits with reasonable assurance that they meet current Government 

Auditing Standards and whether the office has an effective process for audit selection. 

The Office of Regulatory Audit is not conducting audits that meet all July 2007 

Government Auditing Standards, does not have an effective audit selection process, and 

needs to improve CBP’s ability to recoup unpaid duties identified during audits. These 

problems are due to outdated audit policies, poorly implemented field quality control 

mechanisms, a lack of current importer information for audit selection, and insufficient 

collaboration with CBP collection officials. 

We recommend that the CBP Office of Regulatory Audit ensure that its audits comply 

with current Government Auditing Standards, update its audit manual, strengthen its

internal quality control program, revise its audit selection process, and improve 

collaboration with CBP collection officials and other Department of Homeland Security 

(DHS) stakeholders. The CBP Office of Regulatory Audit concurred with all five 

recommendations.

www.oig.dhs.gov 1 OIG-12-117 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Background

CBP collects more than $30 billion in duties, fees, and taxes annually and is the second 

largest revenue generator for the U.S. Government. Since 2002, revenue has been 

identified as one of CBP’s eight Priority Trade Issues (PTIs) that have a high risk of 

threatening or harming U.S. interests. The goal of the revenue-related PTI is to ensure 

that CBP has effective procedures to protect the duties and taxes it collects. The Office 

of Regulatory Audit (ORA), which is under CBP’s Office of International Trade, enforces 

compliance. ORA conducts post-entry audits of importers and other parties involved in 

importing goods and provides special technical audit assistance in CBP priority trade and 

security areas. ORA’s core responsibility is to conduct in-depth reviews of importers to 

determine whether they account for and declare accurate and complete information for 

merchandise imported into the United States. ORA’s audit tracking system showed that 

the office completed 1,053 audits from fiscal years (FYs) 2008 to 2010. 

In FY 2010, DHS received correspondence from Senator Charles Grassley expressing 

concerns about alleged deficiencies in CBP’s revenue collection program. He requested 

that the Office of Inspector General (OIG) conduct an audit of ORA’s operations. This 

audit was initiated in response. 

ResultsofAudit

ORA needs to ensure that its audits are conducted in accordance with current 

Government Auditing Standards and improve the effectiveness of its audit selection 

process. In addition, to improve CBP’s ability to recoup unpaid duties identified during 

audits, ORA needs to improve its collaboration with CBP collection officials. 

AuditProcess

Our review of a sample of 30 audits showed that ORA cannot be assured that 

these audits were documented or conducted in accordance with the 

Government Auditing Standards in effect at the time of our review.1

The audits we reviewed were conducted and documented using an outdated 

audit manual that did not fully comply with current Government Accountability 

Office (GAO) Government Auditing Standards, commonly referred to as 

Generally Accepted Government Auditing Standards (GAGAS). Furthermore, the 

1 GAO Government Auditing Standards (July 2007 Revision), GAO-07-731G.

www.oig.dhs.gov 2 OIG-12-117 
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

ORA field internal quality control system did not adequately ensure that the 

audits were performed and documented in accordance with July 2007 GAGAS. 

In a separate review of other ORA audits issued in November 2009, ORA 

headquarters’ internal quality control team noted that audit reports and 

supporting documentation contained mathematical and sampling calculation 

errors, contradictions, and insufficient audit evidence at the field office level. 

The November 2009 report also noted that these same deficiencies were found 

previously. 

In 2010, ORA received a peer review rating of “Pass” from a certified public 

accountant and consulting firm, whose stated opinion was that ORA’s FY 2009 

system of quality control was suitably designed and complied with professional 

standards. However, this peer review covered data from only 1 year and did not 

include many audit reports we reviewed during our audit. According to the firm, 

noncompliance with the system of quality control may occur and not be 

detected. ORA’s internal quality control team noted GAGAS deficiencies in FY 

2009 and FY 2010. 

In an earlier peer review conducted in FY 2006, the same consulting firm noted 

GAGAS deficiencies, including report findings not supported by audit 

documentation; audit sampling not appropriately documented, evaluated, and 

reported; and issues with GAGAS reporting consistency and adequacy of audit 

programs. The review also noted that the internal quality assurance checklists 

were not properly updated and were not consistent with current policies and 

procedures.

As a U.S. Government auditing organization, ORA’s work must adhere to GAGAS. 

These standards provide guidance for performing high-quality audit work with 

competence, integrity, objectivity, and independence and ensure that users of 

U.S. Government audit reports can rely on report information.

AuditManual

ORA has not fully updated its audit manual to comply with 2007 Government 

Auditing Standards. ORA published its audit manual in accordance with GAGAS 

issued in 2003. ORA has updated four chapters, but six chapters have not been 

fully updated to comply with GAGAS issued in 2007.2 Thus, ORA is not providing 

its auditors with clear guidance to perform audits that comply with current 

2 GAO has issued a 2011 revision of Government Auditing Standards (December 2011), GAO-12-331G. 

These updated standards were not applicable to the work we reviewed, but ORA must also include the 

2011 updated standards when revising its audit manual and applicable guidance.

www.oig.dhs.gov 3 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

GAGAS. We compared the ORA audit manual with the July 2007 GAGAS and 

found areas of noncompliance such as the following: 

•	 The manual does not include the audit risk assessment requirements from 

the July 2007 revision of GAGAS. Performing audit risk assessments helps to 

ensure that auditors do not draw improper conclusions.

•	 The ORA manual states that individuals who conduct quality assurance 

checks of audits prior to issuance do not need to complete an independence 

certification. However, July 2007 GAGAS state that all auditors participating 

in an audit must be free of personal impairments; they also state that 

procedures should provide reasonable assurance that the audit organization 

and its personnel maintain independence.

ORA staff periodically issue updated sections of the audit manual; however, the 

office does not compile the information to provide auditors with a complete, 

organized, and easily accessible manual. Instead, each update is published 

separately and is not clearly referenced to a specific section of the audit manual. 

ORA needs clearly organized and accessible standards to ensure that its auditors 

have the necessary guidance to conduct audits in accordance with current 

Government Auditing Standards. During our review, ORA agreed that the audit 

manual should be completely updated to reflect the current version of GAGAS 

and is taking action to address the most significant updates from the 2007 

revision. ORA has since provided training to its audit staff on the July 2007 

GAGAS requirements. 

InternalQualityControlSystem

ORA has several quality assurance mechanisms to evaluate its audits and audit 

processes and to ensure compliance with both GAGAS and its own policies. For 

example, ORA’s Quality Assurance Division at headquarters conducts internal 

quality control reviews of each field office every 3 years. ORA also has numerous 

quality assurance processes at the field office level. ORA relies on five standard 

checklists to review audit work for accuracy and completeness prior to report 

issuance; two checklists are used twice. July 2007 GAGAS state that quality 

control systems should be designed to provide reasonable assurance that the 

audit organization and its personnel comply with professional standards and 

legal and regulatory requirements. Furthermore, for quality control, GAO 

requires an organization performing audits in accordance with GAGAS to 

undergo an external peer review at least once every 3 years. The external peer 

review determines whether the organization’s system of quality control is 

suitably designed and complies with professional standards. Our review of 30 

www.oig.dhs.gov 4 	 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

audits showed that controls were not collectively implemented at the field office 

level to provide reasonable assurance that ORA’s audits were performed in 

accordance with July 2007 Government Auditing Standards. As a result, ORA 

may not be able to ensure that report deficiencies are identified and corrected 

before report issuance. ORA should strengthen and revise its internal quality 

control review processes to provide additional assurance that its audits are 

conducted and documented in accordance with current Government Auditing 

Standards. 

AuditPerformance—ConductingtheAudit

To review the ORA audit process, we selected 30 audits conducted from FY 2008 

to FY 2010 by six field offices and one sub-office. We determined that ORA did 

not complete all these audits according to all performance auditing standards. 

Therefore, based on our review of audits in the sample, we concluded that ORA 

cannot be assured that all its audits were conducted according to performance 

auditing standards. 

In regard to internal control for performance audits, GAGAS 7.16 (July 2007) 

states that government auditors should obtain an understanding of internal 

controls that is significant within the context of the audit objectives. Internal 

control assessments evaluate whether an organization has measures in place to 

conduct business in compliance with applicable standards. ORA staff did not 

conduct appropriate testing of internal controls to obtain an understanding of 

the internal controls significant within the context of the audit objectives in 19 of 

30 audits (63 percent) we reviewed. As a result, ORA may not have had 

sufficient and appropriate evidence to support its assessment of the 

effectiveness of importer operations. 

For example, one audit concluded that a company was commingling seafood of 

different origins and therefore owed approximately $6.9 million to CBP. The 

audit analyzed 15 company records to determine whether seafood of different 

origins was being commingled. ORA staff selected eight reports in which the 

seafood weight going into the processing plant was less than the weight leaving 

the plant. ORA staff reasoned that seafood of an unknown origin had been 

added during processing because some reports showed that the seafood weight 

was greater after processing. However, other reports showed that the weight 

was greater before processing. 

ORA staff did not include in the methodology a step to determine the reasons for 

weight variances between shipments entering and leaving the plant. Because 

ORA staff did not analyze the company’s internal control operations for weighing 

www.oig.dhs.gov 5 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

the seafood, the evidence is not sufficient and appropriate to support the

findings and conclusions. Collection officials reduced the amount of additional 

payment owed to CBP to zero. ORA noted that many other factors may affect 

CBP’s ability to collect ORA-identified duty underpayments, including a 

company’s ability to pay the duty owed to the U.S. Government and settlement 

offers in which a company agrees to pay a reduced amount. 

AuditDesign

According to GAGAS 7.10 (July 2007), government auditors should design their 

audit methodology to obtain sufficient, appropriate evidence to address the 

audit objectives. ORA staff did not design a methodology to obtain adequate 

evidence for the audit objective in 10 of 30 audits (33 percent) we reviewed. As 

a result, ORA may not be able to provide reasonable assurance that evidence 

collected for these audits was sufficient to support its findings and conclusions.

For example, in one audit we reviewed, ORA staff did not design a methodology 

to obtain sufficient, appropriate evidence to address the audit objective. The 

objective was to determine whether the importer was able to sufficiently 

support the accuracy of its importation information declared to CBP and 

whether the importer owed additional duty payments. From its audit, ORA 

concluded that the company owed $4.5 million in additional duty payments 

because it could not support the accuracy of its claims. However, ORA reached 

this conclusion by applying its audit work to similar, yet more recent, 

importations that required CBP to provide less proof. ORA did not design its 

audit to provide sufficient information on the transactions it used to calculate 

duty underpayment of $4.5 million. As a result, ORA could not support its claim 

for duty underpayment, and collection officials reduced the amount of additional 

payment owed to CBP to zero. 

DataQuality

According to GAGAS 7.57 and 7.68 (July 2007), government auditors should 

evaluate whether the evidence taken as a whole is sufficient and appropriate to 

address the audit objectives and support findings and conclusions. ORA staff did 

not document the work performed to ensure that audit data were accurate and 

complete in 11 of 30 audits (37 percent) we reviewed. As a result, we were 

unable to verify whether the audit work conducted to support findings and 

conclusions for these audits was sufficient.

For example, an ORA audit sampled 30 transactions for 2006 to ensure that 

transaction classifications were accurately reported. The audit identified three 

www.oig.dhs.gov 6 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

transactions that had been misclassified for a total underpayment of $2,351; the 

underpaid amount projected to the entire data population for that time period 

resulted in an estimated underpayment of $215,712. ORA identified internal 

control deficiencies as the reason for the misclassifications. However, ORA 

completed testing of internal controls in 2005 and did not do additional testing 

to determine if the identified deficiencies were applicable in 2006. The audit 

report did not document the circumstances for the three errors in transaction 

classification or relate them back to other transactions in the universe of data. 

Therefore, although ORA used a statistically appropriate methodology, the 

projection was not reliable. The company agreed with the classification errors 

identified but disagreed with the projected underpayment calculated in the audit 

report. At the time of our audit, $32,379.91 had been collected. 

InsufficientDocumentation

In the audits reviewed, we also identified areas in which ORA’s audit work was 

not sufficiently documented in accordance with Government Auditing Standards. 

Each area and the number of audits in which the deficiency was noted are 

explained below. 

ProgramRiskAssessment

According to GAGAS 7.13 through 7.15 (July 2007), government auditors should 

obtain an understanding of the relevant risks associated with the program under 

audit. External risk assessments evaluate external factors or conditions that 

could directly affect the program under audit. ORA staff did not document their 

assessment of external risk in 8 of 30 audits (27 percent) we reviewed. As a 

result, ORA may not be documenting all the high-risk areas of the importers’ 

operations it reviewed. ORA provided examples of its risk assessment 

procedures, including team strategy meetings to identify risk; analysis and 

review of previous audits, types of importations, and trade agreements; and 

reviews of stockholder information. However, ORA does not always document 

these risk assessments or its overall conclusion of external risk. 

AuditRiskAssessment

According to GAGAS 7.05 through 7.07 (July 2007), government auditors should 

assess the possibility that their findings, conclusions, recommendations, or 

assurance may be improper or incomplete. Internal risk is assessed to evaluate 

the possibility that an audit team will reach incorrect conclusions. ORA staff did 

not document their assessment of internal risk in 30 of 30 audits (100 percent) 

we reviewed. As a result, ORA may not have adequate evidence to support the 

www.oig.dhs.gov 7 OIG-12-117 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

steps taken to prevent or mitigate the potential issues identified in its 

assessments. ORA agrees that a formalized process to evaluate internal risk 

would improve the audit process; therefore, it plans to include guidance in its 

audit manual on internal risk and provide training to its staff. 

FraudAssessment

According to GAGAS 7.30 (July 2007), government auditors should assess the risk 

of the occurrence of fraud that is significant within the context of the audit 

objectives. Fraud assessments evaluate the possibility that an audit team may 

uncover fraudulent activities while conducting an audit. ORA staff did not 

document their assessment of fraud in 29 of 30 audits (97 percent) we reviewed.

As a result, ORA may not have adequate evidence to support the steps taken to 

identify fraud risks and whether the risks in these audits were properly detected 

and mitigated. ORA agrees that the audit procedures for documenting fraud 

assessments were deficient and has revised its auditor planning checklist to 

include guidance on assessing and documenting the risk of fraud. All auditors 

are required to complete training on the revised auditor planning checklist. 

Competence

According to GAGAS 3.49 (July 2007), government auditors who use the work of 

external specialists should assess the professional qualifications of such 

specialists and document their findings and conclusions.3 Specialists should be 

qualified and maintain professional competence in their areas of specialization. 

In addition, GAGAS 7.45 (July 2007) states that if planning to use the work of 

specialists, auditors should document the nature and scope of the work the 

specialists will perform. 

ORA staff did not document the professional qualifications and work to be 

performed by external specialists in 27 of 27 audits (100 percent) we reviewed; 

ORA did not use external specialists in the remaining 3 reviewed audits. As a 

result, ORA may not be able to ensure that specialists selected possess the 

necessary knowledge, skills, and experience to conduct the required audit work. 

ORA disagrees with this finding because, according to chapter 4 of the ORA audit 

manual, “DHS employees assigned to an audit will be assumed qualified to 

3 GAGAS were revised in December 2011; however, they still require government auditors to determine 

that external specialists assisting in performing a GAGAS audit are qualified and competent in their areas 

of specialization (GAGAS 3.79).

www.oig.dhs.gov 8 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

participate in the audit.” However, we believe the ORA audit manual should 

require staff to identify the audit work specialists will perform and ensure that 

selected specialists are capable of performing the audit work. 

DataTesting

According to GAGAS 7.64 (July 2007), when government auditors use 

information gathered by officials of the audited entity as part of their evidence, 

they should determine what the officials or other auditors did to ensure that the 

information was reliable. ORA staff did not document the work performed to 

ensure that data used in audit work were accurate and complete in 7 of 30 

audits (23 percent) we reviewed.

Specifically, ORA did not have adequate documentation to support the steps it 

took to test the reliability of the data. Auditors must test each data set used in 

an audit to ensure that the data used to conduct the audit are accurate and 

complete. Since ORA did not document its testing methods, we were unable to 

verify whether the data used to support findings and conclusions in the reviewed 

audits were accurate and complete. 

OtherOpportunitiesforImprovement

Independence

According to GAGAS 3.07 and 3.08 (July 2007), government auditors must be 

free from personal impairments to independence and should maintain 

documentation of the steps taken to identify potential personal independence 

impairments. Although ORA documents the steps it takes to determine auditors’ 

independence, its supervisors certify independence for all team members, so it is 

not possible to ascertain whether each individual is actually free from 

impairments to independence.

ORA staff did not complete individual declarations indicating their independence 

for all staff assigned to a given audit in 29 of the 30 audits (97 percent) we 

reviewed. As a result, ORA may not be able to ensure that its audit work was not 

weakened by personal impairments to independence. ORA staff should prepare 

individual personal impairment statements to ensure that all staff are 

independent before beginning each audit assignment. 

Although ORA disagrees with this finding, its Audit Policy division plans to 

develop and issue a standardize independence form as part of its updated ORA 

audit manual. 

www.oig.dhs.gov 9 OIG-12-117 
 



OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Conclusion

ORA needs to ensure that its audit work is sufficient and appropriate to support 

audit findings and conclusions as required by GAGAS, and it needs to document 

any exceptions to those requirements. ORA should revise and update its audit 

manual and internal quality control process, which should allow it to provide 

reasonable assurance that its audit work is complete and accurate.

AuditSelectionProcess

ORA needs to improve the effectiveness of its audit selection process to ensure 

that the highest risk importers are selected for audit. ORA has not documented 

its audit selection methodology and has not formalized audit selection 

procedures to ensure that staff use similar criteria to select the highest risk 

importers. 

ORA’s audit selection process draws candidates, on average, from a pool of 

approximately 321,000 importers nationwide. Each year, ORA uses a risk-based 

approach to identify which importers it will audit. ORA primarily conducts two 

types of audits: 

•	 Focused Assessments—comprehensive audits of major importers that 

evaluate controls to identify importer strengths, weaknesses, and 

compliance with applicable laws and regulations. 

•	 Quick Response Audits—narrowly scoped audits of importers in high-risk 

trade areas identified by CBP and other officials. 

The general objective of these audits is to protect U.S. Government revenue and 

to ensure compliance with applicable laws, regulations, and trade agreements. 

ORA management did not provide adequate evidence that ORA had a formalized 

and documented method to select audit candidates for Focused Assessments 

and Quick Response Audits. 

FocusedAssessmentsandQuickResponseAudits

According to ORA’s charter, the purpose of the regulatory audit function is to 

concentrate CBP’s resources on high-payoff and high-risk transactions. ORA uses 

a database composed of information from other CBP systems to help identify 

high-risk importers for Focused Assessments. 

www.oig.dhs.gov 10 	 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

For Focused Assessments, ORA’s audit selection process takes approximately 10 

months. Once it makes its initial selections, ORA narrows the field of potential 

audit candidates, first at a conference of ORA staff and stakeholders, and second 

at individual field offices, after which ORA adds the audit candidates to the 

annual audit plan. 

Before ORA auditors begin a new audit, they perform additional analysis of 

importer data to determine if the importer is still a viable audit candidate. 

According to ORA officials, importers may no longer be good candidates for audit 

for multiple reasons. For instance, the importer may no longer import 

merchandise into the United States, may be importing under a new name or 

importer number, or may have merged with another company. ORA has not 

documented and formalized the current methodology for audit selection to 

ensure that staff use the same criteria to select the highest risk importers for 

audit. 

In addition to Focused Assessments, ORA headquarters receives Quick Response 

Audit referrals from U.S. ports, Immigration and Customs Enforcement, and 

various CBP offices. According to ORA officials, the Field Directors are 

responsible for overseeing the audit selection process in their field offices. 

Headquarters provides the Quick Response referrals annually to the field offices. 

According to ORA management, when the lists of referrals are received, the field 

office contacts the referring official to determine whether the importer is still 

considered high risk. 

Currently, ORA’s policies and procedures do not document the Quick Response 

Audit referral process. In addition, criteria affecting the adequacy of information 

collected and the ability to make informed decisions are not fully established. 

Without a documented plan outlining prioritized criteria, it is difficult for ORA to 

ensure that it is selecting the highest risk candidates for audit. ORA should 

document best practices from each field office to develop a standardized process 

for selecting Quick Response Audits. By standardizing the process, ORA could 

ensure that its field offices consistently apply its methodology to identify the 

highest risk importers for audit and improve continuity, regardless of 

organizational changes such as staff departures, new hires, or reorganizations. 

ORA’s current audit selection process for both Focused Assessments and Quick 

Response Audits resulted in the cancellation of 413 audits from FY 2008 to FY 

2010; audit staff charged approximately 17,391 hours to those canceled audits. 

ORA cancels audits for a number of reasons. For instance, the importer may no 

longer import merchandise into the United States, may have filed for 

www.oig.dhs.gov 11 OIG-12-117 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

bankruptcy, or the CBP referring official may no longer require audit services on 

the audit. Without established and documented selection criteria, ORA staff 

have selected audits that cannot be performed and as a result are canceled. 

Conclusion

We believe ORA can better manage the audit selection process and reduce the 

number of cancellations by establishing and documenting audit selection criteria 

and streamlining its audit selection process. With an established, documented 

process, ORA will have greater assurance that the highest risk importers are 

selected for audit. 

ORA agrees that the process can be streamlined and indicated that it is planning 

to develop a Web-based system to improve the process and provide the 

capability to regularly update importer information. In addition, ORA will 

develop a Standard Operating Procedure (SOP) to document the annual audit 

planning process. ORA also agrees that the Quick Response Audits process can 

be improved by using best practices and developing a structured SOP. 

GuidanceforCollaboratingwithCollectionOfficials

When an ORA audit identifies duty owed to the U.S. Government, ORA issues its 

report to the pertinent CBP Port Director (action official). The action official may 

then decide to pursue collection of unpaid duties or revenues. ORA’s audit 

manual outlines the procedures for collaborating with and providing collection 

information to action officials. ORA reports that it has a number of procedures 

to communicate, coordinate, and follow up with collection officials. The current 

ORA audit manual provides a broad overview of the collection process;4

however, it does not—

•	 Fully explain the roles and responsibilities of ORA personnel; 

•	 Provide timelines for issuing collection requests; and 

•	 Adequately explain special issuance procedures in the event of delays or 

disagreements. 

ORA’s unclear collection referral policy may affect auditors’ ability to provide 

adequate information for collection officials to take action. If CBP officials do not 

4 Chapter 12, Enforcement Issues, Section 6: Violations Discovered During an Audit.

www.oig.dhs.gov 12 	 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

have sufficient evidence to initiate collections, they may not be able to collect 

duty underpayments.

ORA does not have the authority to collect underpayments, but it has the 

responsibility to advise the appropriate CBP collection officials of the amounts to 

collect. From FY 2008 to FY 2010, ORA identified approximately $154.2 million in 

lost revenue to CBP. As of June 2011, CBP had collected approximately $63.8 

million, or 41 percent of the revenue identified. Of the remaining $90.4 

million— 

•	 $35.7 million was reduced for various reasons such as mitigation, statutes of 

limitation, changes in applicable laws, legal rulings, or companies’ financial 

positions; and 

•	 $54.7 million is still outstanding, pending mitigation or collection. 

Conclusion

ORA works with other CBP organizations in the CBP collection process. ORA 

needs to update its guidance on collection referrals to clearly identify roles and 

responsibilities of ORA personnel, provide timelines for collection requests, and 

define special issuance procedures to improve collaboration. In addition, ORA 

should improve collaboration with other components involved in CBP’s 

collection process. With improved guidance and collaboration, ORA may be able 

to maximize collections and better protect U.S. Government revenues. ORA 

agrees with this finding and is developing a directive to improve in this area. The 

directive will provide ORA personnel and CBP collection officials with specific 

instructions to resolve ORA audit findings and recommendations. The directive 

will also establish procedures to facilitate implementing audit recommendations, 

monitor the progress of implementation, and report results of resolved audits.

Recommendations

We recommend that the Assistant Commissioner for International Trade direct 

the Office of Regulatory Audit to: 

Recommendation#1:

Identify audit standards to be followed and ensure that all audit activities are 

conducted in compliance with those standards or identify exceptions in audit 

reports. 

www.oig.dhs.gov 13 	 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Recommendation#2:

Revise and update ORA’s audit manual to comply with all current GAGAS. 

Recommendation#3:

Revise the internal quality control process to ensure that the new ORA audit 

manual and GAGAS are followed. 

Recommendation#4:

Develop formal guidance outlining the current audit selection process for ORA’s 

audits. 

Recommendation#5:

Update, issue, and implement guidance to improve coordination with ORA 

stakeholders involved in the revenue collection process. 

ManagementCommentsandOIGAnalysis

The OIG conducted an objective assessment of the CBP ORA program using the 

standards outlined by the Council of Inspectors General on Integrity and 

Efficiency. The OIG audit work was conducted according to current professional 

audit standards for performance audits outlined in GAGAS. The audit report 

provides examples to help illustrate and clarify the deficiencies identified. The 

OIG met with CBP to address the issues raised concerning the audit information 

presented in the report. CBP has agreed with all five recommendations and is 

taking corrective actions to address the deficiencies identified in this report. 

CBPCommentstoRecommendation#1

Concur. According to CBP, ORA is revising its audit manual and training staff to 

address the requirements related to the areas identified in this audit report. 

ORA is also reassessing certain types of assignments and will determine whether 

those activities should be classified as something other than an audit. CBP plans 

to have its corrective action implemented by March 31, 2013. 

OIGAnalysis

We consider the recommendation resolved because CBP’s actions satisfy the 

intent of the recommendation, and CBP has provided a plan of action and 

www.oig.dhs.gov 14 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

milestones to implement corrective actions. However, the recommendation will 

remain open until we can verify, through review of supporting documentation, 

that the revised ORA audit manual and associated training have been completed.

CBPCommentstoRecommendation#2

Concur. According to CBP, the ORA audit manual will be fully updated to reflect 

the current version of GAGAS. Specifically, the issuance of updated chapters will 

address the revisions that have been made to the Field Work and Reporting 

Standards in the December 2011 revision of GAGAS. In the interim, ORA has 

updated the existing chapters to line out superseded sections and provide 

references to where the current policies and procedures can be found in order to 

provide a more complete, organized, and easily accessible audit manual. CBP 

plans to have its corrective action implemented by March 31, 2013. 

OIGAnalysis

We consider the recommendation resolved because CBP’s actions satisfy the 

intent of the recommendation, and CBP has provided a plan of action and 

milestones to implement corrective actions. However, the recommendation will 

remain open until we can verify, through review of supporting documentation, 

that the revised ORA audit manual and associated training have been completed.

CBPCommentstoRecommendation#3

Concur. According to CBP, it will establish a working group to evaluate the 

current field quality assurance program and develop a proposal to strengthen 

and revise its internal quality control process. CBP plans to have its corrective 

action implemented by March 31, 2013. 

OIGAnalysis

We consider the recommendation resolved because CBP’s actions satisfy the 

intent of the recommendation, and CBP has provided a plan of action and 

milestones to implement corrective actions. However, the recommendation will 

remain open until we can verify, through review of supporting documentation, 

that the internal quality control process has been strengthened based on the 

working group’s recommendations. 

www.oig.dhs.gov 15 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

CBPCommentstoRecommendation#4

Concur. According to CBP, it is developing formal guidance and documenting the 

current audit selection process. CBP plans to have its corrective action 

implemented by March 31, 2013. 

OIGAnalysis

We consider the recommendation resolved because CBP’s actions satisfy the 

intent of the recommendation, and CBP has provided a plan of action and 

milestones to implement corrective actions. However, the recommendation will 

remain open until we can verify, through review of supporting documentation, 

that the formal guidance outlining the planning processes has been completed. 

CBPCommentstoRecommendation#5

Concur. According to CBP, it is coordinating with stakeholders and has 

developed a draft CBP Directive, which establishes procedures for the 

implementation and resolution of ORA audit findings and recommendations. 

CBP plans to have its corrective action implemented by March 31, 2013. 

OIGAnalysis

We consider the recommendation resolved because CBP’s actions satisfy the 

intent of the recommendation, and CBP has provided a plan of action and 

milestones to implement corrective actions. However, the recommendation will 

remain open until we can verify, through review of supporting documentation, 

that the draft Directive has been finalized and the ORA audit manual has been 

updated to reflect the revised process. 

www.oig.dhs.gov 16 OIG-12-117 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

AppendixA

Objectives,Scope,andMethodology

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 

established by the HomelandfSecurityfActfoff2002 (Public Law 107-296) by amendment 

to the InspectorfGeneralfActfoff1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the Department. 

The ranking member of the Senate Committee on Finance requested that we conduct an 

audit of trade compliance and revenue collection programs, including management 

enforcement of laws, regulations, and procedures designed to ensure revenue collection 

and protection for the CBP ORA. To address the Senator’s request, we reviewed (1) 

compliance with GAGAS, (2) audit selection, and (3) revenue collection. 

We reviewed audits completed from FY 2008 through FY 2010. We visited six field 

offices (Charlotte, Chicago, Philadelphia, Long Beach, New York, and San Francisco) and 

one branch office (Denver) to conduct our review. The locations were selected based 

on the highest amounts of uncollected revenue from audit findings. We evaluated 

internal controls that were pertinent to the audit objective by reviewing ORA policies 

and quality assurance procedures.

Our analysis of ORA’s audit tracking system showed that the office completed 1,053 

audits during FYs 2008, 2009, and 2010. To determine whether ORA is complying with 

GAGAS, we reviewed 30 audits. We judgmentally selected the audits based on the 

different types of audits performed at the offices we visited and the amounts of 

uncollected revenue from audit findings. Our review included analysis of audit reports 

and audit documentation, as well as interviews with key staff. As part of our audit 

sample, we also reviewed two randomly selected audits that did not result in 

recommended collection of revenue. To review each audit and identify any departures 

from GAGAS, we analyzed audit documentation using applicable and selected portions 

of the GuidefforfConductingfPeerfReviewsfoffthefAuditfOrganizationsfoffFederal Officesfof

InspectorfGeneral, dated March 2009. We also compared the ORA audit manual with 

2007 GAGAS to identify areas of deficiency in ORA’s policy. 

To determine how ORA analyzes risk for each importer, we reviewed the audit selection 

process; reviewed ORA’s audit manual; interviewed ORA management officials, Field 

Office Directors, Assistant Directors, and Program Managers at sites visited; conducted a 

survey of all Field Office Program Managers; reviewed the audit selection database and 

criteria used; and analyzed audit results reported in ORA’s management information 

system. 

www.oig.dhs.gov 17 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

To determine whether ORA is structured to be independent of the importers, we 

reviewed the audit reporting process. We interviewed Port Directors to determine their 

role in collecting the money that ORA has determined is due to the U.S. Government. 

We interviewed Import Specialists to determine their role in collecting funds that ORA 

has determined are owed to the U.S. Government. We interviewed Fines, Penalties, and 

Forfeitures Officials at five of the seven sites visited to determine the nature of their 

role in the collection process; these interviews allowed us to better establish ORA’s 

independence. 

We conducted this performance audit between April and October 2011 pursuant to the 

InspectorfGeneralfActfoff1978, as amended, and according to generally accepted 

government auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our

findings and conclusions based upon our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions based upon our 

audit objectives. 

www.oig.dhs.gov 18 OIG-12-117 
OFF

 D

ICE OF INSPECTOR GENERAL 

epartment of Homeland Security 

AppendixB

ManagementCommentstotheDraftReport

1300 Pennsylvania Avenue NW 

washington, DC 20229 

u.s. Customs and 

Border Protection 

August 7, 20J2 

Mr. Charles K. Edwards 

Acting Inspector General 

U.S. Department of Homeland Security 

245 Murray Drive, SW, Build ing 410 

Washi ngton, OC 20528 

Re: Draft OIG Report, "Audit of Customs and Border Protection's Office of Regulatory 

AuLiit" (Pnljcct No. 1()-I()O-AlJD-CBP) 

Dear Mr. Edwards: 

Thank you for the opportunity to review and comment on this report. The U.S. Customs 

and Border Protection (CBP) appreciates the Department of Homeland Security Office of 

Inspector G~neral's (OICl's) wmk in planning and t:llmlw.;ting its r~ vit:w and issuing this 

report. 

'111C dran repnrt indud~cl several r~t:tJmmc i(Jns that th~ CRP Office nr In tem<ltion<li 

Trade, OOke of Regulatory Audit (ORA) ean take to enhance its overall effectiveness, 

and actions are already underway to implement these recommendations. We believe, 

however, Lhat the n::pmtneeLis additional co nl ~xt and p~rsp~ct vl: tll hdp cnsure a "culd 

readcr" is not left with any mistaken impressions about ORA audit erforts. 

For example, the report states thai ORA is responsible for enforcing compliance; 

however, it is important to nOlc that ORA., with only about 400 auditors nationwide. 

representsjust one small pal1 of a much larger CBP trade processing, oversight, and 

enforcement process related to the collection of revenue underpayments and importer 

noncompliance. Over half the merchandise for sale in U.S . markets comes rrom abroad. 

and in 20 I I the total value of all imp0i1s into the United States was more than $2.3 

trillion. For eBP- whose mission is to prcvent terrorists and terrorist weapons from 

entering the United States, while facilitating the flow oflegitimate trade and travelprocessing these imports means handling 29.5 million emr)' summaries with over 117.8 

million li nes and collecting $37.2 billion in revenues. ORA's primarily focus is on fac tfinding in support of olher port end program ortices charged with the actual processing of 

entries and collectioll of duties. MallY othc:r lcvds of targeting, verification, and 

enforcement occur in real time beyond the scope arORA's area of iniluencc and audit 

practices. 

www.oig.dhs.gov 19 OIG-12-117 
OF

 

FICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Additionally, while the OlG's report focused on ORA involvement in reven ue protection, 

it should he nuted th aI there arc m,my fi:ldllr" l:lIllside red oUlside the ORA audit process 

that impnct CBP's nbility La collect recommended revenue. For instance, recommended 

amounts arc sometimes reduccd beca use of the acceplance of compromise offers when an 

importer demonstrates an inability to pay the full amount recommended. It also should 

be recognized that many other ORA efforts have resulted in va luable nonrevenue 

impacts. In FY 20 11 , for example, ORA completed more than 350 engagemenls 

addressin g a di verse range of areas includi ng revenue protection, intell ectual property 

rights, agriculture, import safety, antidumping and countervailing duties (ADiCVD), free 

mule a~reernenls , amI a irline user fees. In Fulfilli ng CBP's resrxHlsibiliLy for enForcing 

the AD/CVD Inw, ORA helped U.S. companies compete with fore ign industry by 

conducting audits of importers suspected of willfully Circumve nti ng the provisions of the 

f\D/CVO law. ORA also helped combat trade fraud and other criminal activities by 

providing technical assistance related to money laundering, illegal immigratio n, visa 

fraud, and human smuggling. 

In addition, OIG reported that ORA needs to ensure that its audi ts are conducted in 

accordance with current government auditing standards- CBP agrees and, as previously 

stated, is taking actions to do so, especiall y in regards to ensuring that ORA work is 

appropriately documented in accordance whh these standards. However, we believe the 

report could more cl early state the scope and objecti ves ofOIG's review. wh ich did not 

include validating the propriety cfORA 's audit findings and conclusions, with which the 

O IG has nOllaken except ion. 

ORA is committed to ensuring the accuracy and completeness of its findings and to 

communicating. coordinating, a nd foll owing up with others to resolve and implement its 

recommendations, as appropriate. This incl udes: 

• 

• 

• 

working closely with the responsible CBP officials throughout the audillo ensure 

they have the infomlation and documents needed to implement Ihe enforcement 

<Jelinn and audit recnmmendations, such as incl ud ing CBI' Office of Field Operations 

Import Specia lists on audit teams; 

obt aini ng concurrence with audit findings and recommendations from Action 

Offici <tIs prior to repon issuance; 

using the Commercial Enforcement Analysis Response process to ensure that 

signifi cant commerc ial vio lations identifi ed in ORA audits receive prioTl ty; and 

monitoring lhe status of the implementation of audit recommendations by following 

up with lhe responsible cnp officials every 90 days and recording the information in 

Ol{"'\ 's management informati on systems. 

The drnft rcport contained five recommendations with which COP concurs. Specifi cally, 

OIG recommended that the Assistant Commissioner for International Trade direct ORA 

to: 

2 

www.oig.dhs.gov 20 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

 Department of Homeland Security 

Recommendation #1: Identify audit standards 10 bc followed and ensure that all audit 

activities are conducted in compliance with those standards or identify exceptions in audit 

report". 

Response: Concur. ORA will ensure that the updated audit manual and associated 

tmining t!mphasizes the requirements related to the areas in which oro cited deficiencies. 

ORA is also reassessing certain types of assignments and will determine whether those 

activities should be classified as something other than an audit. Estimated Completion 

Date (ECD): ~Iarch 31. 2013. 

Recommendation #2: Revise ~nd update ORA 's ~udit m~n llo comply with all 

current GAGAS. 

Response: Concur The audit manual will be fu ll y updated 10 reflect thc current vcrsion 

of Generally Accepted Govemmcnt Auditing Standards (GAGAS). :\10rc specifically, 

the issuance of updated chapters will address the revisions that have been made to the 

Field \\lork and Reponin g Standards in the f1ecemher 2011 Revision ofGACiAS. In the 

interim, ORA has updated the existing chaptcrs to linc out superseded scctions and 

provide references to where the current polie ics and procedures can be found in order to 

provide a more compll:te, organized, amI easily accessible aullit IllallU<:lI ECD: 

',,1arch 31, 2013. 

RCCUmlllt:ndalillll #3: Revise the internal quality control process to Cllsur!! thc new 

ORA aud it manual and GAGAS arc followed. 

Response: Concur. ORA wiil establish a working group to evaluate the current ficld 

quality assurancc program and dcve lop a proposal to strengthen and revise its internal 

qll~lity control process. ECD : March 31, 20 13. 

Recommendation #4: Develop formal guid ance outlining the current audit selection 

process for ORA's audits. 

Response: Concur. ORA is developing formal guidance and documenting the current 

process it has in plRce. ECT1: :\1arch 31 , 2013 . 

Recommendation #5: Update, issue, and implement guidance to improve coordination 

witll ORA stakl:holuers involved in the revenue collection process 

Response: Concur. ORA is coordinating with stakeholders and has developed a draft 

CfiP Directive, wh ich estab lishe~ procedures for the implementation and resolution of 

ORA audit find ings and recommendations. ECD: March 3 \. 2013. 

3 

www.oig.dhs.gov 21 OIG-12-117 
O

 

FFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Again, thank you for the opportunity to review and comment on this draft report. 

Teclmical comments were previously provided under sepamte cover. Plc(lsC fee! free to 

contact me or Mr. Joseph Westmoreland, Deputy Director, Management Inspections 

Division, at (202) 325~ 7556, if you have any questions. We look forward to working 

with you in lhe futun:. 

Sincerely, 

Assistant Commissioner 

Office of lntcma l Affairs 

4 

www.oig.dhs.gov 22 OIG-12-117 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

AppendixC

MajorContributorstoThisReport

Paul Wood, Director 

Stephanie Christian, Audit Manager 

Jeanette Hyatt, Auditor 

Carolyn Floyd, Auditor 

Keith Nackerud, Program Analyst 

Rebecca Mogg, Program Analyst 

Dianne Leyva, Program Analyst 

Chris Byerly, Referencer

www.oig.dhs.gov 23 OIG-12-117 
 





 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

AppendixD

ReportDistribution

DepartmentofHomelandSecurity

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs

Assistant Secretary for Office of Legislative Affairs 

Director of Local Affairs, Office of Intergovernmental Affairs 

OfficeofManagementandBudget

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress

Congressional Oversight and Appropriations Committees, as appropriate 

www.oig.dhs.gov 24 OIG-12-117 
 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this document, please call us at (202) 254-4100, fax your 

request to (202) 254-4305, or e-mail your request to our Office of Inspector General 

(OIG) Office of Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. 

For additional information, visit our website at: www.oig.dhs.gov, or follow us on Twitter 

at: @dhsoig. 

OIG HOTLINE 

To expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any 

other kinds of criminal or noncriminal misconduct relative to Department of Homeland 

Security (DHS) programs and operations, please visit our website at www.oig.dhs.gov 

and click on the red tab titled "Hotline" to report. You will be directed to complete and 

submit an automated DHS OIG Investigative Referral Submission Form. Submission 

through our website ensures that your complaint will be promptly received and 

reviewed by DHS OIG. 

Should you be unable to access our website, you may submit your complaint in writing 

to: DHS Office of Inspector General, Attention: Office of Investigations Hotline, 245 

Murray Drive, SW, Building 410/Mail Stop 2600, Washington, DC, 20528; or you may 

call 1 (800) 323-8603; or fax it directly to us at (202) 254-4297. 

The OIG seeks to protect the identity of each writer and caller.