Supply Chain Security: Providing Guidance and Resolving Data Problems Could Improve Management of the Customs-Trade Partnership Against Terrorism Program
Published: 2017-02-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The economic well-being of the United States depends on the movement of millions of cargo shipments throughout the global supply chain—the flow of goods from manufacturers to retailers or other end users. However, cargo shipments can present security concerns. CBP is responsible for administering cargo security and facilitating the flow of legitimate commerce. CBP has implemented several programs as part of a risk-based approach to supply chain security. One such program, C-TPAT, is a voluntary program in which CBP staff validate that members' supply chain security practices meet minimum security criteria. In return, members are eligible to receive benefits, such as a reduced likelihood their shipments will be examined.
This report assesses the extent to which (1) CBP is meeting its security validation responsibilities, and (2) C-TPAT members are receiving benefits. GAO reviewed information on security validations, member benefits, and other program documents. GAO also interviewed officials at CBP headquarters and three C-TPAT field offices chosen for their geographical diversity; as well as select C-TPAT members and trade industry officials.
section_title: What GAO Found
paragraphs: Staff from U.S. Customs and Border Protection's (CBP) Customs-Trade Partnership Against Terrorism (C-TPAT) program have faced challenges in meeting C-TPAT security validation responsibilities because of problems with the functionality of the program's data management system (Portal 2.0). In particular, since the system was updated in August 2015, C-TPAT staff have identified instances in which the Portal 2.0 system incorrectly altered C-TPAT members' certification or security profile dates, requiring manual verification of member data and impairing the ability of C-TPAT security specialists to identify and complete required security validations in a timely and efficient manner. While the focus of CBP's staff was initially on documenting and addressing Portal 2.0 problems as they arose, the staff have begun to identify root causes that led to the Portal 2.0 problems. For example, CBP staff cited unclear requirements for the system and its users' needs, coupled with inadequate testing, as factors that likely contributed to problems. In response, CBP staff have outlined recommended actions, along with timeframes for completing the actions. The staff stated that they will continue to work on identifying and addressing potential root causes of the Portal problems through 2017. C-TPAT officials told us that despite the Portal 2.0 problems, they have assurance that required security validations are being tracked and completed as a result of record reviews taking place at field offices. However, these field office reviews were developed in the absence of standardized guidance from C-TPAT headquarters. While the current validation tracking processes used by field offices do account for security validations conducted over the year, standardizing the process used by field offices for tracking required security validations could strengthen C-TPAT management's assurance that its field offices are identifying and completing the required security validations in a consistent and reliable manner.
CBP cannot determine the extent to which C-TPAT members are receiving benefits because of data problems. Specifically, since 2012, CBP has compiled data on certain events or actions it has taken regarding arriving shipments—such as examination and hold rates and processing times—for both C-TPAT and non-C-TPAT members through its Dashboard data reporting tool. However, on the basis of GAO's preliminary analyses and subsequent data accuracy concerns cited by C-TPAT program officials, GAO determined that data contained in the Dashboard could not be relied on for accurately measuring C-TPAT member benefits. Also, CBP has likely relied on such questionable data since it developed the Dashboard in 2012, and, thus, cannot be assured that C-TPAT members have consistently received the benefits that CBP has publicized. C-TPAT officials stated that they are analyzing the Dashboard to finalize an action plan to correct the data concerns. It is too soon to tell, though, whether this process will fully address the accuracy and reliability issues. Despite these issues, C-TPAT officials are exploring new member benefits, and industry officials we met with generally spoke positively of the C-TPAT program.
section_title: What GAO Recommends
paragraphs: GAO is recommending that CBP develop (1) standardized guidance for field offices regarding the tracking of information on security validations, and (2) a plan with milestones and completion dates to fix the Dashboard so the C-TPAT program can produce accurate data on C-TPAT member benefits. DHS concurred with GAO's recommendations.

section_title: Letter
paragraphs: The economic well-being of the United States is dependent on the  expeditious flow of millions of cargo shipments that arrive each year by  land, sea, or air. Cargo shipments are an important segment of the  global supply chain—the flow of goods from manufacturers to retailers or  other end users—and can present significant security concerns. Within  the federal government, U.S. Customs and Border Protection (CBP), part  of the Department of Homeland Security (DHS), is responsible for  administering cargo security and reducing the vulnerabilities associated  with the supply chain, while facilitating the flow of legitimate commerce.  Balancing security concerns with the need to facilitate the free flow of  commerce remains an ongoing challenge for the public and private  sectors alike.
CBP has implemented several programs as part of a layered, risk- informed approach to supply chain security. The Security and  Accountability for Every Port Act of 2006 (SAFE Port Act) established a  statutory framework for key programs within CBP’s layered security  strategy that previously had not specifically been required by law. One  such program, the Customs-Trade Partnership Against Terrorism (C- TPAT), began in November 2001 and is a voluntary program in which  CBP officials work with private companies to review and validate their supply chain security practices, as well as the security practices of the  companies or entities in their global supply chains, to ensure they meet a  set of minimum security criteria defined by CBP. In return for ensuring  their supply chain security practices meet CBP’s minimum security  criteria, C-TPAT members are eligible to receive various benefits, such as  reduced scrutiny or expedited processing of their U.S.-bound shipments.  According to C-TPAT officials, as of September 2016, there were 11,490  C-TPAT members, whose collective shipments have accounted for over  half of all cargo by value entering the United States in recent years.
We previously reviewed and reported on the C-TPAT program in 2008.  At that time we found that, among other things, CBP faced challenges in  verifying that C-TPAT members’ security practices met CBP’s minimum  criteria, and CBP’s records management system did not identify interim  processing dates that would enable management or others to determine  CBP’s compliance with program requirements. We recommended that  CBP improve the security validation process, enhance its records  management system, and identify opportunities to establish performance  measures for improving supply chain security. CBP concurred with and  has since implemented the recommendations.
Given the importance of the C-TPAT program and its continued growth in  membership, you asked that we review the C-TPAT program. In  particular, this report addresses the following questions:  1.  To what extent is CBP meeting its security validation responsibilities?  2.  To what extent are C-TPAT members receiving benefits?
To address the first objective, we requested data from C-TPAT’s Portal  2.0, the data system designed to maintain C-TPAT program data—such  as members’ certification, security validation, and revalidation records— with the intent of reviewing the data to determine CBP’s timeliness and  completeness in meeting its security validation responsibilities. However, based on discussions with C-TPAT managers, as well as staff members  responsible for maintaining the Portal 2.0 system, we determined that  data from the system were not reliable because of functionality problems,  as discussed in more detail later in the report. We also obtained and  reviewed CBP documentation describing Portal 2.0 system requirements,  its development, the nature of Portal 2.0 problems C-TPAT staff have  experienced, and actions that CBP staff are taking to address these  problems. Further, we conducted interviews with officials from the C- TPAT program and CBP’s Office of Information Technology at CBP  headquarters, as well as C-TPAT field office directors, supply chain  security specialists (hereafter referred to as “security specialists”), and  their supervisors at three of C-TPAT’s six field offices in Los Angeles,  California; New York, New York; and Houston, Texas. These interviews  provided us with additional information about the Portal 2.0 problems and  the extent to which the problems have affected the security specialists’  efforts to (1) determine which C-TPAT members are due for security  validations or revalidations, (2) conduct those security validations or  revalidations, and (3) document the results. While the information  gathered from these site visits cannot be generalized to all C-TPAT field  office directors and security specialists, they provide insights into the  nature of the validation process and use of Portal 2.0 in conducting  security validations. We reviewed documentation and interviewed agency  officials to determine how C-TPAT officials assured that security  validations were identified and conducted, as needed, following the Portal  2.0 system problems that occurred in 2015. We also gathered information  on how C-TPAT headquarters officials solicit and review the field office  director security validation submissions and compared this process to  best practices on control activities, information, communication, and  monitoring as identified in Standards for Internal Control in the Federal  Government. We then reviewed CBP and C-TPAT’s efforts to test Portal  2.0 prior to deploying it and to address Portal 2.0 problems that have  arisen since it was deployed in August 2015. Finally, we interviewed a  representative from the Advisory Committee on Commercial Operations  to U.S. Customs and Border Protection (COAC) and a nongeneralizable  sample of trade industry association officials and C-TPAT members  selected to reflect a variety of different C-TPAT member industry types  (e.g., importers, highway carriers) to obtain their perspectives on security  validation and revalidation procedures; as well as any potential areas for  improvement for the C-TPAT program.
To address the second objective, we obtained and analyzed data  compiled by CBP on examination rates, hold rates, and average  processing times of cargo shipments from C-TPAT members as  compared to cargo shipments from non-C-TPAT members covering fiscal  years 2011 through 2015, the 5 most recent fiscal years for which these  data were available. In analyzing these data, we discovered that they  were not reliable for the purpose of reporting on the actual benefits  received by C-TPAT members, which we discuss in more detail later in  the report. After determining that the data were not reliable, we  interviewed cognizant CBP staff to explore the extent to which C-TPAT  officials had determined the causes of the data reliability issues and had  devised solutions. We compared the evidence we compiled to criteria on  effective information management practices identified in Standards for  Internal Control in the Federal Government, leading project  management practices identified in the Program Management Institute’s  A Guide to the Project Management Body of Knowledge, and  requirements of the SAFE Port Act. In addition, we reviewed information  describing C-TPAT benefits for which C-TPAT does not systematically  gather data because the benefits are difficult to quantify—such as access  to C-TPAT security specialists—as well as information on efforts to  potentially expand benefits provided to C-TPAT members. We  supplemented our data analyses and document reviews with testimonial  evidence gathered through interviews with C-TPAT officials at CBP  headquarters, as well as C-TPAT field office directors, supervisory  security specialists, and security specialists at the three C-TPAT field  offices mentioned earlier. We also interviewed officials in CBP’s Office of  Information Technology to discuss how C-TPAT benefit data were  compiled, as well as officials from the trade industry associations and C- TPAT members mentioned above to discuss their views on C-TPAT  program operations and benefits. While their views cannot be generalized  to the entire population of C-TPAT members, they do provide insights into  members’ perspectives on C-TPAT program benefits and challenges.
We conducted our work from September 2015 to February 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: The Global Supply Chain
paragraphs: Supply chain security is a principal element of CBP’s layered strategy to  protect commerce. In the post-9/11 environment, the movement of cargo  shipments throughout the global supply chain from foreign manufacturers,  suppliers, or vendors to retailers or other end users in the United States is  inherently vulnerable to terrorist actions. Every time responsibility for  cargo shipments changes hands along the global supply chain there is  the potential for a security breach. Thus, vulnerabilities exist that terrorists  could exploit by, for example, placing a weapon of mass destruction into a  container for shipment to the United States or elsewhere. Figure 1  illustrates key points of transfer involved in the global supply chain—from  the time that a shipment is loaded with goods at a foreign factory to its  arrival at the U.S. port and ultimately the retail facility or end user.
section_title: C-TPAT Program Structure and Membership
paragraphs: CBP initiated the C-TPAT program in November 2001 as part of its  layered strategy for overseeing global supply chain security. C-TPAT  aims to secure the flow of goods bound for the United States through  voluntary antiterrorism partnerships with entities that are stakeholders  within the international trade community—see table 1 for information on  the types of entities eligible for C-TPAT membership.
The SAFE Port Act established a statutory framework for the C-TPAT  program. In addition to formally establishing C-TPAT as a voluntary  government-private sector partnership program to strengthen and  improve the overall security of the global supply chain, the act codified  existing membership processes for the C-TPAT program and added new  components, such as time frames for certifying, validating, and  revalidating members’ security practices.
Through C-TPAT, CBP intends to enhance the security of the global  supply chain to the United States through partnership agreements, and by  reviewing and periodically validating C-TPAT members’ security  practices. As a first step in C-TPAT membership, an entity must sign an  agreement with CBP signifying its commitment to enhance its supply  chain security practices consistent with C-TPAT minimum security criteria  and to work to enhance security throughout its global supply chain to the  United States. The partnership agreements that C-TPAT members sign  provide CBP with the authority it needs to validate members’ security  practices.
According to CBP officials, as of September 2016, there were 11,490 C- TPAT members. Importers, representing 37 percent of the C-TPAT  members, were the largest C-TPAT member group and, as shown in  Figure 2, the remaining 63 percent of C-TPAT members were distributed  among other trade industry sectors. Since we last reported on the C- TPAT program in April 2008, CBP has expanded C-TPAT membership to  include other trade industry sectors, such as third party logistics providers  and exporters.
According to CBP officials, as of September 2016, CBP employed 146  security specialists (to include supervisory security specialists) who are to  certify or validate members’ security practices and provide other services  for C-TPAT members, such as serving as points of contact concerning C- TPAT program responsibilities. The security specialists operate from C- TPAT headquarters in Washington, D.C., and six field offices throughout  the United States: Los Angeles, California; Miami, Florida; Newark, New  Jersey; Buffalo and New York, New York; and Houston, Texas. The C- TPAT program, which resides within CBP’s Office of Field Operations  (OFO), was funded at over $36 million in fiscal year 2016.
section_title: C-TPAT Membership Requirements and Benefits
paragraphs: CBP employs a multistep process, led by its security specialists, for  accepting entities as members in the C-TPAT program, validating their  supply chain security practices—to include the practices of their supply  chain partners—and providing them benefits. This screening process,  which CBP has documented through standard operating procedures,  consists of five key steps, as shown in figure 3 and described in greater  detail in appendix I.
To facilitate the member screening process, C-TPAT staff gather, review,  and prepare documentation using an information-sharing and data  management system called Portal 2.0. C-TPAT officials use Portal 2.0 to  review C-TPAT member-submitted information and record certification  and validation results. In addition, C-TPAT member companies use Portal  2.0 to submit program applications, security profiles, and other  information to C-TPAT officials.
In exchange for allowing C-TPAT staff to review and validate their supply  chain security practices, C-TPAT members become eligible to receive  benefits—such as reduced likelihood of examinations of their shipments,  expedited shipment processing, and greater access to CBP staff and  information—once their membership is certified. Upon certification, C- TPAT importers and exporters only are granted Tier I status. Importers  and exporters whose supply chain security practices have been validated  by C-TPAT security specialists are granted either Tier II (meeting  minimum security criteria for their business type) or Tier III (employing  innovative supply chain security measures that are considered best  practices and exceed minimum security criteria) status. Tier II and Tier  III C-TPAT importers and exporters receive increasingly reduced risk  scores (i.e., as tier level increases, risk scores are lowered) in CBP’s  Automated Targeting System (ATS), thus generally reducing the  likelihood that their shipments will be examined upon entering U.S.  ports. Specific benefits offered to C-TPAT members, as listed in CBP’s  C-TPAT Program Benefits Reference Guide, can be found in Table 2.
While C-TPAT membership can reduce the probability of CBP selecting  members’ shipments for examinations, holds, or other enforcement  actions, CBP maintains the authority to conduct appropriate enforcement  actions. In addition, other federal agencies (e.g., U.S. Department of  Agriculture, Food and Drug Administration, etc.) can conduct inspections  of arriving cargo shipments based on their own selection criteria.
section_title: CBP Is Taking Steps to Resolve Data System Problems, but Could Take Additional Steps to Ensure Staff Meet Security Validation Responsibilities
subsections: section_title: Data System Problems Have Led to Challenges in Identifying and Completing C-TPAT Member Security Validations
paragraphs: C-TPAT staff have faced challenges in meeting C-TPAT security  validation responsibilities in an efficient and timely manner because of  problems with the functionality of C-TPAT’s data management system  (Portal 2.0). In particular, while the intended purpose of transitioning from  Portal 1.0 to Portal 2.0 in August 2015 was to improve functionality and  facilitate communication between security specialists and C-TPAT  members, a series of problems arose as a result of this transition that  have impaired the ability of C-TPAT staff to identify and complete  required C-TPAT member certification procedures and security profile  reviews in a timely and efficient manner. For example, C-TPAT field office  directors, supervisory security specialists, and security specialists we met  with identified numerous instances in which the Portal 2.0 system  incorrectly altered C-TPAT members’ certification or security profile dates.  In particular, when C-TPAT officials transferred responsibility for some C- TPAT members’ accounts from one security specialist to another, those  members’ certification dates were sometimes incorrectly changed. These  altered dates, in turn, have interfered with security specialists’ ability to  properly identify and track which member companies are due for an  annual security profile review.
In addition to the impact they have had on the daily responsibilities of  security specialists, Portal 2.0 problems also made it more difficult for C- TPAT managers to complete the C-TPAT program’s 2016 annual work  plan for assigning responsibilities for member security validations and  revalidations to its security specialists. C-TPAT managers have typically  relied on data from Report Builder, a reporting module within Portal, to  develop annual work plans. However, in November 2015, C-TPAT staff  had difficulty using Report Builder to access historical data from Portal 1.0  that were to have migrated to Portal 2.0 regarding C-TPAT members that  were due to have security validations or revalidations conducted in 2016.  As a result, the initial 2016 work plan did not have accurate data on the  number of C-TPAT members due for security validations or revalidations.  In addressing this issue, C-TPAT’s Director pointed out that while the  Portal is intended to facilitate the ability of security specialists to perform  their responsibilities, each security specialist is experienced and is not to  rely solely on the Portal to complete his or her job responsibilities. So, to  complete the 2016 work plan, C-TPAT managers implemented a  requirement for security specialists in each of C-TPAT’s six field offices to  manually review documentation, such as prior security validation reports,  for each of their assigned members (approximately 80 to 100 members  per security specialist) to verify or correct the certification and security  validation dates recorded in Portal 2.0 and to ensure that the 2016 work  plan identified all members due for security validations or revalidations in  2016. C-TPAT officials then used the information gathered through these  additional manual steps to update and correct the 2016 work plan.
Further, security specialists we met with told us that they had difficulty  saving and submitting security validation reports to C-TPAT managers in  a timely manner because of Portal 2.0 problems. Instead of submitting the  validation reports directly through the Portal, security specialists told us  they sometimes had to prepare draft security validation reports offline and  copy and paste information section by section in order for Portal 2.0 to  accept and save the security validation reports. While these alternate  means of verifying validation responsibilities and mitigating Portal 2.0  problems have generally allowed security specialists to complete their  required annual security profile reviews and validations, the security  specialists stated that these work arounds are time consuming and have  necessitated the use of overtime. The C-TPAT Director acknowledged the  problems her staff have experienced with Portal 2.0 and that these  problems have led to some inefficient work practices.
Problems with Portal 2.0 have also had an adverse impact on C-TPAT  members. For example, security specialists told us that some C-TPAT  members have experienced difficulties viewing validation report findings  because of problems in accessing Portal 2.0. If validation reports contain  findings regarding security practices that fail to meet the minimum  security criteria that members are to address, the members are to  respond to C-TPAT staff within 90 days about their plans for addressing  the findings and improving their supply chain security practices to meet  CBP’s minimum security criteria. Because Portal 2.0 problems have  sometimes prevented C-TPAT members from accessing and responding  to validation reports in a timely manner, C-TPAT managers told us they  have needed to grant these members additional time to respond to  validation report findings.
section_title: CBP Staff Are Taking Steps to Address Data System Problems
paragraphs: CBP staff from the C-TPAT program and the Office of Information  Technology’s Targeting and Analysis Systems Program Directorate  (TASPD) have taken steps to address problems with Portal 2.0. When  problems with Portal 2.0 first surfaced in August 2015, Portal users in the  C-TPAT field offices began recording problems in spreadsheets. C-TPAT  headquarters officials collected these spreadsheets and sent them to  TASPD managers to address. In an effort to improve coordination and  communication between C-TPAT and TASPD staff, in February 2016,  CBP officials developed a more centralized and systematic process for  documenting, prioritizing, and addressing Portal 2.0 problems as they  arise. In particular, a single C-TPAT point of contact receives a list of  Portal problems from field office security specialists, creates a work ticket  for each problem, and works with TASPD staff to prioritize those work  tickets and group them into batches. TASPD staff then attempt to identify  the causes of the batched Portal 2.0 problems and test the proposed fixes  with input from the end users (primarily security specialists and C-TPAT  field office directors) to ensure the problems are corrected during 2 to 3  week intervals called “sprints.” C-TPAT field office staff we met with told  us that while these sprints have generally resolved the originally-identified  problems, the fixes have, at times, created new problems that affected  the accuracy of data and the usability of certain Portal 2.0 features. For  example, security specialists have encountered error messages when  trying to submit security validation reports for supervisory review and, in  fixing that problem, security validation reports became inadvertently  archived, which prevented supervisory security specialists from being  able to review and edit the reports.
Because of the continued Portal 2.0 problems, C-TPAT and TASPD staff  have worked together to identify root causal factors that led to the Portal  2.0 problems and are implementing actions to address those factors. For  example, TASPD staff cited unclear requirements for the Portal 2.0  system and its user needs as a factor that likely contributed to inadequate  system testing and continued problems. In response, TASPD and C- TPAT staff have begun efforts to better capture Portal 2.0 system  requirements and user needs and have incorporated more consistent end  user testing. Additionally, TASPD and C-TPAT headquarters staff began  having regular meetings with C-TPAT field office managers to institute a  more-encompassing approach for addressing and understanding system  requirements and Portal 2.0 functionality problems. As part of the root  cause analysis, TASPD staff have outlined recommended actions for  addressing causal factors that led to the Portal 2.0 problems, along with  the associated timeframes for completing these actions. While TASPD  and C-TPAT staff have already implemented some actions, such as  establishing a new team structure, the staff stated that they will continue  to work on identifying and addressing potential root causes of the Portal  2.0 problems and noted that this process will likely continue through  2017.
section_title: Issuing Standardized Guidance to Field Offices Could Better Assure Data on Security Validations Are More Consistent and Reliable
paragraphs: Despite the Portal 2.0 problems, C-TPAT headquarters officials and field  office directors we met with told us that they are assured that required  security validations are being identified and completed in a timely manner  because the field offices keep records on required and completed security  validations apart from data recorded in Portal 2.0. C-TPAT officials  provided us with documentation illustrating the steps taken by security  specialists and supervisors at the field offices to identify and complete the  required security validations. Field office directors or supervisors then  verify that the security validations were completed, as required, by the  end of each calendar year. We reviewed this documentation and verified  that field offices are tracking completed validations annually. C-TPAT  headquarters staff have delegated responsibility to field office directors for  ensuring that the required security validations are tracked and completed  and reported to headquarters each year, but headquarters has not issued  centralized guidance or standard operating procedures to be used by the  field offices to ensure that they are tracking and completing the required  security validations in a consistent manner. As a result, the field offices  have each developed their own varied approaches for tracking required  security validations and recording those that are completed. A C-TPAT  headquarters official responsible for reviewing security validation  information provided by the field offices stated that there may be value in  standardizing the approach field offices use to track and report on  completed security validations in order to ensure the data received and  reviewed by C-TPAT headquarters are more consistent and reliable.  While the current validation tracking processes used by field offices do  account for security validations conducted over the year, standardizing  the process used by field offices to track required security validations  could strengthen C-TPAT management’s assurance that its field offices  are identifying and completing the required security validations in a  consistent and reliable manner.
Standards for Internal Control in the Federal Government related to the  use of quality information state that management is to obtain relevant  information from reliable internal sources on a timely basis in order to  evaluate the entity’s performance. In addition, such quality information is  to flow down from management to personnel, as well as up from  personnel to management, to help ensure that key program objectives  are met. This upward communication also helps provide effective  oversight of internal controls. The internal control standards also call for  management to document responsibilities for operational processes  through policies.
Developing standardized guidance for its field offices to use in tracking  required security validations could further strengthen C-TPAT  management’s assurance that its field offices are identifying and  completing the required security validations in a consistent and reliable  manner.
section_title: CBP Cannot Determine the Extent to Which C-TPAT Members Are Receiving Benefits Because of Data Concerns
subsections: section_title: CBP Staff Have Concerns Regarding the Accuracy of C-TPAT Member Benefit Data
paragraphs: Since 2012, CBP has compiled data on certain events or actions it has  taken regarding arriving shipments—such as examinations, holds, and  processing times—for both C-TPAT and non-C-TPAT members through  its C-TPAT Dashboard. However, based on GAO’s preliminary analyses  of data contained in the Dashboard, and data accuracy and reliability  concerns cited by C-TPAT program officials, we concluded that CBP staff  are not able to determine the extent to which C-TPAT members are  receiving benefits, such as reduced likelihood of examinations of their  shipments and expedited shipment processing, compared to non- members.
We conducted preliminary analyses of C-TPAT program data from the  Dashboard to understand, for example, how the examination rates of C- TPAT members’ shipments compared with those of non-C-TPAT  members across different modes of transportation (air, truck, vessel, and  rail) for each year from fiscal year 2011 through fiscal year 2015. The  results of our analyses showed that C-TPAT members’ shipments did not  consistently experience lower examination and hold rates and processing  times compared to non-members’ shipments across the different modes  of transportation.
We shared the results from our preliminary analyses with the C-TPAT  Director and staff familiar with the C-TPAT Dashboard and they  expressed surprise that the data did not show more consistent benefits  for C-TPAT members as compared to non-C-TPAT members, and that  Tier II members did not consistently receive the benefit of lower  examination and hold rates or processing times as compared to Tier I  members. We further discussed that the findings from our analyses ran  counter to C-TPAT member benefits information published by CBP. In  particular, we noted that in its C-TPAT Program Benefits Reference  Guide, CBP asserts that entries filed by Tier III Partners are 9 times less  likely to undergo a security based examination than are entries filed by  non-C-TPAT members and that entries filed by Tier II Partners are about  3.5 times less likely to undergo a security examination than are those filed  by non- C-TPAT members. Further, CBP’s Congressional Budget  Justification for Fiscal Year 2016 states that C-TPAT importers are 4 to 6  times less likely to incur a security or compliance examination than those  for non-C-TPAT members.
Subsequent to our discussion with C-TPAT staff on the results of our  preliminary analyses and the apparent discrepancy with CBP-reported  benefits data, the C-TPAT Director and staff researched the data and  calculations within the Dashboard further. Based on their research, the C- TPAT officials stated that there appear to be errors in the data or formulas  used to compute various actions that are uploaded into the Dashboard,  such as shipment examinations, holds, and processing times. For  example, the C-TPAT Director stated that based on their research, they  discovered errors in the data contained in the Dashboard regarding the  number of CBP shipment examinations on the southwest border in 2015.
C-TPAT officials have not yet determined what accounts for the apparent  accuracy and reliability issues of data contained in the Dashboard. The C- TPAT Program Director explained that the Dashboard was developed in  response to a request for increased data on C-TPAT member benefits by  a former C-TPAT Program Director. The current Director noted that the C- TPAT office has not regularly reviewed the data contained in the  Dashboard. In addition, officials from the C-TPAT program, as well as from TASPD, explained that while the Dashboard has been in place since  2012, it has functioned in a limited operational mode, with data from the  Dashboard only being used internally by program management. The  officials stated that the Dashboard’s requirements are dated, and that  new requirements need to be verified and tested. They further stated that  because of competing priorities, CBP staff have not completed  verification, user acceptance testing, or periodic data checks. C-TPAT  officials noted, though, that C-TPAT and TASPD staff are in the process  of analyzing data contained in the Dashboard to finalize an action plan to  correct the data concerns. It is too soon for us to assess whether this  process will fully address the Dashboard accuracy and reliability issues.
Standards for Internal Control in the Federal Government state that  program management should use quality information to achieve the  entity’s objectives. Specifically, management is to obtain relevant data  from reliable internal and external sources based on identified information  requirements. These sources should provide data that are reasonably  free from error and bias and represent what they purport to represent.  Also, management should process data into quality information. Quality  information is to be, among other things, appropriate, current, complete,  and accurate. In addition, the SAFE Port Act requires CBP to extend  benefits, which may include reduced examinations of cargo shipments, to  Tier II and Tier III C-TPAT members. As mentioned earlier, the 2014 C- TPAT Program Benefits Reference Guide also cites reduced examination  rates for C-TPAT importers compared to non C-TPAT importers as a  benefit of the program. Further, project management criteria established  by the Project Management Institute state that it is necessary to establish  project objectives and outline a plan of action, via a project schedule with  major milestones, to obtain those objectives.
Because the data contained in the Dashboard cannot currently be relied  upon, CBP is not able to determine the extent to which C-TPAT members  have received benefits, such as lower examination or hold rates, or  reduced processing times of their shipments when compared to non-C- TPAT members. CBP has likely relied on such questionable data since it  developed the Dashboard in 2012, and, thus, cannot be assured that C-TPAT members have consistently received the benefits that CBP has  publicized.
section_title: Other C-TPAT Member Benefits Are Difficult to Quantify
paragraphs: Beyond shipment examination and hold rates, and processing times, CBP  does not gather data on its other stated C-TPAT member benefits. There  are a variety of reasons for this, including the inherent difficulty in being  able to quantify certain benefits that are more qualitative in nature, such  as having access to security specialists; or are difficult to meaningfully  quantify across ports because of the many differences that exist in  infrastructure from port to port. C-TPAT officials explained that, although  these other benefits are difficult to measure, they are of value to C-TPAT  members. The C-TPAT officials acknowledged that while the C-TPAT  program might be able to gather and track quantifiable data on some  additional benefits—such as increased mitigation of monetary penalties  for C-TPAT members—given the Portal 2.0 and Dashboard data  accuracy and reliability issues (as described earlier), they plan to focus  first on identifying and correcting these data issues for those benefits  currently tracked rather than trying to quantify and track other current  member benefits.
section_title: CBP is Considering Additional C-TPAT Member Benefits and a New Metric
paragraphs: In addition to the C-TPAT member benefits listed earlier, CBP staff are  working with trade industry partners and the COAC, to identify and  explore potential new benefits, as well as a metric for quantifying potential  cost savings for members. Trade industry officials we met with generally  spoke positively of the C-TPAT program and of CBP staffs’ efforts in  sharing information and listening to their concerns and suggestions for  enhancing the program. However, some trade industry officials we met  with have also expressed the desire for C-TPAT to improve and add  member benefits. In response to suggestions from members of the trade  community, C-TPAT staff said that they are considering some additional  benefits, such as the following:  Advanced Qualified Unlading Approval (AQUA) Lane: The AQUA  Lane pilot is a joint partnership between the C-TPAT program, sea  carriers, and world trade associations at select U.S. ports with the goal of  reducing the amount of time that the carriers must wait for releasing their cargo. At these pilot ports, select C-TPAT member vessel carriers, who  qualify under a set of predetermined requirements, are allowed to  offload—but not release—cargo containers arriving at one of the pilot  ports prior to CBP officials clearing the vessel carrier for release. AQUA  Lane was initially piloted at the ports of Oakland, California; Port  Everglades, Florida; New Orleans, Louisiana; and Baltimore, Maryland.  According to C-TPAT officials, the pilot has been well received by sea  carriers, who have expressed interest in seeing the program expanded to  other domestic sea ports. In response, CBP announced a phased  expansion of the AQUA Lane program, adding six ports in September  2016, an additional 10 ports in December 2016, with final implementation  to all remaining seaports to be completed in early 2017.
Trusted Trader Program: The Trusted Trader Program is a CBP-led  collaborative effort being tested that aims to enhance information sharing  between government agencies regarding importers’ efforts to enhance  supply chain security and comply with trade requirements. As this  program is expanded, one goal is to reduce redundancies in processing  steps, as well as in the vetting and validation procedures of the C-TPAT  and ISA programs. For example, under the Trusted Trader Program, CBP  may conduct C-TPAT supply chain security and ISA trade compliance  validations jointly, reducing time and resources that member companies must invest in these processes. However, the program has received  mixed reactions from members of the trade industry with whom we met.  While some members of the trade industry spoke favorably of the Trusted  Trader Program, other members questioned whether the program’s  benefits offered sufficient incentives compared to the costs and  administrative requirements.
Cost Savings Benefit Metric: CBP is in the process of reviewing a  metric regarding the cost savings derived by C-TPAT members as the  result of a reduced rate of shipment examinations. This metric was  proposed by a C-TPAT member in the summer of 2015 and accepted by  DHS consistent with the Government Performance and Results Act.  CBP began gathering data for this metric during fiscal year 2016;  however, C-TPAT officials noted that they need to revisit the integrity of  the supporting data that would be used in this metric as a result of the  concerns we and C-TPAT officials have raised before CBP can pursue  implementing such a metric.
section_title: Conclusions
paragraphs: CBP’s risk-informed approach to supply chain security focuses on  ensuring the expeditious flow of millions of cargo shipments into the  United States each year, while also managing security concerns. It is  critical that CBP manages the C-TPAT program in a way that enhances  the security of members’ global supply chains, while also providing  benefits that incentivize program membership. A lack of reliable data has  challenged CBP’s ability to manage the C-TPAT program effectively. In  particular, problems with the C-TPAT program’s updated Portal 2.0 data  system that began in August 2015 have impaired the ability of C-TPAT  staff to identify and complete required security validations in a timely and  efficient manner. While C-TPAT field offices have implemented  procedures for ensuring that required security validations are identified  and completed, these procedures are varied because C-TPAT  headquarters has not developed standardized guidance for its field offices  to follow. Taking steps to standardize C-TPAT field offices’ efforts to track  required security validations could strengthen C-TPAT management’s  assurance that its field offices are identifying and completing the required  security validations in a consistent and reliable manner. Further, because  the data contained in the Dashboard cannot be relied upon, CBP is not able to determine the extent to which C-TPAT members are receiving  benefits, such as lower examination or hold rates, or reduced processing  times of their shipments when compared to those for non-C-TPAT  members. Finally, because CBP has likely relied on such questionable  data since the Dashboard was developed in 2012, it does not have  reasonable assurance, consistent with federal internal control standards,  that C-TPAT members have consistently received the benefits that CBP  has publicized. Accurate and reliable data will also be important as CBP  considers adding additional member benefits and developing a cost  savings metric.
section_title: Recommendations for Executive Action
paragraphs: To ensure that C-TPAT program managers are provided consistent data  from the C-TPAT field offices on security validations, we recommend that  the Commissioner of U.S. Customs and Border Protection develop  standardized guidance for the C-TPAT field offices to use in tracking and  reporting information on the number of required and completed security  validations.
Further, to ensure the availability of complete and accurate data for  managing the C-TPAT program and establishing and maintaining reliable  indicators on the extent to which C-TPAT members receive benefits, we  recommend that the Commissioner of U.S. Customs and Border  Protection determine the specific problems that have led to questionable  data contained in the Dashboard and develop an action plan, with  milestones and completion dates, for correcting the data so that the C- TPAT program can produce accurate and reliable data for measuring C- TPAT member benefits.
section_title: Agency Comments and Our Evaluation
paragraphs: In December 2017, we requested comments on a draft of this report from  DHS. In January 2017, officials from CBP provided technical comments,  which we have incorporated into the report as appropriate. In addition,  DHS provided an official letter for inclusion in the report, which can be  seen in appendix II. In its letter, DHS stated that it concurred with our two  recommendations and has begun to take actions to address them. In  particular, for the first recommendation, DHS noted that the C-TPAT  program manager has selected a methodology that will include uniform  monthly reporting from C-TPAT field offices to the C-TPAT program  manager. DHS anticipates that these efforts will be put into effect by May  2017. We will continue to monitor CBP’s efforts in addressing this  recommendation.
Regarding the second recommendation, DHS noted that the C-TPAT  program manager has decided, in conjunction with CBP’S Office of  Information Technology, to terminate the existing Dashboard reporting  tool and, instead, create a new tool for providing accurate data for  measuring C-TPAT member benefits by the end of June 2017. We will  continue to monitor CBP’s efforts in addressing this recommendation.
We are sending copies of this report to the Secretary of Homeland  Security, appropriate congressional committees, and other interested  parties. In addition, the report will be available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7141, or groverj@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.
section_title: Appendix I: Further Details on the Customs- Trade Partnership Against Terrorism (C-TPAT) Member Screening Process
paragraphs: This appendix provides further details on the process used to screen  prospective members of the Customs-Trade Partnership Against  Terrorism (C-TPAT) program.  1.  Application and eligibility: An entity submits an application for C-TPAT  membership that includes corporate information (e.g., company size  and location), a supply chain security profile, and an agreement to  voluntarily participate in the C-TPAT program. In completing the  supply chain security profile, the entity is to conduct a comprehensive  self-assessment of its supply chain security procedures or practices  using the C-TPAT minimum security criteria for its specific business  type, such as importer, highway carrier, or customs broker. The  application is assigned to a supply chain security specialist to be  reviewed to determine if the applicant meets C-TPAT eligibility  requirements for its business type.  2.  Vetting: Once a security specialist determines an applicant is eligible  for C-TPAT membership, the security specialist is to conduct research  as part of the vetting process. Vetting involves a review of the entity’s  compliance with Customs laws and regulations; as well as any  violation history to identify information that might preclude C-TPAT  membership. Once any issues are resolved to U.S. Customs and  Border Protection’s (CBP) satisfaction, the entity can move on to the  certification stage.  3.  Certification: After vetting, a security specialist is to conduct a detailed  review of the entity’s security profile, looking for any weaknesses or  gaps in security procedures or practices, to determine whether  minimum security criteria for that entity’s business type are  adequately addressed. This review is to be completed and the  application approved or rejected within 90 calendar days from the  date the entity submits its security profile. If the security specialist  approves the security profile, the entity is certified as a C-TPAT  member and is eligible to begin receiving benefits.  4.  Validation: Once certified, a security specialist is to conduct a  validation of the security measures outlined in a certified member’s  security profile to ensure that they are reliable, accurate, effective,  and align with CBP’s minimum security criteria. As provided for in the  Security and Accountability for Every Port Act of 2006 (SAFE Port  Act), a member’s initial security validation is to be completed within 1  year of certification, to the extent practicable. During the validation  process, the assigned security specialist is to meet with the member’s  representatives to verify that the supply chain security measures  contained in its security profile are in place as described. If the  member is an importer operating a global supply chain, the security  specialist is to visit the member’s domestic site and at least one  foreign supply chain partner’s site (e.g., a manufacturer who supplies  goods). C-TPAT management and the security specialist assigned to  a member are to identify potential sites to visit based on research of  the member’s business history, import transportation modes, facility  locations, and other factors. To initiate the security validation, the  assigned security specialist is to provide the member a site visit  agenda and documents to help the member prepare for the visit, such  as a validation checklist. Upon completion of the security validation  process, the security specialist is to prepare a final validation report to  present to the member. The report may include recommendations to  improve security practices, as well as any required actions the  member is to take to conform to CBP’s minimum security criteria. The  security validation report is also to address whether the member  should continue to receive program benefits; and, if an importer or  exporter, whether additional benefits are warranted.  5.  Annual reviews and revalidations: Once a security specialist validates  a C-TPAT member’s security practices, the member company is to  undergo a review of its eligibility status, vetting, and certification  processes on an annual basis. This involves having the member  perform an annual self-assessment—essentially an update of its  security profile—that provides the member with an opportunity to  review, update, or change its security procedures, as needed.  Security specialists are to annually certify completion of these  member self-assessments. Each C-TPAT member is to undergo a  security revalidation not less than once every 4 years after its initial  validation, as determined by C-TPAT and in accordance with the  SAFE Port Act. A security revalidation calls for a security specialist to conduct updated document reviews and on-site visits to a member  and at least one of its foreign supply chain partners to ensure  continued alignment with C-TPAT’s minimum security criteria.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact above, Christopher Conrad (Assistant Director),  Adam Couvillion (Analyst-in-Charge), David Alexander, Christine  Broderick, Charles Bausell, Dominick Dale, Dorian Dunbar, Tyler  Mountjoy, Heidi Nielson, Nina Thomas-Diggs, and Eric Winter all made  key contributions to this report.