Supply chain security is a principal element of CBP’s layered strategy to protect commerce. In the post-9/11 environment, the movement of cargo shipments throughout the global supply chain from foreign manufacturers, suppliers, or vendors to retailers or other end users in the United States is inherently vulnerable to terrorist actions. Every time responsibility for cargo shipments changes hands along the global supply chain there is the potential for a security breach. Thus, vulnerabilities exist that terrorists could exploit by, for example, placing a weapon of mass destruction into a container for shipment to the United States or elsewhere. Figure 1 illustrates key points of transfer involved in the global supply chain—from the time that a shipment is loaded with goods at a foreign factory to its arrival at the U.S. port and ultimately the retail facility or end user. CBP initiated the C-TPAT program in November 2001 as part of its layered strategy for overseeing global supply chain security. C-TPAT aims to secure the flow of goods bound for the United States through voluntary antiterrorism partnerships with entities that are stakeholders within the international trade community—see table 1 for information on the types of entities eligible for C-TPAT membership. The SAFE Port Act established a statutory framework for the C-TPAT program. In addition to formally establishing C-TPAT as a voluntary government-private sector partnership program to strengthen and improve the overall security of the global supply chain, the act codified existing membership processes for the C-TPAT program and added new components, such as time frames for certifying, validating, and revalidating members’ security practices. Through C-TPAT, CBP intends to enhance the security of the global supply chain to the United States through partnership agreements, and by reviewing and periodically validating C-TPAT members’ security practices. As a first step in C-TPAT membership, an entity must sign an agreement with CBP signifying its commitment to enhance its supply chain security practices consistent with C-TPAT minimum security criteria and to work to enhance security throughout its global supply chain to the United States. The partnership agreements that C-TPAT members sign provide CBP with the authority it needs to validate members’ security practices. According to CBP officials, as of September 2016, there were 11,490 C- TPAT members. Importers, representing 37 percent of the C-TPAT members, were the largest C-TPAT member group and, as shown in Figure 2, the remaining 63 percent of C-TPAT members were distributed among other trade industry sectors. Since we last reported on the C- TPAT program in April 2008, CBP has expanded C-TPAT membership to include other trade industry sectors, such as third party logistics providers and exporters. According to CBP officials, as of September 2016, CBP employed 146 security specialists (to include supervisory security specialists) who are to certify or validate members’ security practices and provide other services for C-TPAT members, such as serving as points of contact concerning C- TPAT program responsibilities. The security specialists operate from C- TPAT headquarters in Washington, D.C., and six field offices throughout the United States: Los Angeles, California; Miami, Florida; Newark, New Jersey; Buffalo and New York, New York; and Houston, Texas. The C- TPAT program, which resides within CBP’s Office of Field Operations (OFO), was funded at over $36 million in fiscal year 2016. CBP employs a multistep process, led by its security specialists, for accepting entities as members in the C-TPAT program, validating their supply chain security practices—to include the practices of their supply chain partners—and providing them benefits. This screening process, which CBP has documented through standard operating procedures, consists of five key steps, as shown in figure 3 and described in greater detail in appendix I. To facilitate the member screening process, C-TPAT staff gather, review, and prepare documentation using an information-sharing and data management system called Portal 2.0. C-TPAT officials use Portal 2.0 to review C-TPAT member-submitted information and record certification and validation results. In addition, C-TPAT member companies use Portal 2.0 to submit program applications, security profiles, and other information to C-TPAT officials. In exchange for allowing C-TPAT staff to review and validate their supply chain security practices, C-TPAT members become eligible to receive benefits—such as reduced likelihood of examinations of their shipments, expedited shipment processing, and greater access to CBP staff and information—once their membership is certified. Upon certification, C- TPAT importers and exporters only are granted Tier I status. Importers and exporters whose supply chain security practices have been validated by C-TPAT security specialists are granted either Tier II (meeting minimum security criteria for their business type) or Tier III (employing innovative supply chain security measures that are considered best practices and exceed minimum security criteria) status. Tier II and Tier III C-TPAT importers and exporters receive increasingly reduced risk scores (i.e., as tier level increases, risk scores are lowered) in CBP’s Automated Targeting System (ATS), thus generally reducing the likelihood that their shipments will be examined upon entering U.S. ports. Specific benefits offered to C-TPAT members, as listed in CBP’s C-TPAT Program Benefits Reference Guide, can be found in Table 2. While C-TPAT membership can reduce the probability of CBP selecting members’ shipments for examinations, holds, or other enforcement actions, CBP maintains the authority to conduct appropriate enforcement actions. In addition, other federal agencies (e.g., U.S. Department of Agriculture, Food and Drug Administration, etc.) can conduct inspections of arriving cargo shipments based on their own selection criteria. C-TPAT staff have faced challenges in meeting C-TPAT security validation responsibilities in an efficient and timely manner because of problems with the functionality of C-TPAT’s data management system (Portal 2.0). In particular, while the intended purpose of transitioning from Portal 1.0 to Portal 2.0 in August 2015 was to improve functionality and facilitate communication between security specialists and C-TPAT members, a series of problems arose as a result of this transition that have impaired the ability of C-TPAT staff to identify and complete required C-TPAT member certification procedures and security profile reviews in a timely and efficient manner. For example, C-TPAT field office directors, supervisory security specialists, and security specialists we met with identified numerous instances in which the Portal 2.0 system incorrectly altered C-TPAT members’ certification or security profile dates. In particular, when C-TPAT officials transferred responsibility for some C- TPAT members’ accounts from one security specialist to another, those members’ certification dates were sometimes incorrectly changed. These altered dates, in turn, have interfered with security specialists’ ability to properly identify and track which member companies are due for an annual security profile review. In addition to the impact they have had on the daily responsibilities of security specialists, Portal 2.0 problems also made it more difficult for C- TPAT managers to complete the C-TPAT program’s 2016 annual work plan for assigning responsibilities for member security validations and revalidations to its security specialists. C-TPAT managers have typically relied on data from Report Builder, a reporting module within Portal, to develop annual work plans. However, in November 2015, C-TPAT staff had difficulty using Report Builder to access historical data from Portal 1.0 that were to have migrated to Portal 2.0 regarding C-TPAT members that were due to have security validations or revalidations conducted in 2016. As a result, the initial 2016 work plan did not have accurate data on the number of C-TPAT members due for security validations or revalidations. In addressing this issue, C-TPAT’s Director pointed out that while the Portal is intended to facilitate the ability of security specialists to perform their responsibilities, each security specialist is experienced and is not to rely solely on the Portal to complete his or her job responsibilities. So, to complete the 2016 work plan, C-TPAT managers implemented a requirement for security specialists in each of C-TPAT’s six field offices to manually review documentation, such as prior security validation reports, for each of their assigned members (approximately 80 to 100 members per security specialist) to verify or correct the certification and security validation dates recorded in Portal 2.0 and to ensure that the 2016 work plan identified all members due for security validations or revalidations in 2016. C-TPAT officials then used the information gathered through these additional manual steps to update and correct the 2016 work plan. Further, security specialists we met with told us that they had difficulty saving and submitting security validation reports to C-TPAT managers in a timely manner because of Portal 2.0 problems. Instead of submitting the validation reports directly through the Portal, security specialists told us they sometimes had to prepare draft security validation reports offline and copy and paste information section by section in order for Portal 2.0 to accept and save the security validation reports. While these alternate means of verifying validation responsibilities and mitigating Portal 2.0 problems have generally allowed security specialists to complete their required annual security profile reviews and validations, the security specialists stated that these work arounds are time consuming and have necessitated the use of overtime. The C-TPAT Director acknowledged the problems her staff have experienced with Portal 2.0 and that these problems have led to some inefficient work practices. Problems with Portal 2.0 have also had an adverse impact on C-TPAT members. For example, security specialists told us that some C-TPAT members have experienced difficulties viewing validation report findings because of problems in accessing Portal 2.0. If validation reports contain findings regarding security practices that fail to meet the minimum security criteria that members are to address, the members are to respond to C-TPAT staff within 90 days about their plans for addressing the findings and improving their supply chain security practices to meet CBP’s minimum security criteria. Because Portal 2.0 problems have sometimes prevented C-TPAT members from accessing and responding to validation reports in a timely manner, C-TPAT managers told us they have needed to grant these members additional time to respond to validation report findings. CBP staff from the C-TPAT program and the Office of Information Technology’s Targeting and Analysis Systems Program Directorate (TASPD) have taken steps to address problems with Portal 2.0. When problems with Portal 2.0 first surfaced in August 2015, Portal users in the C-TPAT field offices began recording problems in spreadsheets. C-TPAT headquarters officials collected these spreadsheets and sent them to TASPD managers to address. In an effort to improve coordination and communication between C-TPAT and TASPD staff, in February 2016, CBP officials developed a more centralized and systematic process for documenting, prioritizing, and addressing Portal 2.0 problems as they arise. In particular, a single C-TPAT point of contact receives a list of Portal problems from field office security specialists, creates a work ticket for each problem, and works with TASPD staff to prioritize those work tickets and group them into batches. TASPD staff then attempt to identify the causes of the batched Portal 2.0 problems and test the proposed fixes with input from the end users (primarily security specialists and C-TPAT field office directors) to ensure the problems are corrected during 2 to 3 week intervals called “sprints.” C-TPAT field office staff we met with told us that while these sprints have generally resolved the originally-identified problems, the fixes have, at times, created new problems that affected the accuracy of data and the usability of certain Portal 2.0 features. For example, security specialists have encountered error messages when trying to submit security validation reports for supervisory review and, in fixing that problem, security validation reports became inadvertently archived, which prevented supervisory security specialists from being able to review and edit the reports. Because of the continued Portal 2.0 problems, C-TPAT and TASPD staff have worked together to identify root causal factors that led to the Portal 2.0 problems and are implementing actions to address those factors. For example, TASPD staff cited unclear requirements for the Portal 2.0 system and its user needs as a factor that likely contributed to inadequate system testing and continued problems. In response, TASPD and C- TPAT staff have begun efforts to better capture Portal 2.0 system requirements and user needs and have incorporated more consistent end user testing. Additionally, TASPD and C-TPAT headquarters staff began having regular meetings with C-TPAT field office managers to institute a more-encompassing approach for addressing and understanding system requirements and Portal 2.0 functionality problems. As part of the root cause analysis, TASPD staff have outlined recommended actions for addressing causal factors that led to the Portal 2.0 problems, along with the associated timeframes for completing these actions. While TASPD and C-TPAT staff have already implemented some actions, such as establishing a new team structure, the staff stated that they will continue to work on identifying and addressing potential root causes of the Portal 2.0 problems and noted that this process will likely continue through 2017. Despite the Portal 2.0 problems, C-TPAT headquarters officials and field office directors we met with told us that they are assured that required security validations are being identified and completed in a timely manner because the field offices keep records on required and completed security validations apart from data recorded in Portal 2.0. C-TPAT officials provided us with documentation illustrating the steps taken by security specialists and supervisors at the field offices to identify and complete the required security validations. Field office directors or supervisors then verify that the security validations were completed, as required, by the end of each calendar year. We reviewed this documentation and verified that field offices are tracking completed validations annually. C-TPAT headquarters staff have delegated responsibility to field office directors for ensuring that the required security validations are tracked and completed and reported to headquarters each year, but headquarters has not issued centralized guidance or standard operating procedures to be used by the field offices to ensure that they are tracking and completing the required security validations in a consistent manner. As a result, the field offices have each developed their own varied approaches for tracking required security validations and recording those that are completed. A C-TPAT headquarters official responsible for reviewing security validation information provided by the field offices stated that there may be value in standardizing the approach field offices use to track and report on completed security validations in order to ensure the data received and reviewed by C-TPAT headquarters are more consistent and reliable. While the current validation tracking processes used by field offices do account for security validations conducted over the year, standardizing the process used by field offices to track required security validations could strengthen C-TPAT management’s assurance that its field offices are identifying and completing the required security validations in a consistent and reliable manner. Standards for Internal Control in the Federal Government related to the use of quality information state that management is to obtain relevant information from reliable internal sources on a timely basis in order to evaluate the entity’s performance. In addition, such quality information is to flow down from management to personnel, as well as up from personnel to management, to help ensure that key program objectives are met. This upward communication also helps provide effective oversight of internal controls. The internal control standards also call for management to document responsibilities for operational processes through policies. Developing standardized guidance for its field offices to use in tracking required security validations could further strengthen C-TPAT management’s assurance that its field offices are identifying and completing the required security validations in a consistent and reliable manner. Since 2012, CBP has compiled data on certain events or actions it has taken regarding arriving shipments—such as examinations, holds, and processing times—for both C-TPAT and non-C-TPAT members through its C-TPAT Dashboard. However, based on GAO’s preliminary analyses of data contained in the Dashboard, and data accuracy and reliability concerns cited by C-TPAT program officials, we concluded that CBP staff are not able to determine the extent to which C-TPAT members are receiving benefits, such as reduced likelihood of examinations of their shipments and expedited shipment processing, compared to non- members. We conducted preliminary analyses of C-TPAT program data from the Dashboard to understand, for example, how the examination rates of C- TPAT members’ shipments compared with those of non-C-TPAT members across different modes of transportation (air, truck, vessel, and rail) for each year from fiscal year 2011 through fiscal year 2015. The results of our analyses showed that C-TPAT members’ shipments did not consistently experience lower examination and hold rates and processing times compared to non-members’ shipments across the different modes of transportation. We shared the results from our preliminary analyses with the C-TPAT Director and staff familiar with the C-TPAT Dashboard and they expressed surprise that the data did not show more consistent benefits for C-TPAT members as compared to non-C-TPAT members, and that Tier II members did not consistently receive the benefit of lower examination and hold rates or processing times as compared to Tier I members. We further discussed that the findings from our analyses ran counter to C-TPAT member benefits information published by CBP. In particular, we noted that in its C-TPAT Program Benefits Reference Guide, CBP asserts that entries filed by Tier III Partners are 9 times less likely to undergo a security based examination than are entries filed by non-C-TPAT members and that entries filed by Tier II Partners are about 3.5 times less likely to undergo a security examination than are those filed by non- C-TPAT members. Further, CBP’s Congressional Budget Justification for Fiscal Year 2016 states that C-TPAT importers are 4 to 6 times less likely to incur a security or compliance examination than those for non-C-TPAT members. Subsequent to our discussion with C-TPAT staff on the results of our preliminary analyses and the apparent discrepancy with CBP-reported benefits data, the C-TPAT Director and staff researched the data and calculations within the Dashboard further. Based on their research, the C- TPAT officials stated that there appear to be errors in the data or formulas used to compute various actions that are uploaded into the Dashboard, such as shipment examinations, holds, and processing times. For example, the C-TPAT Director stated that based on their research, they discovered errors in the data contained in the Dashboard regarding the number of CBP shipment examinations on the southwest border in 2015. C-TPAT officials have not yet determined what accounts for the apparent accuracy and reliability issues of data contained in the Dashboard. The C- TPAT Program Director explained that the Dashboard was developed in response to a request for increased data on C-TPAT member benefits by a former C-TPAT Program Director. The current Director noted that the C- TPAT office has not regularly reviewed the data contained in the Dashboard. In addition, officials from the C-TPAT program, as well as from TASPD, explained that while the Dashboard has been in place since 2012, it has functioned in a limited operational mode, with data from the Dashboard only being used internally by program management. The officials stated that the Dashboard’s requirements are dated, and that new requirements need to be verified and tested. They further stated that because of competing priorities, CBP staff have not completed verification, user acceptance testing, or periodic data checks. C-TPAT officials noted, though, that C-TPAT and TASPD staff are in the process of analyzing data contained in the Dashboard to finalize an action plan to correct the data concerns. It is too soon for us to assess whether this process will fully address the Dashboard accuracy and reliability issues. Standards for Internal Control in the Federal Government state that program management should use quality information to achieve the entity’s objectives. Specifically, management is to obtain relevant data from reliable internal and external sources based on identified information requirements. These sources should provide data that are reasonably free from error and bias and represent what they purport to represent. Also, management should process data into quality information. Quality information is to be, among other things, appropriate, current, complete, and accurate. In addition, the SAFE Port Act requires CBP to extend benefits, which may include reduced examinations of cargo shipments, to Tier II and Tier III C-TPAT members. As mentioned earlier, the 2014 C- TPAT Program Benefits Reference Guide also cites reduced examination rates for C-TPAT importers compared to non C-TPAT importers as a benefit of the program. Further, project management criteria established by the Project Management Institute state that it is necessary to establish project objectives and outline a plan of action, via a project schedule with major milestones, to obtain those objectives. Because the data contained in the Dashboard cannot currently be relied upon, CBP is not able to determine the extent to which C-TPAT members have received benefits, such as lower examination or hold rates, or reduced processing times of their shipments when compared to non-C- TPAT members. CBP has likely relied on such questionable data since it developed the Dashboard in 2012, and, thus, cannot be assured that C-TPAT members have consistently received the benefits that CBP has publicized. Beyond shipment examination and hold rates, and processing times, CBP does not gather data on its other stated C-TPAT member benefits. There are a variety of reasons for this, including the inherent difficulty in being able to quantify certain benefits that are more qualitative in nature, such as having access to security specialists; or are difficult to meaningfully quantify across ports because of the many differences that exist in infrastructure from port to port. C-TPAT officials explained that, although these other benefits are difficult to measure, they are of value to C-TPAT members. The C-TPAT officials acknowledged that while the C-TPAT program might be able to gather and track quantifiable data on some additional benefits—such as increased mitigation of monetary penalties for C-TPAT members—given the Portal 2.0 and Dashboard data accuracy and reliability issues (as described earlier), they plan to focus first on identifying and correcting these data issues for those benefits currently tracked rather than trying to quantify and track other current member benefits. In addition to the C-TPAT member benefits listed earlier, CBP staff are working with trade industry partners and the COAC, to identify and explore potential new benefits, as well as a metric for quantifying potential cost savings for members. Trade industry officials we met with generally spoke positively of the C-TPAT program and of CBP staffs’ efforts in sharing information and listening to their concerns and suggestions for enhancing the program. However, some trade industry officials we met with have also expressed the desire for C-TPAT to improve and add member benefits. In response to suggestions from members of the trade community, C-TPAT staff said that they are considering some additional benefits, such as the following: Advanced Qualified Unlading Approval (AQUA) Lane: The AQUA Lane pilot is a joint partnership between the C-TPAT program, sea carriers, and world trade associations at select U.S. ports with the goal of reducing the amount of time that the carriers must wait for releasing their cargo. At these pilot ports, select C-TPAT member vessel carriers, who qualify under a set of predetermined requirements, are allowed to offload—but not release—cargo containers arriving at one of the pilot ports prior to CBP officials clearing the vessel carrier for release. AQUA Lane was initially piloted at the ports of Oakland, California; Port Everglades, Florida; New Orleans, Louisiana; and Baltimore, Maryland. According to C-TPAT officials, the pilot has been well received by sea carriers, who have expressed interest in seeing the program expanded to other domestic sea ports. In response, CBP announced a phased expansion of the AQUA Lane program, adding six ports in September 2016, an additional 10 ports in December 2016, with final implementation to all remaining seaports to be completed in early 2017. Trusted Trader Program: The Trusted Trader Program is a CBP-led collaborative effort being tested that aims to enhance information sharing between government agencies regarding importers’ efforts to enhance supply chain security and comply with trade requirements. As this program is expanded, one goal is to reduce redundancies in processing steps, as well as in the vetting and validation procedures of the C-TPAT and ISA programs. For example, under the Trusted Trader Program, CBP may conduct C-TPAT supply chain security and ISA trade compliance validations jointly, reducing time and resources that member companies must invest in these processes. However, the program has received mixed reactions from members of the trade industry with whom we met. While some members of the trade industry spoke favorably of the Trusted Trader Program, other members questioned whether the program’s benefits offered sufficient incentives compared to the costs and administrative requirements. Cost Savings Benefit Metric: CBP is in the process of reviewing a metric regarding the cost savings derived by C-TPAT members as the result of a reduced rate of shipment examinations. This metric was proposed by a C-TPAT member in the summer of 2015 and accepted by DHS consistent with the Government Performance and Results Act. CBP began gathering data for this metric during fiscal year 2016; however, C-TPAT officials noted that they need to revisit the integrity of the supporting data that would be used in this metric as a result of the concerns we and C-TPAT officials have raised before CBP can pursue implementing such a metric. CBP’s risk-informed approach to supply chain security focuses on ensuring the expeditious flow of millions of cargo shipments into the United States each year, while also managing security concerns. It is critical that CBP manages the C-TPAT program in a way that enhances the security of members’ global supply chains, while also providing benefits that incentivize program membership. A lack of reliable data has challenged CBP’s ability to manage the C-TPAT program effectively. In particular, problems with the C-TPAT program’s updated Portal 2.0 data system that began in August 2015 have impaired the ability of C-TPAT staff to identify and complete required security validations in a timely and efficient manner. While C-TPAT field offices have implemented procedures for ensuring that required security validations are identified and completed, these procedures are varied because C-TPAT headquarters has not developed standardized guidance for its field offices to follow. Taking steps to standardize C-TPAT field offices’ efforts to track required security validations could strengthen C-TPAT management’s assurance that its field offices are identifying and completing the required security validations in a consistent and reliable manner. Further, because the data contained in the Dashboard cannot be relied upon, CBP is not able to determine the extent to which C-TPAT members are receiving benefits, such as lower examination or hold rates, or reduced processing times of their shipments when compared to those for non-C-TPAT members. Finally, because CBP has likely relied on such questionable data since the Dashboard was developed in 2012, it does not have reasonable assurance, consistent with federal internal control standards, that C-TPAT members have consistently received the benefits that CBP has publicized. Accurate and reliable data will also be important as CBP considers adding additional member benefits and developing a cost savings metric. To ensure that C-TPAT program managers are provided consistent data from the C-TPAT field offices on security validations, we recommend that the Commissioner of U.S. Customs and Border Protection develop standardized guidance for the C-TPAT field offices to use in tracking and reporting information on the number of required and completed security validations. Further, to ensure the availability of complete and accurate data for managing the C-TPAT program and establishing and maintaining reliable indicators on the extent to which C-TPAT members receive benefits, we recommend that the Commissioner of U.S. Customs and Border Protection determine the specific problems that have led to questionable data contained in the Dashboard and develop an action plan, with milestones and completion dates, for correcting the data so that the C- TPAT program can produce accurate and reliable data for measuring C- TPAT member benefits. In December 2017, we requested comments on a draft of this report from DHS. In January 2017, officials from CBP provided technical comments, which we have incorporated into the report as appropriate. In addition, DHS provided an official letter for inclusion in the report, which can be seen in appendix II. In its letter, DHS stated that it concurred with our two recommendations and has begun to take actions to address them. In particular, for the first recommendation, DHS noted that the C-TPAT program manager has selected a methodology that will include uniform monthly reporting from C-TPAT field offices to the C-TPAT program manager. DHS anticipates that these efforts will be put into effect by May 2017. We will continue to monitor CBP’s efforts in addressing this recommendation. Regarding the second recommendation, DHS noted that the C-TPAT program manager has decided, in conjunction with CBP’S Office of Information Technology, to terminate the existing Dashboard reporting tool and, instead, create a new tool for providing accurate data for measuring C-TPAT member benefits by the end of June 2017. We will continue to monitor CBP’s efforts in addressing this recommendation. We are sending copies of this report to the Secretary of Homeland Security, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7141, or groverj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. This appendix provides further details on the process used to screen prospective members of the Customs-Trade Partnership Against Terrorism (C-TPAT) program. 1. Application and eligibility: An entity submits an application for C-TPAT membership that includes corporate information (e.g., company size and location), a supply chain security profile, and an agreement to voluntarily participate in the C-TPAT program. In completing the supply chain security profile, the entity is to conduct a comprehensive self-assessment of its supply chain security procedures or practices using the C-TPAT minimum security criteria for its specific business type, such as importer, highway carrier, or customs broker. The application is assigned to a supply chain security specialist to be reviewed to determine if the applicant meets C-TPAT eligibility requirements for its business type. 2. Vetting: Once a security specialist determines an applicant is eligible for C-TPAT membership, the security specialist is to conduct research as part of the vetting process. Vetting involves a review of the entity’s compliance with Customs laws and regulations; as well as any violation history to identify information that might preclude C-TPAT membership. Once any issues are resolved to U.S. Customs and Border Protection’s (CBP) satisfaction, the entity can move on to the certification stage. 3. Certification: After vetting, a security specialist is to conduct a detailed review of the entity’s security profile, looking for any weaknesses or gaps in security procedures or practices, to determine whether minimum security criteria for that entity’s business type are adequately addressed. This review is to be completed and the application approved or rejected within 90 calendar days from the date the entity submits its security profile. If the security specialist approves the security profile, the entity is certified as a C-TPAT member and is eligible to begin receiving benefits. 4. Validation: Once certified, a security specialist is to conduct a validation of the security measures outlined in a certified member’s security profile to ensure that they are reliable, accurate, effective, and align with CBP’s minimum security criteria. As provided for in the Security and Accountability for Every Port Act of 2006 (SAFE Port Act), a member’s initial security validation is to be completed within 1 year of certification, to the extent practicable. During the validation process, the assigned security specialist is to meet with the member’s representatives to verify that the supply chain security measures contained in its security profile are in place as described. If the member is an importer operating a global supply chain, the security specialist is to visit the member’s domestic site and at least one foreign supply chain partner’s site (e.g., a manufacturer who supplies goods). C-TPAT management and the security specialist assigned to a member are to identify potential sites to visit based on research of the member’s business history, import transportation modes, facility locations, and other factors. To initiate the security validation, the assigned security specialist is to provide the member a site visit agenda and documents to help the member prepare for the visit, such as a validation checklist. Upon completion of the security validation process, the security specialist is to prepare a final validation report to present to the member. The report may include recommendations to improve security practices, as well as any required actions the member is to take to conform to CBP’s minimum security criteria. The security validation report is also to address whether the member should continue to receive program benefits; and, if an importer or exporter, whether additional benefits are warranted. 5. Annual reviews and revalidations: Once a security specialist validates a C-TPAT member’s security practices, the member company is to undergo a review of its eligibility status, vetting, and certification processes on an annual basis. This involves having the member perform an annual self-assessment—essentially an update of its security profile—that provides the member with an opportunity to review, update, or change its security procedures, as needed. Security specialists are to annually certify completion of these member self-assessments. Each C-TPAT member is to undergo a security revalidation not less than once every 4 years after its initial validation, as determined by C-TPAT and in accordance with the SAFE Port Act. A security revalidation calls for a security specialist to conduct updated document reviews and on-site visits to a member and at least one of its foreign supply chain partners to ensure continued alignment with C-TPAT’s minimum security criteria. In addition to the contact above, Christopher Conrad (Assistant Director), Adam Couvillion (Analyst-in-Charge), David Alexander, Christine Broderick, Charles Bausell, Dominick Dale, Dorian Dunbar, Tyler Mountjoy, Heidi Nielson, Nina Thomas-Diggs, and Eric Winter all made key contributions to this report.

Summary: The economic well-being of the United States depends on the movement of millions of cargo shipments throughout the global supply chain—the flow of goods from manufacturers to retailers or other end users. However, cargo shipments can present security concerns. CBP is responsible for administering cargo security and facilitating the flow of legitimate commerce. CBP has implemented several programs as part of a risk-based approach to supply chain security. One such program, C-TPAT, is a voluntary program in which CBP staff validate that members' supply chain security practices meet minimum security criteria. In return, members are eligible to receive benefits, such as a reduced likelihood their shipments will be examined. This report assesses the extent to which (1) CBP is meeting its security validation responsibilities, and (2) C-TPAT members are receiving benefits. GAO reviewed information on security validations, member benefits, and other program documents. GAO also interviewed officials at CBP headquarters and three C-TPAT field offices chosen for their geographical diversity; as well as select C-TPAT members and trade industry officials. Staff from U.S. Customs and Border Protection's (CBP) Customs-Trade Partnership Against Terrorism (C-TPAT) program have faced challenges in meeting C-TPAT security validation responsibilities because of problems with the functionality of the program's data management system (Portal 2.0). In particular, since the system was updated in August 2015, C-TPAT staff have identified instances in which the Portal 2.0 system incorrectly altered C-TPAT members' certification or security profile dates, requiring manual verification of member data and impairing the ability of C-TPAT security specialists to identify and complete required security validations in a timely and efficient manner. While the focus of CBP's staff was initially on documenting and addressing Portal 2.0 problems as they arose, the staff have begun to identify root causes that led to the Portal 2.0 problems. For example, CBP staff cited unclear requirements for the system and its users' needs, coupled with inadequate testing, as factors that likely contributed to problems. In response, CBP staff have outlined recommended actions, along with timeframes for completing the actions. The staff stated that they will continue to work on identifying and addressing potential root causes of the Portal problems through 2017. C-TPAT officials told us that despite the Portal 2.0 problems, they have assurance that required security validations are being tracked and completed as a result of record reviews taking place at field offices. However, these field office reviews were developed in the absence of standardized guidance from C-TPAT headquarters. While the current validation tracking processes used by field offices do account for security validations conducted over the year, standardizing the process used by field offices for tracking required security validations could strengthen C-TPAT management's assurance that its field offices are identifying and completing the required security validations in a consistent and reliable manner. CBP cannot determine the extent to which C-TPAT members are receiving benefits because of data problems. Specifically, since 2012, CBP has compiled data on certain events or actions it has taken regarding arriving shipments—such as examination and hold rates and processing times—for both C-TPAT and non-C-TPAT members through its Dashboard data reporting tool. However, on the basis of GAO's preliminary analyses and subsequent data accuracy concerns cited by C-TPAT program officials, GAO determined that data contained in the Dashboard could not be relied on for accurately measuring C-TPAT member benefits. Also, CBP has likely relied on such questionable data since it developed the Dashboard in 2012, and, thus, cannot be assured that C-TPAT members have consistently received the benefits that CBP has publicized. C-TPAT officials stated that they are analyzing the Dashboard to finalize an action plan to correct the data concerns. It is too soon to tell, though, whether this process will fully address the accuracy and reliability issues. Despite these issues, C-TPAT officials are exploring new member benefits, and industry officials we met with generally spoke positively of the C-TPAT program. GAO is recommending that CBP develop (1) standardized guidance for field offices regarding the tracking of information on security validations, and (2) a plan with milestones and completion dates to fix the Dashboard so the C-TPAT program can produce accurate data on C-TPAT member benefits. DHS concurred with GAO's recommendations.