CBP maintains two overarching goals: (1) increasing security and (2) facilitating legitimate trade and travel. Disruptions to the supply chain could have immediate and significant economic impacts. For example, in terms of containers, CBP data indicates that in 2003 about 90 percent of the world’s cargo moved by container. In the United States, almost half of all incoming trade (by value) arrived by containers on board ships. Almost 7 million cargo containers arrive and are offloaded at U.S. seaports each year. Additionally, containers arrive via truck and rail. Therefore, it is vital for CBP to try to strike a balance between its antiterrorism efforts and facilitating the flow of legitimate international trade and travel. The terrorist events of September 11, 2001, raised concerns about company supply chains, particularly oceangoing cargo containers, potentially being used to move weapons of mass destruction to the United States. An extensive body of work on this subject by the Federal Bureau of Investigation and academic, think tank, and business organizations concluded that while the likelihood of such use of containers is considered low, the movement of oceangoing containerized cargo is vulnerable to some form of terrorist action. Such action, including attempts to smuggle either fully assembled weapons of mass destruction or their individual components, could lead to widespread death and damage. The supply chain is particularly vulnerable to potential terrorists because of the number of individual companies handling and moving cargo through it. To move a container from production facilities overseas to distribution points in the United States, an importer has multiple options regarding the logistical process, such as routes and the selection of freight carriers. For example, some importers might own and operate key aspects of the overseas supply chain process, such as warehousing and trucking operations. Alternatively, importers might contract with logistical service providers, including freight consolidators and nonvessel-operating common carriers. In addition, importers must choose among various modes of transportation to use, such as rail, truck, or barge, to move containers from the manufacturer’s warehouse to the port of lading. As shown in table 1, there are many players in the trade community, each with a role in the supply chain. According to research initiated by the U.S. Department of Transportation’s Volpe National Transportation Systems Center, importers who own and operate the entire supply chain route from start to finish suffer fewer security breaches than others because they have greater control over their supply chains. However, relatively few importers own and operate all key aspects of the cargo container transportation process, relying instead on second parties to move containerized cargo and prepare various transportation documents. CBP has implemented a layered enforcement strategy to prevent terrorists and weapons of mass destruction from entering the United States through the supply chain. A key element of this strategy is CBP’s targeting and inspection of cargo that arrives at U.S. ports. For all arriving cargo containers, CBP uses a targeting strategy that employs its computerized targeting model, the Automated Targeting System (ATS). CBP uses ATS to review container documentation and help select, or target, shipments for additional documentary review or physical inspection. ATS is operated by CBP’s National Targeting Center and is characterized by CBP as an expert system that uses hundreds of targeting rules to check available data for every arriving container, assigning a risk characterization to each container. The risk characterization helps to determine the type and level of scrutiny a container will receive. For example, CBP could review the container’s bill of lading, examine the container with nonintrusive inspection equipment (that is, X-ray), or physically open the container. The extent of review varies, since according to CBP, the large volume of imports and CBP’s limited resources make it impossible to physically inspect all containers without disrupting the flow of commerce. Initiated in November 2001, C-TPAT is another element of CBP’s layered enforcement strategy. C-TPAT is a voluntary program designed to improve the security of the international supply chain while maintaining an efficient flow of goods. Under C-TPAT, CBP officials work in partnership with private companies to review their supply chain security plans to improve members’ overall security. In return for committing to making improvements to the security of their shipments by joining the program, C-TPAT members may receive benefits that result in reduced scrutiny of their shipments (e.g., reduced number of inspections or shorter border wait times for their shipments). C-TPAT membership is open to U.S.-based companies in the trade community, including (1) air/rail/sea carriers, (2) border highway carriers, (3) importers, (4) licensed customs brokers, (5) air freight consolidators and ocean transportation intermediaries and nonvessel-operating common carriers, and (6) port authorities or terminal operators. According to CBP officials, program membership has grown rapidly, and continued growth is expected, especially as member importers are requiring their suppliers to become C-TPAT members. For example, as of January 2003 approximately 1,700 companies had become C-TPAT members. By May 2003, the number had nearly doubled to 3,355. According to CBP officials, as of November 2004, the C-TPAT program had 7,312 members. For fiscal year 2004, the C-TPAT budget was about $18 million, with a requested budget for fiscal year 2005 of about $38 million for program expansion efforts. As of August 2004, CBP had hired 40 supply chain specialists, who are dedicated to serve as the principal advisers and primary points of contact for C-TPAT members. The specialists are located in Washington, D.C., Miami, Florida, Los Angeles, California, and New York, New York. CBP has a multistep review process for the C-TPAT program. As figure 1 shows, applicants first submit signed C-TPAT agreements affirming their desire to participate in the voluntary program. Applicants must also submit security profiles—executive summaries of their company’s existing supply chain security procedures—that follow guidelines jointly developed by CBP and the trade community. These security profiles are to summarize the applicant’s current security procedures in areas such as physical security, personnel security, and education and training awareness. CBP established a certification process in which it reviews the applications and profiles by comparing their contents with the security guidelines jointly developed by CBP and the industry, looking for any weaknesses or gaps in the descriptions of security procedures. Once any issues are resolved to CBP’s satisfaction, CBP signs the agreement and the company is considered to be a certified C-TPAT member, eligible for program benefits. Members that are not importers begin receiving benefits at this point, but members that are importers must undergo another layer of review, as described below. CBP encourages members to conduct self-assessments of their security profiles each year to determine any significant changes and to notify CBP. For example, members may be using new suppliers or new trucking companies and would need to update their security profiles to reflect these changes. For certified importers, CBP has an additional layer of review called the vetting process in which CBP reviews information about an importer’s compliance with customs laws and regulations and violation history. CBP requires the vetting process for certified importers as a condition of granting them key program benefits. As part of the vetting process, CBP obtains trade compliance and intelligence information on certified importers from several data sources. If CBP gives the importer a favorable review, benefits are to begin within a few weeks. If not, benefits are not to be granted until successful completion of the validation process (see below). The final step in the review process is validation. CBP’s stated purpose for validations is to ensure that the security measures outlined in certified members’ security profiles and periodic self-assessments are reliable, accurate, and effective. In the validation process, CBP staff meet with company representatives to verify the supply chain security measures contained in the company’s security profile. The validation process is designed to include visits to the company’s domestic and, potentially, foreign sites. The member and CBP jointly determine which elements of the member’s supply chain measures will be validated, as well as which locations will be visited. Upon completion of the validation process, CBP prepares a final validation report it presents to the company that identifies any areas that need improvement and suggested corrective actions, as well as a determination if program benefits are still warranted for the member. We have conducted previous reviews of the C-TPAT program and CBP’s targeting and inspection strategy. In July 2003, we reported that CBP’s management of C-TPAT had not evolved from a short-term focus to a long- term strategic approach. We recommended that the Secretary of Homeland Security work with the CBP Commissioner to develop (1) a strategic plan that clearly lays out the program’s goals, objectives, and detailed implementation strategies; (2) performance measures that include outcome-oriented indicators; and (3) a human capital plan that clearly describes how C-TPAT will recruit, train, and retain new staff to meet the program’s growing demands as it implements new program elements. In March 2004, we testified that CBP’s targeting system does not incorporate all key elements of a risk management framework and recognized modeling practices in assessing the risks posed by oceangoing cargo containers. CBP officials cite numerous benefits to C-TPAT members. As table 2 shows, these benefits may reduce the scrutiny of members’ shipments. These benefits are emphasized to the trade community through direct marketing in presentations and via CBP’s Web site. Although these benefits potentially reduce the likelihood of inspection of members’ shipments, CBP officials noted that all shipments entering the United States are subject to random inspections by CBP officials or inspections by other agencies. CBP has in place a two-pronged process to review members’ qualifications for program benefits. First, CBP has a certification process to review the applications and security profiles submitted by applicants for any weaknesses or gaps in security procedures. CBP officials told us that during the certification process, it compares the members’ security profiles against the C-TPAT security guidelines. Under the process, if there are any missing or unclear items, CBP is supposed to contact the member for clarification of those items. If the issues are resolved, CBP considers the member to be certified. However, if CBP determines that the security profiles contain weaknesses, CBP is not supposed to certify the member. According to CBP, approximately 20 percent of applications are not immediately certified because of initial shortcomings with the security profiles. However, CBP has stated that a company will not be rejected from participating in C-TPAT if there are problems with its security profile. Instead, CBP says it will work with companies to try to resolve and overcome any deficiencies with the profile itself. Second, CBP has in place a vetting process to assess the compliance and violation history of importers before granting them benefits. If, in conducting the vetting process, CBP finds no prior negative compliance, violation, or intelligence information, it grants certified importers program benefits. According to CBP, to date most certified members who have been vetted have proven to have favorable or neutral importing histories. CBP officials told us that not many members have been denied benefits. At the program’s inception in November 2001, CBP began granting benefits to applicants upon receipt of their application for C-TPAT membership without any review of the applicants’ paperwork. In February 2004, CBP changed its policy to retroactively delay granting the benefits until after CBP reviewed and certified applicants’ security profiles and completed the vetting process. By providing incentives to members to implement certain security measures and performing various levels of checks on these measures, the C-TPAT program aims to encourage the reduction of vulnerability throughout the supply chain. CBP established a certification process in which it reviews the applications and profiles by comparing their contents with the security guidelines jointly developed by CBP and the industry, looking for any weaknesses or gaps in the descriptions of security procedures. The vetting process, which is required for importers eligible to receive benefits, augments the certification process by providing information about past compliance and violations, which CBP officials told us may suggest whether members’ security practices have historically been effective at reducing vulnerability to exploitation. In addition, the vetting process may disclose threat concerns by pulling in information contained in intelligence databases. Ultimately, however, neither the certification nor vetting process provides an actual verification that the supply chain security measures contained in the C-TPAT member’s security profile are accurate and are being followed before CBP grants the member benefits. A direct examination of selected members security procedures is conducted later as part of CBP’s validation process, as discussed below. After providing benefits, CBP has a validation process to verify C-TPAT members’ security measures have been implemented and that program benefits should continue. However, we found weaknesses in the validation process in that CBP has not taken a rigorous approach to conducting validations and has not determined the extent to which validations are needed. These weaknesses limit the bureau’s ability to ensure that the program supports the prevention of terrorists and terrorist weapons from entering the United States. CBP’s validation process is not rigorous enough to achieve its stated purpose, which is to ensure that the security procedures outlined in members’ security profiles are reliable, accurate, and effective. While C-TPAT’s stated purpose for validations is to ensure that the member’s security measures are reliable, accurate, and effective, CBP officials told us that validations are not considered independent audits and the objectives, scope, and methodology of validations are jointly agreed upon with the member representatives. CBP has indicated that it does not intend for the validation process to be an exhaustive review of every security measure at each originating location; rather it selects specific facets of the members’ security profiles to review for their reliability, accuracy, and effectiveness. For example, the guidance to ocean carriers for preparing a security profile directs the carriers to address, at a minimum, three broad areas (security program, personnel security, and service provider requirements), which contain several more specific security measures, such as facilities security and pre-employment screening. According to CBP officials, as well as our review of selected case files, validations only examine a few facets of members’ security profiles. CBP supply chain specialists, who are responsible for conducting most of the validations, are supposed to individually determine which segments of a company’s supply chain security will be suggested to the member for validation. To assist in this decision, supply chain specialists are supposed to compare a company’s security profile, as well as any self- assessments or other company materials or information retrievable in national databases, against the C-TPAT security guidelines to determine which elements of the profile will be validated. Once the supply chain specialist determines the level and focus of the validation, the specialist is supposed to contact the member company with a potential agenda for the validation. The two parties then jointly reach agreement on which security elements will be reviewed and which locations will be visited. CBP has no written guidelines for its supply chain specialist to indicate what scope of effort is adequate for the validation to ensure that the member’s security measures are reliable, accurate, and effective, in part because it seeks to emphasize the partnership nature of the program. Importantly, CBP has no baseline standard for what minimally constitutes a validation. CBP discourages supply chain specialists from developing a set checklist of items to address during the validation, as CBP does not want to give the appearance of conducting an audit. In addition, as discussed later in the management section of this report, the validation reports we reviewed did not consistently document how the elements of members’ security profiles were selected for validation. CBP has not determined the extent to which it must conduct validations of members’ security profiles to ensure that the operation of C-TPAT is consistent with its overall approach to managing risk. In 3 years of C-TPAT operation, CBP has validated about 10 percent of its certified members. CBP’s original goal was to validate all certified members within 3 years of certification. However, CBP officials told us that because of rapid growth in program membership, it would not be possible to meet this goal. In February 2004, CBP indicated that approximately 5,700 companies had submitted signed agreements to participate in the program. As shown in figure 2, by November 2004, the number of members had grown to over 7,000, about 4,200 of which had been certified and thus eligible for validation. According to CBP, as of November 2004, CBP staff had completed validations of 409 companies, including 147 importers. CBP has made efforts to hire additional supply chain specialists to handle validations for the growing membership. As of August 2004, CBP had hired a total of 40 supply chain specialists to conduct validations, with 24 field office managers also available to conduct validations. CBP officials told us the bureau is currently conducting as many validations as its resources allow. However, CBP has not determined the number of supply chain specialists it needs or the extent to which validations are needed to provide reasonable assurance that it is employing a good risk management approach for the program. As noted above, CBP officials told us it would not be possible to meet the goal of validating every member within 3 years of certification. Instead, CBP is using what it calls a risk-based approach, which considers a variety of factors to prioritize which members should be validated as resources allow. CBP has an internal selection process it is supposed to apply to all certified members. Under this process CBP officials are supposed to prioritize members for validation based on established criteria but may also consider other factors. CBP officials noted that other factors could affect the prioritization of members for validation. For example, recent seizures involving C-TPAT members can affect validation priorities. If a member is involved in a seizure, CBP officials noted that the member is supposed to lose program benefits and be given top priority for a validation. In addition, CBP officials told us that an importer that failed CBP’s vetting process would also be given top priority for a validation. CBP officials have taken this approach because any importer that fails the vetting process is not supposed to receive program benefits until after successful completion of the validation process. In August 2004, CBP began using a risk assessment tool developed for CBP’s regulatory audits to assist in its prioritization of importers for validation. This tool ranks importers by risk according to factors such as value of imports, import volume, and method of transportation used by the importer for its goods. CBP tailored the tool to consider only those factors it deemed relevant to C-TPAT. Applying the tool with this revised set of factors, CBP officials told us they produced a list that ranked each certified importer according to its risk. However, these ranked importers are then re-evaluated, along with members from other trade sectors, using CBP’s internal selection process criteria. CBP officials told us that the human element provided by their internal selection process was important in prioritizing members for validation. CBP continues to expand the C-TPAT program without addressing management weaknesses that could hinder the bureau from achieving the program’s dual goals of securing the flow of goods bound for the United States and facilitating the flow of trade. In our July 2003 report, we recommended that the Secretary of Homeland Security work with the CBP Commissioner to develop (1) a strategic plan that clearly lays out the program’s goals, objectives, and detailed implementation strategies; (2) a human capital plan that clearly describes how C-TPAT will recruit, train, and retain new staff to meet the program’s growing demands as it implements new program elements; and (3) performance measures that include outcome-oriented indicators. While CBP agreed with our July 2003 recommendations, to date only one of them—the development of a strategic plan—has been implemented. According to CBP, the bureau is continuing to work on the July 2003 recommendations, which are in different stages of review. While a draft of this report was with DHS for comment, CBP issued a final strategic plan for C-TPAT on January 13, 2005. Our brief review of this plan indicates that it appears to clearly articulate the goals of the program, their relationship to broader CBP goals, and strategies for achieving them. For example, according to the plan there are five goals for the C-TPAT program: 1. ensure that C-TPAT partners improve the security of their supply chains pursuant to C-TPAT security criteria, 2. provide incentives and benefits to include expedited processing of C-TPAT shipments to C-TPAT partners, 3. internationalize the core principles of C-TPAT through cooperation and coordination with the international community, 4. support other CBP security and facilitation initiatives, and 5. improve administration of the C-TPAT program. While we have not fully reviewed the strategic plan, it is a step in the right direction, and we encourage CBP to ensure that future plans include all of the key elements of a strategic plan as described in the Government Performance and Results Act of 1993. Specifically, the formal strategic plan should include a description of performance goals and how they are related to the general goals and objectives of the program, as well as a description of program evaluations, which are useful for identifying key factors likely to affect program performance. As a companion to developing a strategic plan for C-TPAT, CBP is developing an implementation plan to address the lower-level strategies for carrying out the program’s goals. CBP told us it is still developing the implementation plan for the program but that it will include those elements required in a human capital plan. For example, CBP said it has developed new positions, training programs and materials, and a staffing plan. Further, CBP said the C-TPAT program will continue to refine all aspects of its human capital plan to include headquarters personnel, additional training requirements, budget, and future personnel profiles. CBP has told us that it continues developing a comprehensive set of performance measures and indicators for C-TPAT. In support of the department’s Future Years Homeland Security Program, CBP officials told us has identified 21 budget subactivities (programs, including C-TPAT) and has been tasked to develop two performance measures for each: (1) a main measure that would reflect program outcomes and (2) an efficiency measure that would reflect time or cost savings achieved through the program. CBP’s Director, Strategic Planning and Audit Division, Office of Policy and Planning, noted that developing these measures for C-TPAT, as well as other programs in the bureau, has been difficult. The director noted that CBP lacks data necessary to exhibit whether a program has prevented or deterred terrorist activity. For example, as noted in the C-TPAT strategic plan, it is difficult to measure program effectiveness in terms of deterrence because generally the direct impact on unlawful activity is unknown. The plan also notes that while traditional workload measures are a valuable indicator, they do not necessarily reflect the success or failure of the bureau’s efforts. CBP is working to collect more substantive information—related to C-TPAT activities (i.e., current workflow process)—to develop its performance measures. In commenting on a draft of this report, CBP indicated it has developed initial measures for the program but will continue to develop and refine these measures to ensure program success. CBP’s record keeping for the program is incomplete, as key decisions are not always documented and programmatic information is not updated regularly or accurately. Federal regulations require that bureau record- keeping procedures provide documentation to facilitate review by Congress and other authorized agencies of government. Further, standards for internal control in the federal government require that all transactions be clearly documented in a manner that is complete, accurate, and useful to managers and others involved in evaluating operations. To get a better understanding of the validation process, we asked CBP to provide us with examples of company files for which validations had been completed. CBP selected six members’ files for us to review for some of the initial validations the bureau conducted. During our review, it was not always clear what aspect of the security profile was being validated and why a particular site was selected at which to conduct the validation because there was not always documentation of the decision-making process. The aspects of the security profiles covered and sites visited did not always appear to be the most relevant. For example, one validation report we reviewed for a major retailer—one that imports the vast majority of its goods from Asia—indicated that the validation team reviewed facilities in Central America. CBP officials noted that it recently revised its validation report format to better capture any justification for report recommendations and best practices identified. CBP then provided us with eight additional member files with more recently completed validation reports. After reviewing the more recent validation reports contained in these files, we noted that there appeared to be a greater discussion related to the rationale for validating specific aspects of the security profiles. However, these files did not consistently contain other documentation of members’ application, certification, vetting, receipt of benefits, or validation. While files contained some of these elements, they were generally not complete. In fact, most files did not usually contain anything beyond copies of the member’s C-TPAT agreement, security profiles, and validation report. When we asked if CBP required its supply chain specialists to document their communications with C-TPAT members, CBP officials told us there has been no requirement that communications be documented. For example, member files we reviewed contained no documentation of communications between CBP and members regarding how the scope of a validation was determined. Recently, supply chain specialists located at CBP headquarters (but not at field offices) have been asked to document all conversations with member companies on a spreadsheet, so that each supply chain specialist will be aware of the outcomes of conversations with member companies. CBP does not update programmatic information regularly or accurately. In particular, the reliability of CBP’s database to track member status using key dates in the application through validation processes is questionable. The database, which is primarily used for documentation management and workflow tracking, is not updated on a regular basis. In addition, C-TPAT management told us that earlier data entered into the database may not be accurate, and CBP has taken no systematic look at the reliability of the database. CBP officials also told us that there are no written guidelines for who should enter information into the database or how frequently the database should be updated. We made several requests over a period of weeks to review the contents of the database to analyze workload factors, including the amount of time that each step in the C-TPAT application and review process was taking. The database information that CBP ultimately provided to us was incomplete, as many of the data fields were missing or inaccurate. For example, more than 33 percent of the entries for validation date were incomplete. In addition, data on the status of companies undergoing the validation process was provided in hard copy only and included no date information. CBP officials told us that they are currently exploring other data management systems, working to develop a new, single database that would capture pertinent data, as well as developing a paperless environment for the program. CBP’s primary reliance on members’ self-reporting about their security procedures to receive C-TPAT benefits places added importance on the validation process, which is CBP’s method of verifying the effectiveness, efficiency, and accuracy of the security profile. However, the weaknesses in the validation process we found raise questions about its effectiveness. CBP’s validation process, the purpose of which is to ensure that members’ security measures are reliable, accurate, and effective, is not rigorous enough to achieve CBP’s goals because of the bureau’s consideration of the process as a joint, partnership review with the member company. In this vein, without guidelines for what constitutes a validation, CBP cannot be sure that it effectively and consistently verifies a standard set of security measures to ensure some minimally appropriate level of vulnerability reduction, nor can it apply a methodical approach to assessing the security procedures. In addition, CBP has not assessed the extent (in terms of numbers or percentage) to which it must conduct validations to ensure that the C-TPAT program is consistent with its overall approach to managing risk. Also, we found a lack of clear documentation for the validation process. Because of these weaknesses, CBP’s ability to provide assurance that the program prevents terrorists and terrorist weapons from entering the United States is limited. Finally, CBP has not completed corrective actions from our July 2003 report, which were meant to change the management of the program from a short-term focus to a strategic focus. Specifically, CBP has not completed (1) developing performance measures with which to measure the program’s success in achieving bureau goals and inform decisions for process improvement and (2) developing a human capital plan to account for how the program will recruit, train, and retain staff to achieve program goals. CBP also does not have a basic records management system to ensure adequate internal controls to manage the program. Because of these management weaknesses, CBP will have difficulty effectively planning, executing, and monitoring the program. To help CBP achieve C-TPAT objectives and address the challenges associated with its continued development, we recommend that the Secretary of Homeland Security direct the Commissioner of U.S. Customs and Border Protection to take the following five actions: strengthen the validation process by providing appropriate guidance to specialists conducting validations, including what level of review is adequate to determine whether member security practices are reliable, accurate, and effective; determine the extent (in terms of numbers or percentage) to which members should be validated in lieu of the original goal to validate all members within 3 years of certification; complete the development of performance measures, to include outcome-based measures and performance targets, to track the program’s status in meeting its strategic goals; complete a human capital plan that clearly describes how the C-TPAT program will recruit, train, and retain sufficient staff to successfully conduct the work of the program, including reviewing security profiles, vetting, and conducting validations to mitigate program risk; and implement a records management system that accurately and timely documents key decisions and significant operational events, including a reliable system for (1) documenting and maintaining records of all decisions in the application through validation processes, including but not limited to documentation of the objectives, scope, methodologies, and limitations of validations, and (2) tracking member status. We provided a draft of this report to the Secretary of DHS for comment. We received comments from the Commissioner of U.S. Customs and Border Protection that are reprinted in appendix II. CBP generally agreed with our recommendations and outlined actions it either had taken or was planning to take to implement them. CBP agreed with our two recommendations on validations and said it will readdress the validation process. Specifically, CBP said that it was developing standard operating procedures, guidance, and written baseline criteria for the validation process, as well as an automated validation tool to document validations. CBP also agreed to determine the extent to which C-TPAT members should be validated, stating that it will develop member selection criteria and an automated system to standardize and assist in the selection of companies for validation. If properly implemented, these actions should address the intent of these recommendations. Our draft report also included a recommendation to complete a formal strategic plan that clearly articulates goals, linkages, and strategies. While our draft report was with DHS for comment, CBP issued its final strategic plan on January 13, 2005. Our brief review of this strategic plan indicates that it appears to address the intent of our recommendation. Therefore, we removed the recommendation from this report. Nevertheless, as CBP further refines its strategic plan in the future, we encourage CBP to include all of the key elements of a strategic plan as described in the Government Performance and Results Act of 1993. Specifically, the formal strategic plan should include a description of performance goals and how they are related to the general goals and objectives of the program, as well as a description of program evaluations, which are useful for identifying key factors likely to affect program performance. CBP agreed with our recommendation on developing performance measures, and has developed initial measures relating to membership, inspection percentages, and validation effectiveness. CBP has developed new performance measures for use in the FY 2006 Fiscal Year Homeland Security Plan and plans to enlist the help of a contractor to develop other outcome-based performance measures and targets. If properly implemented, these plans should help address the intent of this recommendation. In addressing our recommendation to complete a human capital plan for the C-TPAT program, CBP told us it is still developing an implementation plan for the program that will include those elements required in a human capital plan. For example, CBP said it has developed new positions, training programs and materials, and a staffing plan. Further, CBP said the C-TPAT program will continue to refine all aspects of its human capital plan to include headquarters personnel, additional training requirements, budget, and future personnel profiles. If the final implementation plan contains these elements, the plan should address the intent of the recommendation. CBP agreed with our recommendation on implementing a records management system that accurately and timely documents key decisions and significant operational events. While its comments did not specify the nature or capabilities of a new system, CBP indicated that in the near future, it plans to automate every aspect of the C-TPAT program, both internally and externally. In automating its system, to fully meet the intent of this recommendation, CBP needs to ensure that the system addresses all aspects of C-TPAT operations and that tracking member status is done timely, accurately, and reliably. Notwithstanding its general agreement with the recommendations, CBP expressed some concerns regarding the report. In its general comments, CBP said that C-TPAT is a voluntary program that is not designed to confirm company compliance with regulatory requirements. Further, CBP said it is very difficult for the U.S. government to regulate supply chain security procedures outside the country. CBP also noted that it is looking to establish more broadly applicable minimum security standards that may build on C-TPAT requirements. Our report clearly notes that the program is of a voluntary nature, designed around security guidelines jointly developed by CBP and the trade community. The cooperation envisioned by the C-TPAT program can build productive relationships and encourage supply chain security. However, in accepting members into the program, CBP still has the responsibility for verifying that security measures planned or claimed by C-TPAT members are properly implemented and effective. This program goes beyond trade facilitation in that it awards benefits that can reduce the scrutiny given cargo containers arriving in the United States. This is not a matter of regulating supply chain security in other countries. Rather, it is a matter of providing a security benefit for containers arriving at our nation’s ports. If CBP does not ensure that this important security-related benefit is deserved, it runs the risk of overlooking potentially dangerous cargo during the inspection process. CBP also said that the report’s title is misleading, asserting that it creates the improper impression that only the validation process ensures adequate security for containerized cargo and does not place enough emphasis on the certification and vetting processes, as well as omits that C-TPAT cargo is not exempt from advance reporting requirements or enforcement and security inspections, such as random inspections and nonintrusive screening technology. Our report clearly describes the various steps CBP takes in the overall cargo inspection process and how the C-TPAT program fits into that process. The report also clearly describes the purpose of each process within the C-TPAT program, including the validation process that is to determine whether C-TPAT members’ security procedures are accurate, reliable, and effective. We did modify the report’s title and, where appropriate, the text to better reflect the report’s focus on C-TPAT versus other programs in CBP’s layered enforcement strategy for cargo security. However, any weakness in C-TPAT could weaken CBP’s layered approach. Given that C-TPAT members enjoy benefits that reduce the likelihood of an inspection of their cargo, not having an effective validation process could serve to defeat the purposes of the other enforcement layers. Finally, CBP noted many benefits achieved under the C-TPAT program, including that thousands of companies working as part of C-TPAT have taken concrete steps to improve their security procedures and that C-TPAT has fostered an expanding international dialogue on best security practices. We agree that actions on the part of program members to shore up supply chain security are valuable and desirable. Again, with the threat of terrorism present in the global supply chain, we believe that verifying that planned improvements are actually implemented and ensuring that security controls are effective are important responsibilities that cannot be achieved only with members self-reporting about their security procedures. CBP also offered technical comments and clarifications, which we considered and incorporated where appropriate. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will provide copies of this report to appropriate departments and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be available on GAO’s Web site http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8777 or at stanar@gao.gov. Key contributors to this report are listed in appendix III. We addressed the following questions regarding the U.S. Customs and Border Protection’s (CBP, formerly the U.S. Customs Service) Customs- Trade Partnership Against Terrorism (C-TPAT): What benefits does CBP provide to C-TPAT members? Before providing benefits, what approach does CBP take to determine C-TPAT members’ eligibility for them? After providing benefits, how does CBP verify that members have implemented their security measures? To what extent has CBP developed strategies and related management tools for achieving the program’s goals? To address these questions, we visited CBP’s headquarters in Washington, D.C., which manages the C-TPAT program. We interviewed CBP officials and reviewed available data and documentation for the program. We reviewed individual CBP files for a subset of C-TPAT members, including members with responsibilities along various parts of the supply chain. We also reviewed CBP’s database for tracking member status in the program from the program’s inception through July 2004. All records in this database were reviewed. We intended to use these data to select a random set of files to review and to conduct analyses of workloads, but the data were not reliable enough to do so (see below). Given the weaknesses in the files as well as the data reliability issues, our review focused on identifying C-TPAT’s processes. Because of deficiencies in the files and database, we were unable to verify the extent CBP actually follows these processes for individual members. We also obtained the status of the agency’s efforts to implement our prior recommendations for the program, including the completion of a strategic plan, a human capital plan, and performance measures. We conducted our work from February through December 2004 in accordance with generally accepted government auditing standards. To assess the reliability of CBP’s database for tracking member status in C-TPAT, we (1) reviewed existing documentation related to the data sources, (2) electronically tested the data to identify obvious problems with completeness or accuracy, and (3) interviewed knowledgeable bureau officials about the data. Initial reliability testing of this database and interviews of staff with responsibility for the program led us to conclude that data used to track participant status had some serious reliability weaknesses. We determined that using the data in certain cases, for example, to calculate average times for phases of the membership process, might have led to an incorrect or misleading message. However, we determined that the data were sufficiently reliable for limited use in descriptions of the program status, such as the approximate numbers of participants, because our analysis and discussions with CBP officials assured us that those data fields were reasonably complete and accurate. In addition to those named above, Kristy N. Brown, Kathryn E. Godfrey, Wilfred B. Holloway, Stanley J. Kostyla, Shakira O’Neil, and Deena D. Richart made key contributions to this report. Homeland Security: Process for Reporting Lessons Learned from Seaport Exercises Needs Further Attention. GAO-05-170. Washington, D.C.: January 14, 2005. Port Security: Planning Needed to Develop and Operate Maritime Worker Identification Card Program. GAO-05-106. Washington, D.C.: December 10, 2004. Maritime Security: Better Planning Needed to Help Ensure an Effective Port Security Assessment Program. GAO-04-1062. Washington, D.C.: September 30, 2004. Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Border Security: Agencies Need to Better Coordinate Their Strategies and Operations on Federal Lands. GAO-04-590. Washington, D.C.: June 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31, 2004. Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail Security, but Significant Challenges Remain. GAO-04-598T. Washington, D.C.: March 23, 2004. Department of Homeland Security, Bureau of Customs and Border Protection: Required Advance Electronic Presentation of Cargo Information. GAO-04-319R. Washington, D.C.: December 18, 2003. Homeland Security: Preliminary Observations on Efforts to Target Security Inspections of Cargo Containers. GAO-04-325T. Washington, D.C.: December 16, 2003. Posthearing Questions Related to Aviation and Port Security. GAO-04-315R. Washington, D.C.: December 12, 2003. Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 19, 2003. Maritime Security: Progress Made in Implementing Maritime Transportation Security Act, but Concerns Remain. GAO-03-1155T. Washington, D.C.: September 9, 2003. Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July 25, 2003. Homeland Security: Challenges Facing the Department of Homeland Security in Balancing Its Border Security and Trade Facilitation Missions. GAO-03-902T. Washington, D.C.: June 16, 2003. Transportation Security: Federal Action Needed to Address Security Challenges. GAO-03-843. Washington, D.C.: June 30, 2003. Transportation Security: Post-September 11th Initiatives and Long- Term Challenges. GAO-03-616T. Washington, D.C.: April 1, 2003. Border Security: Challenges in Implementing Border Technology. GAO-03-546T. Washington, D.C.: March 12, 2003. Customs Service: Acquisition and Deployment of Radiation Detection Equipment. GAO-03-235T. Washington, D.C.: October 17, 2002. Port Security: Nation Faces Formidable Challenges in Making New Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002.

Summary: This report is a publicly available version of our report on the Customs-Trade Partnership Against Terrorism (C-TPAT). The Department of Homeland Security (DHS) designated our original report as Limited Official Use because of the sensitive and specific nature of the information it contained. U.S. Customs and Border Protection (CBP), the DHS bureau responsible for protecting the nation's borders at and between the official ports of entry, has the dual goals of preventing terrorists and terrorist weapons from entering the United States and also facilitating the flow of legitimate trade and travel. Approximately 90 percent of the world's cargo moves by container. Addressing the threat posed by the movement of containerized cargo across U.S. borders has traditionally posed many challenges for CBP, in particular balancing the bureau's border protection functions and trade enforcement mission with its goal of facilitating the flow of cargo and persons into the United States. CBP has said that the large volume of imports and its limited resources make it impossible to physically inspect all oceangoing containers without disrupting the flow of commerce, and it is unrealistic to expect that all containers warrant such inspection. To address its responsibility to improve cargo security while facilitating commerce, CBP employs multiple strategies. Among these strategies, CBP has in place an initiative known as C-TPAT, which aims to secure the flow of goods bound for the United States by developing a strong, voluntary antiterrorism partnership with the trade community. C-TPAT members commit to improving the security of their supply chain (flow of goods from manufacturer to retailer) and develop written security profiles that outline the security measures in place for the company's supply chain. In exchange for this commitment, CBP offers C-TPAT members benefits for participating that may reduce the level of scrutiny given to their shipments, potentially resulting in a reduced number of inspections of their cargo at U.S. borders. The program is promising, but previous work has raised concerns about its management and its ability to achieve its ultimate goal of improved cargo security. Given our past concerns about the program's effectiveness and in light of the program's rapid expansion, we examined selected aspects of the program's operation and management. This report addresses the following issues: (1) What benefits does CBP provide to C-TPAT members? (2) Before providing benefits, what approach does CBP take to determine C-TPAT members' eligibility for them? (3) After providing benefits, how does CBP verify that members have implemented their security measures? and (4) To what extent has CBP developed strategies and related management tools for achieving the program's goals? In return for committing to making improvements to the security of their shipments by joining the program, C-TPAT members receive a range of benefits that reduce the level of scrutiny CBP provides to their shipments bound for the United States. These benefits may change the risk characterization of their shipments, thereby reducing the probability of extensive documentary and physical inspection. Other benefits include access to FAST lanes on the Canadian and Mexican borders, expedited cargo processing at FAST lanes, and an emphasis on self-policing and self-monitoring of security activities. In addition, CBP grants benefits to C-TPAT members that do not directly affect the level of scrutiny given to their shipments. Before providing benefits, CBP uses a two-pronged approach to assess C-TPAT members. First, CBP has a certification process to review the self-reported information contained in applicants' membership agreements and security profiles. Second, CBP has in place a vetting process to try to assess the compliance with customs laws and regulations and violation history of and intelligence data on importers before granting them benefits. CBP believes that this two-pronged approach provides adequate assurance before granting benefits. However, this approach grants benefits to members before they undergo the validation process. After providing benefits, CBP has a validation process to verify that C-TPAT members' security measures have been implemented and that program benefits should continue. However, we found several weaknesses in the validation process that compromise CBP's ability to provide an actual verification that supply chain security measures in C-TPAT members' security profiles are accurate and are being followed. First, the validation process is not rigorous enough to achieve its stated purpose, which is to ensure that the security procedures outlined in members' security profiles are reliable, accurate, and effective. Related to this, CBP has no written guidelines for its supply chain specialists to indicate what scope of effort is adequate for the validation to ensure that the member's measures are reliable, accurate, and effective. In addition, CBP has not determined the extent to which validations are needed. While CBP has recently completed a strategic plan, we found weaknesses in some of the tools it uses to manage the program that could hinder the bureau in achieving the program's dual goals of securing the flow of goods bound for the United States and facilitating the flow of trade. CBP's new strategic plan appears to provide the bureau with a general framework on which to base key decisions, including key strategic planning elements such as strategic goals, objectives, and strategies. However, CBP still lacks a human capital plan, a fact that has impaired its ability to manage its resources. Furthermore, CBP still has not developed a comprehensive set of performance measures and indicators, including outcome-based measures, to monitor the status of program goals. Finally, the C-TPAT program lacks an effective records management system.