GAO recommends C-TPAT improvements

GAO recommends C-TPAT improvements The U.S. program for encouraging suppliers and importers to secure international shipments from terrorist smuggling of mass destruction weapons needs to be fine tuned to correct continuing weaknesses that pose as a source of vulnerability, according to a government report released Tuesday.
   U.S. Customs and Border Protection has addressed many previous recommendations to tighten policies for the Customs-Trade Partnership Against Terrorism but needs to improve the process for validating companies in the voluntary program that have successfully implemented promised security measures, the Government Accountability Office said.
   C-TPAT is a business partnership program to develop trustworthy importers that implement security controls for their shipping processes and those of their overseas business partners in exchange for trade benefits, primarily reduced scrutiny and delay of their shipments.
   The congressional watchdog agency found, for example, that portable tablet PCs used by CBP supply chain specialists to provide a standardized template of inspection steps and enter findings during on-site checks of facilities created confusion about whether answers to the yes/no question format were automatically populated or entered by a person. The handheld devices are designed to make sure auditors follow a uniform process in collecting information and grading firms on their security procedures. The GAO found that “no” is the default response, meaning that one can’t tell if the answer was intentionally entered or the automatic default for a question that was skipped or not completed.
   Another concern is that CBP does not factor in the results of internal or third-party audits of a C-TPAT member’s supply chain security practices, even though Customs has limited resources and jurisdiction overseas to do regular validations on its own beyond the three-year required follow-up. The GAO said the results of in-house monitoring of security effectiveness could augment the findings made during CBP’s own limited spot checks.
   CBP also lacks procedures to follow up on validation recommendations for companies to improve security deficiencies and doesn’t make full C-TPAT benefits conditional upon such improvements, it said.
   “Without such a key internal control, CBP does not have reasonable assurance that companies implement its recommendations to enhance supply chain security practices in accordance with CBP criteria. Until CBP overcomes these collective challenges, CBP will be unable to assure Congress and others that C-TPAT member companies that have been granted reduced scrutiny of their U.S.-bound containerized shipments actually employ adequate security practices,” the GAO said.
   The GAO report also listed several program management deficiencies, such as neglecting to list procedural dates in the C-TPAT Portal used to store information about and share information with program members. The oversight hindered managers from determining full compliance.
   Auditors also said CBP has still not found an adequate way to measure the tangible security benefit of the program so that the public and international traders can evaluate whether the efforts are worthwhile.
   The GAO recommended that CBP:
   ' Revise the handheld device used in validations to include better response options and eliminate the default “no” response.
   ' Require validations to include the results of audits, inspections or other reviews of a member’s supply chain security.
   ' Ensure that companies follow up on recommended fixes to their security systems.
   ' Enhance the C-TPAT Portal to completely document key data elements required to track compliance with the SAFE Port Act and other requirements.
   Develop performance measures for the program.
   CBP said in a statement e-mailed to reporters that it “has strengthened the security of the global supply chain since the 2005 GAO review and is continuing to make improvements to address potential vulnerabilities. As the GAO recently stated, CBP has made significant improvements to the C-TPAT program’s security criteria, the validation process, staffing and performance measures. As well, CBP has initiated steps to address additional recommendations stemming from the GAO’s more recent review of the program.”
   CBP during the past couple years has taken a more thorough approach towards reviewing supply chain security practices of member firms and instituted a tiered benefits structure so that companies aren’t granted full inspection-reduction status until they’ve had their security procedures verified through on-site facility visits.
   Sen. Patty Murray, D-Wash, one of the principle authors of the 2006 SAFE Port Act, said the “GAO’s findings are very troubling. Congress set out specific requirements for C-TPAT in legislation and we expect Customs to perform the duties we require of them.
   “When it comes to protecting our people and economy, we can't afford to simply give companies the benefit of the doubt. We need to ensure that their supply chains are safe, from foreign factories, to ocean carriers, to our shores,” she said.
   The GAO reviewed a sample of 25 corporate validations during its two-year review of the C-TPAT program. ' Eric Kulisch