In the C-TPAT seminar conducted in March 2010, CBP recommended a 5 Step Risk Assessment Process to assist C-TPAT Partners in conducting a risk assessment of their international supply chain(s), in accordance with C-TPAT minimum security criteria. The following 5 steps are included in the risk assessment process:
1) Map cargo flow and identify business partners
2) Conduct a Threat Assessment
3) Conduct a Vulnerability Assessment
4) Prepare an Action Plan
5) Document How Risk Assessments are conducted
I have been asked by numerous customers on what can be done to manage their C-TPAT process within the framework of these new guidelines. This 5 part article is my attempt to explain, in detail, each step in the new guidelines and discuss how you can leverage a software solution to support your C-TPAT process and easily conduct the risk assessments to meet the requirements of each step in the new guidelines and to manage your C-TPAT process efficiently.
In this part of the series, lets us look how a company can conduct the vulnerability assessment of its supply chain partners.
Step 3. Conduct a Vulnerability Assessment
The next step in the process is to gather detailed information from your supply chain partner on the C-TPAT minimum-security criteria categories suggested by CBP.
Note, this is not a one- time process. It is expected that at least once a year you will reevaluate your supply chain partners for compliance with the security criteria requirements through follow-ups.
The following are some of the methods used to conduct the assessment:
1) SVI Number/C-TPAT Membership
2) Membership in “Mutual Recognition Program”
3) Security Surveys
4) Site visits by company representative
5) Site visits by overseas personnel/agents
6) Business reports
7) Security certifications covering C-TPAT minimum-security criteria
8) 3rd party supply chain security assessments
However, the security survey is the most simple, cost-effective and commonly used method. Site visits can be an effective method as well when dealing with a new supply chain partner in a new region, especially directly contracted partners of only local presence in the region e.g. new manufacturer in China with only a local factory and no US presence.
When using a security survey, your survey must request detailed information on the below listed minimum-security criteria categories:
· Business Partner Requirements
· Securing Instruments of International Traffic
· Procedural Security
· Physical Security
· Physical Access Controls
· Personnel Security
· Security and Threat Awareness Training
· Information Technology Security
Design your survey in such a way that it identifies the must and should haves under each criteria.
a. What happens based on the survey response?
The partner survey response helps you rate them into one of the risk rating based on the following guidelines:
· Low Risk - Meets all applicable Minimum Security Criteria (Musts and Shoulds)
· Medium Risk - Meets all applicable “Musts” Minimum Security Criteria, but does not meet all “Shoulds”
· High Risk – Does not meet all “Must” Minimum Security Criteria
b. Do all my partners complete the detailed survey?
The answer to that is based on the below factors:
· Are you working with a supply chain partner who is also C-TPAT certified by CBP?
If yes, then their SVI number is all your need from them in response to the survey. Since your partner has gone through the certification process with CBP to obtain the C-TPAT status, it is assumed that their processes are well established and they have already addressed the vulnerabilities within their processes during their certification process. So their SVI number serves as a proof to their status
· Is your partner certified under a Mutual recognition program?
As of January 2010, four Mutual Recognition Arrangements have been signed by CBP:
o New Zealand Customs Service’s Secure Export Scheme Program
o Canada Border Services Agency’s Partners in Protection Program
o Jordan Customs Department’s Golden List Program
o Japan Customs and Tariff Bureau’s Authorized Economic Operator Program
CBP is also currently working with the following Customs Administration with the goal of reaching MR:
i. Korean Customs – Authorized Economic Operator Program
ii. Singapore Customs - Secure Trade Partnership Plus Program
iii. European Union – Authorized Economic Operator Program
If your supply chain partner is certified under any of the above programs, then you can use their certification status as proof and they do not have to complete the detailed security survey.
If your partner is not certified under any of the above then it is expected that they complete the detailed survey.
c. It is lot of data to collect and needs extensive follow-up with my partners. How can I manage the process using my limited resources?
Software applications like GTKonnect C-TPAT and PRM help you manage this process easily. Use the template surveys already available in the application or easily create your own survey. Select the partners that need to answer the survey and the system manages the request and response process for both the initial survey and the annual follow-ups. System also automatically rates your partner under one of the risk rating based on the responses to the must and should haves.
About C-TPAT
Customs – Trade partnership against terrorism (aka C-TPAT) is a voluntary government-business initiative to build cooperative relationships that strengthen and improve overall international supply chain and U.S. border security.
Launched in 2001, immediately in response to 9/11, to secure our borders from terrorist attacks, the program has grown from 7 US importers at launch to over 10,000 + participants today. For more information please visit http://www.cbp.gov/xp/cgov/trade/cargo_security/ctpat
About Netwin Solutions and GTKonnect
Netwin Solutions is a premier provider of integrated global trade management software solutions through its GTKonnect platform. Netwin's GTKonnect provides organizations with a one stop solution for all their Compliance, automation, content needs related to Global Trade and Logistics.
While you are dedicated in giving more value added services to your customers and growing your core area of business, GTKonnect Global Trade Software and its services will enable you to meet the constant changing demands in being compliant and efficient and unifies import, export, Partner Relationship and CTPAT management, post entry reconciliation and financial processes, Drawback and Trade programs. GTKonnect provides software for ISF, ABI/ACE Software / Imports, Exports, Denied Party Screening, Partner Relationship Management (PRM), Trade Agreements (like NAFTA and CAFTA), C-TPAT, FTZ, Master Data Management; all available as a single integrated suite or available individually as deemed fit for your organization. Our growing global Trade database available for free access includes, trade news, trade content such as CSMS messages, Denied Party lists, global tariffs, various trade tools and trade links. GTKonnect's International Trade Software is being used by organizations in various verticals and of varying sizes, a proof to our capabilities.
Also Read:
The new 5 step C-TPAT Risk Assessment process – Simplified (Part 1)
The new 5 step C-TPAT Risk Assessment process – Simplified (Part 2)
The new 5 step C-TPAT Risk Assessment process - Simplified (Part 4)
The new 5 step C-TPAT Risk Assessment process - Simplified (Part 5)