CTPAT Virtual Validation: What to Expect and How to Prep

Today, we’re here to talk about a topic keeping plenty of CTPAT members awake at night…the CTPAT Virtual Validation! If you’ve recently submitted your Security Profile, it won’t be long before your Supply Chain Security Specialist (SCSS) will be in touch to schedule a Validation review to ensure your program meets CBP CTPAT standards – which can feel pretty intimidating if you’re unsure what to expect. But not to worry. In this article, Veroot covers everything you need to know about the Virtual Validation process as well as best practices to ace your audit.

CTPAT VALIDATION: THEN AND NOW

Until very recently, CTPAT Validations always took place in person. Your assigned SCSS would stop by your facility, take a tour of the building, review any required documentation, and get a general feel for your security methodologies. However, in response to COVID-19, on-site visits were quickly replaced by Virtual Validations for health and safety reasons in 2020. And although the worst of the pandemic has (hopefully) passed, it seems as though the new digital evaluation system may be here to stay.

Unsurprisingly, Virtual Validations take place completely online via remote video/teleconference. Despite the remote nature of the evaluation, the resounding opinion amongst program members who have completed the process is that it’s more challenging than an on-site inspection. The difficulty is due to several factors, including the recent implementation of new Minimum Security Criteria (MSC), more rigorous documentation requirements, and a general increased emphasis on improving the program’s efficacy from Customs and Border Protection. Additionally, security elements are typically harder to assess in a remote meeting format.

GETTING READY FOR A VIRTUAL VALIDATION

When it comes time for your CTPAT Validation, one of the primary focuses of the inspection will be to confirm that your required processes are adequately evidenced. For example, not only must all roughly 160 Security Profile questions be thoroughly answered, but authentic documentation to back your responses must also be provided. This is done by uploading the appropriate written procedures to the CTPAT portal and attaching each process document to its corresponding question in the profile.

Before your CTPAT Validation, there are a multitude of documents to not only prepare but also upload to the portal. These relate to both the traditional and newly updated aspects of the MSC – so, as a reminder, make sure you don’t forget the addition of recent processes that are new points of emphasis to meet CBP CTPAT requirements. For example, legacy processes include the 7/8 Point Inspection, Visitor Processes, and Access Control, just to name a few. The newer processes include Wood Pest Management, Money Laundering, Human Trafficking, and Code of Conduct. It is critical to have these written procedures built out in a standalone format and ready to be virtually shared in the meeting with your Supply Chain Security Specialist.

That brings us to a common question: “So what exactly is the threshold for CTPAT documentation? How much will I need to show my SCSS?” To give you a ballpark, in failed CTPAT Validations, we typically see an average of only 7-10 total documents uploaded to the CTPAT portal. That range generally falls very far short of what CBP considers acceptable. As a general rule, the total number of written documents to provide should be around 35-40 to mitigate the risk of rejection from the program.

VIRTUAL VALIDATION SPECIFICS: WHAT TO BRING AND HOW TO PREP

1) Five-Step Risk Assessment

One area your SCSS will likely lean into during the Validation is your understanding of the Five-Step Risk Assessment process. To prove you know your stuff, you should be ready to answer any questions about these 10 topics:

• Internal / External Risk Assessments
• Threat Mapping
• Cargo Mapping
• Management Reviews
• Action Plans
• Security Questionnaire 
• Cargo Handling Processes
• Visitor Management
• Employee Management
• Process Disbursement

Quick Tip: Having a hard copy version of your documentation printed out and ready to reference throughout the call is helpful when you’re trying to navigate on-the-spot questions about your Five-Step Risk Assessment Process.

2) Security Awareness Training

Another component of the program you can expect to discuss during the Validation is your CTPAT Security Awareness Training procedure. Your SCSS will want to see if you have a training program in place that sufficiently covers the major aspects of the MSC.  They will also want to confirm you have an effective mechanism for distributing training and SOPs to your business partners (because they are also required to be in the loop on your CTPAT protocol). To prove your employees and associates have been adequately educated, you should come into the meeting armed with a Training Log that lists the names, dates, and curriculum on which the required parties were trained.

3) Security Questionnaires

Most CBP inspectors will also want to understand how your company distributes and collects Security Questionnaires. Prepare for questions like “What’s the process,” “Who are you sending them to,” and “How do you determine when a new questionnaire is due?” In our experience, it is always a good idea to bring several recently completed Security Questionnaires to the CTPAT Virtual Validation to unequivocally prove execution in this area. Also, be sure you’ve done your due diligence to confirm your Security Questionnaires cover all 12 sections of the MSC.

Quick Tip: Bringing an out-of-date Security Questionnaire to the Validation meeting will do you more harm than good. Be sure to only present questionnaires that meet new Minimum Security Criteria as evidence of your company’s compliance.

4) Cargo Handling Processes

If your facility handles cargo – and especially if it seals cargo – it’s important to have an example of your Seal Log, Seal Maintenance Process, and your 7-point / 17-point Inspection Sign-Offs on hand for the meeting. It’s an easy area to overlook, but it’s critical not to skimp on preparation when it comes to cargo handling processes!

5) Cargo Flow & Threat Assessment

Another common request from your Supply Chain Security Specialist will be to produce an example Cargo Flow Map, as well as a comprehensive regional Threat Assessment Map. These questions are to ensure you’re able to illustrate a thorough understanding of who handles your cargo and how it (hopefully securely and lawfully) moves from origin to destination. 

6) Physical Security / Facility Inspection

A part of the Virtual Validation may also include using your cell phone or tablet to “walk” your SCSS through your physical facility. This portion of the meeting is just what it sounds like giving your SCSS a virtual video tour so they can see your office, warehouse, dock, storage areas, security technology, emergency exits, etc. In this case, it is incredibly important to make sure your facility presents well in a virtual capacity. Of course, your facility should always be safe, secure, and clean…but it would be foolish not to put your best foot forward ahead of any CBP Inspection. So, as a rule, you should make sure your facilities stack up to all the Physical Security Requirements listed in the most recent MSC. We even recommend doing a practice run of a virtual facility tour to get a feel for what your SCSS’s digital experience might be.

VIRTUAL VALIDATION TAKEAWAYS

In total, you can expect the virtual validation to run about four hours in length, including a few breaks for refreshment. Ultimately, the biggest benefit of switching to a Virtual Validation model for CBP is the huge time and energy savings, while still being able to ensure  CTPAT members are playing by the rules to keep our borders secure. In the long term, it will also increase their capacity and reach, allowing more members to participate in the program…which is ideal because we foresee a day in the not-so-distant future when CTPAT membership will be imperative for all companies who want to continue to operate on a global scale.

We hope this information helps provide clarity about what to expect when it comes time for your first Virtual Validation – but if any part of the process feels too time-consuming or overwhelming to wrap your head around, don’t stress. Veroot is available to help your company easily navigate CTPAT Validation prep and develop all the policies you need to pass with flying colors. Get in touch to see how we can help!