In the post-9/11 environment, the movement of cargo  shipments throughout the global supply chain from foreign manufacturers,  suppliers, or vendors to retailers or other end users in the United States is  inherently vulnerable to terrorist actions. CBP Is Taking Steps to Resolve Data System Problems, but Could Take Additional Steps to Ensure Staff Meet Security Validation Responsibilities

		Data System Problems Have Led to Challenges in Identifying and Completing C-TPAT Member Security Validations

C-TPAT staff have faced challenges in meeting C-TPAT security  validation responsibilities in an efficient and timely manner because of  problems with the functionality of C-TPAT’s data management system  (Portal 2.0). In particular, while the intended purpose of transitioning from  Portal 1.0 to Portal 2.0 in August 2015 was to improve functionality and  facilitate communication between security specialists and C-TPAT  members, a series of problems arose as a result of this transition that  have impaired the ability of C-TPAT staff to identify and complete  required C-TPAT member certification procedures and security profile  reviews in a timely and efficient manner. For  example, TASPD staff cited unclear requirements for the Portal 2.0  system and its user needs as a factor that likely contributed to inadequate  system testing and continued problems. As part of the root  cause analysis, TASPD staff have outlined recommended actions for  addressing causal factors that led to the Portal 2.0 problems, along with  the associated timeframes for completing these actions. While TASPD  and C-TPAT staff have already implemented some actions, such as  establishing a new team structure, the staff stated that they will continue  to work on identifying and addressing potential root causes of the Portal  2.0 problems and noted that this process will likely continue through  2017. Issuing Standardized Guidance to Field Offices Could Better Assure Data on Security Validations Are More Consistent and Reliable

Despite the Portal 2.0 problems, C-TPAT headquarters officials and field  office directors we met with told us that they are assured that required  security validations are being identified and completed in a timely manner  because the field offices keep records on required and completed security  validations apart from data recorded in Portal 2.0. While the current validation tracking processes used by field offices do  account for security validations conducted over the year, standardizing  the process used by field offices to track required security validations  could strengthen C-TPAT management’s assurance that its field offices  are identifying and completing the required security validations in a  consistent and reliable manner. CBP Cannot Determine the Extent to Which C-TPAT Members Are Receiving Benefits Because of Data Concerns

		CBP Staff Have Concerns Regarding the Accuracy of C-TPAT Member Benefit Data

Since 2012, CBP has compiled data on certain events or actions it has  taken regarding arriving shipments—such as examinations, holds, and  processing times—for both C-TPAT and non-C-TPAT members through  its C-TPAT Dashboard. However, based on GAO’s preliminary analyses  of data contained in the Dashboard, and data accuracy and reliability  concerns cited by C-TPAT program officials, we concluded that CBP staff  are not able to determine the extent to which C-TPAT members are  receiving benefits, such as reduced likelihood of examinations of their  shipments and expedited shipment processing, compared to non- members. It is too soon for us to assess whether this  process will fully address the Dashboard accuracy and reliability issues. CBP has likely relied on such questionable data since it  developed the Dashboard in 2012, and, thus, cannot be assured that C-TPAT members have consistently received the benefits that CBP has  publicized. Trade industry officials we met with generally  spoke positively of the C-TPAT program and of CBP staffs’ efforts in  sharing information and listening to their concerns and suggestions for  enhancing the program. Conclusions

CBP’s risk-informed approach to supply chain security focuses on  ensuring the expeditious flow of millions of cargo shipments into the  United States each year, while also managing security concerns. Further, to ensure the availability of complete and accurate data for  managing the C-TPAT program and establishing and maintaining reliable  indicators on the extent to which C-TPAT members receive benefits, we  recommend that the Commissioner of U.S. Customs and Border  Protection determine the specific problems that have led to questionable  data contained in the Dashboard and develop an action plan, with  milestones and completion dates, for correcting the data so that the C- TPAT program can produce accurate and reliable data for measuring C- TPAT member benefits. 1. The report may include recommendations to  improve security practices, as well as any required actions the  member is to take to conform to CBP’s minimum security criteria.
Why GAO Did This Study

The economic well-being of the United States depends on the movement of millions of cargo shipments throughout the global supply chain—the flow of goods from manufacturers to retailers or other end users. However, cargo shipments can present security concerns. CBP is responsible for administering cargo security and facilitating the flow of legitimate commerce. CBP has implemented several programs as part of a risk-based approach to supply chain security. One such program, C-TPAT, is a voluntary program in which CBP staff validate that members' supply chain security practices meet minimum security criteria. In return, members are eligible to receive benefits, such as a reduced likelihood their shipments will be examined.
This report assesses the extent to which (1) CBP is meeting its security validation responsibilities, and (2) C-TPAT members are receiving benefits. GAO reviewed information on security validations, member benefits, and other program documents. GAO also interviewed officials at CBP headquarters and three C-TPAT field offices chosen for their geographical diversity; as well as select C-TPAT members and trade industry officials.

What GAO Found

Staff from U.S. Customs and Border Protection's (CBP) Customs-Trade Partnership Against Terrorism (C-TPAT) program have faced challenges in meeting C-TPAT security validation responsibilities because of problems with the functionality of the program's data management system (Portal 2.0). In particular, since the system was updated in August 2015, C-TPAT staff have identified instances in which the Portal 2.0 system incorrectly altered C-TPAT members' certification or security profile dates, requiring manual verification of member data and impairing the ability of C-TPAT security specialists to identify and complete required security validations in a timely and efficient manner. While the focus of CBP's staff was initially on documenting and addressing Portal 2.0 problems as they arose, the staff have begun to identify root causes that led to the Portal 2.0 problems. For example, CBP staff cited unclear requirements for the system and its users' needs, coupled with inadequate testing, as factors that likely contributed to problems. In response, CBP staff have outlined recommended actions, along with timeframes for completing the actions. The staff stated that they will continue to work on identifying and addressing potential root causes of the Portal problems through 2017. C-TPAT officials told us that despite the Portal 2.0 problems, they have assurance that required security validations are being tracked and completed as a result of record reviews taking place at field offices. However, these field office reviews were developed in the absence of standardized guidance from C-TPAT headquarters. While the current validation tracking processes used by field offices do account for security validations conducted over the year, standardizing the process used by field offices for tracking required security validations could strengthen C-TPAT management's assurance that its field offices are identifying and completing the required security validations in a consistent and reliable manner.
CBP cannot determine the extent to which C-TPAT members are receiving benefits because of data problems. Specifically, since 2012, CBP has compiled data on certain events or actions it has taken regarding arriving shipments—such as examination and hold rates and processing times—for both C-TPAT and non-C-TPAT members through its Dashboard data reporting tool. However, on the basis of GAO's preliminary analyses and subsequent data accuracy concerns cited by C-TPAT program officials, GAO determined that data contained in the Dashboard could not be relied on for accurately measuring C-TPAT member benefits. Also, CBP has likely relied on such questionable data since it developed the Dashboard in 2012, and, thus, cannot be assured that C-TPAT members have consistently received the benefits that CBP has publicized. C-TPAT officials stated that they are analyzing the Dashboard to finalize an action plan to correct the data concerns. It is too soon to tell, though, whether this process will fully address the accuracy and reliability issues. Despite these issues, C-TPAT officials are exploring new member benefits, and industry officials we met with generally spoke positively of the C-TPAT program.

What GAO Recommends

GAO is recommending that CBP develop (1) standardized guidance for field offices regarding the tracking of information on security validations, and (2) a plan with milestones and completion dates to fix the Dashboard so the C-TPAT program can produce accurate data on C-TPAT member benefits. DHS concurred with GAO's recommendations.