C-TPAT Audit Checklist: Supply Chain Security for Exporters to the USA

Supply Chain Security · 2026-08-24 · 2 min read · CR Global Assurance Editorial Team

US importers in the CTPAT programme must make sure their foreign suppliers meet minimum security criteria. Here is what a C-TPAT audit checks and how to prepare your facility.

C-TPAT (Customs Trade Partnership Against Terrorism, now styled CTPAT) is a voluntary US Customs and Border Protection programme. US importers who participate must assess the security of their foreign suppliers against CTPAT Minimum Security Criteria. That is why factories exporting to the USA are asked for a C-TPAT audit. CR Global Assurance conducts C-TPAT security audits and runs C-TPAT training.

C-TPAT audit checklist

1. Security vision and risk assessment

  • Documented supply chain security policy and responsible person.
  • Annual risk assessment covering the supply chain, including business partners.

2. Business partner requirements

  • Screening and security requirements for subcontractors, transporters and forwarders.

3. Container and trailer security

  • Seven-point (container) or seventeen-point (truck and trailer) inspection before loading, with records.
  • High-security seals meeting ISO 17712, with a controlled seal log.
  • Secure storage of empty and loaded containers.

4. Physical access controls

  • Employee ID badges, visitor logs and escort procedures.
  • Control of keys, access cards and restricted areas such as packing and loading.

5. Physical security

  • Perimeter fencing, gates, lighting and CCTV covering loading areas, with retained recordings.
  • Alarm systems and security guard procedures.

6. Personnel security

  • Pre-employment verification and background checks where legally permitted.
  • Procedures for removing access when employees leave.

7. Procedural security

  • Accurate shipping documents, cargo weighing and reconciliation of piece counts.
  • Procedures for reporting anomalies and suspicious activity.

8. Security training and awareness

  • Training for staff on threat awareness, container inspection and reporting.

9. Cybersecurity

  • Password policies, access controls, backups and protection against malware.

Common C-TPAT findings

  1. Container inspection records signed but inspections not actually performed.
  2. Seal logs that do not reconcile with seals in stock.
  3. CCTV not covering the loading dock or recordings kept too briefly.
  4. Visitor IDs not collected on exit.

Beyond C-TPAT: ISO 28000

Companies that want a certifiable security management system can go further with ISO 28000.

Book a C-TPAT audit or training

CR Global Assurance — formerly CR Team — audits factories, warehouses and logistics providers against CTPAT criteria. Apply for a C-TPAT audit or join our C-TPAT training.

Frequently asked questions

Is C-TPAT mandatory for exporters?

CTPAT is voluntary, but US importers that participate must ensure their foreign suppliers meet the security criteria, so many buyers require a C-TPAT audit from suppliers.

What is the seven-point container inspection?

It is an inspection of a container's front wall, left side, right side, floor, ceiling/roof, inside and outside doors, and outside/undercarriage before loading.

Does CR Global Assurance provide C-TPAT training?

Yes. CR Global Assurance offers C-TPAT training for security, logistics and compliance teams, in addition to C-TPAT audits.