The travel shutdowns during the COVID-19 pandemic greatly impacted CBP’s ability to conduct in-person CTPAT validations and led to lasting changes in the way they were conducted. Now that validations are back to being scheduled and conducted in accordance with the SAFE Port Act mandate, we’ve compiled updated tips and guidance about the process.
Who undergoes a validation?
All CTPAT Members must undergo a validation within 1 year of certification. That is not to say within 365 days but rather, at some point before the end of the next calendar year.
Revalidations are then conducted at least once every 4 years per the Safe Port Act of 2006, although some entities may be validated more frequently if they have facilities in high-risk locations or due to a security incident.
Note: CBP sets travel restrictions for locations it determines are too high risk for CBP personnel to travel to, which can considerably delay on-site validations (first-time or revalidations).
How and when will I know if my company is going to be validated?
Typically, the validation list is part of the CTPAT Program’s annual work plan, which CTPAT HQ usually releases to the CTPAT Field Offices in late February. It is then up to the CTPAT Field Offices and Supply Chain Security Specialists (SCSS) to schedule the actual validations, which can take place at any point during the remainder of that calendar year based on logistics and budget.
If you have been selected to undergo a validation, you will be notified by an email from the CTPAT Portal at least 30 days in advance. Your SCSS will then contact you to coordinate the exact date of the validation. To ensure you receive these notifications, make sure that the Point of Contact (POC) information is up to date in your company’s CTPAT Portal!
Will it be virtual or on-site?
First time validations must be on-site. Revalidations may be conducted on-site or virtually.
CTPAT follows an internal process for determining which companies can qualify for virtual validations. This process is heavily based on risk but includes some other factors as well. Ultimately, the decision to conduct a virtual validation is determined by the CTPAT program and Members cannot request a virtual validation.
You will know if your validation will be virtual or on-site when you are notified that you have an upcoming validation.
How do I prepare for a validation?
Preparation will vary slightly depending on if your validation is virtual vs. on-site but ultimately, the principles are the same.
Leading up to the validation, we recommend that you:
- Ensure that upper management is aware of the upcoming validation and supportive of any needs identified by the main POC for your CTPAT membership.
- Conduct a review of your Security Profile to make sure that it remains current and accurate.
- Hold coordination meetings with your CTPAT Committee or key department personnel so that the owners of the information are prepared to participate in the validation.
- Ensure that critical security-related training has been conducted so that staff are aware of security procedures.
Some additional things to keep in mind:
It is always a good idea to conduct some level of internal audit, review, assessment, inspection, to identify any potential gaps that can be corrected before the actual validation takes place.
For a revalidation, make sure to review your company’s previous validation reports and corrective actions. Although it’s impossible to know what questions your SCSS will ask during the validation, it is likely that they will want to review how you have addressed corrective actions issued by CTPAT. But keep in mind, this will not be the sole focus of the revalidation!
For a virtual validation, we recommend creating a slide deck which creates a virtual tour of your facility by displaying photos of key areas, and hyperlinks to key policies/procedures/other documents and evidence of implementation to ensure an efficient navigation through the validation process. For more guidance on virtual validations, check out our Virtual Validation checklist.
For an on-site validation, we recommend completing a walkthrough of the facility prior to validation, ensuring that you have all documentation available and ready to present, making sure staff at the facility are aware of the validation and its purpose, preparing a conference room for the SCSS, and planning any logistics with SCSS (such as getting to the facility, where they should come in, etc.).
For in-depth guidance on the validation process, sign up for our virtual training course CTPAT Validations: Preparation & Best Practices.
Using their experience as former SCSS, Supervisors, and Program Directors, our CTPAT experts will provide an in-depth overview of the CTPAT validation process, including how to prepare, what to expect during on-site and virtual validations, and how to address findings from validation reports.
Check out our Training page for upcoming course dates.
