Your customs broker filed every entry, classified every product, and paid every duty bill on time — and none of that protects you. Under U.S. customs law, the importer of record bears the legal duty to exercise reasonable care over classification, valuation, and every other declaration on the entry, whether you prepared it yourself or a broker did it for you. When U.S. Customs and Border Protection (CBP) decides to test that duty, the audit does not start with your transactions. It starts with your internal controls: the written procedures, assigned responsibilities, and error-catching routines that prove compliance is a system at your company rather than a hope. Importers whose controls look sound often walk away from a light-touch review. Importers whose controls look weak get the full treatment — transaction testing across years of entries, bills for back duties, and penalties that scale with how careless CBP thinks you were.
This guide explains the two main audit programs CBP aims at importers, what "adequate internal controls" actually means in practice, the penalty math that makes preparation worthwhile, and the concrete steps that move your operation from penalty target to low-risk.
The Two Audit Programs, in Brief
CBP's Office of Trade, Regulatory Audit and Agency Advisory Services runs two distinct kinds of importer audit:
- Focused Assessment (FA). The comprehensive audit. CBP evaluates your internal controls over import activities to decide whether you pose an acceptable compliance risk, then tests actual transactions where the risk looks unacceptable. It runs in up to three phases and can span many months.
- Quick Response Audit (QRA) and Risk Analysis and Survey Assessment (RASA). The narrow strike. CBP examines one risk area — a single product line's classification, related-party valuation, an antidumping duty order, a free-trade claim — without committing to a full audit. Faster for CBP, but a bad finding can still expand into something bigger.
Focused assessments were once the primary enforcement tool, but their formal procedures make them slow and resource-intensive, so single-issue audits and survey assessments now carry much of the day-to-day load. Either way, the trigger is usually data, not chance: CBP mines entry data in its Automated Commercial Environment (ACE) system for anomalies — classifications that shifted without explanation, values that dropped after a sourcing change, related-party pricing far from arm's length, claims under trade programs your competitors rarely use.
The Focused Assessment, Phase by Phase
The FA is explicitly built around your control environment rather than a line-by-line re-audit of every entry. Understanding the phases matters because your performance in phase one decides whether phase two happens at all.
Phase 1: Pre-Assessment Survey (PAS)
The PAS answers one question: are your internal controls adequate enough that CBP can trust your transactions without testing them all? Auditors send a detailed questionnaire (Exhibit 2A) covering how you manage each risk area — tariff classification, customs value, quantity, country of origin, trade-program claims — and then verify your answers on-site or remotely. They want to see written procedures, named people responsible for each decision, evidence that procedures are actually followed, and a process for catching and correcting errors.
Each risk area gets judged acceptable or unacceptable. All acceptable, and the FA can end here with recommendations. Any area judged unacceptable moves to phase two.
Phase 2: Assessment Compliance Testing (ACT)
ACT is transaction testing. For each unacceptable risk area, auditors pull samples of real entries and measure your actual compliance rate — and quantify any loss of revenue, meaning duties, taxes, and fees you should have paid but did not. This is where unsupported classifications, undeclared assists, misreported related-party values, and expired trade-program claims turn into dollar figures on a government worksheet.
If testing finds violations, CBP can assess the back duties and pursue penalties under the statute described below. The importer is also typically asked to develop a Compliance Improvement Plan (CIP): your own written corrective action for each weakness, which the auditors review but pointedly do not write for you — deciding how to fix your controls is your responsibility.
Phase 3: Follow-Up Audit
Roughly a year later, CBP may return to verify that the CIP was actually implemented and is working. Importers who treated the plan as paperwork discover at this stage that the auditors keep copies.
One structural incentive is worth knowing: importers who complete a Focused Assessment successfully can transition into the Importer Self-Assessment (ISA) program — CBP's trusted-trader track with reduced scrutiny — without a further CBP review, provided they move within about a year and meet the program's other requirements, including Customs-Trade Partnership Against Terrorism membership. A clean FA is, in effect, an audition for lighter-touch treatment going forward.
Quick Response Audits and RASAs: Narrow, Fast, and Not Harmless
A Quick Response Audit targets one pre-identified risk area of one importer, chosen after CBP reviews that company's import data. Common subjects include the dutiability of a particular charge, the classification of a flagship product, or compliance with a specific antidumping or countervailing duty order. CBP also runs informal "small audits" covering two or so risk areas with the same targeted logic.
RASAs go one step lighter: a collaborative, information-sharing review of a specific issue, sometimes spanning multiple entities or an industry segment, without the formal machinery of an audit. CBP describes the point plainly — a fast read on an area of special interest without either side committing audit-level resources.
Do not mistake narrow for safe. Findings from a QRA or RASA feed directly into CBP's risk picture of your company and can be the reason a full Focused Assessment follows. Treat any targeted inquiry as a preview of what a comprehensive audit would examine, and fix the underlying control weakness — not just the flagged entries.
What "Adequate Internal Controls" Actually Means
CBP auditors think in the same vocabulary as financial auditors: the COSO internal control framework shows up in their own program documents. Translated into an import operation of any size, adequate controls mean at least the following:
- Written procedures for every risk area. How classification decisions are made and documented, how customs value is computed (including additions like assists, packing costs, and royalties paid as a condition of sale), how country of origin is determined, and who approves trade-program claims. Tribal knowledge in one employee's head is not a control.
- Clear responsibility. A named person owns each decision, including oversight of your customs broker. Delegating entry filing to a broker delegates the typing, not the liability — reasonable care requires you to supervise, review, and periodically test what your broker files in your name.
- Error detection and correction. A routine — monthly, quarterly, at minimum annually — that compares what was declared against source documents, catches mistakes, and corrects them through protests, post-summary corrections, or prior disclosure as appropriate.
- Complete, retrievable records. Every entry's support package available on demand for the full retention period, discussed next.
Small importers sometimes assume this machinery is for large companies. CBP disagrees: the reasonable-care standard in 19 U.S.C. section 1484 applies to every importer of record, and auditors scale their expectations to your volume, not to zero. A five-person company needs a short written procedure and a named owner, not a compliance department — but it does need them written down.
Recordkeeping: The Five-Year Paper Trail
The Customs Modernization Act requires CBP to publish the definitive list of records importers must keep — the entry records on the "(a)(1)(A) list," implemented in 19 CFR Part 163 and reproduced in CBP's recordkeeping Informed Compliance Publication. The core set is what you would expect: commercial invoices, packing lists, bills of lading, entry summaries (CBP Form 7501), classification workpapers, valuation support, origin documentation, and broker correspondence.
Three points catch importers off guard:
- Five years from entry, not from the calendar year. With a few thousand entries a year, that means tens of thousands of entry packages must stay retrievable at any moment.
- Waived at entry does not mean waived forever. Documents CBP did not ask to see when goods cleared must still be retained for post-entry audit. Presentation and retention are separate obligations.
- Electronic records must hold up. CBP can demand records by summons under 19 U.S.C. section 1509, and failure to produce brings its own penalties on top of whatever the missing records were hiding. Scans in a shared drive with no naming convention and no audit trail will not survive a determined auditor.
If your broker holds your records, confirm in writing that the arrangement satisfies Part 163 and gives you access on demand. "Our broker has everything" is an answer auditors hear often, and it has never once ended an inquiry.
The Penalty Math: Negligence, Gross Negligence, and Fraud
Violations of 19 U.S.C. section 1592 carry penalties on a three-tier ladder, and the rungs are far apart:
- Negligence — failure to exercise reasonable care. Up to two times the loss of duties, taxes, and fees, or up to 20 percent of the dutiable value if the violation did not affect duty assessment.
- Gross negligence — reckless disregard. Up to four times the loss, or up to 40 percent of dutiable value.
- Fraud — intentional deception. Up to the full domestic value of the merchandise.
Note what the bottom rung punishes: not intent, not knowledge — the absence of reasonable care. That is precisely what a Focused Assessment measures. Weak controls do not merely invite deeper testing; they supply the evidentiary basis for the penalty tier.
The escape hatch is prior disclosure: if you discover a violation yourself and fully disclose it to CBP before an investigation begins — identifying the entries, explaining the error, and tendering the lost duties — penalties collapse. For negligence and gross negligence, the penalty is limited to interest on the underpaid duties; even fraud drops to the amount of the loss (or 10 percent of dutiable value where there was no loss). Two cautions: a disclosure invites CBP scrutiny of your other entries going back five years, so audit yourself broadly before you file; and "before an investigation begins" is a race you lose the moment CBP issues a focused inquiry into the same issue. Get trade counsel involved early — this is the highest-leverage legal spend in the customs world.
Common Mistakes That Trigger Audits
Across enforcement actions and practitioner experience, the same risk areas recur:
- Classification drift. The HTSUS number changes between shipments of identical goods, or a favorable classification has no workpaper behind it. Binding rulings (CROSS) exist for exactly this reason — use them on high-duty classifications.
- Related-party valuation. Buying from your own foreign subsidiary or parent at prices far below what unrelated buyers pay, with no transfer-pricing support adapted for customs purposes. Transaction value between related parties must still be arm's length, and CBP tests it.
- Undeclared additions to value. Assists (materials, tooling, or engineering you supplied to the manufacturer), packing costs, and royalties or license fees paid as a condition of sale all belong in dutiable value. These are QRA favorites because they are easy to spot and easy to quantify.
- Origin and trade-remedy evasion exposure. Shifting sourcing to a new country right after an antidumping order hits the old one draws automated attention; so do free-trade claims without origin analysis on file.
- Quantity and unit errors. Wrong units of measure on the entry summary quietly multiply or divide the duty owed.
Every one of these is cheaper to find yourself — through a self-audit and prior disclosure — than to have CBP find for you.
A Practical Preparation Checklist
- Pull your own ACE data and read it like an auditor. CBP's ACE portal gives importers their entry data. Sort by classification, value trends, and trade-program claims, and ask what looks anomalous — because that is what CBP's targeting models ask too.
- Write down the procedures you already follow, then close the gaps. Classification, valuation, origin, quantity, trade programs: one short procedure each, with a named owner and a review step. Perfect is not required; written and followed is.
- Audit your broker relationship. Review a sample of recent entries against your source documents, confirm powers of attorney and recordkeeping arrangements are current, and put broker oversight on a calendar.
- Verify the five-year record trail. Pick ten entries at random from four years ago and time how long full support packages take to assemble. If the answer is measured in days, fix the archive before an auditor runs the same experiment.
- Run a focused self-test on your top two risk areas. Use the FA risk-area structure as your template. Quantify any exposure, then decide with counsel whether prior disclosure beats waiting.
- Reconcile import activity to the books monthly. Tie entered values, duty payments, and broker payables to the general ledger every month, not at year-end. The reconciliation habit is both a control auditors respect and the earliest warning system you have.
Keep Your Import Finances Audit-Ready
Customs compliance ultimately lives or dies in your books: entered values that tie to supplier invoices, duty and merchandise processing fee payments that reconcile to ACE statements, and landed-cost records complete enough to support every declaration years later. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
