CTPAT Minimum Security Criteria – 3PLs| November 2019
Page 3
2. Risk Assessment – The continuing threat of terrorist groups and criminal organizations targeting supply chains underscores the need
for Members to assess existing and potential exposure to these evolving threats. CTPAT recognizes that when a company has multiple
supply chains with numerous business partners, it faces greater complexity in securing those supply chains. When a company has
numerous supply chains, it should focus on geographical areas/supply chains that have higher risk.
When determining risk within their supply chains, Members must consider various factors such as the business model, geographic
location of suppliers, and other aspects that may be unique to a specific supply chain.
Key Definition: Risk – A measure of potential harm from an undesirable event that encompasses threat, vulnerability, and
consequence. What determines the level of risk is how likely it is that a threat will happen. A high probability of an occurrence will
usually equate to a high level of risk. Risk may not be eliminated, but it can be mitigated by managing it – lowering the vulnerability or
the overall impact on the business.
ID Criteria Implementation Guidance
Must /
Should
CTPAT Members must conduct
and document the amount of
risk in their supply chains.
CTPAT Members must conduct
an overall risk assessment (RA)
to identify where security
vulnerabilities may exist. The
RA must identify threats,
assess risks, and incorporate
sustainable measures to
mitigate vulnerabilities. The
member must take into
account CTPAT requirements
specific to the member’s role in
the supply chain.
The overall risk assessment (RA) is made up of two key parts. The first part is a self-assessment of
the Member’s supply chain security practices, procedures, and policies within the facilities that it
controls to verify its adherence to CTPAT’s minimum-security criteria, and an overall management
review of how it is managing risk.
The second part of the RA is the international risk assessment. This portion of the RA includes the
identification of geographical threat(s) based on the Member's business model and role in the supply
chain. When looking at the possible impact of each threat on the security of the member’s supply
chain, the member needs a method to assess or differentiate between levels of risk. A simple
method is assigning the level of risk between low, medium, and high.
CTPAT developed the Five Step Risk Assessment guide as an aid to conducting the international risk
assessment portion of a member’s overall risk assessment, and it can be found on U.S. Customs and
Border Protection’s website at
https://www.cbp.gov/sites/default/files/documents/C-
TPAT%27s%20Five%20Step%20Risk%20Assessment%20Process.pdf.
For Members with extensive supply chains, the primary focus is expected to be on areas of higher
评论0
最新资源