By Judy Davis, Senior Trade Advisor, Braumiller Consulting Group

When I think of a portal my mind goes immediately to science fiction gateways in time. The literary skills of H.G. Wells in the classic Time Machine, or some of the works of Michael Crichton. Traversing the fantastical realms like the Wizard of Oz, and the Hogwarts time-turners.  The use of multiple types of portals in the Star Trek universe included communication portals, transport portals, and wormholes in time, just to mention a few.  What an experience that would be!  Alas, the focus here diverges from such adventurous concepts. Instead, we want to delve into a more common concept of portal today, that of a user interface within the framework of a communication platform.  I know, I know, not nearly as intriguing, but certainly important to getting the best from your participation in the CTPAT program.  

The CTPAT portal has been a work in progress for a number of years with the latest portal update (3.0) launched at the end of 2023.   Let’s take a few minutes to explore a few strategies for best outcomes while avoiding common challenges and the SCSS response request for “more information”.

Portal Updates:  Let’s be honest, they can be a real hassle.  They take time and resources and interfere with daily operations.  Not only do you have to reacquaint yourself with how the portal operates, but you have to evaluate every response for current status.  In my world it was always traumatic and stress producing.   Although the program is designed so that the portal responses are only submitted on a yearly basis, if you are putting-off updating the information until the annual review is due, you are only sharpening the impact not dulling it.  

Proposed Action:  

Shift the focus to unfolding changes and improvements.  This will effectively distribute the time commitment more evenly throughout the year, making the entire process less overwhelming and much more aligned with the overall CTPAT principles of security.

In Practice: 

1. Check in with department managers, floor supervisors, or other stakeholders for dialogues on how practices are changing. Have they implemented a new process for inspections, or electronic receiving and reconciliation?  Is there a new software program being used to validate potential new business partners?  Are there changes in the on-boarding process for new employees?  Are there new Cybersecurity protocols, or is there planned “testing exercises”, and what are the targeted areas?   
2. If changed areas are identified, make the changes to the portal responses for that section as they happen.  If there are new forms, or new written processes being used add them to the portal documents when response is updated.
3. If you have thoroughly reviewed the criteria for an area, and nothing has changed since the last annual response, no new processes, or documents, don’t spend time reinventing the answer.  It is okay to note an additional,  “Response Remains Valid” or simply “No Changes”  and date it to the current year with your initials.  

Which leads me to –  

Outdated Policies: Referencing out-of-date policies in responses can lead to inconsistencies and require additional clarification during SCSS annual reviews, which equals more time spent on the annual portal submission. Or worse a corrective action needed in your revalidation.  Avoid the habit of just recycling policies already in the portal.  

Proposed Action:  

Consider a tracking program that notifies changes to internal documents.  Make this a discussion point for an email or conversation with mangers or supervisors during a set outreach. When reviewing a portal area, verify your implementation documents are current.  Remember, you can’t just say you have a policy, you have to demonstrate that it is has been implemented. 

 In Practice: 

1. There are eleven (11) sections in the Security Profile.  Create a tracking system (excel type spreadsheet or check list) that takes one each week and follows up on the requirements of that section.  Larger sections like Conveyance and Procedural Security can be broken down further.  This approach reduces the workload.  Not all sections will need updates, further allowing you to prioritize areas that need more attention.  Emphasizing again a better distribution of focused time dedicated to this process.   
2. If documents remain the same, date the tracking for when it was last reviewed.  If procedures or policies have changed, note the change date, and secure the latest copy or the procedures to upload too the portal, adjust the response to that question, and associate the new document. Note: in the latest portal you can delete the associated policy that is out of date.  This does not delete the document, but will assure that the most current document is associated to the criteria.
3. Best Practice might include uploading the tracking document yearly and associating it to the audit program response under Upper Management Responsibility as proof of implementation. 

Repeated Responses: Despite similarities in wording, each portal question is distinct.  Engaging the cruise control and using the copy/paste function of a previous response is usually an ill-fated idea that can lead to rejection, or at the least, a SCSS comment requiring clarification. 

Proposed Action:  

Download your portal summary responses as a PDF. Convert it to a format you prefer (Excel, Word, or plain text) for easier access and updates. This will allow for the advantage of updating offline, saving time.  Additionally, it gives you easy comparison power to responses to previous questions.  

In Practice: 

While some questions may allow for copy-paste answers, avoid the use of total previous  responses. Focus on the details.  Pay attention to the help text associated to each question to understand the details needed.   It will also help you determine what can be reused, and where to provide new material, further ensuring relevant responses and reduced risk of questions prompted from generic answers.  

There are two ways to find the security profile questions for your registered entity:

The Information Button: If online – Look for the information button at the end of each question within the portal. Or 

Public Document Download: Download a copy titled “CTPAT Security Profile Questions [Your Entity Type]” (e.g., “CTPAT Security Profile Questions Importer”) from the public document library.

Conclusion

Don’t let CTPAT portal responsibilities and actions become overwhelming.  By implementing maintenance practices, managing CTPAT requirements can become significantly less time-consuming, even for busy teams. While initial setup requires some effort, these practices will streamline the process and will prove indispensable in the world of evolving supply chain security.

Important Note:  

Don’t submit your annual review on autopilot!  Don’t overlook the “CTPAT-Partner Agreement to Voluntarily Participate” during your portal submission. This document may contain updates each year, potentially outlining new commitments for both you and CBP. Take a moment to read it and stay informed about your partnership responsibilities.

Read more articles by this author: https://www.braumillerconsulting.com/author/judy-davis/