INTERNATIONAL TRADE LAW
How to Prepare for a CBP Import Compliance Audit
A CBP import compliance audit is a review of whether you classified, valued, and documented your imports correctly — and being ready for one comes down to records and reasonable care, not last-minute scrambling. U.S. Customs and Border Protection runs these reviews through its Regulatory Audit function, most often as a Focused Assessment: a risk-based audit of an importer’s internal controls. The importers who come through clean are not the ones with no errors; they are the ones who can show a real compliance system and produce the records to back it up.
This guide explains what CBP is actually testing, the recordkeeping rule that underpins everything, and how to prepare before a notice ever arrives.
The shared-responsibility standard CBP audits against
Since the Customs Modernization Act of 1993, importing has been a “shared responsibility”: CBP provides the rules and information, and the importer of record must use reasonable care to declare goods correctly under 19 U.S.C. § 1484. An audit is, at bottom, a test of whether you met that standard. CBP looks favorably on importers who can demonstrate genuine, documented compliance efforts — and far less favorably on those who treated accuracy as the customs broker’s problem.
Reasonable care shows up in concrete places an auditor will examine:
- Classification — correct Harmonized Tariff Schedule codes, with a documented basis for them.
- Valuation — the right transaction value, including assists, royalties, and related-party adjustments.
- Country of origin — correct marking and origin determinations, which also drive trade-remedy duties.
- Special programs — proper use of any duty preference or exclusion claimed.
The recordkeeping rule that makes or breaks an audit
The foundation of audit readiness is one rule: under 19 U.S.C. § 1508 and 19 C.F.R. Part 163, importers must keep the records that support their entries for five years from the date of entry. The “(a)(1)(A) list” in the regulations spells out the entry records CBP can demand. If you cannot produce a record when CBP asks for it, penalties can follow under § 163.6 regardless of whether the underlying entry was correct — the failure to keep or produce the record is itself the violation.
| Requirement | The rule |
|---|---|
| Retention period | 5 years from the date of entry (or from the activity that created the record) |
| Authority | 19 U.S.C. § 1508; 19 C.F.R. Part 163 |
| What to keep | Entry records on the (a)(1)(A) list: invoices, classifications, valuation support, origin documents, permits |
| Cost of not producing | Penalties under 19 C.F.R. § 163.6, even for an otherwise correct entry |
CBP also runs a voluntary Recordkeeping Compliance Program: certified recordkeepers can become eligible for alternatives to those record-production penalties — a benefit worth weighing if you import at volume.
How a Focused Assessment runs
The Focused Assessment is built around your internal controls, not a line-by-line re-audit of every entry. It moves in phases. CBP first evaluates whether your control environment is adequate — your written procedures, who is responsible for classification and valuation, how you catch and fix errors. If your controls look sound, the audit can stay light. If they look weak, CBP moves to detailed compliance testing of actual transactions, which is where unsupported classifications and valuation gaps surface.
The practical lesson is that the audit largely turns on something you build long before the notice arrives: a documented system showing you take reasonable care and can prove it.
Getting ready before the notice arrives
- Run a self-audit. Pull a sample of entries and test the classifications, values, and origin claims against your own documentation, the way CBP would.
- Write the procedures down. Document who decides classification and valuation, how errors are escalated, and how records are retained — unwritten “we just know” controls do not survive an audit.
- Fix the five-year gap. Confirm you can actually retrieve entry records for the full retention period, not just the recent ones.
- Correct what you find — early. An error caught internally can often be corrected through a prior disclosure to customs, which sharply limits penalties if filed before CBP opens a formal investigation.
- Train the people who touch entries. Classification and valuation decisions made by untrained staff are the most common audit findings.
Frequently asked questions
How long do I have to keep import records? Five years from the date of entry under 19 C.F.R. Part 163. The same period generally applies to the supporting documents behind classification, valuation, and origin.
What is CBP really looking for in a Focused Assessment? Whether your internal controls are good enough that your entries can be trusted. Strong, documented controls keep the audit narrow; weak controls trigger detailed transaction testing.
Can I fix errors I find while preparing? Yes, and you usually should. Correcting them through a prior disclosure before any CBP investigation begins limits the penalty to little more than interest on the lost duties.
What happens if I cannot produce a requested record? Failure to keep or produce a demanded record can draw penalties on its own, even if the entry was accurate. Retrievability matters as much as accuracy.
Worried about how an audit would go? Reidel Law Firm delivers a flat-fee Import/Export Compliance Memo that reviews your classifications, valuation, and recordkeeping against the reasonable-care standard CBP audits to — with direct attorney access. Get a flat-fee compliance memo →
