How should a company handle suspicious or unexplained inventory discrepancies?

• A. Investigate promptly, document findings, implement corrective actions, and notify CBP as required.
• B. Ignore unless it becomes a financial loss.
• C. File a generic quarterly report.
• D. Notify only suppliers.

Answer: (A)

When suspicious or unexplained inventory discrepancies occur, the immediate focus should be on a disciplined, documented response that strengthens security and accuracy in the supply chain. Investigating promptly helps uncover the underlying cause—whether it’s a simple data-entry error, a procedural lapse, mislabeling, misrouting, or a potential security breach like theft or tampering. The speed of the investigation matters because it limits potential losses, prevents recurrence, and demonstrates to regulators and partners that the organization treats security and accuracy as a priority.

Documenting findings creates a clear, auditable trail that shows what was found, what root causes were identified, and what actions were taken. This record supports internal controls, helps refine training and standard operating procedures, and provides evidence during supplier or regulatory reviews that the company is actively managing risk rather than ignoring it.

Implementing corrective actions follows from the investigation to address root causes and strengthen defenses. This can involve updating receiving procedures, tightening access controls, enhancing cycle counts or reconciliations, improving data integrity in the ERP system, retraining staff, or changing process flows to prevent future discrepancies. The goal is to close gaps in security and controls so the issue isn’t repeated.

Notifying CBP as required ensures alignment with regulatory and program expectations. In the context of CTPAT, sharing information about significant security vulnerabilities or incidents helps coordinate risk management across the supply chain and fulfills the program’s obligation for member cooperation with government authorities. This isn’t about alarm for its own sake; it’s about lawful, proactive risk communication that supports overall security.

Ignoring discrepancies, filing only generic reports, or notifying suppliers without addressing internal controls would leave a real risk unmitigated. The best approach combines timely investigation, clear documentation, effective corrective actions, and appropriate regulatory notification to maintain integrity and compliance throughout the supply chain.