What must importers perform to become CTPAT certified?

• A. A financial audit of suppliers.
• B. A third-party certification program review.
• C. A security evaluation of their supply chain.
• D. A risk assessment of only imported goods.

Answer: (C)

CTPAT certification focuses on securing the entire supply chain, not just parts of it. To become certified, importers must show that they have evaluated and strengthened security across their network—including suppliers, facilities, transportation, and information flows—and are prepared for validation by CBP. This security evaluation examines vulnerabilities, tests whether appropriate protections are in place, and demonstrates ongoing risk management across the whole supply chain. That broad focus is why a security evaluation of the supply chain is the best answer. Financial audits of suppliers target financial risk rather than security controls; a third-party program review isn’t the formal validation process for CTPAT; and limiting the risk assessment to imported goods misses the wider, end-to-end security scope required by CTPAT.