Which of the following is not typically considered part of a continuous improvement process in CTPAT?

• A. Regular risk assessments
• B. Updating controls
• C. Refreshing training
• D. Failing to report security incidents promptly

Answer: (D)

In a continuous improvement process, the cycle relies on timely feedback from operations to identify weaknesses, adjust safeguards, and reinforce how people work securely. Regular risk assessments keep spotting new or evolving threats, and updating controls puts those insights into concrete safeguards. Refreshing training ensures everyone stays current with procedures and best practices, so changes are actually put into practice.

Failing to report security incidents promptly disrupts that feedback loop. If incidents aren’t reported quickly, you can’t analyze what went wrong, measure whether current controls worked, or trigger the necessary corrective actions and training updates. Prompt reporting is essential for learning from events and driving improvements across the program, so this behavior doesn’t align with continuous improvement.