Ctpat - Risk Assessment

C-TPAT 5 Step Risk Assessment Process Guide

C-TPAT Training Seminar March 2010

Table of Contents
Page
5 Step Risk Assessment Process - Introduction Definition of Terms Security Risk Rating 5 Step Risk Assessment Process Overview 3 4 6 8

Attachments
Step 1 - Attachment A Example of Mapping Cargo Flow and Business Partners Step 2 – Conducting a Threat Assessment Attachment B SampleRisk Assessment Resource List Attachment C Sample Threat Assessment Step 3 - Attachment D Sample Vulnerability Assessment Step 4 – Attachment E Sample Risk Assessment Action Plan/Follow-up Step 5 - Attachment F Documenting Risk Assessment Process 9

10 12 13 19 20

2

C-TPAT Training Seminar March 2010

5 Step Risk Assessment Process Introduction

In order to assist C-TPAT Partners withconducting a risk assessment of their international supply chain(s) in accordance with C-TPAT minimum security criteria, the 5 Step Risk Assessment Process is recommended. This reference guide contains some of the basic tools, resources, and examples C-TPAT partners should consider using when conducting a risk assessment on their international supply chain(s). The information contained herein isintended to serve as a guide, and is not “all inclusive” of what should be included in an international supply chain security risk assessment. The 5 Step Risk Assessment Process includes: 1. Mapping Cargo Flow and Identifying Business Partners (directly or indirectly contracted) 2. Conducting a Threat Assessment focusing on: Terrorism, Contraband Smuggling, Human Smuggling, Organized Crime, andconditions in a country/region which may foster such threats and rate threat – High, Medium, Low 3. Conducting a Vulnerability Assessment in accordance with C-TPAT Minimum Security Criteria and rate vulnerability – High, Medium, Low 4. Preparing an Action Plan 5. Documenting How Risk Assessments are Conducted It is understood that some C-TPAT members may have numerous supply chains which may present amonumental task when conducting a comprehensive security risk assessment of their international supply chains. Therefore, it is recommended for C-TPAT members to identify their “High Risk” supply chains by conducting a threat assessment at the point of origin/region and where the cargo is routed/transshipped, and then conduct a comprehensive security vulnerability assessment of those supplychains. Conversely, if supply chains involve a limited number of business partners or related business partners, their supply chain security risk assessment may not require such extensive efforts.

3

C-TPAT Training Seminar March 2010

Risk Assessment Process Definition of Terms
The definition of terms below is intended as a guide when examining the roles of parties involved in theinternational supply chain. Instruments of International Traffic (IIT): Containers, trailers, flatbeds, unit load devices (ULDs), lift vans, cargo vans, shipping tanks, bins, skids, pallets, caul boards, cores for textile fabrics, or other specialized containers arriving (loaded or empty) in use or to be used in the shipment of merchandise in international trade. International Supply Chain Security:Encompasses securing all of the following processes from the cargo’s point of origin (factory/farm) until its arrival and distribution in the United States: Procurement, Production, Packing, Staging/Storing, Loading/Unloading, Transportation, and Document Preparation. International Supply Chain Security Risk Assessment: Process of identifying the security threats, vulnerabilities, and weaknesses throughoutthe international supply chain and prescribing corrective actions with follow-up procedures to ensure weaknesses have been mitigated. Loading/Unloading: Placing cargo in/on or taking cargo out/off of an IIT, including containers, trailers, vessels, planes etc. Mapping Cargo Flow/Parties Involved: Method of identifying all parties involved and their prospective roles in the following processes...