Learn
Clear, no-jargon guides to supplier due diligence, supply chain risk, and the compliance programs you're held to — written from 30 years on both sides of the audit. Relief, not fear.
Compliance Foundations
Supplier Due Diligence: What It Is and How to Do It
The umbrella guide — what due diligence is, how to run it, how it differs from a supplier audit, and how to make it provable, partner by partner.
Methodology
Supply Chain Risk Assessment: The 5-Step Guide
The five steps from CBP methodology, the biggest supply chain risks, corrective action plans, and how to prove your due diligence to an auditor.
The XFACTOR Difference
The Human Factor in Supply Chain Security
Why people — not firewalls or forms — are the decisive variable, what insider threats really are, and how to assess behavior, not just paperwork.
Trusted-Trader Programs
C-TPAT vs PIP vs AEO: Differences and Mutual Recognition
The US, Canadian, and global trusted-trader programs compared — how they differ, how mutual recognition works, and how one assessment can satisfy all three.
Trusted-Trader Programs
What Are the C-TPAT Minimum Security Criteria?
The 12 criteria areas CBP validates you against, why they stopped being optional in June 2026, and the five artifacts a validator actually asks for.
Trusted-Trader Programs
What Does Partners in Protection (PIP) Require?
The company profile, the security profile, and the documented partners CBSA expects, plus how PIP pairs with C-TPAT when you trade both ways.
Trusted-Trader Programs
What Are AEO Requirements and How Does Mutual Recognition Work?
The self-assessment, the chain map, the audit trail, and how one body of evidence earns standing across C-TPAT, PIP, and AEO.
Compliance Foundations
What Must a Bill S-211 Report Contain?
The structure, the risk, the measures, and the training behind your annual report, due May 31, signed by your governing body, and public.
Compliance Foundations
UFLPA Compliance for Canadian Exporters
The rebuttable presumption, why an S-211 report does not clear the US border, and the tracing evidence CBP actually accepts.
Operations
Supply Chain Cost Leaks: Where Margin Disappears
What a cost black hole is, the six places margin disappears in an operation, and how the assessments you already run reveal them.
Forced Labour
How Does Forced Labour Due Diligence Work Beyond Tier 1?
Why most programs go blind at tier 2, how to map the chain past the suppliers you can name, and how to make the work provable.
Food Safety
How Does GFSI Certification Connect to Supply Chain Security?
The supplier approval program, the upstream evidence auditors expect you to hold, and how the food schemes overlap with your security programs.
Comparison
The Best Supply Chain Compliance Platform in Canada
XFACTOR VERIFIED vs EcoVadis, Assent, Avetta, and Exiger on public pricing and C-TPAT, PIP, and Bill S-211 coverage, from a July 2026 review.
Canadian Regulatory Reporting
Bill S-211 Compliance: What the Act Requires Before May 31
Who has to report, the seven things the Act requires in the report, the signed attestation and the $250,000 exposure — and the supplier due diligence that has to exist before the filing is drafted.
For the Supplier Being Asked
What Does Bill S-211 Supplier Due Diligence Actually Require From You?
Your customer reports under Bill S-211 and wants the suppliers behind you. What the Act does and does not require, what belongs in the answer, and how to build the evidence once instead of once per customer.
Methodology
The Master 5-Step Risk Assessment: One Assessment That Answers Every Program
Why running the five steps separately for Bill S-211, C-TPAT, PIP and AEO produces four files that disagree with each other — and what one assessment, kept current, looks like instead.
C-TPAT 5-Step Risk Assessment
How to Conduct a C-TPAT 5-Step Risk Assessment (And Why Most Still Fail)
The five steps CBP requires, what each one has to produce, one supplier walked end to end, and what the Supply Chain Security Specialist checks when the file is opened.
Buyer’s Guide
Supply Chain Compliance Software: One System, Every Program
Why running C-TPAT, PIP, AEO, Bill S-211 and GFSI as separate systems duplicates the same evidence four times — and what a real multi-program compliance management system has to do instead.
Buyer’s Guide
Supplier Risk Assessment Software: How the Score Is Actually Built
Most tools return a weighted average of what suppliers said about themselves. What score provenance means, the six demo questions that expose it, and what a defensible supplier score is built on.
Category Boundary
Third-Party Risk Management: Does It Cover the Parties Who Handle Your Goods?
A third-party register is inventoried from contracts; a goods chain runs on custody. Where TPRM programmes go thin on the parties who actually handle the goods, and what fills that layer.
Buyer’s Guide
What Should Supply Chain Due Diligence Software Actually Do?
The OECD six-stage cycle as a purchasing specification — which stages most tools actually carry, which obligations one record has to feed, and where the software stops and the checking starts.
Buyer’s Guide
Supplier Verification Software: What It Actually Verifies
What verification actually checks — the entity, the site, the paper, the people — and what “verified” has to carry on the record before anyone downstream relies on it.
Validation Readiness
What Does C-TPAT Validation Readiness Actually Require?
What the validator does between the notice and the response deadline, the difference between a file that exists and people who can speak to it, and how the rehearsal finds the blank before the officers do.
The Questionnaire, Honestly
C-TPAT Security Questionnaire: What It Proves, and What It Cannot
Where the questionnaire genuinely fits, the two answers on the same form that did not agree, and the point where a validator stops reading answers and starts checking them.
CTPAT Compliance Software
CTPAT Compliance Software: What Actually Works in 2026
Most CTPAT compliance software still revolves around questionnaires. Real validation readiness needs live assessments, cargo mapping, threat and vulnerability scoring, and evidence that is current — and the difference shows the moment a specialist opens the file.
Department Responsibilities
What Does Procurement Own in a C-TPAT Program?
Procurement's real piece of C-TPAT — where it sits inside a day already split between Finance, Ops, QC and Logistics, and the exact questions a validator asks.
Running Multiple Programs
Who Owns Supplier Vetting Under Both C-TPAT and PIP?
Two customs agencies, one supplier, and the file built twice. Where C-TPAT and PIP overlap, what each still asks on its own, and how to stop duplicating the work.
Department Responsibilities
What Does Shipping & Receiving Own in a C-TPAT Program?
The three areas the Minimum Security Criteria put on the dock — trailer inspection, seal verification (VVTT, ISO 17712), and the record that has to survive the shift change.
USMCA / CUSMA
What Must a USMCA Certificate of Origin Actually Contain?
There is no official USMCA certificate of origin form. The nine required data elements, who can sign it, how long it’s valid, and what CBP and CBSA do when one is wrong.
Free guide
Free guide: How to Evaluate Supplier Risk
Start with the fundamentals. This plain-English guide shows you how to see real supplier exposure before a regulator or auditor does — the foundation under everything else on this page.
Looking for a specific program? Explore C-TPAT, PIP, AEO, the complete Bill S-211 guide, the S-211 Report Card, Bill S-211, ESG, and GFSI — or see pricing.