Guide · Business Partner Security

What Does a C-TPAT Security Questionnaire Actually Prove?

By Mandy-Lynn Aitken, 30 years on both sides of the supply-chain auditPublished August 31, 2026

Short answer: a C-TPAT security questionnaire proves you asked. That is worth something, and the Minimum Security Criteria say so outright — criterion 3.5 names questionnaires as an acceptable way to exercise due diligence on a business partner. What the returned form does not prove is that the answers inside it are true, current, or describing the facility your cargo actually moves through. That second half is what a validation is built to test, and it is where questionnaire programs come apart. Sending, chasing and filing the questionnaire is the part software solves easily. Verifying what came back is the XFACTOR VERIFIEDlayer. Holding one supplier record that C-TPAT, PIP and a customer's Bill S-211 request can all read from is XFACTOR COMMANDCENTER, the room those files live in.

Sixty back, eighty still out, and Sales needs a vendor cleared by Friday

The questionnaire cycle is out. Some suppliers answered in a week. Some answered with a PDF of a different company's policy. Most have not answered at all, and the third reminder is now going to a mailbox that may or may not belong to anyone still employed there.

Meanwhile Sales has a launch date and a new vendor they need cleared before the first container books, and they are asking you, politely, whether the security piece can move in parallel. Legal is redlining a supply agreement and wants to know exactly what security language goes in the clause, because the customer's contract already demands certification and they need yours to match. And Shipping and Receiving called this morning because a seal number on a delivery did not match the paperwork, and they want to know who to phone at the carrier and whether it has to be written up.

Somewhere inside that same week, the questionnaire is supposed to be turning into evidence.

I have spent thirty years on both sides of this exchange — sending these forms out for importers, and sitting at a supplier's table while their quality manager worked through one. Nobody in either chair was trying to get away with anything, either time. The form was doing what forms do. The gap it left open showed up somewhere else, later, and usually at the worst available hour.

What does a C-TPAT security questionnaire actually ask?

The good ones are not generic vendor forms. They are drawn from the criteria a validator will actually score, which is why a serious questionnaire ranges far wider than most people expect when they first open one. It reaches into upper management responsibility, risk assessment, business partners, cybersecurity, conveyance and instruments of international traffic, seal security, procedural security, agricultural security, physical security, physical access controls, personnel security, and education, training and awareness.

In business partner security alone, the questions the criteria put to you — and that you therefore put to your partner — read like this:

“Is a written, risk based process in place for screening new business partners and for monitoring current partners?”
“Does the screening process take into account whether a partner is a CTPAT Member or a member in an approved AEO program with a Mutual Recognition Arrangement with the United States? Is evidence of the certification obtained, and are business partners continuously monitored to ensure they maintain their certification?”
“If weaknesses are identified during business partners' security assessments, are they addressed as soon as possible? Is it confirmed that deficiencies have been mitigated via documentary evidence?”
“Are security assessments of business partners updated on a regular basis, or as circumstances and risks dictate?”
“Is a documented social compliance program in place that addresses how the company ensures goods imported into the United States were not mined, produced or manufactured, wholly or in part, with prohibited forms of labor?”

Read those again and notice what several of them are asking for. Not an opinion about security. A document, obtained; a certification, monitored; a deficiency, confirmed closed with evidence. The criteria are already telling you that a stated answer is the beginning of the obligation rather than the discharge of it.

Where does the questionnaire genuinely belong?

Two places, and it does real work in both.

First contact.When a partner enters your chain, you need a structured statement of what they claim to have, in a form you can compare across dozens of partners. Nothing else gets you a baseline that fast. It scopes the relationship, tells you which criteria are even in play for that partner's role, and surfaces the obvious mismatches early — the packer with no written seal procedure, the warehouse with no visitor log, the broker who has never heard of the Consolidated Screening List.

Annual attestation. The criteria require the overall risk assessment to be reviewed at least annually, or more frequently as risk factors dictate, and business partner assessments to be updated on a regular basis or as circumstances change. A re-issued questionnaire is a reasonable way to ask a partner to affirm what has changed since last year, and to catch the changes they would never have thought to tell you about.

Neither of those is a low-value activity, and a program that automates the sending, the reminders, the intake and the status board is genuinely returning time to a team that has none. CBP's own commissioned research treats getting foreign suppliers to complete a company's security evaluation survey as a distinct recurring cost line, which is a fairly blunt admission that the chasing is real work. What C-TPAT compliance software should actually do covers what that cost looks like when you price it out, and what to require of a platform before you sign for one.

Why doesn't a completed questionnaire survive a validation?

Because of three properties it carries no matter how well written it is. It is self-reported, which means the person answering is also the person being assessed. It is unverified, which means nobody outside the supplier has confirmed a single field in it. And it goes stale on a schedule nobody controls, because the facility, the ownership, the subcontracted drayage and the certificate expiry dates all keep moving after the form is filed.

A Supply Chain Security Specialist knows all three. So the validation conversation about a questionnaire is never about the questionnaire. They pick a partner off your list, find their form, and ask what you did with it: who verified this, when, against what. Where the answer said the partner is C-TPAT certified, they ask to see the evidence you obtained and how you monitor that it is still current — because criterion 3.4 asks for exactly that, and it is a requirement, not a suggestion. Where an answer was thin, they ask what corrective action followed and where the documentary evidence of closure is, because criterion 3.6 asks for that too.

There is also a category of criterion that a questionnaire structurally cannot answer, and it is the category that gets containers held. Cargo mapping is one: criterion 2.2 wants the movement of cargo documented from point of origin to the distribution centre, including every business partner involved directly and indirectly, and where the cargo sits at rest. No single supplier can answer that for you. They can only describe their own leg, and the leg they describe is often the leg they subcontracted to someone whose name is not on any form you hold.

The two answers on the same form that did not agree

The questionnaire came back clean. Under seal security, the answer box read the way you would want it to read: written issuance and control procedures in place, high security seals meeting ISO 17712 on every load, the seal verification process followed on all shipments. Signed by a quality manager who was not being dishonest for a second, because upstairs, in a binder, every word of it was true.

Twelve pages later, the same form had a training section. The criteria there ask whether security training is delivered to employees based on their function and position, whether new hires receive it as part of orientation, and — this is the part that decides arguments — whether training evidence is retained: logs, sign-in sheets, rosters or electronic records, carrying the date of the training, the names of the attendees, and the topics covered. That answer was thinner. It described an annual all-staff session and attached nothing.

Nobody reads a questionnaire that way. You read it section by section, scoring each answer against the criterion it belongs to, and each section passes or does not pass on its own. Read across instead and those two answers are arguing with each other: a procedure asserted as performed on every load, and no record that the people performing it had ever been trained on it.

On the floor, the argument resolved in about four minutes. The two people who actually put seals on containers walked me through what they do. They affixed the seal correctly and wrote the number down correctly. They were running the first half of VVTT, the four-step seal check, and had never been taught the last two steps — which is precisely where a seal that has been tampered with gives itself away. (The four steps, and what each one catches, belong to what Shipping and Receiving owns in a C-TPAT program.) So I asked for the training roster. There was one, for a session held that spring, and neither of their names was on it. They had been hired in June.

The procedure existed, and the answer about the procedure was true. This is not a story about a bad supplier; it is a story about what a form can and cannot reach. A written procedure is visible to a questionnaire. Whether the procedure has arrived at the hands that perform it is visible only to somebody who went and looked, or who asked the question in a way the binder cannot answer for. In this case the evidence that would have answered it was sitting in the same envelope, in a different section, unread.

Now put that on your side of the table. When it surfaces during a validation, the finding does not land on the quality manager who filled in the form. It lands on the member — on the file you accepted, on the process you said was risk-based, and on whoever signed the security profile. You will be asked what you did with an answer you had in your possession for a year. The correction runs on the specialist's clock rather than yours, while Sales still needs vendors cleared at the same rate as before, and while every other partner file you hold is suddenly a question you cannot answer quickly either. I have sat through that hour with more than one compliance manager who had done nothing wrong except trust an instrument past the edge of what it measures.

How do you verify an answer without asking the supplier again?

By checking it against a source that is not the supplier. That single sentence is the entire mechanism, and it is more available than most programs assume.

Take the answer that gives you a business address. You do not need the supplier to confirm it; a mapping service will show you soon enough whether that address is a plant, a unit in an office block, or a field. Their corporate registration is a matter of public record in their own jurisdiction, and it will tell you when the company was formed and who owns it now. Screening the company name against the US Consolidated Screening List — OFAC, BIS, DDTC — costs a search, and it can happen before a human ever opens the file. Where an answer claims C-TPAT or approved AEO membership, the program itself will confirm whether that membership is current, which is what turns criterion 3.4's “is evidence of the certification obtained” from a box-tick into a record with a date on it. And where an answer describes a practice rather than a document — a procedure someone says is followed on every load — the only place to test it is with the people who perform the work, in scenarios, instead of with the person who wrote the policy.

That is the work XFACTOR VERIFIEDdoes to each supplier record: the questionnaire answers come in, and then each one is checked against a source outside the supplier, scored against the criteria that actually apply to that partner's business type, and carried into a documented action plan with an owner and a date on every gap. Refusals are recorded as refusals, with what you did next. Those per-supplier records roll up into the signed Master 5-Step Risk Assessment — the same five steps C-TPAT, PIP and AEO all require to support their security profiles, and the same five steps a Bill S-211 executive summary report draws its evidence from. That is why one assessment can serve every program: they rest on the same foundation, so the supplier who answered your questionnaire once does not have to answer three versions of it for three separate filings. The interview that comes after the evidence is real — the room where a specialist asks the follow-up nobody rehearsed — is what XFACTOR VALIDATED is built for.

I hold my own work to that line rather than to the line a program will accept. Most consultants get a client certified and stop. A 100% success rate on C-TPAT, PIP and AEO — at Tier II, not the minimum. I was never someone who gave the bare minimum to my clients, and a questionnaire nobody verified is the bare minimum wearing a process.

If you are mid-cycle right now, the cheapest change is not a bigger form or a new standing meeting. Take the answers you already have and pick the ones that are checkable without the supplier's help — registration, address, screening list, certification status — and check those first. They cost you nothing to confirm, and they are the ones a specialist will reach for first.

The program this maps to: C-TPAT · The departments this maps to: Procurement · Operations · Related reading: What C-TPAT compliance software should actually do · The C-TPAT Minimum Security Criteria · The C-TPAT 5-step risk assessment · What Procurement owns in a C-TPAT program · What Shipping and Receiving owns · Supplier due diligence · Answering a customer's Bill S-211 request