Guide · Business Partner Security

What Does a C-TPAT Security Questionnaire Actually Prove?

By Mandy-Lynn Aitken, 30 years on both sides of the supply-chain auditUpdated September 25, 2026.

Sales has a launch date and a new vendor they need cleared before the first container books. Legal is redlining a supply agreement and needs to know exactly what security language goes in the clause, because the customer's contract already demands certification and theirs has to match. Shipping and Receiving called this morning because a seal number on a delivery did not match the paperwork. And somewhere inside that same week, the C-TPAT security questionnaireyou sent out to a dozen business partners is supposed to have turned into evidence by now — not just a stack of returned forms. Whether that happened is a separate question from whether the form came back at all, and a validation is built to test exactly the difference between the two, which is precisely where questionnaire programs come apart. Proving you asked is still worth something, and the Minimum Security Criteria say so outright. Criterion 3.5 of the published criteriais a “must”: where a Member outsources or contracts elements of its supply chain it “must exercise due diligence (via visits, questionnaires, etc.) to ensure these business partners have security measures in place that meet or exceed CTPAT's Minimum Security Criteria.” The form is named in the rule. But sending, chasing and filing the questionnaire is the easy half of the work and the half everybody buys software for. Verifying what came back is the half that decides whether any of it counts, and it is where the rest of this page goes.

Sixty back, eighty still out, and Sales needs a vendor cleared by Friday

The questionnaire cycle is out. Some suppliers answered in a week. Some answered with a PDF of a different company's policy. Most have not answered at all, and the third reminder is now going to a mailbox that may or may not belong to anyone still employed there.

Somewhere inside that same week — while Sales is still waiting on its answer, and Shipping and Receiving is still waiting on theirs — the questionnaire is supposed to be turning into evidence. So here is the order I work it in, and I have never found a better one.

One. Sort the returns by what the partner touches, not by who answered first. A drayage company that takes your loaded container from the port outranks a packaging vendor who answered in a day.
Two. Read the returns you have against one question only: does anything in here contradict anything else in here? Those are the ones to verify this week.
Three. For the silent ones, stop sending reminders on the third try. Send the request to the commercial owner of that relationship with a date on it, because a supplier answers Purchasing long before they answer Compliance.
Four. Cleared-by-Friday vendors get a scope, not a pass: name the two or three criteria their role actually carries, verify those, and log the rest as open with an owner and a date.
Five. Anything still silent after the commercial ask is not a blank cell. Log it as a refusal, with what you did about it. A documented refusal is defensible; an empty field reads as an answer you never chased.

That is the whole triage. The reason it works is that it spends your verification hours on the partners who can actually cost you a container, and it turns your silences into something you can hand to a specialist instead of something you have to explain.

One more thing about the silent ones, because clients read every non-answer as a threat and most of them are not. In my own tracking of these cycles across clients, the split has held remarkably steady. About sixty percent have not answered because they genuinely do not know what is being asked of them — the form landed on someone who has never heard of the program, and their hesitancy is unawareness, not a red flag. Those you train; a twenty-minute walk-through gets you the return. Roughly twenty percent are the mom-and-pop suppliers: short-staffed, doing their best every day, and unable to see where the hours for this would come from. Those you give a lighter path and a real date, not a fourth reminder. Ten percent know exactly what these programs are and want nothing to do with any of them — that is the group that should raise a flag for the client who depends on them. And the last ten percent may not have the best intentions in being a supplier at all, which is the reason the assessment exists in the first place. Sort your silences into those four before you escalate, and the escalation list gets short and very specific.

I have spent over 25 years on both sides of this exchange — sending these forms out for importers, and sitting at a supplier's table while their quality manager worked through one. Nobody in either chair was trying to get away with anything, either time. The form was doing what forms do. The gap it left open showed up somewhere else, later, and usually at the worst available hour.

What does a C-TPAT security questionnaire actually ask?

The good ones are not generic vendor forms. They are drawn from the criteria a validator will actually score, which is why a serious questionnaire ranges far wider than most people expect when they first open one. It reaches into upper management responsibility, risk assessment, business partners, cybersecurity, conveyance and instruments of international traffic, seal security, procedural security, agricultural security, physical security, physical access controls, personnel security, and education, training and awareness.

In business partner security alone, the questions the criteria put to you — and that you therefore put to your partner — read like this:

“Is a written, risk based process in place for screening new business partners and for monitoring current partners?”
“Does the screening process take into account whether a partner is a CTPAT Member or a member in an approved AEO program with a Mutual Recognition Arrangement with the United States? Is evidence of the certification obtained, and are business partners continuously monitored to ensure they maintain their certification?”
“If weaknesses are identified during business partners' security assessments, are they addressed as soon as possible? Is it confirmed that deficiencies have been mitigated via documentary evidence?”
“Are security assessments of business partners updated on a regular basis, or as circumstances and risks dictate?”
“Is a documented social compliance program in place that addresses how the company ensures goods imported into the United States were not mined, produced or manufactured, wholly or in part, with prohibited forms of labor?”

That last one carries more weight than its place in the list suggests: it is the security criteria's entry point for the Uyghur Forced Labor Prevention Act (UFLPA), the statute under which CBP detains and can deny entry to goods it believes were made with forced labor. A weak answer here carries enforcement consequences the other criteria do not.

Read those again and notice what several of them are actually asking for: a document, obtained; a certification, monitored; a deficiency, confirmed closed with evidence. The criteria are already telling you that a stated answer is the beginning of the obligation rather than the discharge of it.

Where does the questionnaire genuinely belong?

Two places, and it does real work in both.

First contact.When a partner enters your chain, you need a structured statement of what they claim to have, in a form you can compare across dozens of partners. Nothing else gets you a baseline that fast. It scopes the relationship, tells you which criteria are even in play for that partner's role, and surfaces the obvious mismatches early — the packer with no written seal procedure, the warehouse with no visitor log, the broker who has never heard of the Consolidated Screening List.

Annual attestation. Criterion 2.3 requires that “risk assessments must be reviewed annually, or more frequently as risk factors dictate” — CBP's five-step guide puts the same duty as “C-TPAT Partners must conduct a risk assessment at least annually in order to remain in the C-TPAT program” — and criterion 3.7 adds that Members “should update their security assessments of their business partners on a regular basis, or as circumstances/risks dictate”. A re-issued questionnaire is a reasonable way to ask a partner to affirm what has changed since last year, and to catch the changes they would never have thought to tell you about.

Neither of those is a low-value activity, and a program that automates the sending, the reminders, the intake and the status board is genuinely returning time to a team that has none. CBP's own commissioned research treats getting foreign suppliers to complete a company's security evaluation survey as a distinct recurring cost line, which is a fairly blunt admission that the chasing is real work. What C-TPAT compliance software should actually do covers what that cost looks like when you price it out, and what to require of a platform before you sign for one.

Why doesn't a completed questionnaire survive a validation?

Because of three properties it carries no matter how well written it is. It is self-reported, which means the person answering is also the person being assessed. It is unverified, which means nobody outside the supplier has confirmed a single field in it. And it goes stale on a schedule nobody controls, because the facility, the ownership, the subcontracted drayage and the certificate expiry dates all keep moving after the form is filed.

A Supply Chain Security Specialist knows all three. So the validation conversation about a questionnaire is never about the questionnaire. They pick a partner off your list, find their form, and ask what you did with it: who verified this, when, against what. Where the answer said the partner is C-TPAT certified, they ask to see the evidence you obtained and how you monitor that it is still current — because criterion 3.4 asks for exactly that: Members “must obtain” evidence of a partner's certification and continuously monitor it, and it is a requirement, not a suggestion. Where an answer was thin, they ask what corrective action followed and where the documentary evidence of closure is, because criterion 3.6 requires that weaknesses identified in a partner assessment be confirmed mitigated via documentary evidence.

There is also a category of criterion that a questionnaire structurally cannot answer, and it is the category that gets containers held. Cargo mapping is one: criterion 2.2 says the international portion of the risk assessment “should document or map the movement of the Member's cargo throughout its supply chain from the point of origin to the importer's distribution center”, including every business partner involved directly and indirectly, and where the cargo sits at rest. No single supplier can answer that for you. They can only describe their own leg, and the leg they describe is often the leg they subcontracted to someone whose name is not on any form you hold.

The two answers on the same form that did not agree

The questionnaire came back clean. Under seal security, the answer box read the way you would want it to read: written issuance and control procedures in place, high security seals meeting ISO 17712 on every load, the seal verification process followed on all shipments. Signed by a quality manager who was not being dishonest for a second, because upstairs, in a binder, every word of it was true.

Twelve pages later, the same form had a training section. Criterion 12.1 requires a Member to establish and maintain a security training and awareness programme— and that same criterion is where the specifics live: whether security training is delivered to employees based on their function and position, whether new hires receive it as part of orientation, and — this is the part that decides arguments — whether training evidence is retained: logs, sign-in sheets, rosters or electronic records, carrying the date of the training, the names of the attendees, and the topics covered. Criterion 12.2 goes a step further for the people who physically do the work: drivers and other personnel who inspect empty conveyances and instruments of international traffic must be trained to do itfor both security and agricultural purposes — the exact inspection a seal check like VVTT belongs to. That answer was thinner. It described an annual all-staff session and attached nothing.

Nobody reads a questionnaire that way. You read it section by section, scoring each answer against the criterion it belongs to, and each section passes or does not pass on its own. Read across instead and those two answers are arguing with each other: a procedure asserted as performed on every load, and no record that the people performing it had ever been trained on it.

On the floor, the argument resolved in about four minutes. The two people who actually put seals on containers walked me through what they do. They affixed the seal correctly and wrote the number down correctly. They were running the first half of VVTT — View, Verify, Tug, Twist, the four-step seal check — and had never been taught the last two steps, Tug and Twist, which is precisely where a seal that has been tampered with gives itself away. (The four steps, and what each one catches, belong to what Shipping and Receiving owns in a C-TPAT program.) So I asked for the training roster. There was one, for a session held that spring, and neither of their names was on it. They had been hired in June.

The procedure existed, the quality manager had not lied, and the story still shows the limit of what a form can reach. A written procedure sits on the page where anyone can read it. Finding out whether it has reached the hands of the people hired three months ago takes somebody going and asking them, in person. In this case the evidence that would have answered it was sitting in the same envelope, in a different section, unread.

Now put that on your side of the table. When it surfaces during a validation, the finding does not land on the quality manager who filled in the form. It lands on the member — on the file you accepted, on the process you said was risk-based, and on whoever signed the security profile. You will be asked what you did with an answer you had in your possession for a year. The correction runs on the specialist's clock rather than yours, while Sales still needs vendors cleared at the same rate as before, and while every other partner file you hold is suddenly a question you cannot answer quickly either. I have sat through that hour with more than one compliance manager who had done nothing wrong except trust an instrument past the edge of what it measures.

How do you verify an answer without asking the supplier again?

By checking it against a source that is not the supplier. That single sentence is the entire mechanism, and it is more available than most programs assume.

Take the answer that gives you a business address. You do not need the supplier to confirm it; a mapping service will show you soon enough whether that address is a plant, a unit in an office block, or a field. Their corporate registration is a matter of public record in their own jurisdiction, and it will tell you when the company was formed and who owns it now. Screening the company name against the US Consolidated Screening List — OFAC, BIS, DDTC — costs a search, and it can happen before a human ever opens the file. Where an answer claims C-TPAT or approved AEO membership, the program itself will confirm whether that membership is current — CBP's Status Verification Interface is the point of electronic access for verifying another participant's C-TPAT status— which is what turns criterion 3.4's “is evidence of the certification obtained” from a box-tick into a record with a date on it. And where an answer describes a practice rather than a document — a procedure someone says is followed on every load — the only place to test it is with the people who perform the work, in scenarios, instead of with the person who wrote the policy.

So the questionnaire's arrival is where the real work begins. Each answer gets checked against a source outside the supplier, scored against the criteria that actually apply to that partner's business type, and carried into a documented action plan with an owner and a date on every gap. Refusals are recorded as refusals, with what you did next. Those per-supplier records roll up into the signed Master 5-Step Risk Assessment, which is XFACTOR's unified method — a recognised best practice — and answers each programme that asks. That is why one assessment can serve every program, and why the supplier who answered your questionnaire once does not have to answer three versions of it for three separate filings.

I hold my own work to that line rather than to the line a program will accept. Most consultants get a client certified and stop. A 100% success rate on C-TPAT, PIP and AEO — at Tier II, not the minimum. I was never someone who gave the bare minimum to my clients, and sending a questionnaire out without ever checking what came back is the bare minimum, dressed up with a form number.

If you are mid-cycle right now, the cheapest change is not a bigger form or a new standing meeting. Take the answers you already have and pick the ones that are checkable without the supplier's help — registration, address, screening list, certification status — and check those first. They cost you nothing to confirm, and they are the ones a specialist will reach for first.

The program this maps to: C-TPAT · The departments this maps to: Procurement · Operations · Related reading: What C-TPAT compliance software should actually do · The C-TPAT Minimum Security Criteria · The C-TPAT 5-step risk assessment · What Procurement owns in a C-TPAT program · What Shipping and Receiving owns · Supplier due diligence · Answering a customer's Bill S-211 request

Sources: CTPAT Minimum Security Criteria — U.S. Importers, October 2021 (CBP, PDF) · CBP, Supply Chain Risk Assessment guide (the Five Step guide) · CBP, Status Verification Interface FAQ (PDF)

Part of the C-TPAT Learn Hub