C-TPAT

Security Audit

* Example Report *

North America
+1-813-252-4770

Latin America
+52-1-333-2010712

Europe & Middle-East

+49-8122-552 9590

Asia & Asia Pacific

+886-2-2832-2990

Email
[email protected]

www.proqc.com
 C-TPAT AUDIT CHECKLIST Rev.
GUIDELINES 3
PURPOSE:
Assessment scores are rarely understood outside of the quality organization or the auditing company. This assessment is based
upon defined criteria for each element assessed. Scoring is based upon the supplier’s ability to meet all of the requirements of C-
TPAT. The intent of this assessment is to provide the client with information about the supplier's readiness for an official on-site
review.

SCORING:
Scores are to be assigned based upon what is done for the Pro QC client regardless of what is done for other clients. Example: if
Control Plans are developed for other clients but not for Pro QC client, the score must be one 'NC' - Major Non-Conformance.
Complies with the Requirements = C
Improvement Needed = I
Non-Conformance Found = NC
N/A = Does Not Apply to this supplier

GUIDELINE FOR SCORING CONFORMANCE:

Each question has a list of criteria to be used to assess conformance to the requirement of C-TPAT.
Complies with Requirements =
- Has objective evidence to support the question, and
- Has a written procedure (when required).
Improvement Needed =
- Has objective evidence, but procedure needs improvement.
- Has objective evidence, but no written procedure.
- Has written procedure, but is lacking some objective evidence to support the question.
Non-Conformance =
- No objective evidence to support the question (regardless of the procedure).
- Lacking some objective evidence and no written procedure.

RESULTS/RECOMMENDATIONS: (Automatically Calculated)

The score is based upon the percent of questions that conform to the requirements, percent that Needs Improvement, and the
percent that have a major Non-Conformance. Each client should review how the supplier was evaluated for each question and
base their sourcing decisions upon factors which are important to their organization and product(s).

AUDIT REPORT:
The auditor is to complete all sections of the audit report:
- Scope of the audit
- Recommendations
- Strength of supplier’s security system (C-TPAT)
- Opportunities for improvement (weaknesses in the supplier's security system)

RESULTS REVIEW WITH SUPPLIER:

The auditor should review the audit results with the supplier, but cannot give the supplier a copy of the audit. The audit is the
property of the client.

CORRECTIVE ACTIONS:
It is recommended that the client request a corrective action (improvement plan) based upon the results of the audit. The
improvement plan should include the following:
- Detailed description of action plan.
- Name of person responsible for the improvement activity.
- Date when the improvement will be completed.
 C-TPAT AUDIT CHECKLIST Rev.
SUMMARY 3
Supplier Name Audit Date Report No.
XXXXXXXXXXXXX

SUPPLIER'S INFORMATION CLIENT'S INFORMATION

NAME : NAME :
XXXXXXXXXXXXX XXXXXXXXX

ADDRESS : XXXXXXXXXXXXX ADDRESS : XXXXXXXXX

XXXXXXXXXXXXX XXXXXXXXX
CITY : XXXXXXXXXXXXX CITY : XXXXXXXXX
COUNTRY : XXXXXXXXXXXXX COUNTRY : XXXXXXXXX
PHONE : XXXXXXXXXXXXX PHONE : XXXXXXXXX
FAX : XXXXXXXXXXXXX FAX : XXXXXXXXX
SUPPLIER'S PERSONNEL PARTICIPATING
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX
Mr./Mrs. XXXXXXXXXXXXX Title: XXXXXX Email: XXXXXXXX

PRO QC PERSONNEL
Mr./Mrs. XXXXXXXXXX Title: XXXXXXX Email: XXXXXXX
Mr./Mrs. XXXXXXXXXX Title: XXXXXXX Email: XXXXXXX
Mr./Mrs. XXXXXXXXXX Title: XXXXXXX Email: XXXXXXX

Scope :

AUDIT RESULTS

Category No. Ques. %

Complies with Requirements ( C ) 57 85.1%

Improvement Needed ( I ) 6 9.0%

Non-Conformance (NC) 4 6.0%

Not Applicable (N/A) 6

67
RECOMMENDATIONS

Systems are effective, you could start or continue business with this supplier.

System is acceptable with minor nonconformities.You could use this

supplier and keep pushing them to improve it.

System has some major issue. You could temporarily use this supplier and
request immediate corrective action in case of long term business.

There are serious major issues in this supplier that could impact in your business.
The best solution will be to source for another supplier.
 C-TPAT AUDIT CHECKLIST
AUDIT REPORT
Supplier Name Audit Date Report No.
XXXXXXXXXXXXX

Scope of Audit:
To evaluate the factory's compliance to C-TPAT requirements and readiness for an on-site evaluation by official registrars.

Summary:
We recommend factory SSSSS to apply for C-TPAT recognition to obtain benefits of this by facilitating the circulation
of products in the USA market, while at the same time assisting its client to solve on-time delivery in the market.

Strengths:
The company SSSSS is protected by barriers on all sides, north, south, east, and west. The whole barriers
have enough lighting and a camera control system. The factory has two main entrance doors for people and material,
and all have security guards responsible for entrance control. Procedures are in place to control the entrance of
people and material. There is also a room to view the images from a camera 24/24 hours with about fifteen days of image
memory.

Opportunities for Improvement:

1. An ID (identification number) is not required to be presented as a condition to facility access.
2. Maintain records of solutions of the issue of non-identified people found within the company.
3. There must be barriers between parking for private cars and parking for container loading.
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

A GENERAL INFORMATION
1 What is the total land area included in the factory campus? The company has 30997 m2.

2 What is the occupation of total building floor area included in the The total square meter for the building is 14577
factory campus (Take photo of building. At external view)? m2.

3 How many people are working in this facility on 1st shift? 1600 persons for 1st shift

4 How many people are working in this facility on 2nd shift? 500 persons for 2nd shift

5 How many people are working in this facility on 3rd shift? None, there is no 3rd shift

6 How many security guards are present during 1st shift, and what 23 security guards in total. 6-7 for 1st shift, 7h-15h
is their working time?
7 How many security guards are present during 2nd shift, and what 6-7 guards for 2nd shift, 15h-23h
is their working time?
8 How many security guards during 3rd shift, and their working 6-7 for 3rd shift, 23h-7h
time?
9 At what time are gates secure in the evening? 10:00 PM

10 At what time are gates open in the morning? 7:00 AM

B BUSINESS PARTNER REQUIREMENTS

Is the supplier an approved member of its country’s Cargo Not yet part of the C-TPAT member
1 Security Program? NC

Is the supplier a C-TPAT member? If yes, please list SVI number No.
2 NC

Are carriers monitored to ensure they are C-TPAT certified? The company will have a program to become a
3 member of C-TPAT NC

Are sub-contracted carriers monitored to ensure they are The company SSSSS is monitoring its supplier for
4 C-TPAT certified? C-TPAT issues NC

C CONTAINER / TRAILER SECURITY

1 Are procedures in place to verify the physical integrity of the Yes, the factory has developed a procedure for
container/trailer structure prior to stuffing to include: reliability of control of physical integrity of the container/trailer
the locking mechanisms of the doors, container front wall left side, MF-WI-001/B.1 validated in 2010-03-01. The
right side, floor, ceiling/roof, inside/outside doors, procedure respects ISO/PAS17712 as it has been C
outside/undercarriage? (Following the 7 point or 10 point plan) required in element 5.1.1, SEE PHOTO 1

2 Are containers stored in a secure area to prevent unauthorized Yes, it is prohibited for an unauthorized person to
access and/or manipulation? go inside the storage room. Everyone must have
an access card. However, we can see that there
are company staff private cars located around 5 m I
from there, SEE PHOTO 2
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

3 At point of loading, are procedures in place to properly seal and Yes, procedures are available in respect to
maintain the integrity of the shipping containers/trailers? ISO/PAS17712. The company uses locks/seals,
SEE PHOTO 4 C

4 Are high security seals affixed to all U.S. bound loaded Yes, procedures are available in respect to
containers/trailers? ISO/PAS17712. The company uses locks/seals, C
SEE PHOTO 4
5 Are the seals numbered? Yes, procedures are available in respect to
ISO/PAS17712. The company uses locks/seals, C
SEE PHOTO 4

6 Do seals meet or exceed current PAS ISO 17712 standards for Yes, procedures are available in respect to
high security seals? ISO/PAS17712. The company use locks/seals, C
SEE PHOTO 4

7 Are written procedures in place that stipulate how seals are to be Yes, procedures are in place. The person
controlled and affixed to loaded containers/trailers? responsible for verification is Mr. Qi Chun You. The
company uses a temporary worker from an
external service for putting boxes in the container. C
And Mr. Qi Chun You will inspect the sealing
process. Records are available, SEE PHOTO 4

8 Are seals stored in a secured locked location? Yes.

C

9 Are seals limited to authorized employees? Yes.

C

10 Are procedures in place to recognize and report compromised Yes.

seals to appropriate management personnel and authorities?
C

11 Are only designated employees allowed to access seals and Yes.

distribute container seals for integrity purposes? C

12 How many employees have access to seals? The company uses a temporary worker from an
external service for putting boxes in the container.
And Mr. Qi Chun You will inspect the sealing
C
process. Records are available, SEE PHOTO 4

D PHYSICAL ACCESS CONTROL

1 Are access controls in place to prevent unauthorized entry to Yes, the factory has developed a procedure AD-
facilities, maintain control of employees and visitors and protect 008, Rev. A, valid since 2007-6-1. It has defined
company assets? the process to control entrances. C

2 Do access controls provide positive identification of all employees, Each employee at Solex has a working card with a
visitors and vendors at all points of entry? number on it, SEE PHOTO 6. Visitors and vendors
must be registered before entry. C

3 Are visitors required to register and present photo identification for During the registration process, any document, ID
documentation purposes upon arrival? card/passport or photo is required at the entrance.
The visitor is required to record information in the I
paper prepared for that.
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

4 Are visitors escorted at all times and are they required to visibly Visitors are escorted when they get inside the gate
display the temporary identification? and a temporary identification card is given to them
and is required to be visibly displayed at all times. C

5 Are employees only given access to those secure areas needed Yes, employees are given access only to the areas
for the performance of their duties? where they perform their jobs. C

6 Are all employees required to wear or have on their person an Yes, each employee (worker) is required to wear
identification badge or card? an identification card.
C

7 How many employee entrances/exits? There are 2 entrances/exits, North and East. SEE
PHOTO 7. The procedure defines from where the
employees, VIP, and sub-contractors must enter
the factory. The procedure also defines the type of
C
inspection of identification registration that must be
conducted for each of them.

8 Does company management or security personnel adequately Yes, it is written in the procedure AD-008. The
control the issuance and removal of employee, visitor and vendor security guard must take back the identification
identification badges? when anyone leaves. C

9 Are employees limited access to only certain areas necessary for Yes, employees are given access only to the areas
their work? where they perform their job. C

10 Is proper vendor ID and/or photo identification presented for Yes, it is presented.

documentation for delivery personnel? C

11 Are vendor personnel required to register upon each entrance and Vendors are not required to record their ID
exit of the facility? information upon each entrance and exit. I

12 Are procedures in place to identify, challenge and address The company has not documented procedures for
unauthorized/unidentified persons? entrance of a non-identified person. I

E PERSONNEL SECURITY
1 Pre-employment verification – are processes in place to screen Yes, the company investigates the background
prospective employees? record of each candidate. C

2 Are criminal background checks conducted? Yes, the company investigates the background and
record of each candidate. Records are visible.
C

3 Are criminal background checks on employees permissible by Yes, criminal background checks on employees
law? are permissible by law. C

4 Are periodic checks and reinvestigations conducted based on Yes, the company does periodic checks and
cause and/or the sensitivity of the employee’s position? reinvestigations when there is a cause.
C

5 Are procedures in place to remove identification, facility and Yes, procedures are documented.
system access for terminated employees?
C
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

F PROCEDURAL SECURITY
1 Are procedures in place to ensure that all information used in the Yes, the company will exchange information with
clearing of merchandise/cargo is legible, complete, accurate, and the forward, which includes all information
protected against the exchange, loss or introduction of erroneous regarding container inspection, including the
information? forward name, drivers' identification, product list, C
quantities, total weight…etc.

2 Is cargo accurately described, and the weights, labels, marks and Yes, all information regarding containers inspected
piece count indicated and verified? will be recorded, including the forward name and
drivers identification, products list, quantities, total C
weight,…etc.

3 Is cargo verified against purchase or delivery orders? Yes.

C

4 Are drivers delivering or receiving cargo positively identified Yes, and records are available.
before cargo is received or released?
C

5 Are all shortages, overages, and other significant discrepancies Shortages, overages, etc. are not allowed in the
or anomalies resolved and/or investigated appropriately? process of container loading.
N/A

G PHYSICAL SECURITY
1 Is there a roving security schedule and procedure? Yes, the security team, more than 20 peoples,
have a routine security program around the
company. C

2 Does a physical barrier such as a fence or equivalent protect the Yes, see PHOTO 9, 10, 11 with light system and
company premise? cameras.
C

3 If yes, identify type of barrier and height: Yes, see PHOTO 9, 10, 11 with light system and
cameras. C

4 Are all buildings constructed of materials that resist unlawful entry Yes.
and protect against outside intrusion? C

5 Is the integrity of the building inspected on a regular basis? Yes.

C

6 Do all buildings have locking devices for: The doors have locking devices, but are not
- exterior doors monitored for routine maintenance.
- interior doors
I
- windows
- gates

7 Does management or security personnel control the issuance of Yes, issuance of keys is controlled, and there is a
all locks and keys? record of key possession.
C
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

8 Is each issued key holder recorded in a key log? Yes, issuance of keys is controlled, and there is a
record of key possession.
C

9 Is there a separate parking area for private vehicles, separate Yes, there is an area for private vehicles,
from the shipping loading dock and cargo areas? separated from the shipping area, but there are no
- Do barriers or other means separate parking area from shipping barriers, SEE PHOTO 3
I
dock areas?

10 If yes, identify barrier: It is not a barrier, but a depth.

C

11 How many shipping/receiving docks are in use? 1 door for the shipping/receiving
C

12 Are employees allowed to use dock doors for entrance/exit? Yes.

C

13 Is there a written procedure for shipment drop-off and pick-up? Yes, the procedure is AD-008.

14 Does each facility or operation have a designated individual or Yes, the whole security is managed by a security
group responsible for security? team (provided by a police department of the local
police station). C

15 Is adequate lighting provided inside and outside of the facility Yes, each area for packing and barriers is lighted,
including the following areas: SEE PHOTO 9, 10, 11,
- entrance & exit
C
- loading dock and storage areas
- fence line
- parking area
16 Are alarm systems and video surveillance cameras utilized to Yes, there are camera and video surveillance
monitor premises and prevent unauthorized access to critical system in place, SEE PHOTO 11, 12 for cameras,
areas? and video surveillance system in PHOTO 13
- Is alarm system activated when the facility is not occupied? C
- Is the alarm system monitored?

17 Are all exterior doors and windows alarmed? Yes, SEE PHOTO 14.

18 How many days are recorded images stored? 15 days

19 Is lighting adequate to ensure quality recorded images during Yes, there is lighting to record images during
evening hours? evening hours, see lighting system in the wall.
Refer to PHOTO 9, 10 C
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

20 Does perimeter fencing or other barrier protect all company Yes, all of the company is protected with barriers.
facilities? Refer to PHOTO 9, 10
C

21 Is fencing regularly inspected for integrity and damage? Yes, the security guards team has a routine control
program to follow, and each inspected point will be
automatically recorded with a magnetic device. C
SEE PHOTO 15

22 Are perimeter gates which vehicles and personnel enter/exit Yes, it is also inspected by security guards, and
staffed and/or monitored? records are available.
C

23 Is international, high value, and hazardous cargo kept in a No such arrangement, all are kept at the same
separate fenced area from other cargo? place.
C

24 Are truck drivers allowed on the dock area? Yes.

C

25 Is the loading of goods supervised by a supervisor or guard? Yes.

C

H INFORMATION TECHNOLOGY SECURITY

1 Do automated systems use individually assigned accounts that The factory does not use an information technology
require a periodic change of password? security to secure products. The system is manual. N/A

2 How often are passwords changed? Not Applicable

N/A

3 Are IT security policies, procedures and standards established Not Applicable

and in place?
N/A

4 Are employees trained regarding the IT policies, procedures and Not Applicable
standards? N/A

5 Is a system in place to identify abuse of IT systems including Not Applicable

improper access, tampering or the altering of business data?
Please explain. N/A

I SECURITY TRAINING AND THREAT AWARENESS

1 Do you provide a security awareness program to employees that Yes, the factory has developed a procedure for C-
addresses supply chain security including: maintaining cargo TPAT, SGDOC-WI-015.
integrity, recognizing internal conspiracies and addressing C
unauthorized access?
 C-TPAT AUDIT CHECKLIST Rev.
AUDIT CHECKLIST 3

Supplier Name Audit Date Report No.

XXXXXXXXXXXXX

C = Complies with the Requirements, I = Improvement Needed, NC = Non-Conformance, N/A = Not Applicable

QUESTIONNAIRE FINDINGS SCORE

2 How often are employees trained? 2 times / year
C
3 Indicate last training date for all employees The last training about C-TPAT was conducted on
2010.8.10 C

4 Are employees encouraged to report security violations to Yes.

management?
C

5 Is there a confidential means that employees can report Yes.

violations?
C
 C-TPAT AUDIT CHECKLIST Rev.
FACTORY PHOTOS 3
Supplier Name Audit Date Report No.
XXXXXXXXXXXXX

1. Procedure for inspection of container 2. Container loading doors (external view)

3. A view of container loading, with private car located

3. View of container in loading price (internal view)
around 5 m from there, without any barrier

4. Lock/Seals No. L 486147 5. Lock/Seals L486147 locked in the container

 C-TPAT AUDIT CHECKLIST Rev.
FACTORY PHOTOS 3
Supplier Name Audit Date Report No.
XXXXXXXXXXXXX

6. Working ID Card for each employee 7. Record of entrance at the gate for visitors

8. Principal Gate 9. Barriers at north section

10. Barriers at east section, over 4 meters high 11. Camera at the corner of 2 wall/barriers
 C-TPAT AUDIT CHECKLIST Rev.
FACTORY PHOTOS 3
Supplier Name Audit Date Report No.
XXXXXXXXXXXXX

12. Cameras at interval 13. Video surveillance system at the principal gate

15. Inspection record points (there are 20 critical record

14. Hand control alarm system link to the police station
points to visit each day during routine inspection)

16. Security inspection magnetic point 17. Record of security routine inspection