News & Publications

The Importance of Internal Controls

Nobody looks forward to being audited, especially by the U.S. Government, and this certainly holds true in regards to a customs audit. One way a company can mitigate the chances of an unsuccessful audit is to fully understand the audit process. Understanding the government requirements and the audit structure will enable a company to put processes and procedures in place to greatly minimize compliance gaps.

Per the U.S. Government Accountability Office (GAO) there are two types of U.S. governmental audits, financial and performance audits1. A customs compliance audit is actually a mix of the two distinct types. While a financial audit’s goal is to identify the trueness of financial accounts, the performance audit’s function is to identify a company’s effectiveness in undertaking a function (in this case the function is the importation of goods).

U.S. Customs and Border Protection (CBP) will audit importing companies via the Focused Assessment (FA) Process, formerly a customs audit (or a compliance audit) but now referred to as a focused assessment. Prior to the development of the FA process, most compliance audits relied heavily upon transactional sampling to determine if an importer had a passing or failing grade. Since the advent of the FA process, a paradigm shift has taken place and the current goal is to identify the importer’s risk level.

In order to determine the risk level, the first thing CBP will do is assess the internal controls of the importer. Having the appropriate controls in place will go a long way towards successfully making it through a focused assessment.

Below we will introduce you to the principle of internal controls as they pertain to import compliance.

What Are Internal Controls?
Per CBP, internal controls are "a process--effected by an entity's board of directors, management, and other personnel--designed to provide reasonable assurance regarding the achievement of objectives in the following categories: a) reliability of financial reporting, b) effectiveness and efficiency of operations, and c) compliance with applicable laws and regulations." 2

There are five components of Internal Controls, they are as follows:
1. Control Environment: Do the company environment, values and processes promote control? Is management supporting the idea of controls being in place? Is every employee involved in the process buying into the process?
2. Risk Assessment: Has the importer identified and analyzed any relevant risks that may help in determining how to manage the import process? What are your weaknesses and strengths? 

3. Control Activities: Are policies and procedures defined and carried out?
4. Information and Communication: Does the company communicate processes and info in the correct form and in a timely fashion?
5. Monitoring: Is performance monitored and measured over time?

Assessing Internal Controls
A company should conduct an assessment of their internal controls to see if they will meet the standards that are required by CBP. The best way to assess your internal controls is to begin by defining your risks and then continue by developing the controls to mitigate those risks.

Determining the relationship between a company’s risk and the processes and controls that are in place to minimize those risks is the main purpose of a focused assessment.

Risk Assessment
There are five key considerations when determining the risk exposure for an importer. Being proactive and diligent in the following areas will require substantial investment in personnel and process development.

1. Significance and Sensitivity: Significance involves the importance of the items, and the size in terms of dollars or the impact of failure. Sensitivity refers to the perception and response by others.

2. Susceptibility: Is the imported item, manufacturer, country of origin, or any other element designated as high risk by CBP? Does CBP have information that indicates internal controls have been weak? Do incentives to make false representations or declarations outweigh the penalties? Are imposed requirements reasonable or so complicated that failure seems like a valid option? Does the activity have numerous transactions or diverse activities? Does the importer contract our activities without
adequate control systems?

3. Red Flags: The following are considered red flags, indicative of lack of control.
   · Prior History of problems
   · History of weakness in prior audits
   · Poorly defined processes and procedures
   · Lack of monitoring
   · Complex transactions
   · Lack of performance measures that lead to low accountability
   · Lack of management priorities 
   · High rate of turnover leading to decreased knowledge
   · Poor communication about requirements and reporting
   · Poor oversight of brokers and other agents.

4. Management Support: Does management set the tone, by stating in writing the expectations for the company in regards to compliance? Does the management structure promote control and organization? Does management act promptly when issues are recognized? Does the import department have authority within the organization to assure compliance? Does the import department have the ability to provide input to management?

5. Competent Personnel: Is there a stable management team in charge of the import department, are personnel trained and knowledgeable? Are personnel aware of their duties and responsibilities, and are they provided with sufficient training?

Assessing Controls
Once risks are determined it is imperative that an assessment of existing internal controls be conducted. This will determine if actions will be performed with consistency. There are a few key considerations to assess control effectiveness, they are:
1. Identify and understand control: What current controls are in place, and who has ownership of these controls?
2. What is known about control effectiveness: Are additional tests needed or do you have sufficient information to effectively demonstrate the existing controls to CBP?
3. Examine Control Design: Controls should be examined in order to determine if they are working, logical, and reasonable.
4. All transactions, events, and controls should also be documented and available for examination.
5. When designing and putting together their internal controls a company should also take the following into account:
   · The size of the company
   · The organization and ownership characteristics
   · The nature of the entity’s business
   · The diversity and complexity of the entity’s operations.
   · The entity’s methods of transmitting, processing, maintaining, and accessing information.

Due to the sharing of responsibilities between the import community and CBP, and the principles of informed compliance, it is up to each member of the importing community to ensure that they are following the import regulations.

Having a robust set of internal controls will help mitigate the risks associated with a CBP Focused Assessment. Conversely, not having sufficient internal controls will lead to greatly increased risk in the form of monetary penalties and fines.

Understanding the importance of internal controls is the first step towards having a compliance program that will be successful in the event of a FA. All members of the trade community must ask themselves the following questions:
   1) Do we have sufficient controls in place?
   2) What are our risks?
   3) What are our next steps?

If you can’t answer these questions, you are certainly not alone. Consulting with outside experts is considered a component of “reasonable care”, and CBP understands that companies will seek outside input from experts in certain areas.

If you feel you don’t have sufficient controls in place or if you don’t know how to get a handle on your current risks and controls, you may want to consider having Allyn International conduct an internal assessment.

This assessment will mimic a focused assessment and will allow our experts to check if your internal controls and processes meet the rigorous standards set forth by CBP. Allyn will examine your internal controls, and will provide a gap analysis exposing the weaknesses in your controls. Using the analysis, Allyn will be able to make recommendations, provide training, or even provide assistance with setting up internal controls and procedures.

The cost of hiring an outside consultant to look into your internal controls is a bargain compared to the cost of not being prepared for a focused assessment. Allyn is the partner that will help you strengthen your internal controls, processes and personnel at a competitive price Any internal assessment by an outside expert would be considered a best practice, and will show that your company is dedicated exhibiting “reasonable care”.

If you would like a quote, or if you would like additional info on Allyn’s services, please don’t hesitate to contact us.

About Allyn
Incorporated in 1992, Allyn is a privately held professional services firm that employs 160 personnel in 9 countries, in 3 continents, and is capable of conducting business in 15 languages. Allyn has 6 Licensed Customs Brokers on staff, and over 20 years of experience in the following industries: Electronics, Automotive, Power Generation, Oil and Gas, Drilling and Mining, Textiles, Chemicals, Paints and Coatings, Telecommunications, Computing, Automotive, Jewelry and Process Equipment.

Aside from Global Trade Compliance, Allyn provides the following services to our clients.
· Logistics Management
· Supply Chain Consulting
· Tax Management

Allyn’s mission is “Providing exceptional services for the global marketplace, enabling our customers to succeed by focusing on their core business, while inspiring our employees to achieve their full potential”. If you would like more information on this or any other Global Trade Compliance matter, please contact Allyn at (239) 489-9900 or you can email at



This website uses a variety of cookies, which you consent to if you continue to use this site. You can read our Privacy Policy for details about how these cookies are used. Manage Cookies