A CBP audit is a post-entry review, run by U.S. Customs and Border Protection's Trade Regulatory Audit directorate, of the records behind entries you have already filed: classifications, declared values, origin claims, and the documents that support them. CBP's trade statistics, updated as of July 27, 2026, show 262 audits completed so far in fiscal year 2026 and $204.2 million collected as a result of importer audits. This guide covers what a CBP audit is, what tends to put an importer on the list, how to prepare, what to do once selected, and where prior disclosure fits.
What a CBP Audit Actually Is
The legal basis is 19 U.S.C. 1509, implemented through the recordkeeping rules in 19 CFR Part 163. The regulation defines an audit as CBP's evaluation of records you must keep or produce, done to confirm entries were correct, determine whether duties, taxes, or fees are owed, determine liability for penalties, and confirm compliance with the laws CBP administers. In plain terms: CBP already let the goods in. The audit asks whether the entry that let them in was right.
The work is done by Trade Regulatory Audit (TRA). Older correspondence may use its former name; CBP's Office of Trade contact directory (last modified May 4, 2026) lists it as "Trade Regulatory Audit (Formerly Regulatory Audit & Agency Advisory Services)," and CBP's audits page describes Field Offices throughout the United States. CBP describes TRA's method as "a risk-based approach," working with other CBP offices, Homeland Security Investigations, and partner government agencies as needed.
Under 19 CFR 163.2, the recordkeeping obligation reaches owners, importers, consignees, importers of record, entry filers, their agents, and anyone who transports or stores merchandise under bond. If your name is on the entry, you are in scope.
The Kinds of CBP Regulatory Audit You Might Face
Focused Assessment. The broad one. CBP describes it as "a comprehensive audit that involves an assessment of the importer's internal control over its import activities, to determine if the importer poses an acceptable risk for complying with CBP laws and regulations." It can run in up to three phases: a Pre-Assessment Survey, Assessment Compliance Testing, and a Follow-Up Audit. The question is less "was this entry wrong?" and more "does this company have the controls to get entries right?"
Targeted audits. CBP says TRA's other audits have "targeted audit objectives and are compliance driven": one issue, one product line, one program claim. Older industry material calls narrow reviews like these "quick response audits"; CBP's current audit pages describe Risk Analysis and Survey Assessments instead.
Risk Analysis and Survey Assessments (RASAs). CBP classes these as non-audit professional services under 19 U.S.C. 1509(a), used to evaluate a specific issue without the time commitment of a full audit. Companies visited receive a letter describing the outcome of the transactions reviewed.
How Much Audit Activity Is There?
CBP publishes annual audit figures on its Trade Statistics page. As of the page's July 27, 2026 update:
| Fiscal year | Audits completed | Collected as a result of importer audits |
|---|---|---|
| FY 2026 (through July 27, 2026) | 262 | $204,236,985 |
| FY 2025 | 465 | $235,460,000 |
| FY 2024 | 417 | $117,670,000 |
| FY 2023 | 435 | $114,510,000 |
Two cautions. FY 2026 is a partial year. And "collected" in a year is not the same as "found" that year: CBP's April 2025 monthly update reported 33 audits identifying $117 million owed that month, with collections of over $18 million drawn from that month's findings and prior years' assignments combined. Audit dollars arrive on their own schedule.
What Tends to Trigger a CBP Audit
CBP does not publish a selection formula, and nobody outside the agency can tell you why a specific company was picked. CBP does say audits are "often based on a referral to TRA" and are risk-based.
In our experience as a broker, check these first:
- Inconsistency. The same part number classified two ways, or a classification or value change that lines up with a duty increase.
- High duty exposure. Goods where a classification or origin decision moves real money, which in 2026 describes much of what gets imported.
- Related-party pricing. Buying from an affiliate, where the price itself is a judgment CBP may test.
- Special program claims. Free trade agreement preferences and other duty reductions you must be able to support.
- Supply-chain exposure. Materials from regions or suppliers carrying forced-labor risk.
None of these guarantees an audit. All of them are places an audit will look.
Classification Accuracy: Where the Money Moves
Classification under the Harmonized Tariff Schedule of the United States (HTSUS) sets your duty rate, and in 2026 it also decides which additional duties stack on top. One example: effective July 24, 2026, a U.S. Trade Representative Section 301 action added 10 or 12.5 percent ad valorem duties on goods from a long list of economies, including 12.5 percent on products of China, subject to the action's annexes. Our 2026 tariff stacking guide walks through how the layers combine.
That matters in an audit because civil penalties under 19 U.S.C. 1592 scale with the duties the government lost: for negligence, up to the lesser of the merchandise's domestic value or two times the lost duties, taxes, and fees; for gross negligence, four times. More duty per line means more exposure per misclassified line.
The statute also says "clerical errors or mistakes of fact" are not violations "unless they are part of a pattern of negligent conduct." An audit is a tool for finding patterns. One wrong code is a correction. The same wrong code on every entry for three years is a finding.
Good practice: a documented classification for each product with the reasoning written down, re-review when a product, supplier, or material changes, and one person accountable for consistency. Our HTS classification guide covers the method.
Valuation: Assists, Royalties, and Related-Party Prices
Valuation errors hide in payments that never appear on the commercial invoice. Under 19 CFR 152.103(b), transaction value adds to the price paid the buyer's packing costs, selling commissions the buyer incurs, the apportioned value of any assist, royalties or license fees related to the goods that the buyer is required to pay, and resale proceeds that flow back to the seller.
Assists are the classic miss: molds, dies, tools, or components you supply to your foreign manufacturer for use in production. Accounts payable paid for the tooling; your entries may never have reflected it. Royalties are the other: a license fee can be dutiable if it relates to the imported goods and the buyer is required to pay it.
Related-party transactions get their own test. Under 19 CFR 152.103(j), a price between related parties is acceptable if the relationship did not influence the price, or if the value closely approximates certain test values. Either way, you prove it on paper. Our guide to customs valuation strategies goes deeper.
Supply-Chain and Forced-Labor Documentation
An audit reviews records; a forced-labor detention stops goods. Different processes, same documents, and weakness in one usually shows up in the other.
The Uyghur Forced Labor Prevention Act (UFLPA) directs CBP to presume that goods made wholly or in part in China's Xinjiang Uyghur Autonomous Region are prohibited from entry. Overcoming that presumption requires, among other things, "clear and convincing evidence" that the goods were not made with forced labor. The UFLPA Entity List, which extends the presumption to named companies, was expanded by a Federal Register notice on August 3, 2026, adding 43 entities for a total of 187.
The audit lesson is traceability: origin claims, supplier declarations, bills of materials, and mill or smelter records should exist before anyone asks. Our UFLPA compliance guide and our breakdown of the August 2026 Entity List expansion cover what that file should contain.
How to Prepare for a CBP Audit Before You're Selected
Keep records for the full retention period. 19 CFR 163.4 sets the general rule at five years from the date of entry, with shorter periods for some record types.
Be able to produce them in 30 days. Under 19 CFR 163.6, when CBP demands entry records you generally have 30 calendar days. Failing to produce carries its own penalty, separate from any entry error: up to $100,000 or 75 percent of the merchandise's appraised value, whichever is less, for a willful failure; up to $10,000 or 40 percent for a negligent one. "The supplier has it somewhere" is not production.
Test yourself the way CBP will. Each quarter, sample entries and check classification, value (including assists and royalties), and origin against source documents. Look for inconsistency across entries, not just errors within one. Record what you checked and fixed.
Write the procedures down, and close the loop. Documented classification, valuation, and recordkeeping procedures are what a Focused Assessment evaluates. And purchasing knows about the tooling, finance knows about the royalty, logistics knows which supplier changed. Compliance needs to hear from all three.
Our free audit preparation checklist and audit response template turn this section into working documents.
What to Do When You're Selected
19 CFR 163.11 sets the procedure.
The notice. CBP gives notice of intent to audit, with a time estimate, and notice of your right to an entrance conference.
The entrance conference. Use it. CBP explains the audit's objectives, the records it needs, any statistical sampling plan, and an estimated termination date.
Sampling. Auditors may sample when reviewing every transaction is impractical, and results are projected across the full universe of transactions to calculate lost duties. A small error rate in a sample can become a large number across five years of entries.
The closing conference. When on-site work ends, CBP explains preliminary results. If the estimated termination date passes without one, you can petition in writing, and CBP has 15 calendar days to provide it.
The report. CBP is to complete a written report within 90 calendar days after the closing conference, absent written notice of delay, and send you a copy within 30 days of completion.
Practically: name one point of contact, log every request and every document handed over, answer completely and on time, and run your own review in parallel. If that review finds a problem, read the next section.
Prior Disclosure: The Lever You Control
Prior disclosure under 19 CFR 162.74 lets an importer disclose a violation to CBP "before, or without knowledge of, the commencement of a formal investigation." A valid disclosure identifies the merchandise, the entries, what was wrong, and the correct information. You tender the actual loss of duties, taxes, and fees with the disclosure or within 30 days after CBP notifies you in writing of its calculation.
The benefit is significant. Under 19 U.S.C. 1592(c)(4), a valid prior disclosure limits the penalty for negligence or gross negligence to interest on the lost duties, and for fraud to an amount equal to the lost duties. The duties themselves are owed either way; section 1592(d) requires CBP to collect them.
Timing is everything. The regulation presumes knowledge of an investigation in listed situations, including when CBP, having reasonable cause to believe there has been a violation of 19 U.S.C. 1592 or 1593a, so informs you; when a CBP special agent has identified themselves and requested records; and when you receive a pre-penalty or penalty notice. The first is the one an audit most directly reaches. The regulation does not list audit selection or an entrance conference as such notice. If your own review surfaces a problem, evaluate a disclosure before CBP raises it. Whether a specific disclosure qualifies is a fact question; get it assessed quickly rather than assuming either way.
For entries that have not liquidated, a Post Summary Correction (PSC) is, per CBP, "the sole method for trade to electronically correct entry summaries prior to liquidation," filed within 300 days of entry and up to 15 days before scheduled liquidation, whichever is earlier. A PSC fixes an entry; a prior disclosure addresses a violation. Many problems need a decision about both.
The audit notice and entrance conference define the review period. Because 19 CFR 163.4 requires keeping entry records for five years from the date of entry, plan on five years of entries being available for review.
How long does a CBP audit take?
There is no fixed length. CBP estimates it in the notice and at the entrance conference; after the closing conference, the written report is due within 90 calendar days, absent written notice of delay.
Can I still file a prior disclosure after receiving an audit notice?
Possibly. A disclosure must come before, or without knowledge of, a formal investigation. Knowledge is presumed in listed situations, including when CBP informs you it has reasonable cause to believe there has been a violation of 19 U.S.C. 1592 or 1593a. Once CBP tells you that about an issue, the window may have closed for it. Have the timing assessed promptly; don't assume either way.
Does being audited mean I will be penalized?
No. An audit is an evaluation and can end with findings or none. Duties found owed are collected; penalties under 19 U.S.C. 1592 are a separate question that turns on culpability. We do not predict how CBP will decide any audit.
How Strix Helps
We work on audit readiness in four ways. We clear: licensed customs brokers file your entries at all U.S. ports, with full-service brokerage at $100–$250 per entry, so classification and valuation are reviewed before filing, not five years later. We consult: our compliance team reviews your entries, records, and procedures against what a Focused Assessment examines, and helps you decide whether an issue calls for a correction, a disclosure, or both. We comply: ongoing classification maintenance, recordkeeping discipline, and PSC filings at $150 per PSC entry for up to 10 lines. And we automate: ABI-certified self-filing software at $30 per entry, so entries and their supporting data live in one system you can produce from in 30 days.
If an audit notice is on your desk, or you would rather find the problem before CBP does, talk to our team. The best time to prepare for a CBP audit is before the letter arrives.