How to Prepare for a CBP Customs Audit

Executive Summary 

A CBP Customs Audit can pull apart years of imports and ask your company to explain how the decisions behind them were made. The paperwork is only half the story. Can you define what CBP is reviewing, rebuild the record, defend your customs decisions, correct what’s wrong, and manage the audit through the finish? Those five questions shape everything that follows.

Intro 

A CBP Customs Audit can turn a shipment you forgot about eight months ago into the most popular topic in the building.

The lumber’s already been used, the electronics are sitting in someone else’s warehouse, and accounting closed the books months ago. Then CBP asks why you used that HTS code, how you established the country of origin, and where the declared value came from.

Before you know it, purchasing is digging through old emails, customs is pulling entry files, finance is trying to reconstruct who approved what, and someone says, “I’m pretty sure we had a document for that.”

Sorry, but “pretty sure” isn’t much of an audit strategy.

CBP completed 465 audits in FY 2025 and recovered $235.46 million, nearly twice the prior year. June’s Executive Order 14411 also turned up the heat on misclassification, undervaluation, forced labor, and illegal transshipment.

We’ve already covered what the 2026 IOR order changes for importers. This time, we’re focusing on the work that makes an audit less painful: What should you have under control before CBP starts asking for receipts?

We’d start with five questions.

No. 1: What Exactly Is CBP Auditing, and Who’s Running Your Response?

First, figure out exactly what CBP wants to examine and put one person in charge of answering it.

That starts with the audit letter. Read it closely before anyone starts pulling records. A Focused Assessment can reach across your broader import controls, while a Risk Analysis and Survey Assessment or narrower targeted audit may be digging into one specific issue. You need to know which kind of fire you’re dealing with before six departments start throwing paperwork at it.

From there, pin down the legal entity, audit period, ports, commodities, entries, risk areas, requested records, deadline, and CBP contacts.

Then choose one audit lead to coordinate the response, keep the request log, and control what goes back to CBP. Bring in compliance, legal, finance, procurement, logistics, IT, and your customs broker where needed.

Your broker may know the entries inside out. The importer of record still has to stand behind them.

No. 2: Can You Rebuild Each Entry From Purchase Order to Payment?

You should be able to trace every sampled entry from what you ordered and received to what you paid, declared, and ultimately filed with CBP.

Start with ACE, but don’t stop there. ACE shows what was declared. The real test is whether that declaration matches your purchase orders, invoices, receiving records, payments, broker instructions, product specs, and shipping documents.

Build one file for each entry so an auditor can follow the transaction without having to play detective. Include the classification and origin support, then add anything specific to the shipment, such as assists, related-party pricing, Section 232 or 301 duties, AD/CVD decisions, free-trade claims, or forced-labor traceability.

Import records generally have to be kept for five years under 19 CFR §163.4, and CBP can generally request them within 30 days under 19 CFR §163.6. Anything missing or contradictory goes on your fix list now, not after CBP finds it.

If you use myMALLORY, much of that shipment documentation is already organized in one place.

No. 3: Can You Defend the Decisions Behind Your Declarations?

You should be able to explain, in plain English, why you classified, valued, and sourced a product the way you did.

That’s why it pays to audit yourself first. Don’t stop at whether the entry looks right on paper. Pull a sample and ask the same questions CBP will. Why this HTS code? What supports the declared value? What proves origin? Where are the records for forced labor, AD/CVD, marking, or product safety?

The answers will look different depending on what you import. Lumber companies may have Section 232 and origin issues. Cotton and textile importers need production records behind preference claims. Electronics manufacturers should look closely at assists and complex assemblies. Medical and consumer goods companies need customs filings that match what went to FDA or CPSC.

Then look at how those decisions really get made. If engineering changes a part, does the broker know? If an HTS code changes, who signs off?

Find those weak spots before CBP does. 

No. 4: What Should You Do When You Find Errors?

Once you find an error, figure out how far it reaches, what it could cost, and the right way to correct it.

One bad classification on one entry is very different from the same mistake showing up across 40 shipments. Start by separating the one-offs from recurring process failures and anything serious enough to look like a violation. At the same time, fix whatever caused it, whether that’s supplier instructions, broker guidance, classification logic, or a bad valuation input. 

You don’t want next week’s freight repeating an error you already know about.

From there, calculate the exposure entry by entry, including duties, fees, interest, and dates. Unliquidated entries may qualify for a post-summary correction, while liquidated entries generally have a 180-day protest window.

If the issue could be a violation, bring in customs counsel before explaining it to CBP. A prior disclosure is a legal decision where timing counts.

CBP will care about what went wrong, but they’ll also want to see what you changed so it doesn’t happen again.

No. 5: How Do You Keep the Audit From Getting Away From You?

Keep one person running the show from the first meeting with CBP through the final findings.

Use the entrance conference to get the ground rules straight: what’s in scope, who CBP talks to, how interviews will work, what format they want records in, and when everything is due. 

Once that’s clear, keep the response disciplined. One lead should know what CBP asked for, what went out, and what still needs an answer. Send what was requested, keep an identical copy, and don’t dump extra paperwork on the auditor because somebody thinks “more” looks cooperative. More paperwork often means more questions.

The same goes for interviews. People should know their actual process and records, not memorize a script. If they don’t know an answer, “I’ll confirm that” beats guessing every time.

When CBP does send draft findings, read them closely. Correct the facts, provide support where it’s missing, and show exactly how you’ll fix legitimate problems through a corrective-action plan. Be sure to also check the dollars carefully. If CBP projects errors across a larger population, qualifying overpayments may offset underpayments under 19 CFR §163.11.

Don’t Reconstruct February in October

By the end of all this, you should be able to pull an old entry and understand what happened without calling half the company.

The PO should match the invoice. The product specs should support the classification. The origin paperwork should make sense. Finance should be able to show what was paid, and your broker’s filing should line up with the commercial transaction behind it. If something went wrong, you should already know how far it traveled and what you changed afterward.

That’s a pretty practical definition of being ready for a CBP Customs Audit.

It’s also where Mallory Alexander can help. Our licensed customs brokerage already works with the entries and documentation CBP is going to ask about, and our M-PACT trade compliance team can dig deeper into classifications, tariffs, exposure, corrections, and the audit response itself. Meanwhile, our forwarding, warehousing, and transportation teams keep the actual freight moving, because Tuesday’s containers still show up even when CBP wants to talk about last February.

If you’d rather do that digging on your schedule, talk with our brokerage and M-PACT teams.