CPSS: Regulatory Compliance

Regulatory Compliance tests your ability to map obligations to controls and produce evidence on demand. The exam does not expect memorisation of every statute; it expects knowledge of the categories, the responsible owner, and the difference between compliance and security.

The obligation map

• Customs and trade: importer obligations, accurate declarations, recordkeeping (in the US, customs records are generally kept five years), reasonable care, Importer Security Filing.
• Transport safety: dangerous goods rules (IMDG Code for ocean, IATA DGR for air, 49 CFR for US road and rail), verified gross mass, load security.
• Maritime and port security: the ISPS Code under SOLAS and national regimes such as the US Maritime Transportation Security Act.
• Employment and data: background screening law (FCRA in the US, GDPR and UK GDPR in Europe), retention limits, employee monitoring rules.
• Sanctions and export control: restricted party screening, dual-use and export licensing, anti-bribery obligations under the FCPA and UK Bribery Act.
• Product-specific: food safety, pharmaceutical serialisation and traceability, forced-labour import restrictions, conflict minerals.

Building the compliance program

• Maintain a compliance register: obligation, source, owner, control, evidence, review date.
• Horizon-scan for regulatory change and name an owner for regulatory monitoring.
• Train the roles that carry obligations: shipping, customs, HR, procurement.
• Retain evidence: policies, training records, logs, inspection reports, declarations, audit results.
• Calibrate: compliance is a floor. Meeting a regulation does not mean the risk is controlled.

Worked example

A new lane opens to a country subject to sanctions. Compliance is not a customs question alone: screen all parties including shipper, consignee, notify party, bank and vessel; check end use and goods classification; confirm licensing; document the screening result and date; set a re-screen trigger. If the customer refuses end-use information, the correct answer is to stop, not to proceed with a disclaimer.

Traps

Treating certification as compliance; ignoring retention periods; assuming the broker or forwarder absorbs the importer's liability; screening parties once at onboarding; and screening without knowing which list and jurisdiction apply.

Customs and Trade Security Programs

Customs and Trade Security Programs covers the government-private partnerships and filing rules that shape cross-border movement. Expect questions on what each program requires, what it gives back, and how security criteria translate into facility and conveyance controls.

The architecture

• The WCO SAFE Framework of Standards sets the international template with three pillars: customs-to-customs cooperation, customs-to-business partnership, and customs-to-other government agencies.
• AEO programmes implement the customs-to-business pillar; mutual recognition lets one country's AEO benefits travel. AEO is not uniform globally - criteria and benefits differ by jurisdiction.
• C-TPAT (US Customs and Border Protection) is a voluntary partnership. Members commit to minimum security criteria covering business partner requirements, container and trailer security, physical and access controls, personnel security, procedural security, security training and threat awareness, and information technology security. Benefits include reduced examination rates, front-of-line processing and access to a supply chain security specialist.
• Data rules: the 24-hour rule for vessel manifests and the Importer Security Filing, which adds ten importer data elements plus the vessel stow plan and container status messages.

How criteria map to controls

• Container and trailer security: seven-point inspection, ISO 17712 seals, seal logs.
• Physical and access control: fencing, lighting, badges, visitor logs.
• Procedural security: manifest accuracy, document control, discrepancy reporting.
• Personnel and business partner security: screening, written contracts, sub-supplier verification.
• IT security: access control, strong authentication, monitoring.

Validation versus certification

Certification usually means the member has self-assessed against the criteria; validation means an authority has examined evidence on site. Know which one your organisation holds and which the customer contract requires.

Worked example

An importer is deciding on C-TPAT. Reasoning: benefits include lower examination rates and faster release on a lane where a one-day delay costs 8,000; obligations include documented seal procedures, partner vetting and evidence for validation. A gap analysis shows no seal log and no partner questionnaires. The correct answer is to close the gaps first and apply with evidence, not to join and backfill paperwork.

Traps

Assuming C-TPAT or AEO replaces cargo insurance or a security programme; treating the Importer Security Filing as identical to the 24-hour rule; assuming mutual recognition means identical criteria; and expecting the broker to hold the importer's liability.

Incident Management

Incident Management tests the structure you use in the first hours: who declares an incident, who is told, what is preserved, and how the organisation learns. The exam rewards plans with roles, thresholds and clocks, not heroics.

Phases

• Prepare: plan, roles, contact tree, scenario playbooks, training and exercises.
• Detect and classify: report, triage against severity criteria, declare.
• Contain: stop the loss, secure the site or system, preserve evidence.
• Recover: restore operations, verify integrity, release from containment.
• Learn: after-action review and corrective actions with owners and dates.

Plan content the exam expects

• Roles: incident lead, operations, security, legal, HR, communications, IT, finance and insurance, with a named deputy for each.
• Escalation thresholds: what turns an incident into a crisis - safety impact, regulatory breach, media exposure, value threshold, cross-border effect.
• Notification obligations: police, customs or port authority, insurer within the policy window, customers under contract, and data protection authorities for personal data breaches within statutory deadlines.
• Evidence and records: a single incident log with timestamps, photographs, CCTV export under chain of custody, seal and document copies, interview notes.
• Communications: one spokesperson, holding statements, no speculation about cause.

Worked example

A loaded trailer is hijacked 40 km from the distribution centre. First-hour reasoning: safety first, meaning driver welfare, then the notification chain - police, insurer, the customer if goods are regulated, and the carrier. Do not publish details that could compromise recovery. Preserve telematics data and last known position, the seal number, the load list and the driver statement. Declare at the value threshold, open the incident log and assign the investigation owner. Any recovery negotiation is a corporate decision, not a driver decision.

Traps

Confusing an incident with a crisis; notifying before preserving evidence; several informal logs instead of one; missing contractual or regulatory clocks; after-action reviews with findings but no owners; and a contact tree that was never tested.

Business Continuity and Resilience

Business Continuity and Resilience asks whether the supply chain keeps moving when a node, link or system fails. The exam tests the language of continuity - BIA, RTO, RPO, MTD - and whether you can choose proportionate strategies and test them.

Core concepts

• Business impact analysis: identifies critical activities, their dependencies (people, IT, utilities, transport, suppliers, data) and how impact grows over time.
• MTD or MTPD: the maximum tolerable period of disruption before impact becomes unacceptable.
• RTO: the target time to restore the activity, which must be shorter than the MTD.
• RPO: acceptable data loss measured in time, which drives backup frequency.
• WRT: the time needed to return from the recovery arrangement to normal operations.
• ISO 22301 provides the BCMS structure: context, leadership, planning, support, operation, performance evaluation, improvement.

Supply chain resilience

• Capacity types: absorptive (buffer stock, spare capacity), adaptive (alternate routing, reallocation), restorative (rapid recovery, supplier support).
• Strategies: dual sourcing, qualified alternate ports and carriers, safety stock for critical items, pre-approved expedited freight, manual workarounds, backup power and communications.
• Visibility through a control tower, supplier continuity capability assessment, and contract clauses requiring notification and continuity plans.
• Test with plan review, tabletop, simulation and, where feasible, live failover. Untested plans are hypotheses.

Worked example

A port closure strands 30% of inbound volume. Reasoning from the BIA: production line 2 has a six-day MTD and three days of buffer, so the recovery time for alternate supply must be under three days. Options: divert to a second port with a four-hour truck leg, restoring flow in about two days, or air freight, restoring in 24 hours at high cost. Choose diversion for routine volume and air freight only for the line-stopping portion, and document the trigger for the next escalation.

Traps

Confusing RTO with MTD; IT-only continuity plans that ignore logistics and people; assuming suppliers' plans are adequate; never testing; and failing to update plans after organisational or network change.

Auditing, Assurance and Performance Measurement

Auditing, Assurance and Performance Measurement covers how you prove the programme works. The exam tests audit types, evidence standards, findings classification, corrective action discipline, and the design of metrics that drive behaviour rather than decorate a report.

Audit fundamentals

• Types: first-party (self-assessment), second-party (supplier or partner) and third-party (independent or certification body). Internal audits require independence from the activity being audited.
• ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
• Process: define scope and criteria, plan and sample, opening meeting, gather evidence through interview, observation and document review, record findings, closing meeting, report, corrective and preventive action, follow-up.
• Findings: major nonconformity (system failure or unaddressed requirement), minor nonconformity, and observation or opportunity for improvement. Each finding needs objective evidence and a criterion reference.
• Sampling must be documented and risk-based; do not generalise beyond the sample without stating the basis.

Performance measurement

• Lagging indicators: losses, incidents, claims, audit findings.
• Leading indicators: training completion, seal compliance rate, dock audit pass rate, supplier questionnaire return rate, time to close corrective actions, mean time to detect.
• Metrics need a baseline, a target, an owner and a review cadence, and should be hard to game.
• Report to governance in a dashboard tied to risk appetite, not a data dump.

Worked example

A dock audit samples 50 outbound loads and finds six without a recorded seal number - 12% non-compliance. Reasoning: sampling 50 from roughly 400 weekly loads gives a defensible estimate at this frequency, but the finding is a system issue, not six clerical errors. The report cites the procedure, quantifies the rate, and requires root-cause analysis, retraining and a re-audit in 30 days. The KPI changes from seal logs completed to seal number matched at both dispatch and receipt.

Traps

Treating an audit as an inspection; auditing documents only and never observing the dock at night; no follow-up on corrective actions; auditors auditing their own work; too many KPIs with no decision attached; and metrics that reward volume over control.