// FIELD BRIEFING // THE TRADE UNDERGROUND

The Letter You Don’t Want: How a CBP Audit Actually Unfolds, From the Notice to the Room

A Focused Assessment does not start with agents at the door. It starts with a questionnaire, a spreadsheet, and a quiet decision about whether your company is a risk worth the government’s time. Here is the whole arc – and where importers lose it.

Most importers picture an audit as a raid. It isn’t. A CBP Focused Assessment is slow, procedural, and almost polite – which is exactly what makes it dangerous. By the time you know you are being audited, the agency has already run its numbers and decided you are worth a closer look. The letter in your inbox is not the beginning of the investigation. It is the beginning of the part you get to see.

I have sat in these rooms for 25 years, on both sides of the table. The companies that come through clean are almost never the ones with perfect entries. They are the ones who understood the arc before it started, and had their story – and their records – ready. Here is how it actually goes.

// How CBP Picks You

Nobody audits at random. Regulatory Audit selects importers on risk: high entered value, complex or high-duty products, prior compliance history, industry profile, and – more than people realize – tips and referrals from competitors, former employees, and other agencies. In 2026, one of the highest-volume triggers remains classification. If your HTS numbers don’t hold up, everything downstream – valuation, origin, duty owed – is suspect.

The pressure is not theoretical. Through the first seven months of FY2026, CBP recovered roughly $182 million from just 181 audits – an average of more than $1 million per audit – on the heels of a record FY2025 that pulled in about $235 million. The enforcement posture has hardened alongside the dollars. That combination is the story of this year: bigger recoveries per audit, and less room to negotiate your way out of one.

// The Notice

It arrives as a letter. It names the audit, the period under review (often multiple years of entries), and the CBP Regulatory Audit field office running it. It sets a date for an entrance conference. It is not a subpoena and it is not an accusation – but the clock it starts is real, and the first thing it tests is whether you can produce your own records on demand.

The audit is not really about your entries. It is about whether you can prove you exercised reasonable care in making them.

// Inside the Focused Assessment

The Focused Assessment runs in defined phases. Knowing which phase you are in tells you exactly how much trouble you are – or are not – in.

The lever most importers ignore sits before ACT ever begins. If your internal controls hold up in the PAS, CBP can close the audit without ever pulling the big sample. The entire game, in other words, is often won or lost on documentation you should have had in place long before the letter arrived.

// The Room

The on-site portion is not adversarial theater. It is auditors – usually two or three – working out of a conference room at your headquarters or wherever import decisions actually get made, for one to three weeks. They ask for records. They ask the same question three different ways. They watch whether the person answering actually understands the company’s own process, or is reading it off a binder for the first time.

What sinks companies in that room is rarely a single bad entry. It is inconsistency – a classification that doesn’t match the product spec, a value that doesn’t tie to the vendor payment, a country-of-origin claim nobody can source to a document. Each gap is small. Together they tell the auditor your controls are decorative, and that moves you from PAS to ACT and from ACT to penalties.

// The Move Most Importers Miss

If you find the error before CBP does, you have a tool: the prior disclosure. Tell the government about the mistake, tender the lost duties, and you sharply cap your exposure. Wait until the audit surfaces it, and you have thrown that protection away – and 2026 is a bad year to do it. Under the June 2026 executive order on customs enforcement, CBP has been directed to revise its mitigation standards to set a penalty floor of not less than 50% of the assessed penalty, and to eliminate mitigation altogether for repeat offenders – the very relief importers used to count on when an audit turned up a problem.

The math has changed. Self-correction was always the smart play. Now it is close to the only one that still bends the outcome in your favor.

// What To Do Before The Letter

1. Write down your process – and follow it. A documented, actually-used internal control procedure for classification, valuation, and origin is the single thing the PAS is built to find.
2. Reconcile value to payment. Make sure entered value ties cleanly to what you actually paid the vendor, including assists, royalties, and additions. This is where ACT lives.
3. Source every origin claim. Every country-of-origin declaration should trace to a document you can hand an auditor without a phone call.
4. Run a mock PAS annually. Pull your own sample of entries and test them the way CBP would. Find your errors on your own timeline.
5. Know your prior-disclosure trigger. Decide in advance who decides to disclose, and how fast. In 2026 that decision is worth real money.

An audit rewards the boring virtues: written procedures, clean records, consistent answers. None of it is glamorous. All of it is the difference between an audit that closes at the PAS and one that ends with a penalty letter and a number you did not choose.