Audit Proofing: What Compliance With 19 CFR Actually Requires

Audit Proofing: What Compliance with 19 CFR Actually Requires

Under 19 CFR, CBP can pull any entry you filed in the last five years and ask you to justify it, field by field. Audit-proofing is the ability to answer every question CBP can ask before they ask it.

It means pulling any given record and showing the reasoning without retroactive reconstruction or guessing:

• For a broker manager, it is walking into an audit prepared instead of scrambling
• For a brokerage leader, it means compliance stops being the bottleneck that slows growth down

What a CBP Audit Actually Looks Like

Worth separating two things that often get lumped together. A CF-28 Request for Information or CF-29 Notice of Action is transaction-level: CBP is questioning one entry, usually before liquidation. An audit is systemic: CBP is testing whether your process produces correct entries at all, using a sample to draw conclusions about the whole population.

An audit starts with a records request. CBP's Regulatory Audit and Agency Advisory Services runs everything from a Focused Assessment, a comprehensive risk-based review that can stretch across months, to a narrower referral audit triggered by a specific concern. Brokers face a parallel track through routine broker visits under Part 111. In every version, the agency works backward through entries already filed, and the lookback window generally runs five years.

The mechanics are simpler than most teams expect, which is what makes them uncomfortable. An auditor pulls a sample of entries and, field by field, asks where the number came from:

• What was this classified as, and on what basis
• What value was declared, and which document supports it
• What origin was claimed, and what evidence backs the preference
• Who reviewed the transaction, and when
• If a rate changed mid-stream, when did that change reach the filing

What makes this expensive is rarely a single bad entry. It is the same defect repeated across hundreds of them, then priced by culpability: up to two times the lost duties for negligence, four times for gross negligence, and up to the domestic value of the merchandise for fraud.

Where AI Helps, and Where It Creates Exposure

Not all customs AI is built for an audit.

A sampled entry either has a documented basis behind it or it does not. AI that flags a gap leaves the question in the review queue, where a licensed broker resolves it and the resolution gets recorded. AI that fills the gap moves an undocumented determination into the filing, where it looks identical to a sound one until an auditor asks for the source.

The exposure is not that the tool guessed. It is that nothing in the record shows it guessed.

For more, check out our full guide on how to use AI in customs brokerage →

What Good Looks Like

Audit readiness comes down to one question an auditor asks of every field on a declaration: where did this value come from? Teams that answer it comfortably tend to have five things in place.

The reasoning travels with the determination. Every HTS code carries the basis behind it, cross-referenced to the tariff schedule, explanatory notes, and any rulings relied on. Worth asking internally:

If someone pulled an entry from three years ago, well inside the five-year recordkeeping window and long past liquidation, could you reconstruct why that code was chosen, or would you be rebuilding the argument from scratch?

Values trace back to a document. Each declared value maps to the source it came from, with the valuation method recorded alongside it. If an auditor picked ten line items at random, how many could you tie to a specific document without a phone call?

In a recent FDA audit, they reviewed 10 entries filed by a broker. This sample size would mean that 1 single error would put the broker’s accuracy rate at 90%, below the 95% standard required by 19CFR.

The record shows who did what, and when. Part 111.28 turns on whether a licensed broker reviewed work handled by employees and whether that review left a record. Does your system capture that, or does it live in someone's memory and an email thread?

Gaps stay visible instead of getting filled. Missing data should surface for review, not get quietly resolved so the entry can move. What happens in your process at 4pm on a Friday when a value cannot be sourced?

Regulatory changes are dated and traceable. This is the one most teams underestimate. How do you keep abreast of real-time tariff changes, and how quickly are those changes reflected in your process? Being able to show not just what a value is but when it changed and why is the difference between a clean finding and a five-year exposure.