A CF-28 asks about one entry. A Focused Assessment asks whether your company should be trusted to file entries at all.
That is the distinction importers most often miss, and it explains why the two require completely different responses. CBP’s Regulatory Audit function does not open a Focused Assessment to find a bad shipment. It opens one to evaluate whether your internal controls are capable of producing accurate entries year after year — and if the answer is no, everything the auditors find along the way becomes actionable. Because the reviewable period generally reaches back five years, matching the statute of limitations at 19 U.S.C. 1621, a single audit can surface liabilities across thousands of entries at once.
What CBP Is Actually Measuring
The premise of a Focused Assessment is that CBP cannot examine every entry, so it examines the system that produces entries. Auditors want to know whether responsibility for classification is assigned to a named person, whether valuation decisions follow a written procedure, whether someone reviews what the broker files, and whether records exist to reconstruct any determination.
An importer with strong controls and one honest error is a manageable problem. An importer with no controls and no errors yet discovered is, to an auditor, an unmanaged risk — and the audit deepens until the errors appear. This inversion is counterintuitive and worth sitting with: the quality of your documentation matters more to the outcome than the quality of your compliance record. A company that can prove how it decided is treated very differently from one that merely got lucky.
What Puts You on the List
Selection is risk-based, not random, and the factors are reasonably predictable. Revenue at stake drives most of it.
| Factor | Why it raises your profile |
|---|---|
| High duty volume | More revenue at stake means a larger return on audit effort. This is the single strongest driver. |
| AD/CVD exposure | Antidumping and countervailing duty rates can be enormous, and evasion is an enforcement priority. See AD/CVD duties and scope rulings. |
| Related-party transactions | When buyer and seller are related, CBP questions whether the transaction value reflects an arm’s-length price. |
| Prior violations or heavy CF-28 activity | A history of entry problems suggests systemic weakness rather than isolated error. |
| Trade-remedy tariff exposure | Section 301 and Section 232 goods invite origin and classification scrutiny, since the incentive to misdeclare is obvious. |
| Priority trade issues | CBP publicly targets certain industries and commodities. Operating in one raises your odds independent of your own record. |
| Duty preference claims | USMCA and other free trade agreement claims require origin substantiation many importers cannot produce on demand. |
The Two Phases, and Why the First One Decides Everything
Pre-Assessment Survey
Auditors map how your import operation actually works. They interview staff, review your written procedures, walk through how a classification gets assigned and how a value gets calculated, and test a small sample of entries to see whether the process described on paper is the process that runs in practice.
The survey is not a formality. It is a judgment about risk, and it is where the audit’s entire trajectory is set.
If controls are judged weak: the audit proceeds to transaction testing, where the money is found.
Assessment Compliance Testing
Auditors now test actual transactions in the risk areas identified during the survey — typically classification, valuation, origin, and any duty preference or AD/CVD claims. Statistical sampling is common, which carries a consequence importers routinely underestimate: an error rate found in a sample can be extrapolated across the full population of entries in the audit period.
A handful of misclassified entries in a sample of fifty can therefore become a duty liability calculated across five years of imports.
The strategic implication is straightforward. Everything you can do to influence the result happens during the pre-assessment survey, when the question is still whether your controls are adequate. Once compliance testing begins, the conversation has moved from “is this company well run” to “how much does it owe,” and the leverage is gone.
What They Will Ask For
Audit document demands are broad, and the inability to produce a category quickly is itself a finding. Expect requests spanning:
- Entry summaries and supporting entry packets across the audit period
- Commercial invoices, purchase orders, and contracts — and proof of what you actually paid
- Written compliance procedures, org charts, and evidence of who is accountable for customs decisions
- Classification worksheets, rulings relied upon, and any advice sought from brokers or counsel
- Valuation documentation: assists, royalties, transfer pricing studies, retroactive price adjustments
- Origin substantiation, certificates, and production records supporting preference claims
- General ledger and accounts payable records that can be reconciled to declared values
That second-to-last item is where audits most often turn. Auditors reconcile what you told CBP the goods were worth against what your own books show you paid for them. Discrepancies between declared value and accounts payable are difficult to explain away, and they are exactly what a valuation-focused test is designed to surface — see customs valuation and appraisement. Separately, the inability to produce required records is its own violation under 19 U.S.C. 1509, carrying penalties independent of anything the entries reveal. See recordkeeping penalties.
The Disclosure Decision
Sometimes preparing for an audit — or the audit itself — surfaces genuine errors. At that moment an importer faces the most consequential decision in the whole process, and it is time-sensitive in a way that is easy to misjudge.
Disclosing before CBP investigates is worth far more than disclosing after
A valid prior disclosure can reduce penalty exposure dramatically — for negligence and gross negligence, generally to interest on the lost duties; for fraud, generally to the revenue loss itself rather than the full domestic value of the merchandise. The difference between those figures can be measured in orders of magnitude.
The protection depends on disclosing before CBP commences a formal investigation into the same conduct. Whether an audit notice, a document demand, or a particular line of questioning has already triggered that threshold is a genuinely contested legal question that turns on specific facts — and it is exactly the wrong question to answer by guessing.
Once errors are found, the disclosure analysis is measured in days, not months.
The countervailing consideration is real: a disclosure is an admission, it obligates you to tender the lost duties, and it requires a thorough enough internal review that you do not disclose incompletely. That is why the decision belongs with counsel who can weigh the exposure against the protection, rather than with the instinct to either confess or stay quiet.
How to Be Ready Before the Letter Arrives
The audit is scored on artifacts that either exist or do not, and none of them can be created retroactively with any credibility. A defensible posture requires four things in writing: a named person accountable for customs compliance; documented procedures for classification, valuation, and origin; a file of the advice sought and what was done with it; and a records system that can reconstruct any entry for five years. Larger importers add periodic internal self-testing, which serves double duty — it finds errors while a prior disclosure is still available, and it demonstrates exactly the control environment the pre-assessment survey is looking for.
If a Focused Assessment has been announced, the sequence to avoid is the common one: hand over documents, answer questions freely, and call a lawyer when the findings arrive. By then the survey is complete, the risk judgment is made, and the sampling is underway. Bringing a customs and international trade lawyer in before the entrance conference — to run a privileged internal review, prepare the staff who will be interviewed, and evaluate disclosure while the window is open — is the version of this that ends well. Our broader guidance on import compliance covers the program you should have had in place beforehand.
Frequently Asked Questions
How is a Focused Assessment different from a CF-28?
A CF-28 is a request for information about a specific entry. A Focused Assessment is a comprehensive audit of your entire import program and internal controls, conducted by CBP’s Regulatory Audit function, typically reaching back five years. The scope, the stakes, and the correct response are entirely different.
How far back can a customs audit reach?
Generally five years, aligning with the statute of limitations for most customs penalty actions under 19 U.S.C. 1621 and with the five-year recordkeeping requirement. That is why records discarded early become a problem precisely when they are needed.
Should I file a prior disclosure before or during an audit?
It depends on the facts and the timing, and it is a decision best made with counsel. A prior disclosure can sharply limit penalty exposure, but the protection generally depends on disclosing before CBP commences a formal investigation into the same conduct. Whether an audit has crossed that threshold is a fact-specific legal question worth answering carefully rather than quickly.
Can errors found in a sample be applied to all my entries?
Yes. Statistical sampling is common in compliance testing, and an error rate identified in a sample can be extrapolated across the population of entries in the audit period. A small number of errors in a sample can therefore generate a duty liability calculated across years of imports.
Notified of a Focused Assessment?
The pre-assessment survey decides the trajectory of the whole audit. Talk to a customs attorney before the entrance conference — not after the findings arrive.