Which practice best supports continuous supplier monitoring in CTPAT?

Which practice best supports continuous supplier monitoring in CTPAT?

• A. One-time supplier audit
• B. No supplier evaluation after certification
• C. Ongoing assessments of suppliers and service providers
• D. Annual revenue review

Answer: (C)

Continuous supplier monitoring means regularly evaluating and updating your view of supplier security status, not relying on a single audit. In CTPAT, security conditions can change as suppliers modify processes, bring in new facilities, or shift personnel. Ongoing assessments of suppliers and service providers allow you to detect drift, verify that corrective actions have been completed, and reclassify risk as conditions evolve. This keeps your security profile current and aligns with the need for continuous validation of partner security. A one-time supplier audit only provides a snapshot at one moment and may miss later changes that introduce risk. Not evaluating suppliers after certification leaves you without a mechanism to ensure continued compliance. An annual revenue review focuses on finances, not security controls or physical security practices, so it doesn’t support continuous monitoring of supply-chain security.

Continuous supplier monitoring means regularly evaluating and updating your view of supplier security status, not relying on a single audit. In CTPAT, security conditions can change as suppliers modify processes, bring in new facilities, or shift personnel. Ongoing assessments of suppliers and service providers allow you to detect drift, verify that corrective actions have been completed, and reclassify risk as conditions evolve. This keeps your security profile current and aligns with the need for continuous validation of partner security.

A one-time supplier audit only provides a snapshot at one moment and may miss later changes that introduce risk. Not evaluating suppliers after certification leaves you without a mechanism to ensure continued compliance. An annual revenue review focuses on finances, not security controls or physical security practices, so it doesn’t support continuous monitoring of supply-chain security.