What happens during a CBP audit of a DTC brand's import entries?

Short answer: A CBP audit, formally a Focused Assessment, is a systematic review of your import compliance covering classification, valuation, origin, and record-keeping across a sample of entries, usually spanning the past year. It starts with a notification letter and a questionnaire about your internal controls, proceeds to entry sampling and document requests, and ends with a report identifying violations and the duties owed. For DTC brands, the exposure concentrates in a few areas: misclassified bestsellers, undervalued related-party transactions, and origin claims that do not survive scrutiny. The audit is survivable and often improves the operation, but only if you prepare before the letter arrives rather than after.

How CBP picks audit targets

Audits are risk-based, and the risk signals are knowable. High import volumes with low duty payments relative to the industry draw attention, as do frequent classification changes, related-party transactions, and prior violations. CBP also runs targeted enforcement on product categories: if your category is in an enforcement push, your odds rise regardless of your individual history. Whistleblower tips and competitor complaints occasionally trigger reviews too.

DTC brands have a specific risk profile. Direct-to-consumer importers often start with a broker handling everything and minimal internal review, which means errors compound silently for years. When CBP samples entries, it finds the same misclassification repeated across hundreds of shipments, and the duty bill multiplies accordingly. The brands that get audited are rarely the worst actors; they are the visible ones with patterns an analyst can spot.

The audit timeline, step by step

It begins with a notification letter and an informed compliance questionnaire about your internal controls: who classifies your goods, how you value related-party transactions, what your record-keeping looks like. Your answers set the tone, because they tell CBP whether you run a compliance operation or wing it. Then comes entry sampling: CBP pulls a statistical sample of your entries and requests the full documentation for each.

The review phase is methodical. Auditors test your classifications against the tariff, your values against the transaction records, and your origin claims against the supplier evidence. Findings get discussed in exit conferences where you can present additional evidence before the report is final. The whole process typically runs six to eighteen months, and the final report quantifies additional duties owed plus any penalties. It is slow, thorough, and almost entirely document-driven.

The three areas auditors dig into

Classification comes first because it is where DTC brands err most. A bestseller classified under a low-duty heading three years ago keeps generating underpayments on every shipment until someone checks. Auditors know the common misclassifications by category and test them directly. Valuation is second, especially for brands buying from related factories: transfer prices that look like cost-shifting get reconstructed under the related-party rules, and the adjustments can be large. Origin is third, with free trade agreement claims getting verified against the actual production records.

Record-keeping underpins all three. The legal standard is five years of records from the date of entry, and the audit tests whether you can actually produce them. Brands that kept everything in a broker's portal they no longer use, or in the inbox of an employee who left, discover the gap at the worst possible moment. In an audit, a missing document counts the same as a wrong answer.

How to prepare before the letter arrives

Run your own assessment first. Sample your entries the way CBP would: pull a statistically meaningful set across the past year, re-verify classifications, check valuations against the books, and confirm origin documentation exists. Fix what you find voluntarily, because voluntary correction before an audit starts is treated far better than corrections discovered during one. Document the review itself; the existence of a self-assessment program is evidence of reasonable care.

Then build the infrastructure the questionnaire asks about. Assign classification responsibility to a named person or firm, put related-party valuation on a defensible methodology with transfer pricing support, and centralize five years of entry records where you can actually retrieve them. Brief your broker on the expectation that they flag anomalies rather than just filing what you send. None of this is exotic; it is the basic compliance operation that makes an audit boring, which is exactly what you want an audit to be.