CBSA completed 1,847 trade compliance verifications in the 2024–2025 fiscal year. That number is going up. In June 2026, McMillan LLP flagged that CBSA has updated its trade compliance verification priorities to specifically target goods subject to retaliatory tariffs — meaning if you're importing anything caught up in the Canada-U.S. trade dispute, you've moved up the list. With CARM fully live and the retaliatory tariff environment adding new complexity, CBSA has better data and more reasons than ever to look closely at your import program. If it runs on spreadsheets, email chains, and memory, you're not ready for that knock.
This isn't about being paranoid. It's about not being caught flat-footed when CBSA asks you to prove what you declared two years ago.
What "Audit Readiness" Actually Means
Most importers think audit readiness means having your invoices saved somewhere. It doesn't.
A CBSA trade compliance verification — whether it's a focused verification on a specific tariff classification or a broader audit of your entire import program — requires you to produce documentation that connects your goods to your declarations. That means invoices, yes. But also: purchase orders, contracts, proof of origin, valuation worksheets, any rulings you've relied on, and your internal processes for how you arrived at those declarations.
CBSA's D17-1-4 (Accounting for Commercial Goods) and D13-4-2 (CBSA Audit Trail Requirements) lay out what they expect to find. The short version: you need a clear, traceable line from the physical goods to the B3 entry to the supporting documents. If that line has gaps, you're looking at re-assessments, penalties, and interest.
A furniture importer we worked with got hit with a focused verification on tariff classification — specifically sofas with wood frames. They'd been using the wrong HS code for three years. Not maliciously. Their broker at the time had made a judgment call that didn't hold up. By the time CBSA finished, they owed $87,000 in duties plus interest. The records existed, but they were scattered across three email inboxes and a shared drive nobody had organized. The scramble to reconstruct the paper trail cost them weeks and made the whole process worse.
That's what poor audit readiness actually costs.
The Retaliatory Tariff Problem
This is new territory that didn't exist when most importers built their compliance programs.
Canada's retaliatory tariffs on U.S. goods — and the surtax remission orders that followed — have created a layer of complexity that CBSA is now actively verifying. EY reported in June 2026 that CBSA extended the surtax remission for two additional months, which sounds like relief. It is, temporarily. But McCarthy Tétrault has noted that CBSA's guidance is actively narrowing the scope of who qualifies for that relief. If you've been claiming remission, you need to confirm you still qualify under the current interpretation — not the one from six months ago.
The verification priority update McMillan flagged is significant. CBSA isn't just checking whether you paid the right duty rate on ordinary goods. They're specifically looking at goods subject to retaliatory measures. If your supply chain touches U.S.-origin steel, aluminum, or any of the other targeted categories, expect scrutiny. The question isn't whether CBSA will look — it's whether your documentation will hold up when they do.
If you've been relying on remission orders to reduce your duty exposure, pull those claims now and make sure your documentation supports them. The rules have shifted enough in 2026 that what was defensible in January may not be defensible today.
The CARM Factor
CARM changed the risk landscape for importers. Not because the rules changed — they didn't — but because CBSA's visibility into your import history got a lot sharper.
Before CARM, a lot of compliance data lived in broker systems. CBSA had access to it, but pulling patterns across years of entries for a specific importer took effort. Now, with importers holding their own accounts in CARM and all release and accounting data flowing through one system, CBSA can run queries on your import history that would have taken weeks of manual work before. They can see your duty payment patterns, your tariff treatment claims, your amendment history — all of it.
This isn't speculation. CBSA's 2024–2025 Departmental Plan explicitly referenced using CARM data to inform compliance verification targeting. They said it. It's in the document.
What this means practically: if you've been inconsistent in how you classify a product, or if your Free Trade Agreement claims don't line up with your supplier geography, CARM makes that easier to spot. You don't have to be doing anything intentionally wrong to get flagged. Inconsistency is enough.
Check your CARM portal. Look at your transaction history. If you see entries where the same product was classified differently at different times, fix it before CBSA asks about it.
Where Manual Processes Create Risk
Here's the honest version of how most small-to-mid-size importers operate: the broker does the entry, emails a copy of the B3, the accounting team files it somewhere, and nobody looks at it again unless there's a problem. That's not a compliance program. That's hoping nothing goes wrong.
The specific failure points I see most often:
- No classification review process. Tariff classifications get set once — often by the broker, often years ago — and nobody revisits them. HS codes change. Products evolve. A classification that was defensible in 2019 might not be in 2026.
- FTA claims without origin documentation on file. You're claiming CUSMA preferential tariff treatment. Great. Do you have the Certificate of Origin or the importer's knowledge documentation to back it up? If CBSA asks, you have 30 days to produce it. If you can't, the preferential claim gets denied and you owe the difference — plus interest.
- Valuation inconsistencies. Related-party transactions, assists, royalties — these all affect customs value. If your declared value doesn't include elements it should, that's an error. If it's a pattern across multiple entries, that's a problem.
- Retaliatory tariff and remission claims with no paper trail. This one is new and it's burning people right now. If you claimed surtax remission and didn't document why you qualified, you're exposed. CBSA is looking at exactly this.
- No amendment discipline. When you find an error, do you file a voluntary amendment (a K9 correction) or do you just move on? Voluntary disclosure and self-correction are explicitly recognized in CBSA's compliance framework. Ignoring errors you know about is not.
- Documents stored in ways that make them impossible to retrieve. The legal requirement under the Customs Act is to keep records for six years. Keeping them in an email inbox that changes when your logistics coordinator leaves is not a records management program.
Honestly, most importers know they have at least one of these gaps. The question is whether you address it before or after a verification starts.
How Automation Changes Your Risk Profile
This is where the technology piece connects to compliance — not as a sales pitch, but as a practical reality.
When your import data lives in a structured system — whether that's a trade management platform, an ERP with customs modules, or even a well-configured database — a few things happen automatically that reduce your risk:
Classification consistency. When you assign an HS code to a product in a system, that code follows the product. Every entry for that SKU uses the same classification. You can still make a wrong call, but you'll make it consistently — which means if you find an error, you can correct it systematically instead of hunting through individual entries.
Document attachment at the transaction level. Good trade management software ties documents to entries. The commercial invoice, the bill of lading, the certificate of origin — they're linked to the specific B3 they support. When CBSA asks for documentation on entry number 12345, you pull one record, not three email threads from 2023.
Audit trails by default. Systems log who changed what and when. If a classification was amended, you can see why. If a value was adjusted, there's a record. This is exactly what CBSA's D13-4-2 asks for, and it's extremely difficult to produce from manual processes after the fact.
Exception flagging. Some platforms will flag when a new entry for a known product comes in with a different classification or a value that's outside normal range. That's a human error catch that manual processes simply don't have.
A food importer we work with moved their import program into a trade management system about two years ago. When CBSA sent them a verification letter last fall — a focused review of their tariff classification on processed seafood — their response time was three days. They pulled the relevant entries, the supporting documents, and their internal classification rationale, and sent it over. The verification closed with no reassessment. Their previous broker, who ran everything manually, had told them a verification would take "weeks to respond to." It didn't have to.
Building an Internal Compliance Program
You don't need a compliance department. Most importers don't have one and don't need one. What you do need is a basic program — documented, followed, and reviewed at least once a year.
The minimum viable compliance program looks like this:
- A product classification register. A list of every product you import, the HS code you use, who approved it, and when it was last reviewed. This can be a spreadsheet. It just needs to exist and be current.
- An origin documentation procedure. For every FTA claim you make, you need to know where the supporting documentation is and who's responsible for getting it. "The broker handles it" is not a procedure — it's an assumption.
- A valuation checklist. Particularly for related-party transactions or situations where you pay royalties, provide tooling, or have any non-invoice costs that could affect customs value. Run through it annually with your broker.
- A retaliatory tariff and remission log. If you're claiming any relief under Canada's surtax remission orders, document the basis for each claim. Given how quickly CBSA's guidance has shifted in 2026, you want a record of what you relied on and when.
- A self-correction process. When you find an error — and you will find errors — what happens? Who decides whether to file a voluntary amendment? Who files it? This should be written down.
- A records retention policy. Six years, under the Customs Act. Where are they stored? Who's responsible? What happens when staff turn over?
None of this is complicated. It's just work that most importers don't do because nothing has gone wrong yet.
Annual Review: What to Actually Check
Once a year, sit down with your broker and go through the following:
- Pull a sample of 20–30 entries from the past year. Spot-check classifications against the current tariff schedule. HS codes change on January 1 — did your classifications get updated?
- Review any FTA claims. Do you have origin documentation on file for all of them? If not, get it now, not when CBSA asks.
- If you've made any retaliatory tariff or surtax remission claims, review them against the current CBSA guidance. What qualified six months ago may not qualify today.
- Look at your amendment history. Are there patterns — the same type of error recurring? That's a process problem, not a one-off.
- Check your CARM account. Confirm your business account information is current, your broker delegation is set up correctly, and you understand your transaction history.
- Ask your broker if there have been any CBSA notices or D-memo updates that affect your commodity. CBSA publishes these regularly. Your broker should be flagging them. If they're not, that's a conversation to have.
Penalties: What You're Actually Risking
CBSA's Administrative Monetary Penalty System (AMPS) has specific penalty amounts. These aren't discretionary — they're set out in the AMPS schedule, and CBSA applies them.
Failure to report goods accurately: up to $25,000 per occurrence. Failure to keep required records: $150 to $25,000 depending on the contravention. Making a false declaration: up to $25,000. These stack. A verification that finds systemic errors across multiple entries isn't one penalty — it's one per entry.
The broker we mentioned at the start of this piece — the one who ate $40,000 in penalties — made a series of small errors across a lot of entries. No single entry was a disaster. The pattern was.
Voluntary self-correction before a verification starts is treated differently than errors discovered during a verification. CBSA's voluntary disclosure program exists for a reason. Use it if you find something.
Frequently Asked Questions
How does CBSA decide who to audit?
CBSA uses a risk-scoring model that looks at your import history, commodity type, country of origin, and compliance track record. Certain sectors get more attention — textiles, steel, food, and goods subject to anti-dumping or countervailing duties are perennial targets. As of mid-2026, goods subject to Canada's retaliatory tariffs have been explicitly added to CBSA's verification priority list. Inconsistency in your declarations — same product, different classifications — is a flag. So is a sudden change in declared values. CARM has made it easier for them to spot these patterns across your full import history.
How long do I have to keep import records?
Six years from the date of importation, under section 40 of the Customs Act. That's the minimum. If you have goods subject to anti-dumping duties or ongoing trade remedy investigations, keep everything longer. The records need to be available in Canada and producible within a reasonable time if CBSA asks.
My broker handles everything. Isn't that enough?
No. Your broker acts as your agent. The legal liability for customs declarations sits with you as the importer of record. If your broker makes an error, you owe the duties and penalties — not them. A good broker relationship is essential, but it's not a substitute for understanding your own import program. You should be able to answer basic questions about how your goods are classified and why.
What happens if I find an error before CBSA does?
File a voluntary amendment (K9 correction) through your broker. Pay the duties owed. CBSA's compliance framework explicitly recognizes self-correction as a positive compliance indicator. It won't eliminate the duty owing, but it typically avoids penalties. Sitting on a known error and hoping CBSA doesn't find it is the worst option — if they do find it, the penalty exposure is higher and your credibility as a compliant importer takes a hit.
What's the difference between a focused verification and a full audit?
A focused verification targets a specific issue — usually a tariff classification, an FTA claim, or a valuation question — across a defined set of entries. It's scoped. A full trade compliance verification looks at your entire import program. Focused verifications are more common. They can turn into broader reviews if CBSA finds problems that suggest systemic issues. This is another reason why fixing known problems proactively matters — a small issue that gets corrected stays small. A small issue that CBSA finds often leads to more questions.
We claimed surtax remission earlier this year. Are we still covered?
Maybe. CBSA's guidance on remission eligibility has tightened considerably in 2026. McCarthy Tétrault flagged in June that CBSA is actively narrowing the scope of who qualifies. If you claimed remission based on guidance from early in the year, have your broker confirm you still meet the current criteria. If you don't, a voluntary amendment now is a much better outcome than a reassessment later.
Do I need special software to be audit-ready?
No. You need organized records, consistent processes, and documentation you can actually find. Software makes that easier — significantly easier at volume — but a well-organized shared drive and a disciplined process can work for smaller importers. The question to ask yourself: if CBSA sent a verification letter today asking for all documentation supporting your last 50 entries, how long would it take you to respond? If the answer is "weeks" or "I'm not sure we have everything," that's the gap to close, however you close it.