Crmcar1 module 4 by Ceddet

CUSTOMS RISK MANAGEMENT. CARIBBEAN

MODULE 4

INFORMATION SOURCES AND TREATMENT FOR RISK MANAGEMENT

Customs Risk Management. 1st Edition

Module 4

Course author Inter-American Development Bank (IDB) (www.iadb.org), through its Integration and Trade Sector (INT). Course coordinator Inter-American Development Bank (IDB) (www.iadb.org), through its Integration and Trade Sector (INT), the Institute for the Integration of Latin America and the Caribbean (INTAL) (www.iadb.org/en/intal) and the Inter-American Institute for Economic and Social Development (INDES) (www.indes.org). Module author for the Latin-American region Felipe Martínez Priego. Risk Management Expert. Department of Customs and Special Taxes of AEAT under the Ministry of Finance and Public Administration of the Kingdom of Spain. Module author for the Caribbean region Chris Thibedeau. Pedagogical and editorial coordination The Inter-American Institute for Economic and Social Development (INDES) (www.indes.org) in collaboration with CEDDET Foundation (Economic and Technological Development Distance Learning Centre Foundation) (www.ceddet.org).

Copyright © 2017 Inter-American Development Bank. This work is licensed under a Creative Commons IGO 3.0 Attribution-NonCommercial-NoDerivatives (CC-IGO BY-NC-ND 3.0 IGO) license (http://creativecommons.org/licenses/by-nc-nd/3.0/igo/legalcode) and may be reproduced with attribution to the IDB and for any non-commercial purpose. No derivative work is allowed. Any dispute related to the use of the works of the IDB that cannot be settled amicably shall be submitted to arbitration pursuant to the UNCITRAL rules. The use of the IDB’s name for any purpose other than for attribution, and the use of IDB’s logo shall be subject to a separate written license agreement between the IDB and the user and is not authorized as part of this CC-IGO license. Note that link provided above includes additional terms and conditions of the license. The opinions expressed in this publication are those of the authors and do not necessarily reflect the views of the Inter-American Development Bank, its Board of Directors, or the countries they represent.

Customs Risk Management. 1st Edition

Module 4

Table of Contents List of Tables.................................................................................................................... 5 List of Figures .................................................................................................................. 5 Glossary ........................................................................................................................... 5 Module Introduction ....................................................................................................... 6 General Objectives of the Module.................................................................................. 8 Learning-Oriented Questions ......................................................................................... 8 UNIT I. INFORMATION ACCESS ...................................................................................... 9 Learning Objectives ........................................................................................................ 9 I.1. Trade Data (Regulatory Data) .................................................................................. 9 I.1.1. Cargo Report and Field Elements................................................................. 12 I.1.2. Importer Declaration and Field Elements ...................................................14 I.1.3. Single Window Messaging Formats ........................................................... 16 I.1.4. Automated System for Customs Data (ASYCUDA) ................................... 17 I.1.5. Other Considerations for Internal Data ....................................................... 17 I.2. External Sources of Information ............................................................................ 18 I.2.1. National Sources .......................................................................................... 19 I.2.2. International Sources .................................................................................. 20 I.2.3. Open Sources .............................................................................................. 22 SYNTHESIS OF THE UNIT .............................................................................................. 25 UNIT II. DATA EXPLOITATION: SYSTEMS AND APPLICATIONS FOR RISK ASSESSMENT ................................................................................................ 26 Learning Objectives ...................................................................................................... 26 II.1. Unit Introduction .................................................................................................... 27

Customs Risk Management. 1st Edition

Module 4

II.2. Data Processing Lifecycle ...................................................................................... 29 II.3. Three Types of Analytical Approaches .................................................................. 30 II.3.1. Deductive .................................................................................................... 30 II.3.2. Inductive ..................................................................................................... 32 II.3.3. Predictive.................................................................................................... 33 II.3.4. Summary .................................................................................................... 35 II.4. Selectivity Using Automated Risk Analysis and Targeting ................................... 36 II.5. Data Quality .............................................................................................................41 II.6. Historical Trend Analysis........................................................................................ 42 II.7. Data Mining ............................................................................................................ 45 II.8. Network Models .................................................................................................... 50 SYNTHESIS OF THE UNIT ............................................................................................... 51 UNIT III. PREDICTIVE MODELLING .............................................................................. 52 Learning Objectives ...................................................................................................... 52 III.1. Probabilistic Models .............................................................................................. 52 III.2. Deterministic models ............................................................................................ 55 III.3. Silent Alerts ........................................................................................................... 57 III.4. Random Control Module ...................................................................................... 58 SYNTHESIS OF THE UNIT .............................................................................................. 59

Complementary Material .............................................................................................. 60 Bibliography .................................................................................................................. 60

Customs Risk Management. 1st Edition

Module 4

List of Tables Table 1. UN Edifact CUSCAR (Cargo Reporting) data fields ......................................... 12 Table 2. UN Edifact CUSDEC (Importer Declaration) data fields .................................14 Table 3. Examples of open source reference data ...................................................... 23

List of Figures Figure 1. Supply chain stages and example data sets ................................................... 11 Figure 2. The ASYCUDA++ selectivity module.............................................................. 28 Figure 3. Typical Data Processing Lifecycle.................................................................. 30 Figure 4. Three types of analytical approaches for defining risk ................................ 36 Figure 5. Example of a decision tree ............................................................................ 49

Glossary n WCO: World Customs Organization. n CEN: Customs Enforcement Network. n RILO: Regional Intelligence Liaison Office. n CRMS: Customs Risk Management System. n MS: Member State of the European Union. n IPR: Infringement Protection Right. n ENS: Entry Summary Declaration. n AEAT: State Tax Administration Agency, Spain. n SCC: European Union Community Customs Code. n RMS: Risk Management System.

Customs Risk Management

Module 4

Module Introduction Customs in the 21st century must deal with a world dominated by information and new technologies that make it indispensable to incorporate modern tools and instruments to enable and enhance the process of managing risk. In this module, we will introduce various risk assessment methodologies and approaches that have a direct and/or indirect impact on the task of controlling and facilitating trade. A key element refers to the information sources used. This is a critical component of any system, as the entire risk management process depends on quality information. However, not all sources can be considered equally reliable, so they need to be selected and classified according to their source. Secondly, the use of computerized tools is vital in an electronically managed service like customs, both for the systematic exploitation of data obtained from different sources and for the introduction of risk profiles to select which electronic declarations will be subject to control. In principle, the right data is required at the right time to virtualize the border and exploit the data using sound analytical techniques. In fact, many experts recommend that customs administrations: 1. Further cultivate selectivity using sound automated risk analysis and targeting. 2. Conduct post-clearance audit to monitor systemic processing and adjust risk profiles. 3. Integrate new expert systems for anti-smuggling. Without a risk management system driving the customs decision- making and feeding information back into the system, customs will always be chasing trader misconduct, instead of identifying and preventing that misconduct before it happens. 6

Customs Risk Management

Module 4

Historically, many customs administrations have used risk adverse approaches requiring a full inspection of all shipments, conveyances, crews and passengers. While this â&#x20AC;&#x153;gatekeeperâ&#x20AC;? approach was often legislated, or regulated (i.e. 100% inspection required by law) it is clear in hindsight that approach has the following shortcomings: n Costly in resources as it applies the same degree of intensity to all threats. n Constrained in that it forces a lower degree of inspection intensity overall

due to a uniform treatment of all cargo and passengers. n Creates a high incidence of officer errors due to higher workloads. n Realizes fewer enforcement results . n Encourages normally law-adhering entities to circumvent the system to

hasten the cross-border transit of their goods. n Creates opportunities for criminals to circumvent and avoid interdiction by

making customs reactions predictable. n Slows the supply chain. n Hinders economic growth. n Does not scale. n Fails ultimately to achieve efficient, secure border management.

As discussed in other modules within this training, revenue evasion is only one of many threats occurring at the border. Others include security, narcotics, sanitary and phytosanitary safety, health, agricultural and environmental impact, commercial disruption, chemical weapons precursors, dual use goods, prohibited items, weapons and ammunition, intellectual property, endangered species, antidumping, and more. It becomes important to think about how data can be exploited to identify any one of these threats alone or in tandem with others.

Customs Risk Management

Module 4

General Objectives of the Module The general objective of this module is to help participants to identify methodologies, approaches, and tools that can improve operational risk management decisions both from the perspective of the transactional inputs that feed into the system and the applications that can be used to exploit and provide an accurate risk determination.

Learning-Oriented Questions n What information sources should customs authorities use to determine the

risk associated with cargo or passengers? n How reliable are these information sources? n What kinds of analytical approaches can be applied for risk assessment

purposes? n What is the difference between deductive and inductive logic? n How important is data quality for risk assessment purposes? n What are the important functions of a risk assessment system? n Are random controls necessary or should they be replaced as the risk

management system improves?

Customs Risk Management

Module 4

UNIT I INFORMATION ACCESS

Learning Objectives In this unit we will discuss the importance of information for ensuring effective risk analysis and for detecting, correcting, preventing or limiting the effects of the threats customs seeks to prevent. At the end of the unit, participants will be able to: n Classify the different types and sources of information that can be used for

risk assessment purposes. n Understand and discuss a â&#x20AC;&#x153;Data Ontologyâ&#x20AC;? that can be used to augment

border visibility and improve risk assessment capabilities. n Identify the need for quality data. n Understand that an efficient risk management system depends on its

inputs. n Recognize the advantages of obtaining trade related data in advance of

arrival for risk assessment purposes.

I.1. Trade Data (Regulatory Data) Most Customs Administrations establish border and supply chain visibility by regulating two core transactions with the trading industry:

Customs Risk Management

Module 4

n Importer Declaration: An importer declaration is generally filed into a

commercial trade database maintained by customs. This data is used primarily for collection of duties, taxes, and tariffs and for reasons of admissibility. This transaction is key to determine the Harmonized Tarrif System Classification, origin of the goods, and valuation. The electronic UN/EDIFACT message format for an importer declaration is called “CUSDEC”. n Cargo Report: In most customs jurisdictions, the carrier (or transporter) of

the goods is required to present a report or manifest of all cargoes on board the conveyance. Manifest or bill level data is a good overview of the inbound shipment but the data is usually less detailed then found on an importer declaration. This level of data is often shared between supply chain partners (e.g. shippers, consignees, notify parties, importers, exporters, carriers, freight forwarders, brokers, etc.) to account for the goods on board the conveyance, transfer liability, or invoice for payment for the carriage of goods (e.g. “bill” of lading). The electronic UN/EDIFACT message format for a cargo report is called “CUSCAR”. Cargo reporting is often made available or presented to customs before arrival of the goods. Importer declarations are generally presented at arrival of the goods making it difficult to assess the risk on all shipments arriving at arrival. In principle, customs should obtain data pre-arrival and perform a risk assessment before the goods arrive in order to accommodate resource planning and other logistics needed to inspect the goods at the first point of operational intervention. In some countries including the United States, Canada, Japan, and the European Union, the cargo report is regulated to be presented 24 hours before loading for marine shipments and “wheels up” for air cargo shipments. Land border commercial shipments are generally reported 1-2 hours pre-arrival. In doing so, the most serious threats (terrorism- and security-related) can be identified and prevented from being laden on the conveyance or possibly denied entry into sovereign territory if and when

Customs Risk Management

Module 4

required. Advance commercial information guidelines can help a customs administration acquire key data for visibility and risk assessment well in advance of arrival of the goods at the physical border. Other transactions are sometimes regulated and acquired from the trading community to be used by specific customs administrations. Examples include, house bills/supplementary cargo reports, bayplans/stow-plans, container status messages, and importer security filings. Supply chain visibility can be enhanced with this data fill in the missing gaps for information that is not contained on an importer declaration or cargo report. The following diagram demonstrates the various stages of the supply chain and â&#x20AC;&#x153;whenâ&#x20AC;? certain data sets are created as a shipment journeys from origin to destination: Figure 1. Supply chain stages and example data sets

Source: GreenLine Systems Inc. 2008

The next diagram depicts the standardized WCO data model data fields available from a cargo report and an importer declaration. Does your customs administration 11

Customs Risk Management

Module 4

use the same reporting transactions? Are they standardized with the WCO data model? Do you use one transaction or both to assess the risk presented with goods destined to your country? Which elements are key to identify suspicious activity or behaviour for a possible smuggling attempt? Please review and gain a good understanding of the data that is filed with customs from the trading community.

I.1.1. Cargo Report and Field Elements Table 1. UN Edifact CUSCAR (Cargo Reporting) data fields 016

UCR

064

Country(ies) of routing, coded

085

First port of arrival, coded

098

Transport charges method of payment, coded Brief cargo description Conveyance reference number

138 149

152 159

165 172

Equipment size and type identification Equipment identification number Seal number Date and time of arrival at first port

Unique number assigned to goods being subject to cross-border transactions. Identification of a country through which goods or passengers are routed between the country of original departure and final destination. To identify the first arrival location. This would be a port for sea, airport for air and border post for land crossing. Code specifying the payment method for transport charges.

Plain language description of the cargo of a means of transport, in general terms only. To identify a journey of a means of transport, for example voyage number, flight number, trip number. Code specifying the characteristics, i.e. size and type of a piece of transport equipment. Marks (letters and/or numbers) which identify equipment e.g. unit load device.

The identification number of a seal affixed to a piece of transport equipment. Date and time / scheduled date and time of arrival of means of transport at (for air) first

X X

Customs Risk Management

239

of arrival in Customs territory Street and number/P.O. Box

241 242

City name Country, coded

243

Country sub-entity name Country sub-entity identification Postcode identification Office of exit, coded

244 245 G005

L009

L010

R011 R012 T005

T014

Module 4

airport, (land) arrival at first border post and (sea) arrival at first port, coded. Specification of the postal delivery point such as street and number or post office box. Name of a city. Identification of the name of the country or other geographical entity as specified in ISO 3166 and UN/ECE Rec 3. Name of a country subdivision. Code specifying the name of a country subdivision. Code specifying a postal zone or address.

To identify the regulatory office at which the goods leave or are intended to leave the customs territory of despatch. Place of loading Name of a seaport, airport, freight terminal, rail station or other place at which goods are loaded onto the means of transport being used for their carriage. Place of loading, To identify a seaport, airport, freight coded terminal, rail station or other place at which goods are loaded onto the means of transport being used for their carriage. Carrier - name Name [and address] of party providing the transport of goods between named points. Carrier identification To identify a party providing the transport of goods between named points. Identification of Name to identify the means of transport means of transport used in crossing the border. crossing the border Nationality of Nationality of the active means of transport means of transport used in crossing the border, coded. crossing the border, coded

X X

X X X X

X X X

Customs Risk Management

Module 4

I.1.2. Importer Declaration and Field Elements Table 2. UN Edifact CUSDEC (Importer Declaration) data fields 016 064

109 131

135 137

141 144

145

152

159 165 239

241 242

UCR

Unique number assigned to goods being subject to cross-border transactions. Country(ies) of Identification of a country through which routing, coded goods or passengers are routed between the country of original departure and final destination. Total invoice amount Total of all invoice amounts declared in a single declaration. Total gross weight Weight (mass) of goods including packaging but excluding the carrier's equipment for a declaration. Currency, coded Code specifying a monetary unit or currency. Description of goods Plain language description of the nature of a goods item sufficient to identify it for customs, statistical or transport purposes. Type of packages Code specifying the type of package of an identification, coded item. Number of packages Number of individual items packaged in such a way that they cannot be divided without first undoing the packing. Commodity The non-commercial categorization of a classification commodity by a standard-setting organization. Equipment size and Code specifying the characteristics, i.e. type identification size and type of a piece of transport equipment. Equipment Marks (letters and/or numbers) which identification number identify equipment e.g. unit load device. Seal number The identification number of a seal affixed to a piece of transport equipment. Street and Specification of the postal delivery point number/P.O. Box such as street and number or post office box. City name Name of a city. Country, coded Identification of the name of the country or other geographical entity as specified in ISO 3166 and UN/ECE Rec 3

X X

X X X

X X

Customs Risk Management

243 244 245 337

Country sub-entity name Country sub-entity identification Postcode identification Commodity classification type

R003

Agent - name

R004

Agent, coded

R005 R011

Role Code Carrier - name

R012

Carrier identification

R014

Consignee - name

R015

Consignee, coded

R020

Consignor - name

R021

Consignor, coded

R024

Vanning party

R027

Deliver to party

Module 4

Name of a country subdivision.

Code specifying the name of a country subdivision. Code specifying a postal zone or address.

A qualifier to describe the commodity classification, e.g. Harmonized Tariff Schedule (HTS), Export Control Classification Code (ECCC), UNDG Code list, International Code of Zoological Nomenclature (ICZN). Name and address of a party authorised to act on behalf of another party. Identification of a party authorised to act on behalf of another party. Code giving specific meaning to a party. Name [and address] of party providing the transport of goods between named points. To identify a party providing the transport of goods between named points. Name [and address] of party to which goods are consigned. Identifier of party to which goods are consigned. Name [and address] of the party consigning goods as stipulated in the transport contract by the party ordering transport. To identify the party consigning goods as stipulated in the transport contract by the party ordering transport. Name [and address] of the party at whose physical location the goods are loaded into the transport equipment. Name and address of the party to which goods are to be delivered. Address, region and/or country as required by national legislation or according to national requirements.

X X X X

Customs Risk Management

R031

Exporter - name

R032

Exporter, coded

R037

Importer - name

R038

Importer, coded

R045

Notify party

R046

Notify party, coded

Module 4

Name [and address] of party who makes or on whose behalf - the export declaration - is made - and who is the owner of the goods or has similar right of disposal over them at the time when the declaration is accepted. To identify the name and address of the party who makes, or on whose behalf the export declaration is made, and who is the owner of the goods or has similar rights of disposal over them at the time when the declaration is accepted. Name [and address] of party who makes or on whose behalf a Customs clearing agent or other authorized person makes an import declaration. This may include a person who has possession of the goods or to whom the goods are consigned. Identifier of party who makes - or on whose behalf a Customs clearing agent or other authorised person makes - an import declaration. This may include a person who has possession of the goods or to whom the goods are consigned. Name [and address] of party to be notified. Identification of a party to be notified.

X X

I.1.3. Single Window Messaging Formats For countries operating in a single window environment, a new type of electronic message called the Government Cross-Border Regulatory message (GOVCBR) permits a declarant to submit a legally required declaration or other regulatory information to a cross-border regulatory agency. It also permits the transfer of response data from a cross-border regulatory agency to the declarant. It further permits cross-border regulatory agencies to share information included in the declaration among national and international government agencies. In all three scenarios, the GOVCBR is meant to be used in relation to import, export or transit

Customs Risk Management

Module 4

processes for the following functions, either separately or in combination: to report the declaration of goods, to report the reporting of cargo, the reporting of transport equipment and conveyance, and the reporting of crew.

I.1.4. Automated System for Customs Data (ASYCUDA) Ninety countries today operate a system built by the United Nations Conference for Trade and Development (UNCTAD) called ASYCUDA. A recent version of the system called “ASYCUDA World”, allows traders to file electronic transactions to meet regulatory requirements of customs. The system provides some capabilities for accounting of duties and taxes and commercial import processing but is limited in its ability to assess the risk associated with the cross-border movement of goods. The data used in ASYCUDA and other entry level solutions is a Single Administrative Document (SAD) transaction that acts as an import or export declaration, and is normally standardized with the WCO data model and the UN/EDIFACT message for “CUSDEC”. Visibility is often enhanced with manifests or cargo reports provided by the carriers. This cargo reporting is often standardized using the WCO data model and the UN/EDIFACT message for “CUSCAR”. In some countries, ASYCUDA will be the transactional filing database for importers and carriers, and as such houses the regulatory trade data needed for risk assessment purposes.

I.1.5. Other Considerations for Internal Data The regulatory trade data noted above should be the core information that analysts use to make decisions for 1) identifying high risk trade for closer scrutiny or inspection; and 2) facilitating pre-approved and/or low risk shipments. It is these twinned goals and objectives that support the principles of risk management for border management.

Customs Risk Management

Module 4

Importers and carriers are normally obliged to comply with the laws and regulations under the Customs Act within a sovereign territory. Internal sources often can provide data directly from the commercial trade databases managed by a customs authority, based on the information contained in the different types of declarationsâ&#x20AC;&#x201D;information, payment of tariff duties, requests for authorizations, etc. The reach and scope of these trade databases can greatly depend on the organizational structure of the government body the Customs service is housed in. For example, Customs may fall under the same entity as the authorities responsible for management, collection and inspection of internal taxesâ&#x20AC;&#x201D;either direct (e.g. income and property taxes applied to both private individuals and legal entities alike) or indirect (e.g. taxes on consumption)â&#x20AC;&#x201D;or be completely independent from the internal tax administration. In any case, and regardless of the organizational model adopted nationwide, customs should have access to all tax-related information. It is important to bear in mind that foreign trade is just one additional economic activity and those operators who commit violations against domestic tax law or other regulatory requirements become higher risk of violating foreign trade regulations, and vice versa. Similarly, the foreign or domestic transactions of an economic operator must be consistent and coherent, and as such, crosschecking its domestic tax records with its customs records may help to detect potential irregularities.

I.2. External Sources of Information In contrast with their internal counterparts, external sources correspond to databases that are not managed by customs authorities and therefore must be made available to them. These sources include databases from other government authorities, whether national or international, and data not originating in an official agency, which may be 18

Customs Risk Management

Module 4

accessed freely or under certain conditions (for example, by signing in as a user and entering a password, with or without payment). For clarity purposes, we will distinguish three types of external sources.

I.2.1. National Sources The exact scope of customs authorities typically changes from one country to another, so it is only logical to think that sources will also change. Still, national sources may be defined as any information facilitated by a national authority other than Customs that may be useful for managing risk. The information may be provided on a one-time or regular basis by exchanging whole databases or specific data, or by granting access to the databases of other authorities, as is the case in Spain, where customs authorities have access to databases that contain health-related irregularities. As an example of one-time information we can cite the case of a warning issued by health authorities to all border enforcement agencies in relation to an outbreak of horse flu in Country X, which requires the enactment of exceptional measures regarding imports from that country or related to it (neighboring or transit countries). In the case of regular or systematic information exchange, a good example is the reporting by the relevant authorities of all licenses or certificates issued as well as those denied. The reason is that operators whose transactions have been rejected may attempt to introduce or export the goods in another shipment, but altering the declaration. The quality of this information should be considered optimal, as it comes from official entities that have no second interests.

Customs Risk Management

Module 4

I.2.2. International Sources International external information sources are those from government agencies or authorities from other countries, which establish collaboration mechanisms to increase the amount of inputs to feed the national risk management system. The quality of the information received is high, as it obeys to agreements that, among other things, specify the type of information to be facilitated. In module 2 we covered a number of national solutions to coordinate all border management agencies using a single window system. In this module, we will focus our attention on international collaboration and cooperation from a security perspective. Several multi-national agencies have designed and developed tools or systems to promote the exchange of information among several national customs authorities. The WCOâ&#x20AC;&#x2122;s Customs Enforcement Network (CEN) is defined as a global network for exchanging information among customs authorities around the world. It manages data related to illicit activities, so it may be used to exchange information on potential seizures. CEN may also serve to advance coordination among participating customs authorities for a certain period of time to address a specific risk type. These collaborative efforts not only promote the exchange of information, but also the alignment of control procedures, thus spreading the use of good practices and improving national risk management systems. Similarly, the WCO has developed the Regional Intelligence Liaison Office (RILO) in ten regional points around the world, each of which also includes National Contact Points (NCPs). Their purpose is to provide a liaison between customs authorities of the same region in order to facilitate information exchange and cooperation. For its part, the European Union has developed a number of software applications allowing customs to share information on seizures, send alerts, implement joint databases or request information.

Customs Risk Management

Module 4

As examples, the European Union makes the following systems and databases to EU Customs Authorities: n CIGINFO: System for the exchange of information on the seizure of tobacco

products. n MARINFO or YACHTINFO: System for the exchange of information on the

seizure of drugs. n RIF: System for the exchange of information on financial irregularities. n FIDE: System for the recording of information related to ongoing

investigations by various European entities with a view to coordinate actions. It also allows uploading information that may be useful to other administrations. A quick alert communication system has been implemented through the Customs Risk Management System (CRMS) application, which informs customs authorities through different national contacts of a threat that may affect all or most member states. For example, the quick alert system was utilized during the Fukushima nuclear accident of March 11, 2011, which required all member states to coordinate the criteria for treating shipments from Japan after the accident. Concerning the use of common databases, member states feed information into European centralized databases that can be exploited jointly. For example, the European Anti-Fraud Office (OLAF) has developed information solutions for the exploitation of data regarding transit operations and financial irregularities. In the field of security, we can mention the Schengen II database, which includes information on people linked to criminal activities and may be accessed by European security agencies. Interpol and Europol are similar examples. The European Union has signed regulatory agreements for the exchange of information with third countries. Instances of this type of arrangements are the mutual recognition of known operators programs with Japan or the United States,

Customs Risk Management

Module 4

or the exchange of irregularities regarding IPR in the air transportation flows between the European Union and China, and vice versa. In the national sphere, although related to international cooperation, a number of solutions have been implemented to enhance collaboration among national authorities, positively impacting the selection and analysis of risks by customs authorities. For example: n Some countries have included customs attachĂŠs among their embassy

personnel to facilitate work with the country's customs authorities in matters of common interest. These kind of efforts increase trust and promote cooperation and common operations or interventions. n Exchange of information through regular feeding of data on matters agreed

to beforehand. Sometimes, checking the consistency between the exports declared by the sending country and the imports declared by the receiving country and vice versa can be very useful, as this type of exchange can help to identify pockets of fraudulent activity. This type of information can also prove its worth in investigations concerning the value or the illegal trade of tobacco products. So, when investigating the declared value, having access to the declared value at the country of origin is particularly valuable. Similarly, any differences in weight detected between the export and import declarations may be indicative of fraud.

I.2.3. Open Sources Open external sources are those available to the general public, including customs authorities, freely or through a subscription fee.

Customs Risk Management

Module 4

Table 3. Examples of open source reference data Dun & Bradstreet

D&B manages a commercial database with information on 100 million companies. Business information is gathered in over 200 countries, in 82 languages or dialects, covering 181 monetary currencies. The database is refreshed over 1.5 million times a day to provide accurate, comprehensive information for more than 150,000 customers. Data is obtained from impartial third party businesses and government sources.

Lexis Nexus

A third-party service of risk management services and data.

IMO Data

The official IMO registry can be aquired from IHS Fairplay (formally Lloyds) for all vessels over 100GRT. This accounts for over 150,000 global vessels. A network of 1200 Lloyds/IMO land-based receiver towers collecting AIS positional data in the largest ports of call by volume.

AIS Live

Lloyds Vigilance

Janes

OrbCom ComDev Exact earth ESRI

A competitive product to AIS Live, Lloyd's List has a separate land-based network of approximately 800 receivers positioned globally by gross tonnage movement of vessels. Military Subscription with description and details of Naval vessels and other foreign military assets by country. Satellite Data Provider of Vessel Positional data for Automated Information System (AIS). Satellite Data Provider of Vessel Positional data for Automated Information System (AIS). Satellite Data Provider of Vessel Positional data for Automated Information System (AIS). Global Information System for mapping and layering of map layers for visualization of data.

Google Maps

Map Repository

BING maps

Map Repository

Allbytes cargo data

Allbytes sells cargo and container movement data for 30-40 countries globally. 23

Customs Risk Management

Piers Cargo Data

Contraffic

Module 4

PIERS maintains a database of import and export information on cargoes moving through ports in the United States, Mexico, Latin America and Asia. PIERS collects data from over 25,000 bills of lading everyday. The European Union Joint Research Council has built a screen scraping application to pull all Container Status Messages from the Ocean Carrier Websites. The current repository exceeds 400M CSMs.

Reference data as noted in the above examples can provide new insight and information that can be linked to the transaction under review by an analyst. Addresses can be confirmed, or new suspicions can emerge if one discovers the importer is undergoing financial stress as a company, doing business as another suspect entity, or has filed for bankruptcy. When conducting research on the internet, it should be remembered that the information on the internet or written press is not always reliable and that it should be confirmed or corroborated against other types of information. Blogs or social media are cases in point. Still, customs administrations can greatly benefit from the information available by analyzing cases and taking the corresponding measures much faster than previously possible. For instance, in August 2015 there was a big explosion of highly toxic chemicals in the port of Tianjin, China. The toxic cloud could have affected the goods and equipment located in port at that time. But the media quickly spread the news globally, allowing customs authorities to take joint actions with other border enforcement agencies by building and equipping facilities especially dedicated for controlling risks to public health.

Customs Risk Management

Module 4

SYNTHESIS OF THE UNIT In this unit we have presented different sources of information that may be of help to implement effective risk management. We have seen that the quality of the information obtained varies according to its source. This must be borne in mind when assessing the convenience of utilizing it and the way in which it should be used.

Customs Risk Management

Module 4

UNIT II DATA EXPLOITATION: SYSTEMS AND APPLICATIONS FOR RISK ASSESSMENT

Learning Objectives The contents presented in this unit will allow participants to: n Recognize three different types of analytical approaches for determining

risk. n Understand the basic technical functions needed to accurately assess the

risk associated with the cross-border movement of goods. n Understand the need for using quality data, which presupposes a clear

definition of the objectives behind each transaction required from the trading community.

Customs Risk Management

Module 4

II.1. Unit Introduction This section will provide an overview of the landscape of risk assessment systems used by global customs administrations. It may be important to note that according to the World Trade Organization’s Trade Facilitation Agreement (TFA), each member country shall, to the extent possible, adopt and maintain a risk management system for customs control. The landscape of risk management technology solutions for global customs administrations varies widely. Smaller economies and lower GDP nations sometimes do not use risk-based decision-making at the border, and those that do use rudimentary approaches provided by the United Nations Conference on Trade and Development (UNCTAD) in the Automated System for Customs Data (ASYCUDA). Two versions of the system, ASYCUDA ++ and ASYCUDA World are now used in ninety developing nations around the globe. The data used in the larger economies includes declarations and cargo reporting in the same UN/EDIFACT and WCO data model formats, but this is often enhanced with additional supply chain data to improve end to end supply chain visibility, as well as improve the risk assessment capabilities. Examples include bayplans, container status messages, conveyance reporting, and more. This focus allows a customs administration to begin virtualizing the border, and has spawned centralized analytical units called National Targeting Centers or “NTCs.” Many experts believe developing administrations should be adopting risk assessment systems but the confusion and rudimentary functions introduced by UNCTAD in ASYCUDA has unfortunately delayed maturity to a suitable solution. As an example, the interface shown in the diagram below demonstrates how ASYCUDA targets shipments for inspection. The parameters for selectivity are based on a random generation of percentage. No intelligence products are used to drive decisions in the system. As demonstrated in this example, ASYCUDA simply includes

Customs Risk Management

Module 4

rudimentary functions to attempt to solve a need for more complex decision making problems. Figure 2. The ASYCUDA ++ selectivity module

Source: ASYCUDA++ Functional Manual V1.15, UNCTAD.

Higher tier GDP nations and larger economies develop more robust targeting and selectivity solutions which become the core decision-making tool to identify high risk commercial shipments before arrival at the border. These systems are designed to automate the use of intelligence products including lookouts, watch-lists, and alerts with a layer of known profiles, intelligence indicators, or risk indicators which are automated as configurable business rules. Recognizing these are all products of intelligence generated by strategic post seizure analysis or other intelligence gathering disciplines, this information becomes â&#x20AC;&#x153;intelligenceâ&#x20AC;? after being corroborated with other sources to predict an outcome. The products are then automated and used in a risk assessment or targeting system to identify shipments of interest for closer scrutiny or inspection. Examples include

Customs Risk Management

Module 4

the Automated Targeting System (ATS) used by US Customs and Border Protection, the TITAN system used by the Canada Border Services Agency, and the â&#x20AC;&#x153;Sempahoreâ&#x20AC;? System used by the UK Border Agency.

II.2. Data Processing Lifecycle In an operational targeting environment, the transactional data will normally be filed per regulatory requirements of a Customs Act. Carriers will be required to provide cargo reports (manifest / prime bill of lading level data) for all commercial shipments, and importers are normally required to file declaration level data for all importations. The data will normally be sent electronically by EDI, XML, flat files, FTP, or other. In some instances, Value Added Networks (VANs), and mailbox services are used to poll for data at regular intervals. This data generally goes through an electronic commerce platform where it is validated, and a confirmation of receipt is sent to the sender. Edit rules determine whether the data is correctly formatted and can be rejected when incomplete, egregious, or contains errors. In these instances, the data is re-submitted by the trader. Trade data is often cleaned and standardized on receipt by removing noise words and the standardizing commodity descriptions using the Harmonized Tariff System (HTS). Transactions and filings are linked for similar shipments using key elements like container number, declaration number, importer number, etc. Entities are linked to a common account, client index, or golden record. Common entities are also collapsed to one account as needed. Business rules can then be used to exploit the data for insight using deductive and inductive logic. A visualization layer is often presented to users to access additional detailed information by query, creation of cases, and other analyst functions. In some countries, the data is sometime segregated between operational databases (i.e.

Customs Risk Management

Module 4

ninety days) and historical databases (i.e. seven years) for management and BI reporting activities. A typical process flow for data integration/acquisition is presented in the following diagram: Figure 3. Typical Data Processing Lifecycle

Source TTEK Inc. (2017)

II.3. Three Types of Analytical Approaches II.3.1. Deductive Deductive reasoning uses generalized principles that are known to be true to a true and specific conclusion. Many security-focused and law enforcement organizations use a deductive approach to determine the risk associated with people, cargo, or conveyances.

Customs Risk Management

Module 4

Many agencies have watch-lists and lookouts for known criminal entities, addresses, names, dangerous commodities, and geographical areas of concern (origin). These “targets” are already pre-determined to be of concern to sovereign interests as a potential threat. Systematically these lists can be vetted using simple Boolean rule logic and flagged to analysts when found within transactional data. Lower GDP and developing nations embrace the use of deductive logic in rudimentary transactional systems including ASYCUDA World, and others. Most targeting and selectivity systems use an initial deductive approach, and it is seen as the initial layer of risk assessment. Here are two examples: Example 1: During an importation of foodstuffs from Thailand, the importer name, “Chiang Mai Banana Shop” is flagged as an entity of concern having been convicted of smuggling illegal migrants into Trinidad and Tobago in 2009. The container is referred for an inspection. Upon offload of the cargo, Customs identifies broken door seals, remnants of empty water bottles, food wrappers, two sleeping bags, a flashlight, and fecal matter near the nose of the container. Customs refers the case to immigration authorities who later identify and detain two suspect stowaways wandering the Tate and Lyle container terminal in port of Spain. Example 2: During an importation of 40 barrels of “chemical cleaning agents” in a 20’ dry van container, the Harmonized Tariff System (HTS) number identifies a possible line item commodity description as “arsenic trichloride” which falls under the Australia Group Chemical Weapons Precursor List. The container is referred and detained pending an investigation on the consignee and delivery address, and potential permit violation. In these instances, Customs already has pre-determined the entity or the commodity is a potential threat. As such, this becomes a simple vetting process against inbound data. When the lookout information is presented, the transaction is flagged to an analyst for action.

Customs Risk Management

Module 4

II.3.2. Inductive Inductive reasoning starts with a conclusion and deductive reasoning starts with a premise. Inductive reasoning moves from specific instances into a generalized conclusion. While the generation of intelligence often uses a deductive model, many experts believe that successful targeting systems employ a process of triage to eliminate low risk shipments from view with a narrowing process that continues to lead to an outcome that may suggest the pending threat is a general smuggling event. This could be a narcotics smuggling attempt, endangered species, or IPR infringement as examples. Inductive systems use a business rules management system to manage and run risk indicator rules and a risk scoring logic, to rank transactional data in order of risk (High/Medium/Low). This approach should also be used to refer shipments of interest for closer scrutiny. This may include a documentation check, physical inspection, or both. Results of inspections are collected and used to validate the reasons for selectivity. This ensures that the system is always updated with the latest smuggling trends. The following is an example of a targeting system that uses inductive logic: Example 3: The Vessel Maersk Pusan arrives in Dubai, Jebel Ali Terminal 1 and files a cargo manifest. The NTC system scores the transaction as 163pts/Red/High Risk due to the following: n Place of receipt = Cali Columbia (source country for Cocaine) n Port of load = Buenaventura Columbia (source country for Cocaine) n Container transshipped /re-handled in Kingston Jamaica (port with weak

security measures) n Commodity = auto parts (known cover load)

Customs Risk Management

Module 4

n Reefer container (commodity inconsistent with container type) n Gross weight = 13,000 kg (less than 50% max payload) n One-to-one relationship between shipper and consignee (Maersk Logistics

consigned to Maersk Logistics.) n Delivery address = P.O. Box

The National Targeting Center (NTC) refers the container for a full off-load due to the suspicions presented within the data. The cargo inspection is non-resultant yet upon closer scrutiny of the internal reefer unit, 61 kg of cocaine are found concealed within. Customs seizes the drugs, and attempts a controlled delivery with police.

II.3.3. Predictive A predictive model draws upon all available historical data in the transactional database, and forms relationships with the data on file linked to all historical seizures, penalties, forced payments, enforcement actions, and other resultant inspections. This analytics tooling provides a wide variety of statistical (linear and nonlinear modelling, classical statistical tests, time-series analysis, classification, clustering, etc.) and graphical techniques. Once a predictive model is established on a large volume of data (e.g. more than 5+ years) the model should be re-run on the inbound data (i.e. all data reported on file in the last 24-48 hours) and any shipments that are deemed a match, should be flagged to the analysts for referral to an interdiction or inspection team or referred automatically for inspection. While healthcare and finance industries are embracing an approach of predictive modelling, there is no known customs, transportation security agency, or port authority felt to be utilizing this form of analytics on top of supply chain data. Chinese customs has recently announced success in this area. Canada and New Zealand are also achieving results but have not fully migrated the approach into production.

Customs Risk Management

Module 4

Challenges in this area include: n Establishing a data warehouse environment of historical transactions. n Baselining and an agreement on a definition of common enforcement

actions with stakeholders. n Automating the re-running of the predictive model on inbound data as a

machine learning process. The following is an example scenario using predictive analysis: Example 4: In 2019, the NTC determines all significant enforcement actions to include: n Cargo control violations exceeding $1,200 in penalty. n Smuggled goods exceeding $1,200 evasion in duties and taxes. n All narcotics seizures. n All monetary seizures greater than $10,000 in cash. n All weapons and ammunition seizures. n All CITES infractions. n All prohibited items seized.

A data environment is established in MSQL to house the last seven years of import declarations and cargo reports. Strategic Analysts and Data Scientists use the SPSS Clementine Statistical Mining Application to establish a predictive model using a quantitative approach for historical trend analysis. NTC engineers then architect a process to re-run the model against all inbound data (about 14,000 transactions on file in the last 24 hours). Two in-transit containers destined to Cali, Columbia are identified as a match and flagged to the NTC operations analysts on shift. The NTC analysts refer the 2 x 20â&#x20AC;&#x2122; containers for inspection. Scanner teams image the contents of both containers. One container has an anomaly in the image near the front of the container. Upon offload the 20â&#x20AC;&#x2122; container is measured and found to be only 18â&#x20AC;&#x2122; in length. Upon closer scrutiny,

Customs Risk Management

Module 4

the container appears to have a false wall and 2â&#x20AC;&#x2122; void. The wall is dismantled and reveals $749,000 in cash.

II.3.4. Summary The three analytical approaches can be applied seperately or together. Most inductive systems easily run a deductive process as watch-list vetting is a natural function nested within these applications. Most countries run an introductory deductive logic for watch-list and lookout vetting at the border. The future of risk-based technologies will use machine learning concepts for predictive analytics and predictive modelling. Already heralded by companies like Google and IBM, cognitive analytics are being successfully employed in health care, retail online sales, finance, banking, credit card transactions, and other industries. With high costs that exceed tens of millions of dollars, the challenge becomes how to introduce cognitive computing for all border agencies in a cost-effective manner. The following diagram attempts to illustrate the value chain of adding more complex analytical functions to a risk assessment process.

Customs Risk Management

Module 4

Figure 4. Three types of analytical approaches for defining risk

Source TTEK Inc. (2017)

II.4. Selectivity Using Automated Risk Analysis and Targeting A robust risk management system uses both deductive and inductive logic to identify and select high risk cargo for closer scrutiny or inspection on arrival. A system that automates this targeting and selectivity should process all manifest and import data filed by the trading community within Haiti commercial systems. As mentioned, inductive reasoning moves from specific instances into a generalized conclusion, while deductive reasoning moves from generalized principles that are known to be true to a true and specific conclusion. Successful targeting systems employ a process of triage to eliminate low risk shipments from view with a narrowing process that continues to lead to an outcome that

Customs Risk Management

Module 4

may suggest the pending threat is a general smuggling event. This could be a narcotics smuggling attempt, endangered species, or IPR infringement as examples. In principle, the system should automatically risk assess all manifest and importer data when filed by the appropriate trade chain partner and present the associated shipments in order of risk for review by analysts. In addition to the profiles established through the analysis of post-clearance historical data, the system should be augmented with WCO Standardized Risk Assessments (SRAs). These SRAs have been developed and based on the WCO SAFE Framework, Standardized Risk Assessments (SRAs) and Global High Risk Indicator Document (GHRI) and designed to trigger and identify on the risks associated with the WCO SRAs which include: n Revenue evasion. n Security items. n Narcotics. n Mode of transport. n Other threats.

The system should use an inductive logic to tier the manifest and declaration data in order of high, medium, and low risk scores. This will facilitate the triage of the data by an analyst or customs officer (manually or through an automated threshold score established by Customs). Presenting the data in this manner allows Customs to ensure its officers are focused on the highest risk trade while pre-approved and/or low risk trade can be facilitated. The officer has the ability to work the data manually through an analytical workflow and refer high risk shipments for inspection to examination teams or other customs officers. Results should be collected in an inspection template and held on file for historical query and future analytical usage. This approach has been proven to be highly successful in identifying and interdicting threats upon arrival at a port of entry. Additionally, it has the flexibility of automating

Customs Risk Management

Module 4

referrals for inspection through threshold scores, or establishing a team of analysts to triage through the data and manually decide which shipments will be inspected. The system should also be used to refer shipments of interest for closer scrutiny. This may include a documentation check, physical inspection, or both. Results of inspections are collected and used to validate the reasons for selectivity. This ensures that the system is always updated with the latest smuggling trends. To enable risk-based decisions at the border, customs administrations should deploy a risk assessment /risk management system that provides an end-to-end risk management and inspection system in an easy-to-use graphical user interface (GUI). The foundation should be based on inductive reasoning and use a logical workflow that delineates roles and responsibilities to ensure that the right people have the right information at the right time to mitigate vulnerabilities and security threats. The system should be easily integrated with other systems, including legacy solutions, and has the capability to extend its core functionality via interfaces with other application and tools. Inherent to its core structure, the CTS solution should have the following components to meet the requirements. n Data Extraction and Management

Methods that provide the integration of customs transactions and other historical data objects, both current and historical, into the RMS. n Risk Assessment Framework

A configurable set of parameters that supports the risk assessment process and provides the foundation for the selectivity and inspection processes. n Pre-Clearance Risk Assessment

Tools that provide end-to-end transparency of the risk assessment and inspection processes via operational content and pre-clearance risk analysis profiles.

Customs Risk Management

Module 4

n Post-Clearance Risk Analysis

Audit-based analysis functionality utilized to determine candidates for new risk profiles and selectivity profiles that will target future transactions. n Control and Case Management

A mechanism that allows for the management of an electronic dossier of tasks, case files, activities, and findings relating to pre- and post-clearance controls. n Selectivity Profiling

A mechanism that allows for the selection of desired inbound transactions based on pre-defined selectivity profiles using the view manager capability. n Business Intelligence and Reporting

The view manager that provides comprehensive data extraction and robust reporting capabilities. The system should include a module to collect enterprise data and maintain the integrity of databases needed for the risk management process. This module provides customs with the flexibility and adaptability to integrate with its current platform or external applications and customize it with visualization components, workflows, user-oriented capabilities and data models. Any number of events happening in a customs or trade platform (e.g. ASYCUDA World) may trigger the need for risk assessment. Typically, this will include new transactions being submitted to the system, existing transactions being updated with new data, or transactions being processed through various stages of the life-cycle. The RMS should provide for a robust and highly configurable risk process to identify transactions for inspection or release. After a completed risk infrastructure has been established, customs should have the ability to easily identify anomalous patterns and target specific behaviors, such as:

Customs Risk Management

Module 4

n ENTITY RELATIONSHIPS

First time relationships between shipper and consignee / importer.

ii.

New or low volume importers and carriers.

n COMMODITIES

High risk cover loads.

ii.

First time importer has imported a commodity.

iii.

Valuation that is inconsistent with the commodity type (e.g. by HTS code or description).

iv.

Origin inconsistent with the commodity type (e.g. by HTS code and country OR region).

n GEOGRAPHY

Cargo routing is inconsistent based on historical ports stops and transits.

ii.

Goods have been exported from a high risk country.

n MODE OF TRANSPORT

First time an importer has used an air or marine port of entry to import goods.

ii.

Maximum payload weight is inconsistent with the commodity type.

As described in the examples, customs should be able to identify suspect shipments or entities that are attempting to evade paying applicable monies, mis-declare goods, under-report, or import smuggled threats and contraband. Customs should also have the capability to fully modify its risk infrastructure on-demand. The approach to risk identification should reduce redundant and duplicate efforts by focusing customs on only those threats and interests of importance to the vision and mission. While targeting and selectivity decisions will be made in the RMS and high risk shipments referred for inspection, the outcomes of those inspections must be reviewed periodically to determine how effective the risk indicators are in the envisioned RMS. For any shipments that were resultant for seizures or other enforcement actions, it is these transactions, that will be reviewed promptly by a strategic analyst or a risk

Customs Risk Management

Module 4

management committee. The reasons for referral including profiles/risk indicator rules, and risk scores, will be reviewed in detail, and vetted/confirmed. If the referral from the RMS confirms an enforcement outcome, then the analysts or risk management (RM) committee will recommend the successful profiles be increased in score. Conversely, for those shipments that were identified as high risk and obtained no results, then those profiles will have their scores reduced. Over time, an unsuccessful profile or risk indicator rule will be turned off.

II.5. Data Quality Achieving data quality standards for systematic assessment of risk is challenging. As menitoned earlier in this module in the data processing lifecyle, several processes help to ensure data quality for risk assessment purposes. Firstly, most data quality issues can be resovled with reporting policies for the trading community. Customs should take steps to hold outreach sessions with the trading community so they understand that certain common reporting language will not be accepted. Examples may include: n Commodity Descriptions reported as “Freight of all kinds”, “FAK”, “General

merchandise”, and “Said to contain” (vague commodity desciptions mask the true nature of the goods). n Consignees reported as fright forwarders or third-party logistics providers

(no ultimate consignee is being reported who will take physical possession of the goods upon arrival). Once the trade data is filed in many commercial systems, edit rules help to ensure the data is correctly submitted using a standard alpha/numeric formula with a set number of characters. As an example, a container number is standardized with a three alpha character set (known as a SCAC code) followed by six numeric and a seventh check

Customs Risk Management

Module 4

digit. The six numeric and check digit are used in a long division formula to determine whether the container number is correct or not. Some applications clean data by removing noise words (the, and, etc.) and others standardize free text into codes like the Harmonized Tariff System using Natural Language Processing (NLP). Finally, some applications resolve common entities to one standard name. Called “entity resolution”, this activity can become complex due to multi-language names and other variables. As such, a machine-learning process is applied to prompt close variations for a human to make the decision upon. Based on this action, the system learns from the decision and adjusts its linking algorithm accordingly.

II.6. Historical Trend Analysis While risk asssesment is a “front end” activity that takes place in real time to identify high risk shipments or passengers for closer scrutiny or inspection, historical trend analysis is a “back end” activity that helps to identify strategic outlooks, forecasting, and recuring known risk indicators or profiles. Learnings from historical trend analysis often become inductive risk indicator rules and profiles in the front end risk assesment system. The expansion in foreign trade and the multiplicity of information sources resulting from the development of new technologies have created an enormous volume of data that customs authorities can hardly manage without the right technology. This is where data analysis comes into play. It may be defined as a process aimed at inspecting, cleaning and transforming data to highlight useful information that helps to draw conclusions and guide decisions so as to "find the needle in the haystack". Data analysis is multifaceted and comprises different approaches and techniques that may be classified into two types of analysis:

Customs Risk Management

Module 4

a) Quantitative analysis, which includes: 1. Data cleansing to detect and fix inconsistencies that may result in duplicated or incorrect data. For example, if we want to analyze the history of drug seizures confiscated on flights from different origins in order to elaborate a risk profile or to adjust customs staffing depending on the severity of the risks detected, we will first have to verify that the information on each shipment is accurate and complete, and that it is not duplicated. The following table shows flights in red affected by some type of irregularity such as duplication, incomplete data or cell misplacement. Our first task will be to correct these errors to clean the table and ensure proper data analysis. AGE RANGE

SEX

FLIGHT

DAY OF WEEK

ARRIVING FROM

NATIONALITY

DRUGS

SYSTEM OF CONCEALMENT

21-30

TG666

Sunday

Colombia

Yes

On body

51-60

TG666

Saturday

Colombia

Ecuador

21-30

TG666

Monday

Colombia

Yes

51-60

TG666

Saturday

Colombia

Ecuador

On body

21-30

UA444

Tuesday

Mexico

31-40

UA444

Monday

Mexico

United States

31-40

AI555

Tuesday

Ecuador

Colombia

41-50

UA444

Monday

Mexico

United States

31-40

TG666

Monday

Colombia

Yes

Checked baggage

31-40

TG666

Monday

Colombia

Yes

Checked baggage

51-60

UA444

Monday

Mexico

21-30

TG666

Monday

Colombia

41-50

TG666

Saturday

Colombia

21-30

UA444

Sunday

Mexico

Spain

Yes

21-30

TG666

Monday

Colombia

21-30

UA444

Sunday

Mexico

Ghana

Yes

21-30

TG666

Tuesday

Colombia

Ecuador

21-30

TG666

Sunday

Colombia

Spain

Yes

Checked baggage

31-40

TG666

Monday

Colombia

Yes

On body

21-30

UA444

Monday

Mexico

Colombia

Yes

On body

UA444

Monday

Mexico

21-30

UA444

Monday

Mexico

Colombia

Yes

On body

31-40

TG666

Monday

Colombia

Colombian

Yes

Checked baggage

41-50

TG666

Sunday

Colombia

United States

AI555

Tuesday

Ecuador

United States

Hand luggage On body

Customs Risk Management

Module 4

AGE RANGE

SEX

FLIGHT

DAY OF WEEK

ARRIVING FROM

NATIONALITY

DRUGS

SYSTEM OF CONCEALMENT

21-30

TG666

Monday

Colombia

Yes

On body

21-30

UA444

Saturday

Mexico

Colombia

TG666

Saturday

Colombia

Mexico

TG666

Sunday

Colombia

Yes

AI555

Monday

Ecuador

Spain

25 45 36

TG666

Saturday

Colombia

Spain

41-50

UA444

Saturday

Mexico

Spain

UA444

Monday

Mexico

Ecuador

AI555

Tuesday

Ecuador

Ghana

UA444

Monday

Mexico

Ecuador

UA444

Saturday

Mexico

Ecuador

UA444

Sunday

Mexico

Spain

Yes

TG666

Saturday

Colombia

Mexico

UA444

Saturday

Mexico

TG666

Monday

Colombia

Yes

TG666

Tuesday

Colombia

Mexico

Checked baggage

Hand luggage

On body

Source: MartĂnez F. (2015)

2. Removal of atypical data if they contaminate the table (an atypical value is an observation that is numerically far from the rest), that is, data too far from the median value. In a chart, such data can be identified because most data appears close to a certain value while a small set is at a greater distance from such value. In these cases, these extreme values must be removed, as they may lead to erroneous conclusions when performing the data analysis. 3. Select a statistical test. In this case, the goal is to use different statistical variables such as mean, mode, median, typical deviation, etc. that help us identify certain characteristics of the population or data under study. 4. Applying the statistical program to the analysis means to decompose the whole set into its constituents, recompose it and observe the phenomenon through the measures applied. The objective is to establish combinations of the different variables considered crucial and, based on these combinations, obtain new results that will need to be analyzed. For example, in the flight table above,

Customs Risk Management

Module 4

the objective is to establish all possible combinations and then see which one obtains the best results. In other words, check the results obtained with each individual variable (day of week, age range, nationality, etc.), then combine variables in groups of two, then in groups of three, etc. so as to obtain a different result for each combination regarding positive and negative seizures. 5. Interpreting data. In this phase the objective is to draw conclusions from the data obtained in the previous phase. Following the example, the objective is to determine which combination of variables has the highest percentage of positive seizures. b) Qualitative analysis, which includes numerical and non-numerical or categorical variables (non-numerical means that no arithmetical operations can be performed with them). Qualitative analysis comprises the following phases: 1. Description: organizing information into matrices or figures. In this case, the goal is to provide a visual description that combines numerical and categorical data by means of double entry tables or charts (histograms, curves, etc.) to allow analysis or comparisons between them. 2. Comparison: Variable comparison studies contrast some values with the rest and interpret them. The result is an analysis of the different ways in which the information has been presented or organized so as to validate the conclusions obtained. Among the many different data analysis techniques available, we will focus our attention on the most important two: data mining and network models.

II.7. Data Mining There is abundant literature on data mining, which may be defined as a set of techniques and technologies that allow exploring large databases automatically or

Customs Risk Management

Module 4

semi-automatically, in hope of discovering patterns, trends or rules that explain data behavior in a given context. A typical data mining process consists of a number of sequential steps. Further details may be obtained by referring to the virtual library called Wikipedia: 1. Data selection: both regarding target variables (those that will be predicted, calculated or inferred) and independent variables (those that help to carry out the calculation) and the sampling of the registers available. In our flight table above, our data selection regarding the information on flights with positive and negative drug seizures will consist of choosing those variables (sex, age, nationality, origin, etc.) that may be significant, as well as the sample of flights that will be analyzed. It is important to select a sample that allows applying the conclusions obtained to the entire set of variables. 2. Data property analysis, especially histograms, dispersion charts, presence of atypical values and lack of data (negative values). This is part of the first stages of the qualitative analysis process described above. 3. Transformation of the set of entry data. This will be carried out in accordance with the previous analysis in order to prepare it for the application of the data mining technique that best adapts to the data and the problem. This stage is also known as pre-processing. The objective is to prepare the information for treatment. In our "drugs on commercial flightsâ&#x20AC;? example, it may be interesting to include age ranges. The passengerâ&#x20AC;&#x2122;s age will thus need to be expressed as an age range. 4. Select and apply data mining techniques to construct the prediction, classification and segmentation model. 5. Knowledge discovery. Through a data mining technique a knowledge model is obtained that represents behavioral patterns observed in the values of the variables used or associations among those variables. Several techniques may also be used simultaneously to generate different models, although each technique generally implies different data pre-processing. This phase will

Customs Risk Management

Module 4

allow utilizing the data sample to draw conclusions on the variables that constitute a material risk. 6. Data interpretation and assessment. Once the model has been obtained, it must be validated by verifying that its conclusions are valid and satisfactory. If several models have been obtained using different techniques, they will have to be compared in order to select the one that best fits the problem. If none of the models produces the expected results, one of the previous steps will need to be changed to generate new models. If the final model does not pass the test, then the whole process may be repeated from the beginning or from any of the previous steps, as appropriate. This feedback cycle may be conducted as many times as necessary, until a valid model is obtained. Once the model is validated and judged acceptable (results are appropriate and/or error margins are acceptable) it may be exploited. Models obtained through data mining techniques must be incorporated into customs' information analysis systems. Data mining techniques originated in artificial intelligence and statistics. In essence, they consist of algorithms with varying degrees of sophistication that are applied to a set of data in order to obtain certain results. The main techniques can be reviewed in Wikipedia under "Data mining". Some of them are described below: n Neural networks: Defined as a computer system modeled on the human

brain and nervous system. n Linear regression: This is the most common technique to establish

relationships between data. It is considered a quick and effective solution, though insufficient for multi-dimensional spaces where two or more variables may be related.

Customs Risk Management

Module 4

n Decision trees: A decision tree is a predictive model used in artificial

intelligence and predictive analysis. It uses a data base to make a graph of logic sequential decisions, very similar to rule-based predictive systems used to represent or categorize a series of conditions that happen in a sequential order, so as to provide a solution to a problem. Figure 2 illustrates this type of data mining. Starting with a set of declarations with a 5% of infractions detected, data is disaggregated into value and weight segments in order to determine the areas with the greatest errors with both variables. In the example, the largest percentage of infractions is for values under 16,794 and weights over 8,099. Therefore, and based on the information provided by our model, the risk profile defined will be more efficient if the value and weight variables are used in the segments mentioned than by using other variables or thresholds to select consignments for inspection.

Customs Risk Management

Module 4

Figure 5. Example of a decision tree

Source: WCO Risk Management Manual (2007)

n Statistical or econometric models: This is a symbolic expression in the form

of equality or equation used in all experimental designs and the regression to indicate the different factors that modify the response variable. n Clustering: This method is used to group together vectors according to

distance-based criteria. The goal is to arrange entry vectors so that they are closer to others with similar characteristics.

Customs Risk Management

Module 4

n Rules of association: These techniques are used to discover common facts

occurring within a certain set of data. Also, and in order to discover hidden behavioral patterns, the algorithms utilized may be supervised or unsupervised: n Supervised algorithms are those that help to predict unknown individual

data or sets of data from other known data. n Unsupervised algorithms are those that allow discovering patterns or

trends in the data collected. Regardless of the methodology employed, it is important to remember that we should work with two samples drawn from the same database so that we can use one to extract a model and the other one to test or validate the model. For example, when examining infractions of origin for a given consignment, we will take data from import declarations over a certain period and divide it in two, using a criterion of choice, such as the date of lodging. One of the samples will be processed to obtain a model permitting to discover a pattern that helps to identify potential fraud niches. The model will then be tested on the second sample to determine its validity and thus adopted or rejected for the selection of declarations lodged from that moment on.

II.8. Network Models Network models combine data analysis techniques for the exploitation of corporate databases with the information contained in open sources (public registers, social media, blogs, corporate information, etc.). This type of analysis supplements the analysis of internal databases with information taken from open online sources. For example, when classifying traders, one approach may be to crosscheck data from their compliance history stored in internal databases with online information

Customs Risk Management

Module 4

regarding their partners and administrators. Databases contain certain infractions committed by private individuals through legal entities. These same people may participate or manage companies located overseas. Network models allow identifying, through mass online research on corporate information, all those companies that may be linked to the ones in corporate databases, thus revealing a corporate frame that would be almost impossible to detect manually. With these models, results are instantaneous.

SYNTHESIS OF THE UNIT In this unit we have reviewed the importance of using quality data for proper risk management. We have also discussed systematic approaches available for data exploitation.

Customs Risk Management

Module 4

UNIT III PREDICTIVE MODELLING

Learning Objectives At the end of this unit, participants will be able to: n Identify the pros and cons of different solutions for defining existing risk

profiles. n Recognize the usefulness of random controls for the detection of emerging

fraud trends. n Recognize the existence of tools for managing alerts and acting without the

operator knowing.

III.1. Probabilistic Models Implementing risk profiles in computerized systems requires setting up the parameters used to identify the reference values for selecting the customs declarations to be controlled. Basically, these searches can consider an exact identity and/or the whole set of conditions considered in the risk profile, or a similar identity and/or weighing of all the conditions to get a final value. In the first case, we will be in the presence of a deterministic model, whereas in the second case the model will be probabilistic. 52

Customs Risk Management

Module 4

In probabilistic models, the risk profile is constructed using a relatively complex algorithm in which each of the variables utilized in its definition will be weighed differently, so each customs declaration will be assigned a different score. Depending on the scale adopted, a threshold will be defined to control customs declarations, either through documentary or physical inspections. For example, if a simple risk profile is defined with the following variables: n Type of operator (a): Weight 35% n Country of origin (b): Weight 20% n Type of goods (c): Weight 15% n Type of equipment (d): Weight 10% n Country of loading (e): Weight 15% n Delivery conditions (f): Weight 5%

the score for each type of declaration will be the result of the following type of algorithm: Y= (a*0,35)+(b*0,2)+(c*0,15)+(d*0,1)+(e*0,15)+(f*0,05)

The selection will operate once the declaration exceeds a certain level past which it will be subject to control or review. In some customs administrations, the criterion used is that past a certain score, the consignment will be subject to control. Declarations under another score will not be controlled. If the declaration falls anywhere between these two scores, it will be manually analyzed to determine whether control is warranted or not. In other administrations that have adopted this model, the score determines whether there will be no control, or if control will only affect the documentation or a physical inspection will be performed.

Customs Risk Management

Module 4

Obviously, before applying the model it will be necessary to define the thresholds past which controls will be warranted. In order to establish these thresholds, we must consider the potential impact on the customs workload as well as any possible delays due to an excessive number of controls. Another possibility is to let the analyst decide how many declarations should be controlled based on the thresholds she/he considers most appropriate and depending on the workload. However, this modality introduces a great deal of subjectivity. Probabilistic models are also established when we look for similarities between text fields in a declaration. This is often the case when looking for a name or an address that we know is involved in some kind of irregular activity and therefore requires controlling the shipments where the name appears as sender or recipient. One example of this type of tools is the Levenshtein distance, which compares the text we want to check against the text on the declaration and, based on the distance between them, assigns a similarity score. In this case, authorities will need to set a value past which the declaration will be selected, as it contains a name or address that is similar to the one sought. This type of tools prevents typographical errors in the declaration to be used as subterfuge for bypassing customs controls. However, establishing a percentage of similarity may bring about a high number of false positive cases if the threshold is too low or a lack of control if the value is too high. Experience in the implementation of these tools will help to determine the best percentages of similarities to reach balance. The value can be corrected upwards or downwards depending on the risk detected and the potential impact on the system.

Customs Risk Management

Module 4

III.2. Deterministic models Unlike probabilistic models, deterministic ones require an exact identity and the meeting of all conditions in order to select a declaration for control by customs authorities. If defining risk profiles with several different variables, the declarations selected for control will have met all conditions used to define the risk profile. For example, let us go back to our profile in the probabilistic model. n Type of operator (a): Private individual or limited liability entity. n Country of origin (b): China, Hong Kong, Malaysia. n Type of goods (c): Textiles or shoes. n Type of equipment (d): Container. n Country of loading (e): China, Hong Kong, Malaysia, Singapore or Thailand. n Delivery conditions (f): FOB.

In a deterministic context, customs declarations selected for control will be those that meet all six conditions defined, unlike the probabilistic model, which did not require all conditions to be met. Instead, each one was weighed in and added to obtain a final score. It is important to note that the same condition may have several values, such as the country of origin. In this case, only one will suffice for the condition to be met. This model generates a greater number of false positives and may cause some suspicious declarations to skip controls because one or more of the conditions established are not met. Therefore, in such a context the risk profile must be adjusted, hence the importance of managing risk properly. One solution to this problem is to create profiles that combine the previous conditions, so as to reduce the chances of suspicious declarations skipping control. Still, they will generate more false positives.

Customs Risk Management

Module 4

As in the previous model, it is important to assess the impact of these type of profiles. One solution may be to introduce control percentages, even though all conditions may be present. For example, let us pretend that we have assessed the impact of the previous profile, but it turned out to be unaffordable due to the scarce resources available and the delays it would cause. One solution could be to physically control 20% of the declarations that fit the profile, control the documents of 50% and leave the remaining 30% without control. Controls will be randomly assigned by the system according to the control percentages defined. Alternatively, we may establish a maximum number of daily or weekly controls, so once the number is reached, no more declarations will be selected under that criterion. With regard to the tools required for selecting text fields, this kind of tool requires the name or address declared to be identical to the one searched. This is indeed a limitation, as any typographical errors may prevent the declaration from being selected. To mitigate these problems, some solutions include: n Eliminating blank spaces, odd characters such as hyphens or asterisks, and

acronyms at the end of the text, such as “Inc.”, “GmbH”, “Corporation”, “The”, etc. n Using relevant expressions that coincide with the ones searched in the

declaration text box. Let us consider the following example: Imagine we have significant information on a company called GRANDMA’S CHIPS Inc. In principle, our objective will be to identify declarations that contain such name. In order to facilitate identification, the solutions described would work as follows: n Elimination of blank spaces, odd characters and usual words at the

beginning or end. The name would thus be reduced to GRANDMASCHIPS.

Customs Risk Management

Module 4

n Once characters have been removed, we must select the key word(s) we

need to identify, in this case “GRANDMA” and “CHIPS”. This method would allow identifying those customs declarations containing these key words in that order, regardless of whatever is declared in the middle. Each model commercially available has its pros and cons, so each administration must assess them with a view to implementing its own computerized system, although a combination thereof seems the wisest choice. For example, when identifying people or addresses, the deterministic model may be more efficient, while probabilistic formulas may be more appropriate for determining values calculated as first shipments. Whatever the solution adopted, the system chosen should have a test environment permitting to define risk profiles in order to assess impact before applying them in the real setting, thus preventing too many controls that may overload customs and cause delays, or concluding that profiles are not selecting declarations, which is indicative of an error during the risk management process.

III.3. Silent Alerts The applications that support the risk management system may include, if so required, the possibility of introducing tools to send alerts on the inclusion of relevant information to a certain e-mail or corporate telephone. These are computerized tools that inform about a consignment that fits the information available. This system is particularly useful when authorities do not want to perform controls at the time of lodging the declaration or upon arrival of the goods, but when the goal is to establish a monitoring procedure to carry out controls at the point of delivery or to pursue investigations already in progress.

Customs Risk Management

Module 4

Let us think about a shipment of drugs inside a container. Based on current investigations, it transpires that the businesses used as importers are actually front companies that hide the real operators. In such a case, and in order not to raise suspicion, we may introduce a risk profile assigned to the green line, i.e. not subject to customs control, which alerts the investigating unit when the container is declared to customs authorities. After receiving the warning, the unit may set up a follow-up system that identifies the place where the container is to be delivered. Authorities may choose to act right then or pursue the investigation so as to collect further evidence to prosecute those involved in the crime. Similarly, computerized systems must allow searching for live shipments by enabling one or more queries through key fields for each type of customs declaration, such as operators, goods, container, etc. Implementing these queries will allow customs officials to enter the required data in all or just some of the key fields for obtaining all shipments related to the key data, thus expediting the investigation.

III.4. Random Control Module As has been discussed in previous modules, risk management implies the use of a systematic decision-making process to avoid unjustified, discretional controls. But this should not mean that random controls should be eliminated altogether. Even though good risk management may be in place, randomized controls can allow for the discovery of previously unknown trends and types of fraud. By enforcing controls and by detecting and responding to illegal actions, customs authorities force fraudsters to change their strategies to avoid further controls. This is why the effectiveness of risk controls fades with time. Faced with changing criminal strategies, random controls continue to be an effective way to tackle illicit behavior. They should therefore be maintained as a complement to the methodology described in the previous module. 58

Customs Risk Management

Module 4

The importance of random controls is recognized in Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code. Article 5 on definitions includes random controls as part of risk management.

Art. 5 UCC: To the effects of this code, “risk management” means the systematic identification of risk and the implementation of all measures necessary for limiting exposure to risk.

It is important to remember that random controls can also be used to adapt each customs office’s workload to the requirements of the moment. In other words, it should be applied flexibly by defining a percentage of additional documentary or physical verifications to be applied either permanently or temporarily.

SYNTHESIS OF THE UNIT In this unit we have presented different tools for defining a risk profile, which can be incorporated into the system to select declarations when presented on file based on the criteria established. We have discussed the need to introduce random controls as a way to discover new types of fraud. Finally, we have highlighted the need for warning systems to allow performing controls without informing the operator.

Customs Risk Management

Module 4

Complementary Material n Article on Similarity Metrics for Fuzzy Search. n Example of decision tree and definition of risk profiles.

Bibliography n Bertrand, L. “Risk Management systems: using data mining in developing

countries’ customs administrations.” Source: http://worldcustomsjournal.org/Archives/Volume%205,%20Number%201%20(Mar%202011)/03%20Laporte.pdf n Regulation (EU) No 952/2013 of the European Parliament and of the Council

of 9 October 2013 laying down the Union Customs Code. n Thibedeau C., Rochon D., Miller C. (2010). “Risk Management of Cargo and

Passengers.” InterAmerican Development Bank. https://publications.iadb.org/handle/11319/5233?locale-attribute=en

n Weiss, S. M., Indurkhya, N. Predictive. Data Mining: A Practical Guide. n Wikipedia (2015). Entry on “Data mining”. Source:

https://en.wikipedia.org/wiki/Data_mining n World Customs Organization. Customs Risk Management Compendium.

Volume 1. Brussels, Belgium. n World Customs Organization (2008). Customs in the 21st Century. Brussels,

Belgium.