Customs Duty Audit: How Importers Find the Money CBP Never Will (2026)

What is a customs duty audit, and why won't CBP find your overpayments?

A customs duty audit is a self-run review of your already-filed entry summaries to find duty you overpaid and recover it before the window closes. It is not something CBP does for you. CBP audits exist to protect government revenue, which means they look for the duty you underpaid, never the duty you handed over by mistake. If you are waiting for CBP to catch your overpayments, nobody is coming.

A customs duty audit is your own review of past entries to find and recover overpaid duty. CBP's audit program moves the other direction: it protects revenue by catching underpayment, so an overpayment you made is invisible to it. In FY2024 CBP completed 417 regulatory audits against 38.36 million entry summaries, roughly one audit per 92,000 entries. At that coverage, self-auditing is the only realistic way overpaid duty ever comes back, and the clock on each entry is already running.

Primary source: CBP Trade Statistics, which establishes that CBP completed 417 regulatory audits in FY2024 against 38.36 million entry summaries (updated May 26, 2026).

Most importers get this backwards. The mental model is "CBP polices the numbers, so if we were badly wrong we'd have heard by now." But the odds of any single entry being audited are almost zero, so an underpayment can sit undetected for years, and an overpayment sits uncollected forever because CBP has no reason to flag money it already has.

This is a diagnostic guide: how to run the audit that finds your overpayments. It ends where you have found the overpayment and know how far back you can act. The mechanics of getting the money back through each channel live in separate guides, linked where they belong.

The 1-in-92,000 problem: why overpaid duty accumulates silently

Overpaid duty accumulates because the entity most able to catch it has no incentive to, and the entity with the incentive (you) usually never looks. That is the 1-in-92,000 problem, named for the ratio in CBP's own data.

CBP's Trade Statistics show 417 regulatory audits completed in FY2024 against 38.36 million entry summaries filed. Divide those and you get an audit rate near 0.001 percent, about one audit per 92,000 entries. Measured against active importers instead of entries (roughly 225,000 of them), those 417 audits still touch only about 0.2 percent of companies in a year. You will sometimes see "2 percent of imports are audited" repeated on vendor blogs; CBP publishes no such number, the true rate is far lower, and you should not plan around it.

Two government findings sharpen the point. A Treasury Inspector General audit, OIG-24-026 (March 2024), found CBP needs to enhance its monitoring of its own duty-underpayment investigations, meaning even confirmed problems can go unresolved. And GAO-20-50R (November 2019) found that of the antidumping and countervailing duties CBP billed importers in FY2001 to FY2018, roughly $4.5 billion remained uncollected as of May 2019. CBP's revenue-protection machinery is strained even in the direction it cares about. In the direction it does not care about, your overpayment, there is no machinery at all.

CBP's own measurement program even quantifies the money flowing in your direction. The agency's Trade Compliance Measurement sample, published each year in the DHS Agency Financial Report, estimated that importers overpaid $2.17 billion in duties in FY2021 alone, against $3.64 billion underpaid; the FY2023 estimate was $175 million overpaid. Yet CBP's enforcement statistics report only dollars collected from importers, never a returned-overpayment line, and the audit sampling rule at 19 CFR 163.11 merely offsets overpayments an audit happens to find against underpayments in the same sample. One more thing that estimate cannot see: it counts outright errors against the legally correct duty, so whatever a sharper classification or an unclaimed preference would have saved sits on top of it, uncounted.

So the silence around your entries is not evidence they are correct. It is the expected outcome of a system that audits one entry in ninety-two thousand and only looks for money owed to it. Overpaid duty does not get caught; it gets forgotten.

Where does duty overpayment actually hide on a 7501?

Duty overpayment hides in six recurring places on the entry summary, and naming them turns a vague "are we overpaying?" into a checklist you can run. Most guides say "misclassification" and stop. This is the full overpayment pattern taxonomy, each paired with the 7501 field to check and the red flag that gives it away.

#	Overpayment pattern	7501 field to check	Red flag
1	Misclassified into a higher-rate line	HTS number + duty rate	Rate applied is higher than a fresh classification of the same product
2	Missed FTA / Chapter 98 (9801 US goods returned) / Chapter 99 preference	Special-program indicator / SPI code	Duty paid on goods that qualified for a free or reduced rate you never claimed
3	Entered value too high	Entered value vs commercial invoice	International freight, inland freight, or discounts folded into the dutiable value
4	Duplicated or split lines	Line count + quantity	Same goods appear twice, or a shipment split so both halves paid full duty
5	MPF / HMF miscalculation	Merchandise/Harbor fee lines	Merchandise Processing Fee above the statutory cap, or HMF charged on non-ocean entries
6	Missed active exclusion	HTS + Chapter 99 secondary code	A live Section 301 or Section 232 exclusion existed on the entry date and was not applied

This taxonomy is the core of any real audit because five of the six patterns are invisible if you only read the 7501 by itself. The entry looks internally consistent because the broker keyed it consistently. The overpayment appears only when you compare the 7501 against an external truth: your current classification, the commercial invoice's freight breakdown, the exclusion list in effect that day. An audit that only re-reads the entry finds nothing. An audit that cross-checks each field against its source finds the money.

One caution on pattern 1. When your audit flags a line as "misclassified into a higher rate," you are asserting your own past classification was wrong, a claim you must defend both directions: a correct code with a lower rate is your overpayment, but a higher rate means you have found an underpayment (see the two-sided discipline below). The USITC Average Unit Value method is one technique for detecting these anomalies at scale; we cover it in the USITC AUV duty audit walkthrough.

With thousands of entries, which ones do you audit first?

Rank entries by expected recoverable dollars multiplied by an open recovery window, and audit that ranked list top-down. This is the audit-prioritization triage, the single most useful move for anyone staring at thousands of lines with no idea where to start.

The instinct is to audit chronologically or exhaustively (open all 6,000 lines). Both guarantee the audit stalls before it finds anything, because most lines carry trivial duty and most old lines are past recovery. The triage inverts the work:

1. Sort by duty paid per line, descending. A line that paid $12 cannot return more than $12; a line that paid $40,000 is where recovery lives. Keep the high-duty lines.
2. Gate by recovery window. Drop anything that liquidated more than 180 days ago; that money is legally gone regardless of what you find (see the recoverability overlay below). Keep unliquidated entries and anything liquidated within 180 days.
3. Weight by pattern likelihood. Push products you already suspect (composite goods, anything with a split or "other" HTS code, anything sourced from a country with active exclusions) to the top; they carry the overpayment patterns most often.

Run those three filters and a 4,000-line year collapses into a worklist of a few hundred entries that are simultaneously high-value and still recoverable. That worklist is the audit. Everything below it is noise you were never going to profitably recover.

If you suspect the problem is upstream (your broker keyed a wrong rate or value rather than you classifying wrong), reconciling what the broker filed in ACE against your own records is its own discipline; the broker entry-data reconciliation in ACE guide owns that field-by-field method.

The two-sided-audit discipline: what if the audit finds an underpayment?

A duty audit that only looks for overpayments is not an audit; it is wishful thinking, and it can create legal exposure. The two-sided-audit discipline is the rule that you never start without a plan for the money that runs the other direction, because a structured review surfaces both directions at once.

The moment your audit shows a product was classified into a lower-rate line than it should have been, you have found an underpayment, and under reasonable care (19 U.S.C. 1484) you cannot pretend you didn't. Left uncorrected, that becomes 19 U.S.C. 1592 exposure (culpability for a material false statement to CBP). The same audit that hands you a refund can hand you a disclosure obligation.

The discipline is not "don't look." It is "look with a plan":

• Decide before you audit how underpayments get handled, and by whom, so a finding doesn't sit in a spreadsheet growing worse.
• Correct underpayments through a prior disclosure, which typically reduces penalties substantially versus waiting for CBP to find the same error. The disclosure mechanics live in the prior-disclosure to CBP guide; the reasonable-care and cost analysis is in what HTS misclassification actually costs.
• Net honestly. If the same catalog produces $300,000 of recoverable overpayment and $60,000 of disclosable underpayment, the audit still nets in your favor, with your compliance posture intact.

Framing an audit as one-directional ("find our refunds!") is what most recovery-vendor content does, and it is the least honest part of the pitch. The two-sided view is more work and far more defensible.

How far back can you audit, and when is the money already gone?

You can review any entry ever filed, but you can only recover on an entry where a channel is still open, so every finding has to be mapped to its recovery window before it counts as money. This is the recoverability-window overlay: sort every overpayment into pre-liquidation, still-in-protest, or dead.

• Pre-liquidation (unliquidated entries). The entry has not yet finalized. You can correct it with a Post-Summary Correction (PSC), generally available up to 300 days from entry and before liquidation. This is the cleanest fix.
• Liquidated, within 180 days. Once an entry liquidates, the PSC door closes and the protest door opens: you have 180 days from the date of liquidation to file under 19 U.S.C. 1514. A missed free-trade preference has its own path, a 19 U.S.C. 1520(d) claim, with a longer window for qualifying FTAs.
• Liquidated, past 180 days. The money is gone. A finding here is a lesson that improves your go-forward classification, not a recovery.

This overlay is why step 2 of the triage drops old liquidated entries: reviewing them costs the same effort and returns nothing. To know which bucket an entry sits in, check its liquidation status; the mechanics of monitoring that status from ACE are covered in the Section 122 liquidation monitoring guide.

Two boundaries. This post finds the overpayment and tells you whether a channel is open; it does not walk through filing each channel. For choosing between and filing them, see how to file a customs protest and the CAPE vs protest vs PSC decision guide. And a duty overpayment audit is not duty drawback: drawback refunds duty on goods you later exported, a separate lane with its own rules (duty drawback resources). If your recovery depends on exports, that is a drawback question, not an audit finding.

Can software find duty overpayments automatically, or do you still need people?

Software can flag overpayment candidates at a scale no spreadsheet can match, but a human still confirms each one and a licensed broker still files, so the honest answer is "both, in that order." The right choice depends entirely on your line count.

A one-analyst spreadsheet audit is free, and every importer should start there. It teaches you where your own money leaks and catches the obvious wins. Its ceiling is real: a person can hand-review dozens of 7501s, not several thousand lines, and no analyst can economically re-run classification against a 5,000-code catalog to surface the "misclassified into a higher rate" pattern across every SKU. Past a few hundred meaningful lines, the manual audit doesn't get wrong answers; it just stops.

That ceiling is where a research-and-audit layer earns its place. GingerControl runs duty, freight, and PO reconciliation audits: it re-checks classification with documented reasoning across the catalog, surfaces overpayment-pattern candidates at volume, and produces audit-ready reports so a person reviews the findings and the broker still files. It is not a broker, does not act as importer of record, does not file entries, and never guarantees a recovery amount. It turns 6,000 lines into a reviewable shortlist.

A contingency recovery firm is the third option, fitting a specific case: a large backlog you have no capacity to touch and no appetite to staff. These firms typically take 20 to 30 percent of what they recover (a market range, not any one vendor's figure). That cut is worth paying on complex recoveries you can't reach and wasteful on the obvious overpayments an internal sort would have caught for free. Sequence it correctly: self-audit first, add tooling when volume exceeds what people can review, hand a firm only the recovery you can't staff. The full comparison of audit tooling versus recovery services lives in tariff audit software vs duty drawback, and the trade-compliance software ROI calculator covers the "overpayment avoided" math.

Building a repeatable duty audit process (so this isn't a one-time scramble)

The last move is to turn the one-time audit into a standing process, because tariffs change monthly now and a catalog that was clean last quarter drifts out of compliance the moment a new exclusion or rate lands. A repeatable duty audit runs the same taxonomy and triage on a schedule instead of once under CFO pressure. A workable cadence for a mid-market importer:

• Quarterly: run the triage against the last quarter's entries while they are still pre-liquidation and every recovery channel is wide open. This is where PSCs are cheapest to file.
• On every rate or exclusion change: re-check the affected HTS codes across your catalog. A new Section 301 exclusion is an overpayment waiting to happen on every entry filed before you applied it. Wrong-value and wrong-classification issues at the point of purchase are also a valuation and PO-reconciliation question; the customs valuation governance for related-party value and assists guide covers the upstream program.
• Annually: re-run classification across the full catalog. The USITC HTS updates yearly, and codes split, merge, and sunset; a code correct in 2025 can be wrong in 2026 without you touching the product.

The repeatable process converts "find out if we've been overpaying" from a fire drill into a line item the CFO can forecast. The one-time audit tells you what you already lost; the process stops you losing it again, and keeps the recovery window open where it still matters.

The bottom line

If you are waiting for CBP to tell you that you overpaid duty, you are waiting for a message that structurally cannot arrive: CBP audits protect its revenue, at a rate near one entry in ninety-two thousand, and has no reason to flag money you already gave it. A customs duty audit is the only path back to an overpayment, and it works when you run it as a discipline: name the six places overpayment hides, triage thousands of lines down to the few hundred that are high-value and still recoverable, map each finding to an open channel before you act, and plan for the underpayments the same audit will surface. Start in-house, because the first pass is free. When the line count outgrows what people can review, a research-and-audit layer flags the candidates and documents the reasoning, so your team reviews and your broker files.