A $200,000 radar component arrives at a tier-one defence contractor’s facility in Kanata. The procurement team approved the crating supplier three months earlier based on a website claim of “CGP compliance.” Now the receiving team discovers the supplier’s Controlled Goods Program registration expired six weeks ago. The component cannot be legally transferred. Production halts. The prime contractor faces a compliance violation they inherited from a vendor they never properly vetted.
This scenario plays out more often than defence procurement teams want to admit. The Controlled Goods Program registration requirements exist because the Defence Production Act regulations prohibit unauthorized examination, possession, or transfer of controlled goods. When your logistics partner falls out of compliance, your organization inherits the problem.
We built this checklist from our experience as a CGP-registered crating provider working with defence contractors across the Ottawa corridor. Every verification point below reflects real compliance requirements that protect your organization from regulatory exposure.
Who This Checklist Serves
This article is written for procurement officers, supply chain managers, and compliance leads at defence contractors who must vet packaging and logistics suppliers before awarding contracts involving controlled goods.
This checklist is for you if:
- You ship items appearing on Canada’s controlled goods list
- Your contracts require CGP-compliant handling throughout the supply chain
- You need to verify supplier credentials before transfer of controlled goods
- You face audit requirements that extend to your logistics partners
This checklist is not for you if:
- You ship commercial goods with no controlled goods designation
- You need general export crating without defence specifications
- You are seeking information about how to register your own organization
Verifying Active CGP Registration Status
A supplier claiming CGP registration and a supplier holding current, valid registration are different things. The Controlled Goods Directorate notes that processing times are currently running significantly longer than their 32-business day standard due to application volume. This means registrations can lapse during renewal periods if suppliers do not plan ahead.
Documentation to Request
- Registration certificate: Ask for a copy showing the registration number, legal entity name, registered site addresses, and expiry date
- Scope of registration: Confirm the registration covers the specific activities you need—examining, possessing, and transferring controlled goods
- Site-specific coverage: If your goods will be handled at multiple locations, verify each site is registered
Verification Steps
- Compare the legal entity name on the registration to the company you are contracting with
- Confirm the registration expiry date falls well beyond your contract timeline
- Verify the registered site address matches where your goods will actually be handled
- Request proof of renewal submission if expiry falls within 60 days
The U.S. revoked Canada’s ITAR exemption in 1999, which led directly to creation of the Defence Production Act and Controlled Goods Regulations in 2001. This history matters because it explains why CGP registration is not optional—it is the legal mechanism that allows Canadian companies to handle defence materials that would otherwise require individual U.S. export licences.
Security-Assessed Personnel Requirements
CGP registration covers the organization. Security assessments cover the people. A supplier can hold valid registration while employing personnel who have not been security-assessed to handle controlled goods. This gap creates liability for everyone in the supply chain.
What to Verify
- Designated Official: Every CGP registrant must have at least one Designated Official responsible for security assessments and compliance. Ask for this person’s name and confirm they are current
- Personnel coverage: Anyone who will examine, possess, or transfer your controlled goods must hold a current security assessment
- Assessment documentation: Suppliers should maintain records including security assessment applications, identification verification, and criminal record checks
Questions to Ask
- How many security-assessed personnel do you employ who can handle controlled goods?
- What is your process for assessing new employees before they handle controlled goods?
- How do you handle situations where assessed personnel are unavailable?
- Can you provide written confirmation that only assessed personnel will handle our goods?
The security assessment requirement means your supplier cannot simply reassign any available warehouse worker to your project. They must deploy specifically vetted personnel, which affects scheduling and capacity.
Facility Security and Access Control Standards
CGP registrants must implement physical security measures that prevent unauthorized access to controlled goods. These requirements translate into specific facility characteristics you can verify during site visits or through documentation.
Minimum Security Features
- Controlled access: Entry points to controlled goods areas must restrict access to security-assessed personnel only
- Visitor protocols: Non-assessed visitors require escort by assessed personnel and documented sign-in/sign-out procedures
- Secure storage: Controlled goods must be stored in areas that prevent unauthorized examination or access
- Surveillance: Monitoring systems appropriate to the sensitivity of materials handled
Site Visit Checklist
If you conduct supplier site visits, look for these indicators:
- Physical separation between controlled goods areas and general warehouse space
- Access control mechanisms (badge readers, locked doors, sign-in requirements)
- Clear signage indicating controlled goods zones
- Documented visitor management procedures
- Camera coverage of controlled goods handling and storage areas
At our Ottawa facility, we maintain dedicated secured areas for controlled goods crating services with access restricted to assessed personnel. This physical separation is not a premium service—it is a baseline CGP requirement.
Chain of Custody and Transfer Documentation
The Defence Production Act governs how controlled goods move between registered parties. Your supplier must maintain documentation that creates an unbroken chain of custody from receipt through transfer.
Required Documentation Elements
- Receipt records: Date, time, and identity of controlled goods received, including who accepted delivery
- Examination logs: Records of when controlled goods were examined and by whom
- Transfer records: Documentation of all transfers including recipient registration verification
- Disposition records: Final disposition of controlled goods (shipped, returned, destroyed)
What Compliant Documentation Looks Like
Ask potential suppliers to describe their documentation system. A compliant system should:
- Track each controlled item by serial number or unique identifier
- Record every instance of examination, possession, or transfer
- Identify the security-assessed personnel involved at each step
- Maintain records for the period required by regulation (typically seven years)
- Support audit requirements with retrievable, organized records
The CGP compliance inspection guidelines detail what the Controlled Goods Directorate reviews during audits. Your supplier’s documentation system must satisfy these requirements.
Controlled Goods Storage Capabilities
If your goods will be held at the supplier’s facility for any period—even overnight—you need to verify their storage capabilities meet CGP requirements.
Storage Requirements
- Segregation: Controlled goods must be physically separated from non-controlled inventory
- Access restriction: Storage areas must limit access to security-assessed personnel
- Inventory control: Systems must track controlled goods location and status at all times
- Environmental protection: Storage conditions must protect goods from damage (relevant for sensitive defence equipment)
We provide secure warehousing for controlled goods because many of our defence clients need to stage equipment before shipping or hold crated goods awaiting transport. Storage capability is often overlooked during supplier vetting, but it becomes critical when shipping schedules shift.
Questions About Storage
- Do you have dedicated controlled goods storage space?
- How is access to storage areas controlled and logged?
- What inventory management system do you use for controlled goods?
- What is your capacity for controlled goods storage?
- What happens if goods need to remain on-site longer than planned?
Red Flags and Disqualifying Factors
During supplier evaluation, certain indicators should prompt immediate concern or disqualification.
Immediate Disqualifiers
- Expired registration: Any supplier whose registration has lapsed cannot legally handle your controlled goods
- Refusal to provide documentation: Legitimate registrants can and should provide registration certificates
- No Designated Official: If they cannot name their Designated Official, their compliance structure is inadequate
- Unregistered sites: If your goods will be handled at a location not covered by their registration, the transfer is non-compliant
Warning Signs Requiring Further Investigation
- Vague answers about personnel: Evasive responses about who will handle your goods suggest inadequate assessment coverage
- No visible security measures: Site visits revealing open access to handling areas indicate systemic issues
- Informal documentation: Handwritten logs or ad-hoc tracking systems may not satisfy audit requirements
- Limited capacity claims: Suppliers who “can handle anything” without demonstrating specific controlled goods infrastructure may be overstating capabilities
- No compliance history: New registrants may lack the operational experience to handle complex controlled goods projects
Questions to Ask Potential Partners
Use these questions during supplier evaluation conversations. Document the answers for your compliance records.
Registration and Structure
- What is your CGP registration number?
- When does your current registration expire?
- Which of your facilities are covered by your registration?
- Who is your Designated Official and how can we contact them?
- Have you ever had a registration suspended or revoked?
Personnel and Operations
- How many security-assessed personnel do you have who can handle controlled goods?
- What is your process when a project requires more assessed personnel than currently available?
- How do you handle visitors to controlled goods areas?
- What training do your personnel receive on controlled goods handling?
Documentation and Compliance
- Can you describe your chain of custody documentation system?
- How long do you retain controlled goods records?
- When was your last CGP compliance inspection and what was the outcome?
- Have you ever had a compliance violation and how was it resolved?
Capabilities
- Do you have dedicated controlled goods storage space?
- What security measures protect your controlled goods areas?
- Can you handle the physical requirements of our specific goods (weight, dimensions)?
- What is your experience with items similar to what we need to ship?
Ongoing Compliance Monitoring
Supplier vetting is not a one-time activity. Your organization’s compliance depends on your partners maintaining their status throughout the contract period.
Periodic Verification Activities
- Registration renewal tracking: Note your supplier’s registration expiry date and request proof of renewal 60 days before expiry
- Documentation audits: Periodically request chain of custody records for your goods to verify documentation standards
- Site re-verification: For long-term contracts, consider annual site visits to confirm security measures remain in place
- Incident reporting: Require suppliers to notify you of any compliance issues, security breaches, or registration status changes
Contract Language
Your contracts with CGP-registered suppliers should include:
- Requirement to maintain active CGP registration throughout contract term
- Obligation to notify you of any registration status changes
- Right to audit documentation and facilities
- Confirmation that only security-assessed personnel will handle your goods
- Requirement to provide updated registration certificates upon renewal
Summary Checklist
Use this condensed checklist during supplier evaluation:
Registration Verification
- Registration certificate obtained and reviewed
- Expiry date extends beyond contract period
- All handling sites included in registration
- Legal entity name matches contracting party
Personnel Verification
- Designated Official identified
- Security-assessed personnel available for project
- Assessment process documented
Facility Verification
- Controlled access to handling areas
- Dedicated controlled goods storage
- Visitor management procedures in place
- Surveillance and monitoring systems
Documentation Verification
- Chain of custody system described
- Record retention meets requirements
- Audit readiness confirmed
Working With a Compliant Partner
We have been CGP-registered since our work with defence contractors began. Our facility in Ottawa maintains the physical security, personnel assessments, and documentation systems that this checklist describes. When you need controlled goods crated for shipment, stored between production phases, or handled anywhere in the supply chain, we can demonstrate compliance at every point.
Before verifying an export control list verification, ensure your logistics partners meet the baseline CGP requirements outlined here. If you are evaluating crating suppliers for controlled goods projects and want to see how we meet these criteria, request a quote and we will walk you through our compliance infrastructure.
Frequently Asked Questions
How do we verify that a crating supplier’s CGP registration is active?
We request the supplier’s current registration certificate and compare the legal entity name, registration number, expiry date, and covered site addresses with the proposed contract. We confirm that registration remains valid throughout the project, not merely on the award date. If expiry is within 60 days, we request documented proof of renewal submission and establish a written contingency plan before transferring any controlled goods.
Why must we verify the personnel handling our controlled goods?
Organizational registration does not automatically authorize every employee to examine, possess, or transfer controlled goods. We confirm the supplier has a current Designated Official and enough security-assessed personnel for the project. We also ask how new employees are assessed and what happens when qualified staff are unavailable. This prevents unauthorized workers from being assigned during busy periods or schedule disruptions.
What facility controls should we inspect before selecting a supplier?
We verify that controlled goods areas are physically separated from general warehouse space and accessible only to assessed personnel. We look for badge readers, locked doors, visitor sign-in and escort procedures, clear controlled-zone signage, and camera coverage. We also confirm that storage protects sensitive equipment from damage. These controls matter because goods may remain on-site overnight when transport or production schedules change.
What chain-of-custody records should a compliant supplier maintain?
We require records that identify each item by serial number or another unique identifier. The system should document receipt date and time, the person accepting delivery, every examination, each transfer, and final disposition. Records must identify the assessed personnel involved and remain organized for audit retrieval. We ask suppliers to demonstrate their process rather than relying on informal notes or unsupported claims of compliance.
Which supplier findings should disqualify a bid immediately?
We disqualify suppliers with expired registration, unregistered handling sites, or no identifiable Designated Official. Refusal to provide registration documents is another immediate concern. Vague answers about assessed personnel, open access to controlled areas, handwritten tracking, or unsupported claims of unlimited capacity require investigation before approval. We also include ongoing contract obligations for renewal notices, audits, incident reporting, and updated registration certificates.
