CBSA’s Own Audit Says Border Security Needs a Fix Ledger

Border security is not a slogan. It is controlled doors, current risk assessments, protected records and completed fixes.

The Canada Border Services Agency’s own March 2026 audit should end any Ottawa habit of treating border security as a press-conference line. The audit reviewed physical-security governance, controls and risk management from April 1, 2022 to September 30, 2025. It concluded that CBSA had the basic framework in place — but also found gaps serious enough to demand a public fix ledger.

Start with the baseline. CBSA operates in more than 1,000 facilities and deemed 410 sites “critical.” Yet the audit found that 312 of 410 critical facilities — 75 per cent — had no threat-and-risk assessment or had one more than five years old. For medium- and high-risk facilities, only 69 of 162 had a valid assessment. Two high-risk facilities were missing assessments. That means management did not have an up-to-date view of vulnerabilities across much of the border-security footprint.

The access-control findings were just as uncomfortable. During walkthroughs, audit team members accessed all secure and non-secure floors tested, unannounced, at various times of day, without access cards or visible CBSA identification. They got in because occupants let them in or because they followed authorized people through doors. Their presence was challenged on only one of six secure floors and two of nine non-secure floors.

Then came the information-security failure. The audit found sensitive documents left at printers, including financial material and traveller data such as names, passage dates, passport numbers and dates of birth. In some cases, auditors could consult Protected B and C paper documents in open cabinets without being questioned. This is not an abstract paperwork issue. CBSA handles travellers, enforcement files, commercial releases and sensitive operational information. If staff culture allows strangers through doors and documents to sit exposed, Canadians deserve to know exactly how that is being fixed.

The audit also reviewed 180 physical-security recommendations issued between April 2022 and April 2025. CBSA could confirm implementation of only 44. The remaining 136 were either not implemented or their status could not be confirmed. The agency also had incomplete facility data, poor records management for signed assessments, and outdated tracking for security-controlled assets including port stamps. CBSA policy requires a police report when a stamp is declared lost, but auditors found limited awareness of that expectation.

To be fair, CBSA management accepted the recommendations and said some sampled deficiencies had already been corrected or added to planned work. Good. Now prove it. The Carney government should publish a non-operational public ledger showing which categories of facilities lacked current assessments, how many recommendations remain open, what funding was denied, how port stamps and access credentials are reconciled, and which senior official signs off when a risk is accepted instead of fixed.

Conservatives should be careful here: no one should demand a map of vulnerabilities that helps criminals. But Parliament and taxpayers can demand aggregate numbers, deadlines, responsible branches and completion status. Border security requires more than speeches about control. It requires locked doors, accounted-for assets, protected traveller data and a government willing to publish the receipts.