Son Ha Hue Company Limitederp.hansae.com/sharefile/Compliance/Survey/Carters_2019...Son Ha Hue...

LOCATION CORPORATE AUDIT REPORTReport# CA-2018-10-0148Updated on Oct 23, 2018

Son Ha Hue Company LimitedThis Report Applies Solely for SCAN - Supplier Compliance Audit Network

Completed on Oct 22, 2018

of 38

Disclaimer: This Audit Report is prepared at the direction of and intended for the benefit and use of SCAN members only. None of thematerial contained in this Audit Report may be altered, transmitted, copied or distributed to any other party, without the prior expresswritten permission of SCAN. The information contained within this Audit Report addresses third party facilities that are not affiliated withSCAN. The accuracy of the information contained in this Audit Reports is not guaranteed or warranted by SCAN. This Audit Reportsshould not in any way be construed as advice of any sort by SCAN. SCAN shall not be responsible or liable for the accuracy of thisAudit Report. www.scanassociation.com

LOCATION INFORMATION

Son Ha Hue Company Limited

Phu Da Industrial Zone, Phu Da Town,Phu Vang District, Thua Thien Hue, VietnamN/AN/A, Hue Province, VietnamN/AN/A

SCAN ID: VNY6F62443SOPoint of Contact Name: Mr. NghiaPoint of Contact Email: [email protected]/[email protected] Month: Early SeptemberVendor Name - Entered by SCAN Member: Hansae Co., Ltd.Vendor Email Address - Entered by SCAN Member: [email protected]

Contact Name Phone Email

Location: Son Ha Hue Company Limited

Primary Location: Yes

Critical Location: No

Assigned Auditor: Omega

Schedule Date: 10/16/2018

of 38

90 % Compliance Score

AUDIT SUMMARY

SCAN - SCAN Security Audit

Audit completed on October 22, 2018

Compliance by Category

90 % (Oct-18)

Business Partner Requirements

Container & Trailer Security

Conveyance Security

Information Technology Security

Personnel Security

Physical Access Control

Physical Security

Procedural Security

Security Training & Threat Awareness

0 20 40 60 80 100

71

100

90

79

80

97

87

91

100

of 38

Disclaimer: This Audit Report is prepared at the direction of and intended for the benefit and use of SCAN members only. None of thematerial contained in this Audit Report may be altered, transmitted, copied or distributed to any other party, without the prior expresswritten permission of SCAN. The information contained within this Audit Report addresses third party facilities that are not affiliated withSCAN. The accuracy of the information contained in this Audit Reports is not guaranteed or warranted by SCAN. This Audit Reportsshould not in any way be construed as advice of any sort by SCAN. SCAN shall not be responsible or liable for the accuracy of thisAudit Report. www.scanassociation.com

BUSINESS PROFILE INFORMATION

Profile Question Response

Year Established 2017

Does the facility participate in any government, local customs, or World CustomsOrganization (WCO) accredited facility security program?

No

Do you hold a Certification? No

Has the facility been reviewed or audited by this program? No

Primary Industry of Operations Apparel Industry

Product Type / Commodity Jacket for man and woman

Grounds Size (Square Meters) 45000

Number of Buildings 2

Facility Size (Square Meters) 25000

Number of access points? (i.e. gates, exterior doors) 1

Hours of OperationMonday to Saturday from 7:15 A.M. – 4:15 P.M.;lunch break from 12:00 A.M. - 13:00 P.M.;overtime from 4:15 P.M. – 8:15 P.M.

Number of Employees greater than 500

Number of Contract Employees 645

Number of Security Guards 6

Number of Migrant Workers 0

Annual Revenue 0 - 1 Million

of 38

Actual

YesNo

Actual

Yes

No

Actual

YesNo

Actual

No

Yes - annuallyYes - minimally every 2 years

One time

AUDIT RESPONSES

Overall Compliance Score: 90 % Audit Sent: 10/22/2018 Due Date: 10/21/2018

Business Partner Requirements 71%

Question

1. Does the facility utilize any contract services, such as security, transportation or manufacturing labor?

Additional Comments: No comments were provided

2. Must Does the facility have written, verifiable processes and procedures used in the selection of businesspartners including: material suppliers, manufacturers, and logistics service providers?

Additional Comments: The facility has a written procedure for the selection of its business partners and fordetermining if the screening and selection process includes verifying the business profile, financial status, thestandards for employee hiring and the ability to accomplish the requirements of the proposed business partner.However, the written procedure does not include the terms requiring a business partner to conduct screeningthat involves a truck carrier for transporting containers or trailers that should also include a driver's backgroundcheck prior to hiring. In practice, the facility required transportation company to conduct driver’s backgroundcheck prior to hiring, and these driver’s background check were provided to auditor on the audit date.

3. Must Does the facility incorporate and require minimum supply chain security requirement language incontracts with a business partners?


4. Must Are contracted business partners required to conduct and provide an annual security risk assessment oftheir operation? These business partners include any contract services, such as security, transportationprovider, freight consolidation or manufacturing labor.


of 38

Actual

YesNo

NA

Actual

YesNo

NACurrently used

seals.jpg

Actual

YesNo

NA

Actual

YesNo

NASeal storagelocation.jpg

5. Should Are contracted logistics service providers given an outline of minimum security standards in their locallanguage?


Container & Trailer Security 100%

Question

6. Critical Are international shipments sealed with an ISO 17712:2013 compliant high-security seal immediatelyafter a container or trailer is loaded?

Additional Comments: The facility uses cable seals for its LCL shipments. FCL shipments are locked with abolt seal which is provided by the forwarder.

7. Must Does the facility have written and verifiable procedures to ensure that security seals are controlled andare properly applied to a container or trailer by a designated facility representative?


8. Critical Are security seals stored in a secured location?


9. Must Does the facility have a designated employee with responsibility to maintain, distribute, and handle

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281225/Currently%20used%20seals.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281227/Seal%20storage%20location.jpg

Actual

YesNo

NA

Actual

YesNo

NA

Actual

Nothing in place

Reporting requirementProcedure is writtenContainer/trailer cannot be left unattendedNA

Actual

YesNo

NA

Actual

YesNo

NA

security seals?


10. Must Is the security seal number recorded on the bill of lading document and a copy of the bill of ladingretained by the facility?


11. Must Does the facility have written and verifiable security procedures in place to report any unscheduled stops,compromised shipments, or any unattended shipments. These procedures should be provided to theircontracted logistics provider and driver? Select all that apply.


12. Must Does the facility have a written and verifiable procedure in place indicating how to recognize a suspectedor compromised security seal, container or trailer structure tampering, including how to report the issue to thefreight forwarder and appropriate local law enforcement?


13. Must Is a written and verifiable procedure in place to require that security or shipping personnel verify thesecurity seal number against the bill of lading when the container or trailer departs the facility?

of 38

Actual

No

Photos takenSeal number in photosTrailer/container number in photosNA

Actual

YesNo

NA

Actual

YesNo

Actual

YesNo

NA

Actual

YesNo

NA


14. Should Does the facility have a written procedure in place to take photographs of a loaded container or trailerwith the security seal affixed, and is photo-taking part of the written process? Select all that apply.


15. Must Is a loaded and stored container or trailer closed and secured with a security seal?


16. Must Is a written procedure in place to report unauthorized access to a container or a trailer, and/or productstorage areas within the facility including whom to notify?


17. Must Is there a written procedure in place to inspect the security integrity of a container or trailer prior toloading?


18. Critical Prior to loading a trailer or container does the facility conduct a 7-point inspection using a documentedchecklist?

of 38

7 point inspectioncheck sheet.jpg

Actual

Mirrors for undercarriageNo tools available

Laser distance measurer or Pre-measured stringTap test tool (such as a hammer)NA

Actual

YesNo

NA

Actual

Yes

No

Driver log book.jpg

Actual

YesNo


19. Must Does the shipping area use equipment to conduct a 7-point container inspection? Select all that apply.


20. Must Does the facility maintain training records indicating which employees are trained to properly perform a7-point container/trailer inspection?


Conveyance Security 90%

Question

21. Critical Is driver information recorded and retained for all departing shipments?

Additional Comments: The drivers' log book is maintained with the driver's name, date and time of departureand arrival, reason for coming, and a truck number. However, there was no truck license number record on thelog book. Based on a document review, the written procedure does not require that a truck's license number berecorded.

22. Must Is a written procedure in place instructing drivers to take designated routes between the origin and theport?


of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281237/7%20point%20inspection%20check%20sheet.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281240/Driver%20log%20book.jpg

Actual

YesNo

NA

Actual

Procedure is writtenNo requirements

GPS or other (please explain)

Actual

YesNo

NA

Actual

Procedure is writtenNo requirements

Padlock with key controlled by either factory and/or driverTamper evident sealNA

Actual

YesNo requirements

23. Must Where possible, are transit routes from the facility to the port or next destination location randomlychanged to minimize predictability.


24. Must What container or trailer tracking technologies does the facility require to be used by the contractedtransportation company? Select all that apply.

Additional Comments: The facility has tracked its cargo containers/truck via a GPS system

25. Must Is a written and verifiable security procedure in place with contracted less than container load (LCL)service providers?


26. Must Is there a procedure in place that requires an LCL container or trailer to be sealed after each stop witheither a tamper evident seal or a padlock? Select all that apply.

Additional Comments: The facility used cable seals and padlocks for securing their LCL containers. The keysare kept by the shipping staff.

27. Must If the facility makes LCL shipments, does the facility have a procedure to validate tamper evident sealsprior to removal at each stop, and do all seals accompany the load to the final destination?

of 38

NA

Actual

Yes

No

NA

Actual

YesNo

Written accesscontrol

procedures.jpg

Actual

YesNo

Actual

YesNo

NA


28. Must If the facility makes air shipments, is there a written and verifiable procedure in place outlining stepsrequired to document shipment movement from the facility all the way to delivery to the freight forwarder orairline?

Additional Comments: There was no air shipment in the facility.

Physical Access Control 97%

Question

29. Critical Is a written procedure in place that outlines access control to the facility, property and buildings?Procedure should include details covering issue, removal, and changing of access control devices and IDcards?


30. Must Are access control procedures or devices used to ensure that only authorized employees have accessthe facility?


31. Critical Is a written and verifiable procedure in place to monitor and limit access to critical operational areas ofthe facility, such as warehouse picking, final packing or packaging, shipping and receiving? Access should belimited to only authorized employees.

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281248/Written%20access%20control%20procedures.jpg

Restricted areaaccess controlprocedure.jpg

Actual

Nothing in place

Procedure is writtenVisitor sign-in log in usePhoto ID checked Visitor log book.jpg

Actual

YesNo

Actual

Yes

No

Badges issued, but not numberedNA

Actual

YesNo


32. Critical Is a written and verifiable procedure in place to require a visitor to present photo identification uponarrival and their information is recorded into a visitor log? Select all that apply.


33. Should Is a written and verifiable procedure in place to inspect a visitor's bag or package before entering andleaving the manufacturing, production or shipping area of the facility?


34. Must Is a visitor issued a numbered visitor badge which is displayed while at the facility?

Additional Comments: Based on a random check from the visitor and vehicle’s log, it was noted that all visitorsand drivers were issued the numbered visitor badges. However, the number of the visitor badges was notrecorded in the visitor and vehicle’s log.

35. Must Is a visitor escorted at all times while at the facility?


36. Must Is a written and verifiable procedure in place to inspect a suspicious package and mail for dangerousmaterials prior to distribution?

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281250/Restricted%20area%20access%20control%20procedure.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281251/Visitor%20log%20book.jpg

Actual

YesNo

NA

Actual

YesNo

NA

Actual

YesNo

Actual

Nothing in place

Policy is writtenProcedures for hiringProcedures for applicationsEmployee documentationNew employee screening

Actual

No requirement

Written application requiredGovernment issued ID required


37. Must Are employees required to display their ID badge at all times while at the facility?


38. Must Is a written and verifiable procedure in place to identify, challenge, and remove an unauthorized personat the facility?


Personnel Security 80%

Question

39. Must Is an employee hiring procedure documented and implemented? Select all that apply.


40. Must Are permanent and temporary job applicant(s) required to submit a written application for employmentand provide proof of their identity? Select all that apply.


of 38

Actual

Nothing in place

Policy is writtenEducation checkReference checkPrevious employment check

Actual

No

Policy is writtenCriminal background checksNA

Actual

Yes

No

Actual

YesNo

41. Must Is a written and verifiable procedure in place to validate information provided on an employmentapplication, such as an address, previous employment history, education, personal or professional references,and a certification? Select all that apply.


42. Must If allowed by local law, is a written procedure in place to perform a background check on an applicantand employee who works in sensitive area of the facility, such as personnel, shipping, computer systems, orcontract employees?


43. Must Is a written and verifiable procedure in place to remove facility access, such as a facility issued ID badgeor card and a computer access code from any employee who has resigned, was terminated, or takes anextended leave of absence?

Additional Comments: The facility has a written and verifiable procedure in place to remove facility access,such as a facility issued ID badge or card from any employee who has resigned, was terminated, however, thewritten procedure did not include the term of removing a computer access code from any employee who hasresigned, was terminated.

Procedural Security 91%

Question

44. Must Is a written and verifiable procedure in place that requires all information used in the shippingdocuments for merchandise/cargo to be legible, complete, and accurate?


of 38

Actual

YesNo

Actual

Yes

NoNA

Actual

YesNo

NA

Actual

YesNo

NAShipping and

loadingprocedure.jpg

Actual

YesNo

45. Must Is a written and verifiable procedure in place that restricts access to shipping and receivingdocumentation? Access should be limited to only personnel required to complete and review the documents.


46. Should Is a written and verifiable procedure in place to communicate business information necessary forcustoms clearance within 24 hours of shipment departure from the facility?

Additional Comments: There is no written and verifiable procedure in place to communicate businessinformation necessary for customs clearance within 24 hours of a shipment's departure from the facility.

47. Must Is an international shipment marked, counted, weighed, and properly reported on the commercialinvoice and bill of lading? Note due to Safety of Life at Sea (SOLAS) accurate container weights are nowrequired for all ocean going shipments FCL and LCL.


48. Critical Is a written and verifiable procedure in place to protect against the introduction of unauthorized andun-manifested materials during the container and trailer loading and shipping processes?


49. Must Is a written and verifiable procedure in place to resolve a carton count shortage, overage, or anydocumentation issue found during container or trailer loading; or after the shipment has departed the facility?

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281267/Shipping%20and%20loading%20procedure.jpg

NA

Actual

Nothing in place

Procedure is writtenLocal law enforcement notifiedCustomer notifed Procedure to notify

local lawenforcement.jpg

Actual

No

Shipping & Receiving fencedNo personally owned vehicles are permitted in Shipping& Receiving areaAccess controlled

Actual

YesNo

Actual

YesNo


50. Critical Is a written and verifiable procedure in place to notify local law enforcement and the customer whenillegal shipping activity or any abnormality is suspected or detected? Select all that apply.


Physical Security 87%

Question

51. Must Is there a designated employee and visitor vehicle parking area separated from the shipping andreceiving area? Select all that apply.

Additional Comments: CCTV cameras and supervisor are assigned to monitor the shipping and receivingarea. There is fencing surrounded at the loading and unloading area. There were no personnel vehicles parkednear such area.

52. Must Is the area adjacent to the shipping and receiving areas enclosed or otherwise monitored?


53. Must Does the shipping area have a fence, a wall, or other controls separating domestic, hazardous, highvalue, and international goods and materials?


of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281269/Procedure%20to%20notify%20local%20law%20enforcement.jpg

Actual

Nothing in place

Procedure is writtenRegular inspections are documentedPreventative maintenance logs kept

Actual

YesNo

NAFacility gate when

not in use.jpg

Actual

Yes

NoNA

Actual

YesNo

NA

54. Must Is a preventative maintenance procedure in place that requires a regular inspection of perimeter fencingor other barriers, buildings, and structures? Select all that apply.


55. Must Are facility gates through which vehicles and/or employees enter and exit guarded or monitored andsecured when not in use?


56. Must In the event of a power outage, does the facility have an alternate electrical power system to ensureuninterrupted operation of electronic security systems?

Additional Comments: The facility did not have an alternate electrical power system to ensure uninterruptedoperation of electronic security systems. However, the facility has signed a renting contract with an outsideagency to provide alternate electrical power system in case of the electric power system off.

57. Should Are facility buildings constructed of materials that will resist easy illegal entry?


58. Must Are facility windows, gates, fences, and doors secured with locking devices to deter unauthorizedaccess? (Note: a designated fire exit must never be locked from the inside that prevents employees fromevacuating the building in an emergency situation.)

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281274/Facility%20gate%20when%20not%20in%20use.jpg

Actual

YesNo

Actual

Nothing in place

Procedure is writtenChecklist is included in Termination document,

Actual

YesNothing in place

Interior lighting only

Exterior lighting only

Actual

Yes

No

Actual

CCTVNo CCTV or camera system

Other surveillance system (please explain)CCTV monitor and control

room.jpg


59. Must Is a written and verifiable procedure in place to control the issue, removal, and changing of accessdevices such an ID badge, door and lock keys, access cards, and security alarm codes? Select all that apply.


60. Must Does the facility have sufficient lighting at entrances, exits, cargo handling and storage areas, alongfence lines, and in parking areas to detect movement during periods of darkness?


61. Should Does the facility have an anti-intrusion alarm system?

Additional Comments: There is no anti-intrusion system in the facility.

63. Should Is a CCTV system used to monitor the facility and premises' including entrances, exits, cargo storage,shipping, and other loading/unloading areas?

Additional Comments: It was noted that no CCTV system was installed in the finished goods warehouse.However, the CCTV system was installed to monitor the entrance gate, exits, shipping, packing, loading andunloading area.

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281281/CCTV%20monitor%20and%20control%20room.jpg

Actual

Nothing in place

Procedure is writtenRegular testingRegular inspectionsPreventative maintenanceMaintenance logs keptNA

Actual

90 or more days

Less than 30 days

Recordings not retained

45 - 89 days30 - 44 days

NA

Comments: The main gate is monitored by security guards. The facility's name is inlocal language name “CÔNG TY TNHH MTV SƠN HÀ HUẾ” is posted in front of the entrygate.

Facility name at themain gate.jpg

Comments: There are 2 security guards monitoring at the entry gate.

Access gate and securityguard station.jpg

Comments: There are 2 buildings in the facility. - One flat building is used as cutting,sewing, finishing, packing and office areas. - One flat building is used as finished goods

64. Should Is a procedure in place to test and inspect the CCTV system? Select all that apply.


65. Should If used, how many days are CCTV recordings kept?

Additional Comments: The CCTV recordings for the loading, unloading, packing area, fence lines, entrancegates and production areas were kept 57 days; from August 21, to October 16, 2018

66. Describe the front of the factory building including any signage. Please attach a picture.

67. Describe the guard station and facility access gates. Please attach a picture.

68. Describe the buildings and structures for this location. Please attach a picture.

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281284/Facility%20name%20at%20the%20main%20gate.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281285/Access%20gate%20and%20security%20guard%20station.jpg

warehouse, raw materials warehouse, and eating area.

Facility building.jpg

Comments: The loading is also unloading areas. A CCTV camera is installed for theloading and unloading area. A movable string is installed during loading and unloadingas a barrier to prevent unauthorized access. A guard is stationed there when loadingand unloading activity is taking place.

Loading andunloading area.jpg

Comments: Packing area is separated. The packing area is monitored by the securityguard, leader and supervisor of this area. The camera is installed for the packing areato monitor all activities in this area.

Packing area.jpg

Comments: i) The container storage area is also the loading area. CCTV camera isinstalled for this area. A movable fence is installed during loading as a barrier to preventunauthorized access. A guard is stationed there when activity is taking place. Ii) Thevehicle parking area is separated. A guard is stationed there to monitor during workingtime

Container storage andvehicle parking lot.jpg

Actual

Nothing in place

Procedure is writtenYes - to all employees, on hire

69. Describe the shipping and receiving areas. Please attach a picture.

70. Describe the final packaging area. Please attach a picture.

71. Describe any container storage and vehicle parking areas and please attach picture.

Security Training & Threat Awareness 100%

Question

72. Should Is a security Threat Awareness training program established and maintained? Is training provided toall new employees and current employees as an annual refresher? Select all that apply.

of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281286/Facility%20building.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281287/Loading%20and%20unloading%20area.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281288/Packing%20area.jpg

https://www.scrisksolutions.com/files/AssessmentAnswers/4281289/Container%20storage%20and%20vehicle%20parking%20lot.jpg

Yes - to all employees, annually

Actual

YesNo

Actual

YesNo

Actual

Nothing in place

Shipping & Receiving controlsSeal controlsContainer/trailer inspectionsContainer/trailer sealing

Actual

Nothing in place

Threat awarenessContrabandHuman smugglingTerrorism


73. Must Does Threat Awareness training identify unique risks for sensitive or restricted areas of the facility suchas final packing, shipping and receiving?


74. Must Does Threat Awareness training inform employees of procedures to report suspicious activity or asecurity incident?


75. Must Does Threat Awareness training provide additional instruction to shipping and receiving employeesregarding access controls, container and trailer inspection, and security seal control procedures? Select allthat apply.


76. Should Does the training program include criteria critical to security programs such as Threat Awareness,Contraband, Human Smuggling and Terrorism? Select all that apply.


77. Should Does the facility have a program to recognize an employee when reporting a security incident orrecommending improvements?

of 38

Actual

Nothing in place

Incentive/recognition program

Actual

Nothing in place

Policy is writtenAssignment and removal of access controlsNA

Actual

Nothing in place

Individually assigned accountsPeriodic password changesNA

Actual

Nothing in place

Procedure is written - Automated back-up

Procedure is Written -Manual back-upProcedure is written - No back-ups

NA

Actual

YesNo

NA


Information Technology Security 79%

Question

78. Must Is a written information technology system security policy in place? Select all that apply.


79. Must Do automated systems at the facility have individually assigned user accounts that require a periodicchange of password? Select all that apply.


80. Should Are written procedures and automated back-up capabilities in place to protect against the loss of data?

Additional Comments: The facility backs up its data weekly by manual backup.

81. Should Are automated systems in place to monitor for and prevent attempts of unauthorized access andtampering with systems and/or electronic data?


of 38

Actual

Nothing in placeEmployees trained

Training documented and retained

Training material available

NA

Actual

YesNo

NA

Actual

YesNo

Signed openingmeeting letter.jpg

82. Should Are employees with computer systems access aware of and receive training about informationtechnology system policies, procedures, and security standards; and is employee training documented andretained? Select all that apply.

Additional Comments: No information technology training was provided to the employees.

83. Should Is an employee who violates or abuses the information technology policies and procedures subject todisciplinary action?


84. Did the Factory Representative and the Auditor sign the Opening Meeting Letter? Please attach the signed copy.


of 38

https://www.scrisksolutions.com/files/AssessmentAnswers/4281302/Signed%20opening%20meeting%20letter.jpg

ATTACHED DOCUMENTATION - PHOTOS

Container & Trailer Security - Question # 6


of 38


of 38

Conveyance Security - Question # 21

of 38

Physical Access Control - Question # 29

of 38


of 38

Procedural Security - Question # 48

of 38

Procedural Security - Question # 50

of 38

Physical Security - Question # 55

of 38



of 38


Information Technology Security - Question # 84

of 38

Son Ha Hue Company Limitederp.hansae.com/sharefile/Compliance/Survey/Carters_2019...Son Ha Hue...

Documents

Transcript of Son Ha Hue Company Limitederp.hansae.com/sharefile/Compliance/Survey/Carters_2019...Son Ha Hue...