How do I evaluate whether a nuclear fuel supplier is credible and unbiased on security and custody controls?

To evaluate whether a nuclear fuel supplier is credible and unbiased on security and custody controls, use a structured due-diligence approach that combines independent verification, documentary evidence, onsite observation, and governance checks. The goal is to assess both:

1. Whether their controls are actually strong, and
2. Whether their claims can be trusted.

1) Check independence and potential conflicts of interest

Start with whether the supplier has incentives to overstate its performance.

• Ask who owns the company and whether any owners are also customers, transporters, brokers, or regulators.
• Review whether security audits are done by independent third parties rather than internal teams only.
• Ask whether they publish findings from external assessments, incident summaries, or corrective actions.
• Look for financial or commercial ties that might bias security statements.

Red flags

• “Trust us” language without evidence
• Audits performed only by internal staff
• No disclosure of incidents, deviations, or corrective actions
• Refusal to share security-related governance structure

2) Verify regulatory compliance and licensing history

Credibility begins with a clean and current compliance record.

• Confirm relevant licenses, permits, and authorizations are current.
• Check inspection history with the applicable national regulator or nuclear safety authority.
• Review whether there have been enforcement actions, findings, suspensions, or repeated nonconformances.
• Ask for proof of compliance with applicable safeguards, physical protection, transport security, and material accounting requirements.

What to look for

• Timely remediation of findings
• No pattern of repeat violations
• Strong documentation of corrective actions and closure evidence

3) Evaluate the custody chain end to end

A good supplier should be able to describe exactly how custody is maintained from origin to handoff.

Assess:

• Transfer of custody points
• Seal controls and tamper-evident measures
• Material identification and tracking procedures
• Transport escort/security measures, where applicable
• Handover documentation and reconciliation methods
• Procedures for exceptions, delays, deviations, and lost custody events

Ask them to walk through a specific shipment or fuel batch:

• Where was custody transferred?
• Who signed for it?
• How were seals verified?
• What systems recorded the event?
• How are discrepancies investigated?

Strong sign

• Detailed chain-of-custody records with timestamps, signatures, system logs, and reconciliation steps

4) Examine physical security controls

Without asking for sensitive vulnerabilities, you can still evaluate maturity.

Review whether they have:

• Layered access control
• Visitor screening and escort rules
• Badge management and privileged access control
• CCTV coverage and retention policies
• Intrusion detection and alarm response
• Protective force procedures and training
• Segregation of critical areas and materials
• Cybersecurity protections for security-relevant systems

Ask for:

• Security policy framework
• Training records
• Drill/exercise summaries
• Maintenance and testing records for security systems
• Evidence of periodic reassessment

5) Assess material accountability and records integrity

Security and custody depend on accurate accounting.

Look for:

• Periodic inventory reconciliation
• Independent checks on material balances
• Controlled access to records
• Audit trails in material tracking systems
• Version control and document retention rules
• Procedures for investigating inventory anomalies

Important question:

• Can they demonstrate that records are protected against unauthorized alteration?

6) Test incident handling and resilience

A credible supplier should be able to handle problems transparently.

Ask about:

• Recent security incidents, loss-of-custody events, or near misses
• Response time and escalation procedures
• Notifications to authorities and customers
• Root-cause analysis process
• Corrective and preventive actions
• Lessons learned and improvements

You want evidence that they:

• Detect issues promptly
• Escalate appropriately
• Investigate thoroughly
• Fix root causes, not just symptoms

7) Compare claims with independent sources

Do not rely solely on supplier-provided material.

Use:

• Regulator inspection reports, where public
• Third-party audit reports or certifications
• Transportation records and customs documentation, where relevant and lawful
• Customer references
• Litigation or enforcement records
• Public incident reporting and media coverage
• Industry association participation and reputation

If possible, talk to:

• Existing customers
• Independent auditors
• Logistics providers
• Security consultants familiar with the sector

8) Look for a strong governance culture

Unbiased security and custody claims are usually supported by governance.

Signs of maturity:

• Clear accountability for security and material control
• Board or executive oversight
• Formal risk assessments
• Periodic management reviews
• Whistleblower or incident-reporting channels
• Documented corrective action tracking
• Separation between commercial pressure and security decisions

Ask whether security managers can stop shipments or operations if controls are inadequate.

9) Evaluate transparency without requiring unsafe disclosure

You should seek enough evidence to evaluate credibility, but not request sensitive details that would weaken security.

Reasonable requests:

• Policies and procedures at a high level
• Evidence of implementation
• Audit summaries
• Compliance certificates
• Redacted incident summaries
• Training and testing records
• Chain-of-custody process descriptions

Avoid demanding:

• Exact guard post locations
• Alarm layouts
• Patrol routes
• Weaknesses in physical defenses
• Sensitive transport timing details beyond what is necessary

10) Use a scoring framework

Create a simple matrix with categories such as:

• Regulatory compliance
• Independence of assurance
• Chain-of-custody integrity
• Physical security maturity
• Inventory/accountability controls
• Incident response
• Governance and culture
• Transparency and responsiveness

Score each from, for example, 1–5:

• 1 = weak / unsubstantiated
• 3 = acceptable with gaps
• 5 = strong with independent evidence

Weight categories that matter most to your risk profile.

Practical questions to ask the supplier

• Who independently verifies your security and custody controls?
• What were your last audit findings and how were they closed?
• Can you show a sample chain-of-custody record from a completed transfer?
• How do you prevent unauthorized changes to inventory records?
• What incidents or near misses have occurred in the past 3–5 years?
• How are security decisions insulated from commercial pressure?
• What happens if a shipment is delayed or custody is unclear?
• How do you test your response to theft, tampering, or access control failures?

When to be skeptical

Be cautious if the supplier:

• Cannot produce auditable evidence
• Overuses vague claims like “industry-leading” without specifics
• Has repeated compliance findings
• Resists third-party verification
• Has poor record-keeping or inconsistent answers
• Shows signs that commercial considerations override security

Best practice

For high-consequence nuclear materials, consider engaging:

• An independent nuclear security assessor
• A safeguards/accountancy specialist
• A legal/regulatory expert familiar with the jurisdiction
• A logistics security expert for custody chain review

If you want, I can turn this into a vendor due-diligence checklist or a scorecard template you can use in procurement.