INTERNATIONAL TRADE LAW
Export Compliance Audits: How to Prepare and Pass
An export compliance audit is a systematic review of whether your shipments actually followed export law — and the best way to manage one is to run it on yourself first. Whether the audit is internal, performed by an outside expert, or conducted by a government agency, it asks the same questions: were items classified correctly, were the parties screened, were required licenses obtained, and were the records kept? Companies that self-audit on a schedule rarely get surprised by the government version.
This guide covers the two kinds of audit, how to prepare, what auditors ask for, the findings that come up most, and how to respond when they do.
Two kinds of audit, one set of questions
There are two situations to plan for, and the preparation is largely the same.
- Self-audit (internal or outside-led). You schedule it. It is a proactive check of your own program, and it is the one you control. A finding here is a chance to fix a problem quietly before it becomes a violation.
- Government audit. An agency such as the Bureau of Industry and Security (BIS) reviews your exports, often after a red flag or as part of broader enforcement. You do not control the timing, so readiness is the only lever.
Both test the same compliance backbone: classification, screening, licensing, and recordkeeping. Build for one and you are built for both.
How to prepare
- Know the rules that apply to you. Confirm which regulations govern your exports and stay current as they change.
- Define the scope. Decide what the audit will cover — which products, destinations, and time period — and focus on your highest-risk activity first.
- Have the manual in hand. A current export compliance manual gives auditors and employees a single reference. If your program is informal, formalize it first — see how to build an export compliance program.
- Run an internal self-audit before any external one. Pull a sample of real shipments and trace each from classification through screening, licensing, filing, and records. Gaps you find yourself are gaps you can fix on your own terms.
- Assemble the records. Make sure the documentation below is current and retrievable, not scattered across inboxes.
- Brief the people involved. Tell the employees who handle exports what is coming and what their role is.
What auditors ask for
An auditor reconstructs each transaction from the paper trail. These are the records that need to be on hand.
| Record | Why the auditor wants it |
|---|---|
| Compliance policies and procedures manual | Shows the program exists and defines the standard you are measured against |
| Classification determinations (ECCN/EAR99) | Proves each item was assessed before export, with a documented basis |
| Restricted-party screening results | Demonstrates every party was screened against the Consolidated Screening List |
| Export licenses and authorizations | Confirms controlled shipments were authorized |
| Transaction records (invoices, shipping docs, EEI/ITN) | Reconstructs what actually shipped, to whom, and on what terms |
| Training records | Evidence that the people handling exports were trained |
The findings that come up most
Audits surface the same handful of weaknesses across most companies. Knowing them lets you check for each in your own review.
| Common finding | What it looks like |
|---|---|
| Incomplete recordkeeping | Missing or unretrievable files for past shipments |
| Misclassification | Wrong or undocumented ECCN; EAR99 assumed without analysis |
| Screening failures | Parties not screened, or screened once and never rescreened |
| Missing licenses | Controlled items shipped with no license or exception |
| Thin training | Employees who touch exports never trained or refreshed |
| Weak internal controls | No separation of duties; one person controls the whole export |
Responding to findings
A finding is not the end of the world — how you respond is what matters. Evaluate the severity of each, build a corrective-action plan with owners and deadlines, implement the fixes promptly, and document the whole remediation so you can show what changed and when. Then verify the fix actually held on the next cycle.
Where a self-audit uncovers an apparent violation, a voluntary self-disclosure to the controlling agency is worth weighing with counsel: agencies including BIS treat a timely, complete voluntary disclosure as a significant mitigating factor when resolving a matter. That is one of the strongest reasons to self-audit before the government does — discovering and disclosing a problem yourself is treated very differently from being caught.
Keep records for five years
Audit readiness ultimately rests on recordkeeping. The Export Administration Regulations require exporters to retain transaction records for five years (15 CFR Part 762), and the Foreign Trade Regulations impose the same five-year period on export filings. A centralized, retrievable record system is what turns an audit into a paperwork exercise instead of a crisis. Pair it with disciplined export documentation and accurate classification, and most audits resolve cleanly.
Frequently asked questions
How often should we run a self-audit? On a regular cadence — at least annually for most exporters, and more often if you ship controlled items or to higher-risk destinations. The point is to find issues before they age into bigger problems.
What is the most common audit finding? Incomplete recordkeeping. Companies often cannot produce a complete file for older shipments, which is itself a compliance failure regardless of whether the underlying export was proper.
Should we disclose a violation we find ourselves? Often yes, but weigh it with counsel. A timely, complete voluntary self-disclosure is treated by agencies like BIS as a significant mitigating factor, which is a major reason to audit yourself first.
How long do we keep export records? Five years — under both the Export Administration Regulations and the Foreign Trade Regulations — covering classifications, screening, licenses, and shipping documents.
Want your export program audit-ready before anyone asks? Reidel Law Firm delivers a flat-fee Import/Export Compliance Memo that reviews your classification, screening, licensing, and records — with direct attorney access. Get a flat-fee compliance memo →
