INTERNATIONAL TRADE LAW
Benchmarking Your Sanctions Compliance Program
Benchmarking your sanctions compliance program means measuring your controls against an external standard — OFAC’s own framework and the practices of comparable companies — to find the gaps before a regulator does. It is one way to satisfy the fourth component of OFAC’s compliance Framework: testing and auditing. Benchmarking does not replace an independent audit, but it gives you a structured, repeatable way to ask “is our program actually good, or just busy?” This guide shows how to do it without fooling yourself.
What benchmarking is — and is not
Benchmarking compares your program against a reference point and surfaces where you fall short. The most authoritative reference point is not a competitor; it is OFAC’s 2019 Framework for OFAC Compliance Commitments and the pattern of conduct OFAC rewards or penalizes in its public enforcement actions. Peer practice is a useful secondary lens, but “everyone in our industry does it this way” is not a defense if the way everyone does it is wrong.
Benchmarking is a self-assessment tool, not an independent audit. Testing and auditing under OFAC’s framework calls for genuinely independent review; benchmarking is the cheaper, more frequent check that tells you where to point that review.
Benchmark against the five components
The cleanest benchmark is OFAC’s own five-component model. Score your program honestly against each, and the weak spots become obvious.
| Component | A strong program shows… |
|---|---|
| Management commitment | A funded program, a named compliance officer with real authority, visible leadership support |
| Risk assessment | A current, documented assessment that drives the rest of the controls |
| Internal controls | Written procedures and screening that map to the assessed risks, with clear escalation |
| Testing and auditing | Independent review on a set cadence, with findings tracked to closure |
| Training | Role-based, recurring, and documented training for everyone who touches transactions |
Rate each component, note what evidence supports the rating, and treat any component you cannot back with evidence as a gap. This same model anchors building the program in the first place.
Run the benchmark in four steps
A useful benchmarking exercise is disciplined, not a vague self-congratulation. Work it in four steps. First, pick the standard — OFAC’s framework plus, where available, recognized industry guidance for your sector. Second, gather evidence — pull the actual policies, screening logs, training records, and audit findings rather than relying on what you think the program does. Third, score and find gaps — compare the evidence to the standard and rank the shortfalls by risk. Fourth, build an action plan — assign each gap an owner, a fix, and a deadline, then track it to closure. A benchmark that produces a tidy report and no follow-up is wasted effort.
Use the right reference points
Choose benchmarks that actually fit your business. Regulatory alignment comes first: the standard has to reflect the sanctions rules that apply to you. Then relevance — compare against organizations of similar size, sector, and risk exposure, because a global bank’s program is not the right yardstick for a mid-size exporter. And rely on credible sources: regulators, established industry associations, and recognized compliance guidance, not marketing material from a vendor selling a tool.
Avoid the common traps
Benchmarking goes wrong in predictable ways. The most dangerous is grading your own homework generously — scoring intentions instead of evidence. Others include treating peer practice as the ceiling rather than the floor, benchmarking once and never repeating it, and producing findings that no one is accountable for fixing. Tie the exercise to a real owner and a real calendar, and feed the results into your risk assessment and training so the gaps actually close. Keep the documentation: OFAC now requires sanctions-relevant records to be retained for ten years (extended from five, effective March 12, 2025), and your benchmark findings and remediation are part of showing the program is tested and improving.
Frequently asked questions
Is benchmarking the same as an OFAC audit?
No. Benchmarking is a structured self-assessment against an external standard. Testing and auditing under OFAC’s framework contemplates genuinely independent review. Benchmarking tells you where to focus the audit; it does not replace it.
What standard should we benchmark against?
Start with OFAC’s 2019 Framework for Compliance Commitments and the conduct reflected in its enforcement actions. Add sector-specific industry guidance where it exists. Peer practice is a secondary reference, not the primary one.
How often should we benchmark?
On a set cadence — at least annually — and again after any material change in your business or the sanctions landscape. The value comes from repeating it and tracking whether last cycle’s gaps actually closed.
What do we do with the results?
Turn them into a prioritized action plan with owners and deadlines, then track each item to closure. Findings without accountable follow-up do nothing to reduce your exposure.
Benchmarking is the cheapest honest answer to “how good is our program, really?” — and the findings only matter if they drive fixes. Reidel Law Firm benchmarks and reviews sanctions compliance programs for U.S. exporters and importers on a flat fee, then delivers a plain-English gap analysis and prioritized action plan: get a flat-fee compliance memo to start.
