INTERNATIONAL TRADE LAW
Sanctions Audit Checklist: Test Your OFAC Program
A sanctions audit is an independent test of whether your OFAC compliance program actually works — not whether it exists on paper. This checklist walks the audit from scope and independence through transaction sampling, screening tests, and remediation. It covers the “testing and auditing” pillar of a sanctions program; for the whole framework, see the international trade compliance program checklist.
Auditing is one of the five components the Office of Foreign Assets Control (OFAC) names in its 2019 Framework for OFAC Compliance Commitments: management commitment, risk assessment, internal controls, testing and auditing, and training. An audit is how you find the gap before OFAC does.
Why a Sanctions Audit Matters
OFAC enforces civil penalties on a strict-liability basis — a company can be liable for a prohibited transaction even with no intent and no knowledge. An audit is the cheapest way to catch a control failure while it is still a finding instead of a violation.
It also pays off if something does slip through. Under OFAC’s Economic Sanctions Enforcement Guidelines, the existence and quality of a compliance program — including whether you test it — is a mitigating factor in how a penalty is calculated. A program that is audited and remediated looks very different from one that was never checked.
What to Audit
A useful audit maps to the same five framework areas the program is built on. Each gets its own evidence question.
| Framework area | The audit asks |
|---|---|
| Management commitment | Are resources, authority, and a named owner actually in place? |
| Risk assessment | Is the risk assessment current and tied to real products, customers, and geographies? |
| Internal controls | Do written procedures match what employees actually do? |
| Testing and auditing | Are screening hits and prior findings tracked to closure? |
| Training | Did the people in risk-facing roles complete relevant training? |
The Audit Checklist
Set Scope and Independence
- Define the period, business units, and transaction types under review before you