Trade compliance audit checklist for importers and exporters

a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}

What a trade compliance audit checklist should cover

A trade compliance audit checklist should help an importer or exporter verify three points: shipment data is accurate, required documents support each declaration, and internal controls can detect and correct errors before regulators, customers or banks identify them. The checklist should not stop at filing accuracy. It should cover governance, product classification, customs valuation, country of origin, export controls, sanctions screening, broker instructions, freight records, recordkeeping and corrective actions. For companies trading across several markets, the most useful checklist is risk-based: high-value goods, regulated products, new suppliers, new destinations and repeated data changes usually deserve more testing than routine low-risk shipments.

This article provides a practical framework for building and using a trade compliance audit checklist in a documentation-focused trade environment. It draws on common expectations reflected in customs, export-control and sanctions compliance guidance from authorities such as U.S. Customs and Border Protection, the Bureau of Industry and Security, the Office of Foreign Assets Control, and European customs guidance under the Union Customs Code. It is not legal advice, and the checklist should be adapted to the jurisdictions, products and routes that apply to each business.

Start by defining audit scope and risk

A strong audit starts before any invoice or customs declaration is reviewed. The first step is to define the scope clearly enough that the review can be repeated and defended. A company should identify which legal entity, business unit, product line, country, broker, freight forwarder, supplier group or date range will be tested. Without that boundary, the review can turn into a general discussion instead of an evidence-based audit.

The audit scope should be tied to risk. Importers and exporters often face higher exposure where products are technically complex, subject to licenses or permits, shipped to restricted destinations, sourced from multiple countries, entered under preferential duty programs, or handled by new service providers. Regulators also expect companies to understand their own transactions. For example, customs authorities generally expect importers to know the goods being entered, maintain reasonable support for classification and valuation, and keep records that explain how declarations were made.

Before sampling shipments, document the following:

• The audit period, such as the previous quarter, previous fiscal year or a defined shipment campaign.
• The trade lanes and countries covered.
• The systems used for purchasing, product master data, logistics, customs brokerage and export screening.
• The responsible teams, including trade compliance, logistics, finance, procurement, sales and customer service.
• The regulations or internal policies used as the audit criteria.
• The sampling method, such as random selection, risk-based selection or a combination of both.

For documentation-heavy teams, it can help to keep audit files close to the operating procedures that generate them. Related guidance can be organized under a central trade documentation resource so that staff can find templates, instructions and review notes in one place.

The core checklist for trade documentation audits

The following checklist is designed for practical review. It is not a substitute for country-specific legal advice, but it gives teams a structured way to test whether commercial, logistics and regulatory data tell the same story.

Audit area	Records to review	Test questions	Evidence of control
Governance and responsibility	Compliance policy, procedure manuals, role descriptions, escalation logs	Who owns classification, valuation, origin, license review and broker instructions? Are approvals documented?	Current procedures, named owners, approval records and issue logs
Product classification	Product master data, technical sheets, bills of material, HS or tariff classification files, export classification records	Do classifications match product descriptions and technical specifications? Are changes reviewed before use?	Classification rationale, review dates and version control
Commercial invoice quality	Invoices, purchase orders, sales orders, packing lists and shipment confirmations	Do descriptions, quantities, values, currency, Incoterms and parties match across documents?	Invoice review checklist and exception resolution notes
Customs valuation	Invoices, payment records, assists, royalties, commissions, freight and insurance data	Are declared values supported by transaction records? Were additions or deductions considered where required?	Valuation worksheet and finance sign-off for complex transactions
Country of origin	Supplier declarations, manufacturing records, certificates of origin and product sourcing data	Is origin based on manufacturing facts rather than ship-from location? Are preferential and non-preferential origin separated?	Origin determination file and supplier evidence
Duty preference and trade programs	Preference claims, origin certificates, supplier statements and claim calculations	Does the shipment qualify under the specific rule of origin? Is evidence retained for each claim?	Eligibility analysis, certificate review and periodic supplier refresh
Export controls and licenses	Export classification, end-use statements, destination checks, license files and shipment holds	Was license determination completed before export? Were restricted end uses or end users reviewed?	Screening results, license determinations and blocked-shipment records
Sanctions and restricted-party screening	Customer, supplier, consignee, vessel and bank screening logs	Were parties screened at onboarding and before shipment? Are potential matches resolved by trained staff?	Screening logs, match-resolution records and escalation approvals
Broker and forwarder oversight	Broker powers of attorney, standard instructions, entry packets, post-entry messages and broker KPIs	Did service providers receive accurate written instructions? Are entries checked after filing?	Broker instruction templates, entry review logs and correction records
Recordkeeping	Entry files, export files, correspondence, permits, screening records and corrections	Can the company retrieve complete records within the required retention period?	Retention schedule, archive controls and retrieval test results
Corrective action	Audit findings, root-cause analysis, disclosures, amendments, training records	Are errors corrected at source, or only fixed shipment by shipment?	Corrective action plan, owner, due date and effectiveness review

How to test import records

Import testing should compare the official customs entry with the documents that created it. A practical sample usually includes the commercial invoice, packing list, transport document, customs declaration, duty payment record, purchase order, payment evidence and broker communication. The purpose is to confirm that the entry was not prepared from incomplete or inconsistent information.

Start with tariff classification. The auditor should check whether the product description in the invoice is specific enough to support the declared tariff code. Generic descriptions such as “parts,” “samples,” “accessories” or “equipment” often do not provide enough detail for a defensible classification. If a product was classified using technical characteristics, the file should contain datasheets, composition details, use descriptions or engineering input.

Next, review customs value. The invoice value should be compared with purchase orders, payment records and any known additions such as assists, royalties, tooling, commissions or certain packing costs where applicable. If the declared value differs from the commercial invoice, the file should explain why. If related parties are involved, the audit should check whether transfer pricing, customs valuation and finance documentation are aligned rather than handled as separate silos.

Country of origin is another frequent weak point. Origin should be supported by production facts, not simply by the location from which the goods were shipped. For resold goods, distributors may not know the true manufacturing origin unless the company requires supplier evidence. If a preferential duty claim was made, the audit should test whether the exact rule of origin was met and whether the certificate or statement was valid for the shipment period and product.

Finally, review post-entry activity. Corrections, protests, voluntary disclosures, duty refunds and broker messages can reveal recurring control failures. If the same type of correction appears repeatedly, the audit finding should address the upstream data source, not just the individual entry.

How to test export records

Export testing should confirm that goods, technology, software, destinations, end users and end uses were reviewed before shipment or transfer. The review should not stop at the export invoice. In many companies, relevant information sits in engineering, sales, customer onboarding, order management and logistics systems.

The first export test is classification. The file should show whether the item is subject to export-control rules and whether an export control classification has been assigned by a qualified person or approved process. Technical changes can alter classification, so the audit should check whether engineering changes trigger a compliance review.

The second test is destination and party screening. A shipment may involve a purchaser, consignee, intermediate consignee, freight forwarder, bank, vessel, parent company or end user. A sanctions or restricted-party control is stronger when it screens relevant parties at onboarding and again close to shipment, especially where lists change or where the transaction has been delayed.

The third test is license determination. If a license exception, general authorization or no-license-required conclusion was used, the file should explain the basis for that decision. If a license was required, the audit should compare the shipment with license conditions such as quantity, value, destination, end user, expiration date and reporting requirements.

The fourth test is end-use review. Red flags can include vague product applications, reluctance to provide end-use information, unusual routing, mismatch between customer profile and product capability, or requests to alter documentation. The audit should confirm that staff know how to stop and escalate shipments when red flags appear. See also: Customs and Compliance.

Common red flags in a trade compliance audit

Red flags do not always prove a violation, but they show where the compliance team should ask more questions. The most important warning signs are usually patterns, not isolated paperwork imperfections.

• Product descriptions differ between sales orders, invoices, packing lists and customs entries.
• The same product has multiple tariff classifications without documented justification.
• Country of origin is copied from the supplier invoice without manufacturing evidence.
• Preference claims are made automatically because a supplier provided a certificate, with no review of the applicable rule.
• Declared customs value excludes assists, tooling, royalties or other cost elements that finance tracks separately.
• Broker entries are rarely reviewed after filing.
• Restricted-party screening is performed only on direct customers and not on consignees, banks, forwarders or known end users.
• Export license decisions are stored in email but not in a searchable compliance record.
• Manual overrides in ERP, screening or customs systems are not reviewed.
• Corrective actions close without testing whether the same error stopped recurring.

A mature audit treats these red flags as control signals. The finding should identify the process failure, the affected transactions, the likely root cause and the corrective action owner.

Turn findings into corrective actions

An audit has limited value if it produces a list of errors but no measurable improvement. Each finding should be written in plain language and tied to evidence. A useful format is condition, criteria, cause, impact and action. The condition states what was found. The criteria identify the policy, regulation or procedure that should have applied. The cause explains why the issue occurred. The impact describes the risk. The action assigns an owner, deadline and verification step.

Corrective actions should focus on the source of the problem. If invoices often lack product detail, retraining the customs broker will not solve the issue by itself. The better action may be to revise the invoice template, update the product master, require technical descriptions from product teams and block shipment creation when mandatory fields are missing. If sanctions screening misses intermediate consignees, the action may require a data-field change in order management, not only a reminder to logistics staff.

Companies should also decide when issues require escalation. Some errors may be corrected through normal post-entry or internal processes. Others may require legal review, formal disclosure, customer notice, license amendment or management reporting. The audit procedure should describe who makes that decision and how it is documented.

After actions are implemented, retesting is essential. Retesting can be narrow: for example, review 20 shipments after a classification update, or compare all entries for one tariff code during the next quarter. The goal is to confirm that the control works in live transactions, not only on paper.

Building an audit cadence that fits the business

There is no single audit frequency that fits every trader. A small importer with stable products and one customs broker may not need the same cadence as a multinational exporter shipping controlled technology to many markets. A practical approach is to combine scheduled reviews with event-based reviews.

Scheduled reviews might cover high-volume import entries each quarter, export controls twice a year and recordkeeping annually. Event-based reviews should be triggered by changes such as a new supplier country, acquisition, new broker, new product family, new export destination, tariff change, sanctions update, preferential program claim, regulatory inquiry or repeated broker correction.

Audit results should be visible to management. Authorities such as BIS and OFAC emphasize that compliance programs work better when management commitment, risk assessment, internal controls, testing and training operate together. In practical terms, audit findings should not sit only with the compliance team. Procurement, sales, finance, logistics, engineering and IT often control the data that determines whether trade declarations are correct.

Frequently asked questions

How often should a trade compliance audit be performed?

Most companies benefit from at least an annual review of their trade compliance program, with more frequent transaction testing for high-risk products, markets or brokers. Event-based audits should also be used when the business changes, such as entering a new country, adding a new supplier or launching a regulated product.

What is the difference between a customs audit and a trade compliance audit?

A customs audit usually focuses on import declarations, duty, classification, valuation, origin and recordkeeping. A trade compliance audit is broader. It can include customs, export controls, sanctions, restricted-party screening, licenses, trade documentation, service-provider oversight and corrective action management.

Who should own the checklist?

Trade compliance should usually own the checklist, but the evidence comes from several departments. Finance supports valuation, engineering supports technical classification, procurement supports supplier and origin evidence, sales supports end-use information, and logistics coordinates broker and forwarder records.

Can a customs broker replace an internal audit?

No. A broker can help file entries and may provide valuable advice, but the importer or exporter still needs internal controls over the data given to service providers. A good audit checks both sides: whether the company sent accurate instructions and whether the broker or forwarder filed according to those instructions.

What should be kept after the audit is complete?

Keep the audit plan, sample list, documents reviewed, findings, root-cause analysis, corrective actions, approvals and retesting results. These records show that the company did more than identify errors; it maintained a controlled process for improving trade compliance.