OFAC, EAR and ITAR Compliance Audit: What Exactly Is Reviewed

An OFAC, EAR and ITAR compliance audit is an independent review that checks whether a company’s compliance program effectively detects and blocks transactions prohibited by U.S. sanctions or export controls. It does not measure intentions: it measures real controls. It reviews the components that the implementing agencies consider essential —management commitment, risk assessment, internal controls, testing and auditing, and training— and compares what the policies say with what actually happens in day-to-day operations.

For a non-U.S. company, this audit is the fastest way to find out whether it is exposed before OFAC, BIS (the Commerce Department’s Bureau of Industry and Security) or DDTC (the State Department’s Directorate of Defense Trade Controls) does. At Burke Compliance we approach it as a decision-oriented review: what is failing, how much risk it creates and what gets fixed first. For the full scope, see our audits and due diligence service. This article explains, point by point, what this kind of audit reviews and which findings come up most often.

What Is a U.S. Economic Sanctions and Export Controls Compliance Audit?

A compliance audit against U.S. economic sanctions and export control regulations is an objective assessment of an organization’s compliance program, carried out by personnel independent of the functions being audited. Its purpose is to verify that the program works as designed and to identify weaknesses before they turn into violations. OFAC, BIS and DDTC regard it as a fundamental component of a sanctions compliance program (SCP) and recommend that it be comprehensive, independent and objective.

The audit does not replace the program: it puts it to the test. A well-built OFAC, EAR and ITAR compliance program defines policies, screening, training and escalation; the audit checks whether those pieces hold up in a real case. It can focus on a specific element —for example, counterparty screening alone— or cover the whole company. In both cases, a negative finding requires immediate action with compensating controls while the root cause is fixed.

What Exactly Does a Compliance Audit Review?

A compliance audit reviews five main areas: management commitment, risk assessment, internal controls, testing itself and training. These areas match the essential components of the frameworks published by OFAC, BIS and DDTC. (See the OFAC, BIS and DDTC publications in Documents 1, 2 and 3.) Each one is tested with specific checks on the company’s real cases, not generic questionnaires.

Management Commitment

The audit checks whether senior management has approved the program in writing, whether there is a designated compliance officer with real authority and autonomy, and whether there are direct reporting lines between compliance and management. The auditor looks for evidence, not statements: minutes, an allocated budget, an organization chart in which compliance does not report to the sales unit it is supposed to control.

Risk Assessment

The audit reviews whether the company has mapped its points of contact with the outside world: customers, supply chain, intermediaries, products, technologies, equipment, export control classifications, end uses and end users, and geographic locations. A weak risk assessment is the source of almost every other failure. The auditor verifies that risk is assessed when each counterparty is onboarded and reassessed in sensitive transactions, especially mergers and acquisitions, where the agencies have identified numerous problems.

Internal Controls and Screening

This is the core of the audit. The screening software is tested against restricted party lists (the SDN List and others), and the audit checks that it is updated every time a designation changes. This is where poorly applied counterparty due diligence shows up: filters that do not include complete information on blocked entities, no application of the 50 Percent Rule, or no control over alternative spellings of sanctioned countries —”Habana” for “Havana”, “Kuba” for “Cuba”— that let real matches through. Other risk elements are also tested, including the presence of U.S. items and technology in products, the use of U.S. technology, and transactions in sensitive sectors or geographies.

Testing, Auditing and Records

The auditor reviews whether the company tests itself regularly and keeps the records required by OFAC, BIS and DDTC regulations. The auditor also checks that, when a previous test detected a weakness, the root cause was fixed and not just the symptom. A program that never generates its own findings is usually a program that is not being tested.

Training

The audit verifies that relevant staff receive periodic training —at least annually— tailored to their role, sector, products and technologies and to the regions where the company operates, and that there is a mechanism to measure whether the training has been understood. Generic training that nobody remembers does not pass the test.

The Failures an Audit Most Often Detects

The most common compliance audit findings match the root causes that OFAC, for example, has identified in its enforcement cases. Knowing them in advance allows the review to focus where the real risk lies.

• No formal program. The company operates without a written SCP. The agencies treat this as an aggravating factor in their penalties.
• Misreading whether the rules apply. Believing that U.S. sanctions or export controls do not apply because the company is not American or operates outside the United States. It is necessary to analyze, among other criteria, whether there is a U.S. nexus, whether U.S.-origin goods, components or technology are involved, or whether the U.S. financial system is involved.
• Participating in restricted transactions involving U.S. entities or persons. The participation of U.S. entities or persons in a transaction creates a U.S. nexus and exposes all participants, including non-U.S. entities, to the risk of violating primary sanctions if any aspect of the transaction is restricted by sanctions.
• Screening software failures. Outdated filters, incomplete information or blindness to alternative spellings.
• Presence or incorporation of U.S.-origin items or technology in transactions. Under both economic sanctions and export controls, the presence of U.S.-origin items or technology can subject transactions to restrictions and possibly to prior licensing requirements.
• Incomplete customer due diligence. Failing to verify the counterparty’s beneficial ownership and location.
• Decentralized compliance. Decisions spread across offices without a common escalation process.

Each finding is documented with its risk level and a specific recommendation. The value of the audit lies not in the list of failures but in the order of correction: what exposes the company to a strict liability violation and must therefore be fixed first.

When Should You Carry Out a Compliance Audit?

A compliance audit should be carried out periodically and also in response to certain events that multiply risk. The frequency depends on the risk profile, but there are four moments when it is practically mandatory.

1. Before or after a merger or acquisition. The company inherits the sanctions history of what it buys. A post-integration audit is critical to surface hidden risks.
2. When entering new markets or product lines. The risk map changes and previous controls may fall short.
3. After a significant regulatory change. New designations, executive orders, or updates to the export control de minimis rules or Foreign Direct Product Rules affecting the sector.
4. Before a voluntary self-disclosure. If a violation is suspected, the audit sizes its scope before approaching the agency, and the agency requires it as part of its assessment process.

Internal Audit vs. External Audit

The key difference between an internal and an external audit is independence. The agencies require the testing function to be independent of the audited activities and to have sufficient authority. An internal audit is useful for ongoing control but loses objectivity when the reviewer reports to the people who run the operations. An external audit brings an independent perspective, experience from comparable cases and a report that serves as evidence of diligence before the agency itself.

For most non-U.S. companies, the most effective model combines both: frequent internal control and a periodic external review that validates the whole. That is the balance we offer in Burke Compliance’s audits and due diligence service.

In practice

A European manufacturer of industrial components requests an audit after buying a subsidiary in the Middle East. On paper, both have a sanctions policy. In the real test, the subsidiary’s filter does not include the latest SDN List designations and does not apply the 50 Percent Rule: it was letting through a company majority-owned by a blocked party.

The finding was not yet a violation —that would only happen once a transaction with the prohibited party took place—; it was an exposure. An immediate compensating control is put in place —manual blocking and rescreening of the inherited portfolio— while the software of both entities is unified. The lesson repeats itself: the risk is almost never in the policy; it is in the gap between the policy and what the system does every morning.

Frequently Asked Questions

Is an OFAC, EAR or ITAR compliance audit mandatory?

In general, the regulations do not require a formal program or an audit of it, except in certain circumstances such as a voluntary self-disclosure of a violation. However, the agencies view the existence of an effective, audited program favorably as a mitigating factor and treat its absence as an aggravating one. In practice, for any company with international operations, an audit is a risk management measure, not an optional formality.

How often should it be repeated?

There is no single legal timeframe. A review is recommended at a frequency consistent with the risk profile —annually for medium and high risk profiles— and always in the event of mergers, entry into new markets or significant regulatory changes affecting the sector.

What is the difference between an audit and counterparty due diligence?

The audit assesses the company’s entire program; counterparty due diligence checks a specific customer, supplier or partner. Due diligence is one of the controls the audit verifies are working.

Does an audit serve as a defense before OFAC, BIS or DDTC?

An effective, tested program with remediated findings is a mitigating factor that the agencies take into account when determining the response to a violation. A documented audit is the evidence that the program exists and works.

Want to know whether your program would withstand an OFAC, BIS or DDTC review? Request a compliance audit with Burke Compliance or write to us through our contact page.

Referenced documents

1. A Framework for OFAC Compliance Commitments: https://ofac.treasury.gov/media/16331/download?inline
2. BIS Elements of an Effective Compliance Program: https://www.bis.gov/learn-support/export-compliance-programs#the-eight-elements-of-an-effective-export-compliance-program
3. DDTC Compliance Program Guidelines: https://www.pmddtc.state.gov/ddtc_public?id=ddtc_kb_article_page&sys_id=KB0010123