What Should a Trade Compliance Health Check Include?

Trade compliance programs often evolve one decision at a time. A company adds a broker, enters a new market, changes an enterprise system, launches a product, reorganizes responsibilities, or adopts a procedure to address a particular problem. Over time, the written program and day-to-day operations can drift apart.

A health check provides a structured way to step back and evaluate that alignment. It should not be limited to confirming that policies exist. A useful review asks whether responsibilities are understood, source data is reliable, procedures reflect actual workflows, transactions are handled consistently, records support decisions, and identified problems are corrected.

The goal is not to create a perfect binder. The goal is to give leadership a clear view of what is working, where exposure may exist, and which improvements deserve attention first.

What is a trade compliance health check?

A trade compliance health check is a risk-based assessment of a company’s trade-compliance framework and selected activities. It combines document review, interviews, process walkthroughs, data analysis, and transaction testing to evaluate both program design and operating effectiveness.

The scope may cover import compliance, export compliance, or both. It may examine the complete program or focus on a specific business unit, product line, process, location, or recent operational change.

A health check is generally diagnostic and improvement-oriented. It can help leadership establish a baseline, prepare for growth, evaluate a newly inherited program, validate corrective action, or determine whether a deeper audit or investigation is warranted.

Is a health check the same as a formal audit?

The terms are sometimes used interchangeably, but the scope and purpose should be defined before work begins.

A health check is often a targeted assessment designed to identify gaps and improvement priorities efficiently. A formal internal audit may require a more defined methodology, independence standard, testing protocol, evidence trail, and reporting process. A government audit or examination is different from both and follows the relevant agency’s authority and procedures.

The label matters less than clarity. Leadership should understand the objective, scope, methodology, limitations, deliverables, and intended use of the review before testing starts.

What should the health check review?

The strongest reviews connect governance, processes, data, transactions, people, and corrective action. The following areas provide a practical starting framework.

1. Governance, accountability, and management oversight

The review should identify who owns trade compliance, who performs critical tasks, who approves higher-risk decisions, and how unresolved questions reach the right level of management.

Key questions include:

• Is responsibility clearly assigned across legal, compliance, finance, operations, supply chain, engineering, sales, logistics, and information technology?
• Does the trade-compliance function have sufficient authority, access, resources, and independence?
• Are important decisions documented and escalated consistently?
• Does leadership receive meaningful information about risks, errors, corrective actions, and resource needs?
• Are responsibilities maintained when personnel, systems, or business structures change?

An organization chart alone is not enough. Interviews and workflow testing should confirm that employees understand who decides, who reviews, and who acts.

2. Risk profile and review scope

The health check should begin with the company’s actual activities rather than a generic checklist. Relevant considerations may include product complexity, import and export volumes, countries involved, customer and supplier relationships, regulated technology, partner-government-agency requirements, special customs programs, prior errors, acquisitions, and system changes.

The resulting risk profile should determine which business units, processes, data sets, and transaction populations receive deeper review. A lower-volume activity can still merit attention when the potential consequence of error is significant.

The review should also test whether the company’s existing risk assessment is current and whether it influences procedures, training, monitoring, and resource allocation.

3. Policies, procedures, and decision tools

Policies establish expectations, but employees need usable procedures that explain how work is performed.

Reviewers should determine whether procedures:

• Reflect current regulations, systems, products, and organizational responsibilities.
• Identify required inputs, decision points, approvals, records, and escalation paths.
• Address exceptions rather than only routine transactions.
• Are accessible to the employees expected to use them.
• Match the processes employees describe and demonstrate during walkthroughs.
• Include practical tools such as checklists, decision trees, templates, or controlled data fields where appropriate.

A recurring warning sign is a well-written policy that employees cannot translate into a consistent operational decision.

4. Import transaction controls

For import activity, the review should evaluate the information that supports entry accuracy and the controls used to oversee customs brokers and other service providers.

Depending on the company’s risk profile, testing may include:

• Tariff classification and supporting rationale.
• Customs valuation, assists, additions, deductions, and related-party considerations.
• Country-of-origin determinations and supporting documentation.
• Preferential claims and required substantiation.
• Entry data supplied to and filed by customs brokers.
• Reconciliation between purchase, logistics, broker, accounting, and entry records.
• Partner-government-agency requirements applicable to the merchandise.
• Post-entry review, correction, reconciliation, and escalation processes.
• Broker instructions, powers of attorney, performance monitoring, and communication controls.

Testing should trace selected transactions from source records through the filed entry and back again. The objective is to determine whether reported information is accurate, supported, and produced through a repeatable control.

For additional context, see “What Is an Importer of Record Responsible For?”

5. Export transaction controls

For export activity, the health check should evaluate how the company determines jurisdiction and classification, analyzes authorization requirements, controls technology, manages filings, and retains supporting records.

Depending on scope, testing may include:

• Product, software, and technology classifications and their supporting analyses.
• Processes for determining whether an item is EAR99 or described by an ECCN.
• Authorization analysis and approval before release or shipment.
• Destination, end-user, and end-use review within the company’s export-control procedures.
• License conditions and other authorization requirements when applicable.
• Electronic Export Information and other shipment documentation.
• Controls over technology access, transfer, and release.
• Freight-forwarder instructions and verification of filed information.
• Recordkeeping and evidence supporting the company’s decisions.

The review should confirm that classifications and approvals are not merely stored in a system, but are supported, current, and used at the correct point in the workflow.

See “What Is an ECCN, and How Do You Determine Whether a Product Is EAR99?” for additional classification context.

6. Data integrity, systems, and reporting

Trade decisions depend on data that may originate in product, purchasing, engineering, sales, logistics, broker, finance, or enterprise systems. A health check should examine how those data elements are created, approved, transferred, changed, and monitored.

Reviewers should look for:

• Conflicting values across systems.
• Missing or default classifications.
• Uncontrolled manual overrides.
• Incomplete audit trails.
• Data changes without review or approval.
• Interface failures between internal systems and third parties.
• Reports that cannot be reconciled to source transactions.
• Access rights that do not reflect current responsibilities.

Importers may also use ACE data to identify trends, discrepancies, unexpected filers, classification patterns, value anomalies, or other issues that merit review. Data analysis should guide transaction sampling rather than replace examination of the underlying records.

7. Training, communication, and escalation

Training should reflect the decisions employees actually make. A health check should evaluate who receives training, whether the content is role-based, how completion is documented, and whether employees know when and how to seek help.

Interviews can reveal whether employees understand:

• Their responsibilities within the trade process.
• The limits of their authority.
• The records they must create or retain.
• The warning signs that require escalation.
• The internal resource or process for obtaining guidance.

Training records show attendance. Interviews, transaction testing, and workflow observations help determine whether the training changed behavior.

8. Recordkeeping and documentation

The review should test whether the company can retrieve complete records that explain and support its trade decisions. That includes more than final filings. Supporting analyses, source documents, approvals, communications, instructions, and correction records may be necessary to reconstruct what occurred and why.

The health check should compare retention practices with applicable requirements, including 19 CFR Part 163 for customs records and 15 CFR Part 762 for records under the Export Administration Regulations, as relevant to the company’s activities.

Reviewers should also examine storage locations, access controls, naming conventions, retention settings, third-party dependencies, and the company’s ability to produce records promptly.

9. Monitoring, issue management, and remediation

A mature program does not stop when an error is identified. The health check should determine how the company records issues, evaluates significance, identifies root causes, assigns corrective action, monitors deadlines, and verifies completion.

An effective remediation process should answer:

• What happened?
• Why did the control fail or fail to exist?
• Which transactions, products, systems, or business units may be affected?
• What immediate containment is appropriate?
• What long-term corrective action will address the root cause?
• Who owns the action and when is it due?
• What evidence will demonstrate completion?
• When and how will the corrected control be retested?

Closing a task is not the same as proving that the underlying risk has been reduced.

If a review identifies a potentially significant compliance issue, the company should preserve relevant records, assess the facts promptly, and obtain case-specific professional advice before deciding next steps.

How should transaction testing be designed?

There is no universal sample size that works for every health check. Testing should be tied to the objectives, available population, risk indicators, materiality, transaction diversity, prior findings, and reliability of the data.

A practical approach may combine:

• Targeted selections based on identified risk.
• Data-driven selections for unusual values or patterns.
• Representative selections across products, locations, brokers, customers, suppliers, or business units.
• Follow-up selections tied to known errors or corrective actions.
• Limited random selections to test ordinary activity.

The report should explain how transactions were selected and the limits of the testing. A small diagnostic sample can identify warning signs, but it should not be presented as proof that an entire population is error-free.

Who should participate in the review?

Trade compliance rarely sits within one department. The review team should include the functions that create, approve, transmit, rely on, or retain relevant information.

Depending on scope, participants may include:

• Executive sponsors and business-unit leaders.
• Trade compliance, legal, and internal audit.
• Finance, tax, and accounting.
• Supply chain, sourcing, procurement, and logistics.
• Product, engineering, and information technology.
• Sales, customer service, and order management.
• Human resources and training personnel.
• Customs brokers, freight forwarders, or other service providers when appropriate.

Independent perspective can be valuable when internal teams are stretched, responsibilities have recently changed, or leadership wants an objective assessment of established practices.

What should the final health-check report contain?

The report should help leadership make decisions. At a minimum, it should include:

• The objective, scope, period, and methodology.
• The business units, systems, documents, data, and transaction populations reviewed.
• Any limitations or areas outside scope.
• A concise executive assessment of strengths and priority concerns.
• Findings supported by evidence.
• The control expectation, observed condition, risk, and likely root cause for each finding.
• Practical recommendations proportionate to the issue.
• A risk-based prioritization method.
• Responsible owners and target completion dates.
• Immediate containment steps where appropriate.
• A plan for management follow-up and retesting.

The most useful reports distinguish urgent matters from longer-term program improvements. They also recognize effective controls so the company can preserve what is working while directing resources to the highest priorities.

How often should a trade compliance health check be performed?

No single schedule fits every company. The frequency should reflect the organization’s risk profile, transaction volume, regulatory environment, prior findings, available monitoring, and pace of change.

BIS identifies regular risk assessment and auditing as elements of an effective export compliance program, and its current guidance recommends export risk assessments at least annually. That does not mean every company must conduct the same full-scope health check each year. A company may combine ongoing monitoring, targeted reviews, periodic transaction testing, and broader program assessments based on risk.

Events that may justify a new or expanded review include:

• Entry into a new country or market.
• Significant changes in products, technology, sourcing, customers, or suppliers.
• A merger, acquisition, divestiture, or reorganization.
• A new enterprise, product, broker, or logistics system.
• Turnover in key compliance or operational roles.
• A material error, repeated exception, or overdue corrective action.
• An agency inquiry or anticipated examination.
• Rapid growth or a meaningful change in transaction volume.

CTPAT Trade Compliance program-specific requirements apply to participating companies. Its framework provides useful context for internal controls, annual risk assessment, self-testing, corrective action, audit trails, and management reporting—not universal requirements for every importer.

The central question is whether leadership has current, evidence-based assurance that controls remain appropriate and effective.

What are common warning signs that a health check is needed?

Common indicators include:

• Policies have not been updated after business or system changes.
• The company relies on a broker or forwarder without independently verifying key information.
• Classifications or origin determinations lack supporting analysis.
• Different systems contain conflicting trade data.
• Employees cannot identify who approves exceptions.
• Training is generic, outdated, or disconnected from job responsibilities.
• Records are scattered across personal drives, email, and third-party systems.
• Errors recur after corrective actions are marked complete.
• Leadership receives activity counts but little information about risk, exceptions, or remediation.
• The organization cannot explain how its transaction samples or monitoring priorities are selected.

One warning sign does not necessarily establish a violation. It does indicate that the underlying process deserves closer review.

A health check should end with action, not a score

A numerical score can help summarize results, but it should not become the objective. Two programs with the same score may have very different risks, and a polished policy can mask a control that does not work in practice.

The more useful outcome is a defensible view of current conditions and a realistic improvement plan. Leadership should know which issues require immediate attention, which improvements can be sequenced over time, who owns each action, and how completion will be verified.

Baber Management Group, LLC helps organizations assess trade-compliance governance, procedures, data, transactions, records, training, and corrective-action processes. The work is tailored to the organization’s operations and designed to translate findings into practical priorities.