Compliance Risk Assessment Methodology For Trade Teams

A compliance risk assessment methodology is a repeatable process for listing every trade compliance obligation your business carries, scoring each obligation for likelihood and impact, testing the controls that sit against it, and recording the residual exposure in a register with a named owner and a review date. The method matters more than the score it produces.

What does a compliance risk assessment methodology actually consist of?

A methodology is the rulebook that makes two people reach the same score from the same facts. Six parts make it work.

1. A defined risk universe, meaning the obligations and activities in scope.
2. A likelihood scale with stated drivers, not adjectives.
3. An impact scale tied to real consequences, such as shipment detention, duty underpayment or loss of export privileges.
4. A control inventory naming each control, its owner and the evidence it leaves behind.
5. A testing plan stating how each control will be checked and on what sample.
6. A register and a refresh cycle, keeping the assessment a living document.

The COSO internal control framework places risk assessment as one of five components of an internal control system, alongside the control environment, control activities, information and communication, and monitoring activities. ISO 31000 supplies the vocabulary most audit functions already use. Write the method down first. A one-page note stating your scales, scoring rules and evidence standards is what an auditor asks for.

Which regulator’s expectations are you designing for?

Different authorities expect different things. Decide which audience you are building for before choosing scales.

For United States export controls, the Bureau of Industry and Security publishes export compliance programme guidance built around core elements, management commitment and risk assessment among them. The Office of Foreign Assets Control names five components in its framework for compliance commitments: management commitment, risk assessment, internal controls, testing and auditing, and training. An OFAC-facing assessment must show the risk assessment driving the controls.

For United States imports, Customs and Border Protection runs the Focused Assessment, which opens with a Pre-Assessment Survey of internal controls and moves to Assessment Compliance Testing where the survey finds weakness. The statutory expectation behind it is reasonable care, attaching to classification, valuation, origin and entry accuracy.

In the European Union, Article 39 of the Union Customs Code sets the criteria for Authorised Economic Operator status, and applicants complete a self-assessment questionnaire covering records, solvency, competence and security. The United Kingdom runs an equivalent authorisation. If you hold or want AEO status in the UK or EU, build the register so it answers the questionnaire sections directly.

How do you build the risk universe for a trade compliance programme?

The risk universe is a list, and the quality of the whole assessment depends on it. Start from the obligations a regulator can act on.

• Tariff classification, and customs valuation with its link to transfer pricing.
• Preferential origin claims and the supplier declarations behind them.
• Licences, permits, export jurisdiction, technical data and deemed exports.
• Restricted party screening and sanctions, including ownership analysis.
• Forced labour due diligence, where the United States Uyghur Forced Labor Prevention Act creates a rebuttable presumption against goods linked to named regions.
• Record retention, and duty relief regimes such as inward processing, customs warehousing and drawback, each carrying authorisation conditions.

Then add your own data. Count declaration lines by tariff heading, origin, supplier, broker and entry type, because concentration shows where volume risk sits. Customs administrations run the same analysis from the other side. Finally read recent penalty notices, detention trends and administrative rulings in your product area, because an issue regulators are actively pursuing deserves a higher score than internal history suggests.

How should likelihood and impact be scored?

Score likelihood from observable drivers, not from how worried anyone feels. Five drivers do most of the work: the volume and frequency of the activity, whether a written procedure exists, whether the staff performing it have been trained, whether there has been a recent violation in that area, and whether a corrective action was implemented too recently to have been tested.

Score impact from consequence type. At the low end sits a shipment delay or an amended entry. In the middle sit duty arrears with interest and loss of a preference claim across a period. At the high end sit penalties, suspension of an authorisation, loss of export privileges, and criminal exposure for wilful conduct. Describe the consequence rather than attaching a figure, because penalty maxima move. Where a figure matters, take it from the publishing authority at the time you decide.

Plot the two on a matrix. A business with weak export jurisdiction controls and weak foreign national access controls scores high on both axes. One with strong restricted party screening scores low on likelihood but high on impact, because a single sanctions hit is serious however rare. Do not let a low composite hide that combination.

Risk domain	What drives likelihood	What drives impact	Primary control test
Tariff classification	New product launches, broker-assigned codes, no classification database	Duty arrears across many entries, licence breach where the code triggers a control	Re-classify top-volume codes independently and compare to what was declared
Customs valuation	Related-party purchases, royalties, assists, post-importation price adjustments	Retrospective duty demand, transfer pricing inconsistency exposed to two authorities	Reconcile declared values to the ledger and the transfer pricing policy
Preferential origin	Stale supplier declarations, changing bills of material, several agreements in use	Loss of preference across a claim period, repayment, customer indemnity claims	Rebuild the origin calculation for selected parts from the bill of material
Restricted party and sanctions	New counterparties, manual screening, no ownership analysis, no rescreening	Blocked payment, missed licence requirement, banking relationship loss	Re-run the counterparty master against current lists and check past hit clearances
Export jurisdiction and licensing	Engineering changes, technical data transfers, foreign national access	Unlicensed export, denial of export privileges, criminal exposure	Trace shipments from licence condition to declaration
Record retention	Records held by brokers, system migrations, no retention schedule	Inability to defend a claim, recordkeeping penalty	Request a named entry file and time the retrieval

What is the difference between inherent and residual risk?

Inherent risk is the exposure before any control is applied. Residual risk is what remains once the controls that actually operate are accounted for. Most trade compliance assessments collapse the two into one score, which hides the question a manager needs answered: is the gap closed by a control, or by luck?

Score inherent risk first, from the activity alone. Then grade control effectiveness separately, on evidence, in three bands: designed and operating effectively, meaning you tested it and it worked; designed but not evidenced, meaning a procedure exists and nobody can show it running; not designed, meaning there is no control. Derive residual risk from the combination. Moderate inherent risk with no control needs work this quarter.

Record a risk tolerance statement alongside the register. A sentence such as “we accept residual exposure on classification of low-volume spare parts, and accept none on sanctions screening” turns the assessment into a decision record. Senior sign-off on that sentence makes accepting a risk a management decision rather than an oversight.

How do you test whether a control actually works?

Four techniques cover almost every trade control. Use all four, not document review alone.

• Document review. Read the policy, the procedure and the desk instruction, and check that local site guidance matches corporate policy and local law.
• Interviews. Ask the people who perform the task to describe what they do. Include logistics, procurement, IT and engineering, since many trade controls are executed by staff who do not consider themselves compliance staff.
• Over-the-shoulder observation. Have the operator demonstrate the tool live, for example running a screening check. For access controls, review the system with IT under different user profiles.
• Transaction testing. Trace sampled declarations end to end. Compare an export declaration against the licence or exception claimed and the shipping documents. Compare an import entry against the invoice, the classification decision and the origin evidence.

Design the sample deliberately. Judgemental sampling, which picks unusual transactions on purpose, finds control failures fastest. Statistical sampling, which selects at random across the population, supports a defensible statement about the error rate across all entries. Use judgemental samples to find problems and statistical samples to size them, and record which you used.

Spread the sample across authorisations and exceptions, product families, classifications, destinations, end users and freight forwarders, because a customs audit will not be confined to your best-run route. Training is testable too: ask an operator a question from their own procedure, which beats an attendance register. The same applies to compliance training design.

What goes in the risk register, and how often is it refreshed?

A register that holds only scores is a report. Each row should carry the risk description, the obligation it arises from, the inherent score, the controls relied on, the control effectiveness grade with the date and method of the last test, the residual score, the owner named by role, the agreed action, the due date and the review date.

Name owners by role rather than by individual so the register survives staff turnover. The owner is whoever can change the process, often a logistics or procurement manager rather than the compliance team, because the trade compliance manager’s role is usually to specify and monitor controls that other functions operate.

Refresh on two clocks: a full reassessment on a fixed annual or biennial cycle, and an event-driven update whenever something changes the picture. Trigger events worth writing into the methodology include a new product line, a new country of supply, an acquisition, a change of broker, a new sanctions designation affecting a counterparty, a tariff change, and a staffing change in a control-owning role.

Keep the working papers, because they prove the control was operating at the relevant time. The United States recordkeeping statute requires importers to keep entry records for five years from the date of entry, and your customs record retention schedule should cover assessment evidence too.

What happens when the assessment finds a live violation?

Most published methodologies leave this out, and it needs deciding before testing starts. Transaction testing will sometimes find an actual breach, and at that moment the exercise stops being a planning task.

Run root cause analysis before committing to a fix. Establish whether the error was clerical, meaning one person mistyped one field, or systemic, meaning the process produces the error reliably. The answer changes both the remedy and the scope of the look-back, because a systemic cause means other periods are affected.

Then take the disclosure decision with legal input. Several regimes reduce penalties where the party reports the matter itself before the authority finds it. United States customs law provides for prior disclosure, and United States export control and sanctions agencies operate voluntary self-disclosure processes. Equivalent routes exist elsewhere, with different benefits, timing and scope. Treat it as a gate in the methodology, with a stated escalation path to legal and to the board.

Write corrective actions so someone can tell whether they happened: the action, the owner, the due date and the closing evidence. Put open actions in front of the same committee every cycle until they close.

Key takeaways

• A compliance risk assessment methodology is the written rulebook defining the risk universe, the likelihood and impact scales, the control inventory, the testing plan and the refresh cycle.
• Score inherent risk and control effectiveness separately, then derive residual risk, because a blended score hides whether an exposure is controlled or merely untested.
• Score likelihood from observable drivers: transaction volume, written procedures, training coverage, recent violations and the age of corrective actions.
• Describe impact as a consequence type, from shipment delay to loss of an authorisation, rather than as a currency figure that will date.
• Four techniques cover most trade controls: document review, interviews, over-the-shoulder observation and transaction testing.
• Judgemental sampling finds control failures fastest, while statistical sampling supports a defensible statement about the error rate across the population.
• The methodology needs a disclosure gate, because transaction testing sometimes uncovers a breach and voluntary disclosure rules differ by jurisdiction.

Frequently asked questions

How often should a trade compliance risk assessment be repeated?

Run a full reassessment on a fixed cycle, commonly annual or biennial, and update between cycles on defined trigger events. Triggers worth naming are a new product line, a new country of supply, an acquisition, a change of customs broker, a new sanctions designation touching a counterparty, and a detained shipment. Quarterly review of one risk area keeps the register current between full cycles.

Who should own a compliance risk assessment?

The compliance function usually designs and runs the assessment, but each risk should be owned by the role that can change the underlying process, often a logistics, procurement or IT manager. Assign ownership by role rather than by named individual so the register survives turnover, and have a senior manager sign the risk tolerance statement so accepting a residual risk is a recorded decision.

What is the difference between a risk assessment and an internal audit?

A risk assessment decides where to look and why. An internal audit is the fieldwork checking whether controls in a chosen area operate as described. The assessment produces the audit plan, and audit results feed back into the next assessment by changing control effectiveness grades. Using the assessment to scope the audit is also how you justify the resources it consumes.

Should the risk assessment cover suppliers and service providers?

It has to. Customs brokers assign classifications, forwarders file declarations, and suppliers issue the origin declarations behind preference claims. Those are your controls operating in someone else’s hands. Test a sample of their output rather than relying on assurances, and include their screening and record retention in scope. Forced labour due diligence obligations also reach into supplier tiers you do not contract with directly.

How does restricted party screening fit into the scoring?

Screening is usually a low-likelihood, high-impact row, so a blended score understates it. Score the axes separately and keep it under monitoring regardless of the composite. Test the completeness of the counterparty population, the ownership analysis behind corporate hits, the rescreening routine when lists change, and the audit trail for cleared matches. Our denied party screening checklist covers the control points.

To build a methodology from scratch, or have an existing register pressure-tested before an audit, get in touch with our team.