Table of Contents
Sanctions screening governance is the set of roles, rules, and checks that keep your screening program honest. It answers simple questions. Who owns the program? Who approves the settings? Who reviews the results? Screening software can flag a name, but it cannot tell you if your process is sound. That job belongs to people, and governance is how you assign it.
Good oversight turns a screening tool into a defensible program. Regulators now judge governance as closely as they judge hit rates. If you cannot show who decided what and why, a clean screen still looks weak. This guide breaks down the structure, the roles, and the controls you need. It also covers the records that prove your program works when someone asks.
What sanctions screening governance covers
Governance is the frame around the daily screening work. The work itself is checking names against sanctions lists. Governance decides how that work is designed, run, and reviewed. It sets the policy. It names the owners. It defines what a good outcome looks like.
Most of the modern framework traces back to guidance from the Office of Foreign Assets Control. In 2019 OFAC published its Framework for Compliance Commitments. You can read it on the OFAC website. It lists five parts every program should have. Those five parts map neatly onto governance.
| Framework element | What governance provides |
|---|---|
| Management commitment | Senior sign-off, budget, and a named compliance owner |
| Risk assessment | A written view of where your sanctions exposure sits |
| Internal controls | Written procedures, approvals, and separation of duties |
| Testing and auditing | Independent review of whether the program works |
| Training | Staff who know the rules for their role |
If you are new to the wider topic, start with our overview of denied party screening. This article assumes you already run some form of screening and want to govern it well.
Roles and responsibilities
Clear roles stop tasks from falling through the cracks. When everyone owns the program, no one does. Assign each duty to a named person or team. Write it down. Review it once a year.
Senior management and the board
Leadership owns the program at the top. They approve the policy and fund the tools. They set the tone that violations are taken seriously. OFAC has been clear on this point. Accountability cannot be handed to a software vendor. In some cases senior leaders face personal liability for weak controls.
The compliance officer
You need one named person who owns screening day to day. This person reports to senior management. They keep the policy current. They decide how alerts get worked. They sign off on list updates and threshold changes. Give them the authority to stop a shipment or hold an account.
Screening analysts
Analysts run the screens and clear the alerts. They follow written steps. They escalate real matches. They document every decision. For the mechanics of that daily work, see our guide on how to process denied party screenings.
Independent review
Someone outside the screening team must check the work. This can be internal audit or an outside firm. The key word is independent. The person who runs screening should not be the person who grades it.
Building the governance framework
A framework is just your program written down in a way others can follow. Three documents form the core. A policy, a set of procedures, and a risk assessment. Keep them separate but linked.
- The policy states what you will do and why. It names the owners and the lists you screen against.
- The procedures explain how. They give step by step instructions for screening and alert handling.
- The risk assessment shows where your exposure lies. It drives the settings in your tool.
Your risk assessment should look at your customers, your products, and your countries. A firm shipping dual-use goods to high-risk regions needs tighter controls than a local retailer. Match the program to the risk. Do not copy a template and leave the default settings in place. Factory defaults calibrated to no one are a common audit finding.
Decide which lists you screen. Most programs cover the OFAC SDN list, the BIS Entity List, and the wider Consolidated Screening List. Learn more about the anchor list in our piece on the OFAC SDN list. Remember the reach of ownership rules. Our guide to the 50 percent rule explains why a clean name can still be blocked.
Setting and controlling screening thresholds
Screening tools use fuzzy matching. A threshold controls how close a name must be to trigger an alert. Set it too tight and you miss real matches. Set it too loose and you drown in false positives. This setting is a governance decision, not just a technical one.
Whoever changes a threshold must record the change. Note the old value, the new value, the reason, and the approver. This is called change control. It gives you a clear trail of who tuned the system and why. Without it, you cannot explain why an alert fired or stayed silent.
- Log every threshold or rule change with a date and an approver.
- Test a change in a safe environment before it goes live.
- Re-run past data to check the change does not hide real hits.
- Review thresholds on a set schedule, not just when problems appear.
False positives eat time and hide real risk. Handle them with a written method, not guesswork. Our guide on resolving a false positive walks through a defensible approach.
Testing, auditing, and monitoring
You cannot trust a control you never test. Testing checks that the screening works as designed. Auditing checks that the whole program works as promised. Monitoring watches the numbers over time. All three feed governance.
What to test
Run known bad names through the system and confirm they flag. Check that list updates loaded on time. Confirm that alerts route to the right people. Test after every major system change. Keep the results.
Watch a few core numbers each month. They tell you if the program is healthy or drifting.
| Metric | What it signals |
|---|---|
| Alert volume | A sudden jump or drop may mean a setting broke |
| False positive rate | Very high rates waste staff and hide real hits |
| Time to clear an alert | Slow clearing can mean short staffing or unclear rules |
| List update lag | Old lists mean you screen against yesterday’s rules |
The independent audit is your outside check. It reviews the policy, samples cleared alerts, and tests the controls. Fix what it finds and record the fix. An audit with no follow-up is worse than no audit. For the wider habit of good records, read what is an audit trail.
Record keeping and reporting
Records are the proof your program exists. If a decision is not written down, a regulator treats it as if it never happened. Keep the screening result, the analyst notes, and the final call for every alert. Keep them for at least five years under US rules.
Reporting closes the loop back to leadership. Send senior management a regular summary. Include alert volumes, true matches, open issues, and audit findings. This keeps them informed and shows their commitment is real. Our guide to record keeping for denied party screening covers what to store and how long.
Watch for signs of trouble in the data. A partner who resists screening or uses odd routing may signal evasion. Learn the warning signs in our list of red flags of sanctions evasion. Weak governance also carries a price. See OFAC penalties explained for what failures can cost.
Common governance gaps to avoid
Most programs fail in the same few places. Learn them and check your own setup against the list.
- Running default settings that no one calibrated to your risk.
- Screening an incomplete set of lists.
- No written link between policy, risk, and system settings.
- Different teams reading the same rule in different ways.
- Changes made with no approval and no log.
- Audits that find issues no one ever fixes.
Fixing these is mostly discipline, not spend. Write things down. Assign owners. Keep the trail. For a broader checklist of habits, see our denied party screening best practices.
Frequently Asked Questions
Who is responsible for sanctions screening governance?
Senior management owns it at the top. A named compliance officer runs it day to day. Analysts do the screening. An independent reviewer checks the work. The point is that each duty has a clear owner.
How often should we review our screening program?
Review the risk assessment and thresholds at least once a year. Review sooner if your business, products, or countries change. Run an independent audit on a regular cycle. Test after every major system change.
Do small businesses need formal governance?
Yes, but it scales to your size. A small firm may put one person in charge and keep a short written policy. The duties are the same. The paperwork is lighter. See our guide on screening for small businesses.
Can we outsource screening and skip governance?
No. You can hire a vendor to run the tool. You cannot hand off the accountability. OFAC holds your firm responsible for the outcome. You still need to own the policy, approve the settings, and review the results.
Key Takeaways
Sanctions screening governance is the structure that makes your screening trustworthy. Name your owners. Write your policy, procedures, and risk assessment. Control your thresholds with logged changes and approvals. Test the system, audit the program, and keep every record. Report the results to leadership so their commitment stays real. Do these things and a clean screen becomes a program you can defend. If you want help setting up or reviewing your governance, contact us.
