OFAC Audit Preparation Guide

An OFAC compliance audit — whether internal, external, or regulatory — examines your sanctions screening program. This guide covers what auditors look for, what documentation to prepare, and how to demonstrate compliance readiness.

What auditors examine

1. Screening coverage: Are you screening every transaction? Every counterparty? What is your screening rate?
2. List currency: How current is your SDN list? When was it last updated? How do you sync?
3. Match handling: What happens when a potential match is found? Is there a documented escalation procedure?
4. Audit trail: Can you produce screening logs for any given transaction on demand?
5. Training: Has your team received sanctions compliance training? Is it documented?

Documentation checklist

• Sanctions compliance policy document (dated, signed, reviewed annually)
• Screening procedure documentation (step-by-step, with tool names and configurations)
• Screening logs (timestamped, searchable, retained for minimum 5 years)
• Training records (dates, attendees, content covered)
• Risk assessment document (jurisdictions served, transaction types, risk ratings)
• Incident response plan (what happens on a sanctions hit)
• Third-party tool documentation (API keys, integration dates, vendor due diligence)

Self-assessment questions

Before an auditor arrives, answer these honestly:

• Do I screen every transaction, or only some?
• When was my SDN list last updated?
• Can I produce a screening log from last month?
• Do I have a written compliance policy?
• What happens when my screening tool flags a match?

If you cannot answer "yes" to all five, start there. The OFAC audit readiness gap is usually smaller than it feels.

See also: OFAC compliance checklist and voluntary self-disclosure guide.