How to audit sanctions screening code

Code audit checklist: (1) Is the screening call before payment authorization in every payment path? (2) Does the code handle screening errors (fail closed)? (3) Are screening results logged with timestamp and inputs? (4) Is there a way to bypass screening in the code (remove it)? (5) Are API keys hardcoded (they shouldn't be)? (6) Is cache TTL appropriately short?