Beyond The Checklist: Auditing Clinical Supply Export Compliance

By Julie David, content lead, Trade Compliance Academy

Most companies with an export compliance program have policies, procedures, automation, and training in place. But how do you know those controls are actually working? That is where internal audits come in.

In clinical supply, it’s easy to assume that a shipment is compliant because the paperwork is complete, a screening result is on file, or someone approved the transaction. Those records are important, but they don’t necessarily tell you whether the right decisions were made or whether the process worked as intended.

An effective internal export compliance audit must look beyond the paperwork. It should test how export controls are applied in the day-to-day operations, identify gaps between written procedures and actual practices, and help the organization address problems before they become potential violations.

So, what should you actually be auditing?

Start With Where The Risk Lives

Before pulling records or selecting transactions for review, take a step back and consider how your clinical supply organization operates.

• Are you shipping investigational products internationally?
• Working with overseas contract development and manufacturing organizations (CDMOs)?
• Are you sharing technical documentation with foreign partners or providing access to manufacturing data through cloud-based systems?
• Expanding a study into a new country?

Each of these activities can present different export control considerations.

I recommend starting by reviewing the organization’s export compliance risk assessment and using it to determine the scope of the audit. If your previous assessments identified gaps in restricted party screening, for example, that area deserves attention. If a new manufacturing partner has introduced cross-border technical data sharing, that may warrant a closer look as well.

Don’t limit the audit to the activities that are easiest to review. Shipping records may be readily available, but they represent only part of the picture.

Practical Tip: Include people from clinical supply, logistics, procurement, IT, and other relevant functions in the planning process. They can help identify where transactions occur, which systems hold the records, and where workarounds or manual processes might create risk.

Follow The Transaction From Beginning To End

One of the most useful audit techniques is to select a sample of actual transactions and follow each one through the process.

For a physical shipment, that might mean starting with the shipping record and working backward. Determine how the item was classified, whether parties were screened, how the destination and end use were evaluated, and whether the appropriate authorization was obtained before shipment.

Don’t stop when you find a signature or a green light in the system. Ask whether the approval was based on accurate information and whether the person making the decision had the necessary context. For example:

• Was the consignee’s full legal name used in the screening record?
• Was the ultimate end user considered?
• Did the destination or end use raise red flags?
• If an export authorization was required, did the shipment remain strictly within its terms and conditions?

The audit should also examine whether the records tell a consistent story. If the shipping documentation identifies one consignee but the screening record identifies another party, someone should be able to explain the difference.

Sampling should be risk-based rather than purely random. Include routine transactions, but specifically select shipments involving new destinations, newly onboarded partners, unusual routing, or modifications to an existing study. These scenarios often reveal weaknesses that a standard sample misses.

In clinical trials, a missed export control step can affect more than an individual shipment. If a shipment is delayed while an authorization issue is resolved, the impact may extend to depot availability, site resupply, and the ability to keep a study on schedule. Audits should therefore assess not only whether controls were followed, but also how quickly the organization can identify and resolve gaps before they disrupt supply.

Revisit Classification And Authorization Decisions

Classification and authorization are two areas you cannot afford to overlook.

Clinical supply organizations handle investigational products, equipment, software, technical data, and materials that require vastly different export control analyses. A pharmaceutical product’s regulatory status does not, by itself, determine its export classification or whether a license is required.

During an audit, review whether classifications are thoroughly documented, supported by technical rationale, and accessible to the employees who need them. Check whether the organization has a process for reassessing decisions when products, technical characteristics, destinations, or regulatory landscapes change.

Then look at how the organization determines license requirements. Where a license, license exception, or other authorization is relied upon, verify that the applicable requirements were fully evaluated and documented. For license exceptions, confirm that the transaction meets the precise eligibility criteria and that all recordkeeping requirements are satisfied.

A classification stored in a database is useful only if it is accurate and applied to the right item.

Practical Tip: Select several classifications and authorization decisions and ask the responsible team to walk you through the rationale. Can they explain how the decision was reached, where the supporting information is stored, and when it should be revisited? That conversation may reveal far more than checking whether a field in the system has been completed.

Don’t Forget Restricted Party Screening

Screening audits should test the underlying process rather than merely confirm that a software tool is active.

Start by reviewing the organization’s written procedures:

• Which parties are screened?
• When does screening occur?
• How are potential matches investigated, escalated, and resolved?
• What happens when a new party is introduced after a study has already begun?

Then test a sample of actual clinical supply partners against those procedures. Depending on your operations, look closely at:

• Clinical trial sites
• Logistics providers and customs brokers
• Depots and warehouses
• CDMOs and external laboratories

Look for clear evidence that screening was performed before the transaction proceeded, that potential matches were appropriately resolved, and that no shipment moved while a material concern remained open.

It is also worth examining how the organization responds to changes. A party that passed screening during onboarding may subsequently appear on a restricted list months later. Does the organization have a defined process for identifying and escalating these mid-study changes?

Audit Technology Transfers, Not Just Shipments

This area deserves particular attention because so much clinical supply collaboration happens digitally.

A clinical supply team might send manufacturing documentation to an overseas partner, share technical specifications with a testing laboratory, or grant access to a system containing controlled technology. These activities may warrant export control review even when no physical product crosses a border. Remember that not every technical document is controlled, and not every transfer requires a license; the goal is to test whether the organization makes and documents the appropriate determination rather than treating all data identically.

An audit should examine whether the organization has identified its controlled technology and technical data, evaluated applicable export control requirements, and established appropriate review and access procedures.

Sample your document transfers, system access approvals, or technology transfer projects involving foreign partners. Determine whether the organization assessed the information involved, considered the recipient and destination, and obtained any required authorization before the transfer or access occurred.

Cloud-based collaboration deserves standalone scrutiny. Review how access is granted, modified, and removed, and whether relevant system logs are audited. A user access list alone may not establish what information was actually accessed or whether a particular data transfer was authorized.

Look Beyond Your Own Four Walls

Clinical supply organizations rely heavily on third parties, making partner oversight a critical component of an internal audit.

Start by determining which export compliance responsibilities belong to your organization and which activities are performed by service providers. Review contracts, service level agreements (SLAs), and onboarding records to see whether compliance expectations are crystal clear.

Then, test compliance. If a logistics provider performs screening or maintains export documentation on your behalf, can you readily obtain evidence of the work performed? If a CDMO handles technical information, do you understand the controls governing access and transfer?

Outsourcing a task does not automatically eliminate your legal responsibility.

Practical Tip: Prioritize partners based on the risk of the activities they perform and the data they handle. Focus audit attention on the relationships that create the greatest potential exposure, rather than treating every vendor review as equally intensive.

Check Whether Employees Know What To Do

An audit can uncover weaknesses even when the written procedures appear flawless.

Talk to the employees who perform day-to-day export-related activities. Ask them how they handle real-world disruptions:

• What do you do if a new clinical site is suddenly added in a country not previously included in the study?
• What is the immediate step if a screening result raises a red flag?
• How do you respond if an overseas partner requests rapid access to technical documentation?

Do they know when to pause and seek guidance? Do they know who to contact? Can they easily find the relevant procedures?

These conversations help determine whether training translates into actual behavior. Training records matter, but completion certificates do not equal understanding.

Ensure employees can confidently apply requirements to the unexpected situations they encounter in their roles.

What Happens After The Audit Matters Just As Much

Finding a problem is only the beginning; an audit has limited value if its findings are documented and then forgotten.

When a gap is identified, determine its root cause, how extensive the issue might be, and whether similar transactions are affected. Document the finding, assign ownership for corrective action, and establish a firm completion date.

For example, if the audit finds that screening was completed during vendor onboarding but omitted when new partners were added to existing studies, the solution requires revising the workflow, updating system controls, and retraining the affected teams. Simply telling employees to “screen more carefully” rarely fixes a broken process.

Where a finding suggests a potential export control violation, promptly involve export compliance leadership and legal counsel to assess the facts. Don’t assume every audit finding is a violation, but never dismiss a potential systemic gap as a simple administrative error.

Finally, verify that corrective actions actually worked with a small follow-up sample a few months later.

Make Auditing Part Of The Routine

There is no single audit checklist that fits every clinical supply organization. The scope and frequency of your internal audits should reflect your specific risk profile, transaction volume, operating model, and changes your clinical programs.

The important thing is to make audits a regular, predictable part of the export compliance program rather than an emergency exercise reserved for an impending inspection.

A good audit should leave you with more than a list of deficiencies. It should give you a clearer understanding of where your controls are robust, where they need reinforcement, and whether your teams have the tools they need to stay compliant.

Ultimately, the goal isn’t to prove that a policy exists on paper. It’s to ensure your compliance controls work in practice, and to use what you learn to build a stronger operation.

About The Author:

Julie David is the Content Lead for the Trade Compliance Academy at Skill Dynamics, where she creates and maintains training programs that help organizations embed trade compliance directly into their business processes. With more than 15 years of experience in U.S. export controls, regulatory compliance, and corporate fraud detection and prevention, Julie brings a strong risk-management lens to building effective compliance programs. Her work focuses on fostering compliance cultures, strengthening internal controls, and equipping teams with the knowledge they need to proactively identify risk, prevent violations, and support business objectives. Through Skill Dynamics’ role-based learning platform, Julie ensures trade compliance training is practical, engaging, and aligned with how businesses actually operate.