Documentary Control, Compliance, Ethics and Governance

Introduction and Context

International trade depends on documents that communicate commercial, logistical, financial and regulatory facts across organisational and national boundaries. A commercial invoice may support customs valuation; a packing list may support physical verification; a bill of lading may evidence carriage and control of goods; a certificate of origin may determine preferential tariff treatment; and an export licence may establish legal authority to ship controlled items. Because these documents influence the movement of goods, money and legal rights, documentary accuracy is not merely an administrative concern. It is a strategic control issue.

Documentary control is the system through which an organisation creates, checks, authorises, stores, retrieves and disposes of trade documents. Compliance is the process of ensuring that transactions conform to applicable laws, regulations, contracts, licences, internal policies and ethical standards. Governance provides the structures through which responsibility, accountability, oversight and escalation are exercised.

Weak documentary control can produce customs penalties, shipment delays, payment disputes, loss of preferential tariff treatment, sanctions exposure, reputational damage and criminal liability. More seriously, poorly controlled documents may conceal money laundering, bribery, diversion of strategic goods, forced labour, tax evasion or deliberate misrepresentation.

This chapter treats documentation as a controlled information system rather than a collection of forms. It develops practical methods for maker-checker controls, document checklists, standard operating procedures, retention schedules, audit trails, fraud prevention and regulatory compliance.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the relationship between documentary control, compliance, ethics and governance.
2. Design a maker-checker control system for trade transactions.
3. Prepare document checklists and standard operating procedures.
4. Establish retention schedules and reliable audit trails.
5. Identify indicators of false invoicing, document manipulation and trade-based money laundering.
6. Explain the operational significance of sanctions, export controls, anti-money-laundering requirements, anti-bribery rules and data privacy.
7. Apply ethical decision-making and escalation procedures to documentary dilemmas.
8. Evaluate the effectiveness and limitations of technology, including artificial intelligence, in trade compliance.

1. Documentary Control as a Governance System

1.1 The control objective

A control is a policy, procedure, system feature or human action designed to reduce a defined risk. Documentary controls should ensure that trade information is:

• Accurate: it represents the transaction and goods truthfully.
• Complete: all required documents and data fields are present.
• Authorised: the transaction and any amendments are approved by appropriate personnel.
• Consistent: descriptions, quantities, values, currencies, parties and dates agree across documents.
• Traceable: changes can be linked to a person, time, reason and evidence.
• Accessible: authorised users can retrieve records when required.
• Confidential: personal, commercial and security-sensitive information is protected.
• Retained and disposed of lawfully: records are kept for the required period and securely destroyed when permitted.

The control objective must precede the control activity. For example, “a supervisor signs the invoice” is not a sufficient control objective. The objective is to prevent inaccurate or unauthorised invoicing; the signature is only one possible control activity.

1.2 Preventive, detective and corrective controls

Strong systems combine all three. A blocked shipment may be prevented by sanctions screening, detected through a post-shipment review and corrected through investigation and reporting if a failure occurred.

1.3 The three lines of responsibility

A practical governance model distinguishes three lines:

1. Operational management: prepares documents, performs first-level checks and owns day-to-day risks.
2. Risk, compliance and control functions: provide advice, independent monitoring, testing and escalation.
3. Internal audit or equivalent independent assurance: evaluates whether governance and controls are designed and operating effectively.

The board or senior management retains ultimate accountability for the organisation’s risk appetite and compliance culture, even when activities are delegated.

2. The Maker-Checker Principle

2.1 Meaning and rationale

The maker-checker principle requires one person to prepare or initiate a transaction and another suitably authorised person to review and approve it. It reduces the probability that one individual can create, conceal and benefit from an error or fraud.

A checker must perform a substantive review, not merely apply a signature. The checker should have adequate knowledge, authority, time and independence. A nominal second signature is ineffective if the checker is under pressure, lacks access to source evidence or routinely approves without examination.

2.2 Typical trade-document control points

A maker-checker structure may apply to:

• customer and supplier onboarding;
• classification of goods and determination of export-control status;
• quotation and pro-forma invoice preparation;
• commercial invoice issuance;
• licence applications;
• sanctions and restricted-party screening;
• shipment release;
• amendments to bills of lading or invoices;
• refunds, credits and commission payments;
• bank-document presentation under documentary credit;
• closure of compliance alerts.

The level of review should be risk-based. A low-value shipment of ordinary goods to a long-standing, low-risk customer may receive standard review. A high-value shipment involving dual-use goods, unusual routing, a new intermediary or a high-risk jurisdiction requires enhanced review and potentially senior approval.

2.3 Segregation of duties

At minimum, the following incompatible functions should normally be separated:

• vendor or customer creation and payment approval;
• document preparation and final release;
• goods classification and independent compliance approval;
• shipment booking and exception closure;
• master-data amendment and audit-log administration.

Small organisations may not have sufficient staff for complete separation. In that case, compensating controls should be introduced, such as senior review, daily exception reporting, restricted system privileges, surprise checks and independent periodic audits.

2.4 A maker-checker design table

3. Document Checklists and Standard Operating Procedures

3.1 Designing a document checklist

A checklist translates legal, contractual and operational requirements into observable checks. It should identify the document, responsible person, source of truth, review status, exceptions and evidence.

A useful checklist contains:

• transaction reference number;
• buyer, seller, consignee, end user and intermediary;
• product description, quantity, unit of measure and classification;
• value, currency, price basis and payment terms;
• origin, destination, route and transport mode;
• applicable licences, permits and certificates;
• sanctions and restricted-party screening status;
• consistency checks across invoice, packing list, transport document and customs declaration;
• required approvals;
• outstanding exceptions and their owners;
• date, reviewer identity and electronic sign-off.

Checklists should not become mechanical tick-box exercises. A reviewer should be required to record the basis for high-risk conclusions, such as why a product is not controlled or why an unusual price is commercially reasonable.

3.2 Example pre-shipment checklist

3.3 Standard operating procedures

An SOP should explain not only what to do, but who does it, when it is done, what evidence is retained and what happens when the normal process fails. A professionally designed SOP normally includes:

1. purpose and scope;
2. definitions and governing requirements;
3. roles and authority levels;
4. inputs and prerequisites;
5. sequential procedure;
6. decision points and escalation triggers;
7. required records and naming conventions;
8. quality-control checks;
9. exception and incident handling;
10. review frequency and document owner;
11. version number and change history.

An SOP must distinguish a process deviation from an approved exception. A deviation is an actual departure from the procedure; an exception is a formally authorised departure supported by a documented risk assessment. Neither should be concealed by altering historical records.

3.4 Exception management

A transaction should be placed on hold when a material inconsistency cannot be resolved. Examples include a mismatch in consignee identity, unexplained price deviation, missing licence, suspicious routing, unexplained amendment or a potential sanctions match. The hold should identify the issue, owner, due date and release authority.

Commercial urgency does not eliminate legal requirements. If goods are released before a material issue is resolved, the decision must be made by an authorised person under a documented escalation policy. “Proceed and regularise later” is particularly dangerous where sanctions, export controls or customs declarations are involved.

4. Reconciliation, Audit Trails and Record Integrity

4.1 Cross-document reconciliation

Reconciliation compares information from independent sources. Important fields include:

• legal names and addresses of parties;
• product description and classification;
• quantities and units;
• gross and net weight;
• price, currency and total value;
• Incoterm and payment term;
• country of origin and destination;
• shipment date, vessel, flight or container details.

Not every field must be identical. For example, a commercial invoice may use a commercial product description while a customs declaration uses a tariff-oriented description. The difference must nevertheless be explainable and non-misleading.

4.2 What an audit trail should show

An audit trail should permit an independent reviewer to reconstruct what happened. It should show:

• the original record;
• each subsequent version;
• identity of the person making a change;
• date and time, preferably with a reliable time zone;
• the field changed and old and new values;
• reason for change;
• supporting evidence;
• reviewer and approval;
• system or workflow event associated with the change.

A control system should never overwrite the original document without preserving its prior state. Where a correction is necessary, the corrected version should be linked to the original and the correction rationale retained.

4.3 Retention schedules

Retention is governed by several potentially overlapping sources: customs law, tax law, corporate law, anti-money-laundering rules, export-control requirements, contractual terms, litigation holds and privacy law. The organisation should identify the applicable period for each record category and apply the longest mandatory period where requirements conflict, subject to legal advice.

A retention schedule should specify:

The exact retention period varies by jurisdiction and record type; therefore, organisations must not rely on a universal number. Records subject to investigation, litigation, audit or regulatory inquiry must not be destroyed even if their ordinary retention period has expired.

4.4 Data quality and the audit trail

Data quality has at least four dimensions: accuracy, completeness, timeliness and consistency. A useful management indicator is the exception rate:

The measure is meaningful only if “material exception” is defined consistently and the review population is known. A falling exception rate may indicate improvement, but it may also indicate under-reporting or weak review. Metrics therefore require interpretation, sampling and independent validation.

5. Fraud, False Invoicing and Document Manipulation

5.1 Common schemes

Trade documentation can be abused through:

• over-invoicing or under-invoicing;
• multiple invoicing for one shipment;
• false descriptions or quantities;
• fictitious shipments;
• duplicate use of transport documents;
• forged certificates of origin;
• manipulation of weights or units;
• backdating documents;
• unauthorised changes to bank details;
• use of shell companies or undisclosed intermediaries;
• circular trading designed to create artificial transaction volume.

These techniques may support customs fraud, tax evasion, bribery, sanctions evasion or trade-based money laundering.

5.2 Red flags

No single red flag proves misconduct. However, combinations require investigation. Indicators include:

• prices materially inconsistent with market or contract terms;
• vague descriptions such as “parts” or “general goods” for technically sensitive products;
• complex routes without a commercial explanation;
• last-minute changes to consignee, bank account or destination;
• requests to split invoices or payments;
• payment by an unrelated third party;
• reluctance to identify the end user;
• unusual urgency or pressure to bypass controls;
• repeated document corrections;
• inconsistent weights, quantities or serial numbers;
• transactions involving high-risk jurisdictions or opaque ownership;
• commissions disproportionate to the service provided.

5.3 Control responses

Controls should combine prevention and analysis:

1. Verify counterparties and beneficial ownership.
2. Compare prices with contracts, historical data and reasonable market evidence.
3. Reconcile documents and investigate unexplained differences.
4. Confirm bank-account changes through an independent channel.
5. Restrict manual overrides and monitor them.
6. Conduct enhanced due diligence for high-risk transactions.
7. Preserve evidence and escalate suspicious activity through approved channels.
8. Avoid alerting a subject where law prohibits tipping-off.

Employees should not conduct informal investigations that compromise evidence or create personal safety risks. Suspicion should be reported to the designated compliance, legal or financial-crime function.

6. Sanctions and Export Controls

6.1 Sanctions screening

Sanctions may target countries, territories, governments, entities, individuals, vessels, aircraft, financial institutions or sectors. The legal effect depends on the issuing jurisdiction and the organisation’s connection to it. Screening should therefore be designed around the laws applicable to the transaction, not merely a generic database search.

Effective screening considers:

• buyer, seller, consignee, end user and beneficial owners;
• banks, carriers, brokers and other intermediaries;
• vessels, aircraft and shipping identifiers;
• destination and transit locations;
• goods and sector restrictions;
• ownership and control relationships;
• timing, aliases, transliteration and address information.

A potential match is an alert, not automatically a confirmed match. It must be resolved using reliable identifiers and documented reasoning. A confirmed or unresolved high-risk match should lead to a hold and escalation.

6.2 Export controls

Export controls regulate the transfer of military, dual-use, strategic or otherwise sensitive goods, software, technology and technical assistance. Controls may apply to physical shipment, electronic transfer, technical discussions, repair services and access by foreign persons, depending on the applicable law.

A sound classification process records:

• technical characteristics and intended use;
• applicable control-list entry or reason for non-listing;
• destination and end user;
• licence requirement or exception;
• reviewer and date;
• supporting technical evidence.

A product should not be classified solely by its marketing name. Technical specifications, performance thresholds and end-use context may be decisive.

6.3 Sanctions versus export controls

Sanctions primarily restrict dealings with designated persons, places, sectors or activities, although they may also regulate goods. Export controls primarily regulate the movement or provision of controlled items and technology. A transaction can comply with one regime and violate the other. Both analyses should therefore be performed where relevant.

7. AML, Anti-Bribery and Ethical Governance

7.1 Anti-money-laundering controls

Money laundering generally involves disguising the origin, ownership or destination of criminal proceeds. In trade, value can be moved through mispriced goods, phantom shipments, complex intermediaries or apparently legitimate invoices.

An AML-oriented trade programme should include risk-based customer due diligence, beneficial-ownership identification, transaction monitoring, escalation of suspicious activity, staff training, record retention and independent testing. The organisation must follow the reporting and confidentiality rules of the applicable jurisdiction.

7.2 Anti-bribery controls

Bribery risk may arise through customs brokers, freight forwarders, agents, consultants, distributors, gifts, hospitality, facilitation payments or charitable contributions. Controls should include:

• risk-based third-party due diligence;
• written contracts describing legitimate services;
• verification that commissions are reasonable;
• approval of gifts and hospitality;
• accurate books and records;
• prohibition or strict control of facilitation payments;
• training and confidential reporting channels;
• protection against retaliation.

False invoices are frequently used to disguise bribes. A payment labelled “consulting” is not legitimate merely because an invoice exists. The organisation should verify services, deliverables, pricing and recipient ownership.

7.3 Ethical decision-making

A useful ethical test asks:

1. Is the action lawful under all relevant regimes?
2. Is it consistent with the organisation’s policy and contractual obligations?
3. Would the decision remain defensible if disclosed to a regulator, customer or the public?
4. Does it treat affected stakeholders fairly?
5. Does it create a misleading record or conceal material information?

Ethics is broader than legal compliance. An action may be technically legal but inconsistent with honesty, fairness, human rights or responsible business conduct.

8. Data Privacy and Information Governance

Trade records may contain names, identity documents, contact details, bank information, beneficial-ownership data, employee records and commercially sensitive information. Privacy obligations vary by jurisdiction, but sound principles commonly include purpose limitation, data minimisation, accuracy, security, access control, lawful processing, retention limitation and accountability.

Practical safeguards include:

• collect only information necessary for a defined purpose;
• restrict access according to role;
• encrypt sensitive records in storage and transmission where appropriate;
• use multi-factor authentication;
• maintain supplier and processor agreements;
• log access to sensitive records;
• establish breach-response procedures;
• redact information when full disclosure is unnecessary;
• securely delete records when retention obligations end.

Privacy and compliance can conflict. For example, a screening process may require personal data, while privacy law requires proportionality and safeguards. The solution is not to abandon screening, but to define a lawful purpose, limit data, control access and document the rationale.

9. Technology, Automation and Artificial Intelligence

Trade-control systems can improve consistency through workflow approvals, automated screening, electronic signatures, document comparison, optical character recognition and exception dashboards. However, automation does not transfer legal accountability to software.

Artificial intelligence may identify anomalies in descriptions, prices, routes or counterparties, but it can produce false positives, false negatives, biased results and unexplainable recommendations. Sensitive decisions should retain human oversight, especially when a shipment is blocked, a licence is denied or a suspicious-activity decision is made.

Governance for AI-supported compliance should address:

• approved use cases and prohibited uses;
• data quality and training-data provenance;
• model validation and performance monitoring;
• explainability appropriate to the risk;
• human review and override authority;
• access controls and confidentiality;
• records of model versions and decisions;
• vendor accountability and incident response.

A system that automatically clears a party based only on an incomplete name match is not a substitute for risk-based screening. Technology should strengthen professional judgment rather than conceal its absence.

10. Applied Case: Meridian Components Ltd. (Illustrative)

Background

Meridian Components Ltd., an exporter of industrial sensors, receives an urgent order from a newly formed distributor. The order is for a high-value shipment to a country that is not itself comprehensively sanctioned, but the route includes a transit hub associated with diversion risk. The distributor asks Meridian to describe the products as “general electronic parts,” use a third-party payer and send the invoice to a different company. A sales manager argues that delay will lose the customer.

Problem

The request creates potential risks involving export classification, end-use uncertainty, sanctions evasion, false invoicing, third-party payment, beneficial ownership and document manipulation. The ordinary sales process has no independent compliance approval.

Analysis

The vague description may conceal the technical nature of the sensors. The third-party payer and alternative invoice recipient create uncertainty about the real buyer. The route may be commercially legitimate, but it requires explanation. The newly formed distributor has limited operating history, and the urgency increases pressure to bypass controls.

Approach and solution

Meridian places the transaction on hold and assigns a compliance case number. The maker records the order, technical specifications, parties, route and requested amendments. A separate compliance checker:

1. verifies the distributor, end user, owners and payer;
2. classifies the sensors using technical evidence;
3. screens all parties, banks, vessels and relevant locations;
4. requests an end-use statement and commercial explanation of the route;
5. reconciles the contract, invoice, packing list and transport information;
6. consults legal counsel regarding licensing and applicable sanctions;
7. records the customer’s request as a red flag rather than silently changing the documents.

The transaction may proceed only if the real parties and end use are satisfactorily verified, the description is truthful, required authorisation is obtained and the payment structure is approved. If material uncertainty remains, Meridian declines or suspends the order. Any suspicious-transaction reporting is handled by the authorised financial-crime function, subject to applicable law.

Outcome

The investigation identifies that the distributor is controlled by an undisclosed intermediary connected to a restricted entity. Meridian declines the transaction, preserves the records, reports internally and reviews other orders introduced by the sales manager. No shipment occurs, and the company strengthens third-party-payment and end-use controls.

Learning points

• Commercial urgency is not a compliance exception.
• A document request can itself be evidence of evasion risk.
• Truthful description and identification of the real parties are fundamental controls.
• Maker-checker separation is valuable only when the checker is independent and empowered to stop the transaction.
• A defensible decision requires preserved evidence, not merely an outcome.

11. Implementation Framework for Organisations

An organisation introducing or improving documentary governance can use the following sequence:

1. Map obligations: identify customs, tax, sanctions, export-control, AML, anti-bribery, privacy and contractual requirements.
2. Map processes: show how a transaction moves from enquiry to closure and where documents are created or changed.
3. Assess risks: consider likelihood, impact, control gaps and risk concentration.
4. Assign ownership: define makers, checkers, approvers, escalation officers and independent assurance.
5. Standardise documents: create controlled templates, checklists and naming conventions.
6. Configure systems: implement role-based access, workflow approvals, version control and audit logs.
7. Train personnel: use realistic scenarios rather than only theoretical presentations.
8. Test controls: sample transactions, review overrides and conduct simulated alerts.
9. Measure performance: monitor exceptions, ageing, repeat findings, training completion and corrective actions.
10. Improve continuously: update procedures after legal changes, incidents, audits and emerging risks.

Control performance should be assessed in two dimensions: design effectiveness, meaning whether the control could address the risk, and operating effectiveness, meaning whether it actually operated as intended over time.

12. Challenges and Limitations

Documentary controls cannot eliminate all risk. Counterparties may provide sophisticated false information; sanctions lists may change rapidly; laws may conflict across jurisdictions; data may be incomplete; and excessive controls may delay legitimate trade. Poorly designed controls can also create alert fatigue, causing staff to ignore genuine risks.

Other limitations include dependence on third-party data, inconsistent product descriptions, fragmented systems, manual workarounds, limited specialist expertise and pressure from commercial leadership. Controls must therefore be proportionate, risk-based and periodically tested. A large volume of approvals is not evidence of good governance if reviewers do not understand the transaction or if exceptions are routinely overridden.

Chapter Summary

Documentary control is a strategic governance discipline that protects the accuracy, legality, traceability and confidentiality of trade information. Effective systems combine preventive, detective and corrective controls; clearly separate preparation from review; and use risk-based maker-checker arrangements.

Checklists and SOPs convert legal and contractual requirements into repeatable actions, while exception procedures ensure that unresolved inconsistencies are held and escalated rather than concealed. Reconciliation, version control, audit trails and retention schedules preserve the organisation’s ability to explain what happened and why.

Fraud prevention requires attention to false invoicing, fictitious shipments, duplicate documents, unusual pricing, opaque ownership, third-party payments and suspicious routing. Sanctions screening and export-control classification must address all relevant parties, goods, destinations, end uses and intermediaries. AML, anti-bribery, privacy and ethical governance requirements extend beyond simple document completion.

Technology and AI can improve screening and anomaly detection, but they require data governance, validation, human oversight and accountability. Ultimately, effective compliance depends on organisational culture: employees must be empowered to stop questionable transactions, report concerns and preserve truthful records even when commercial pressure is intense.

Key Terms

Audit trail: A chronological record showing document versions, changes, users, dates, reasons and approvals.

Beneficial owner: The natural person who ultimately owns or controls an entity.

Checker: An authorised person who independently reviews work prepared by the maker.

Compliance: Conformity with applicable laws, regulations, contracts and organisational policies.

Documentary control: The system for creating, checking, authorising, storing and disposing of trade records.

Dual-use item: An item capable of civilian and military or strategic use.

End user: The person or organisation that ultimately uses the goods or technology.

Exception: A formally authorised departure from a standard requirement or process.

Export control: Regulation of specified goods, technology, software, services or transfers.

False invoicing: The intentional presentation of inaccurate or fictitious invoice information.

Maker: The person who prepares or initiates a document or transaction.

Material exception: An inconsistency or failure significant enough to affect legality, value, risk or decision-making.

Maker-checker control: Separation of preparation and independent review or approval.

Sanctions: Legal restrictions imposed on specified persons, places, sectors, goods or activities.

Segregation of duties: Division of incompatible responsibilities among different people or roles.

Standard operating procedure: An approved, documented method for performing a recurring process.

Trade-based money laundering: Movement or concealment of criminal value through trade transactions.

Version control: A system for identifying, preserving and managing successive document versions.

Review Questions

Short Answer Questions

1. What is the purpose of a maker-checker control?
2. Identify three characteristics of a reliable audit trail.
3. Why should a potential sanctions match not automatically be treated as a confirmed match?
4. State two examples of documentary fraud in international trade.
5. What is the difference between a process deviation and an approved exception?

Long Answer Questions

1. Explain how a trade organisation can design an effective documentary-control framework from customer onboarding through shipment closure.
2. Discuss the relationship between segregation of duties, audit trails and fraud prevention.
3. Explain the principal documentary implications of sanctions, export controls and AML requirements.
4. Evaluate the role of checklists and SOPs in achieving compliance without creating mechanical tick-box behaviour.
5. Discuss the ethical and governance issues associated with using artificial intelligence in trade-compliance screening.

Analytical / Application Questions

1. An exporter discovers that the consignee on the transport document differs from the consignee on the invoice, while the customer requests immediate release. Analyse the risks, controls and escalation steps that should apply.
2. A distributor requests a lower invoice value, payment by an unrelated company and a vague description of technically sensitive goods. Assess the red flags and design an investigation and decision process.
3. A small trading company cannot fully segregate document preparation, screening and approval because it has only four employees. Design compensating controls and explain how their effectiveness should be tested.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the maker-checker principle?

A. The same employee prepares and approves a document to improve speed.

B. One person prepares or initiates a transaction and another independently reviews it.

C. A system automatically approves all low-value transactions without review.

D. A customer signs every document before shipment.

Correct Answer: B. One person prepares or initiates a transaction and another independently reviews it.

Question 2

Which item is an essential feature of an effective audit trail?

A. Deletion of all earlier versions after correction

B. A record of the original value, new value, user, time and reason for change

C. A handwritten signature without transaction identification

D. A summary showing only the final approved document

Correct Answer: B. A record of the original value, new value, user, time and reason for change

Question 3

Which is the strongest red flag for possible trade-based money laundering?

A. A shipment supported by consistent documents and a verified end user

B. A routine order under an established contract

C. A request for vague goods descriptions, third-party payment and an unusual route

D. A shipment using a standard transport mode

Correct Answer: C. A request for vague goods descriptions, third-party payment and an unusual route

Question 4

What should normally happen when a material sanctions concern remains unresolved?

A. Release the shipment and investigate after delivery

B. Delete the alert to avoid delay

C. Place the transaction on hold and escalate it through the approved process

D. Ask the customer to approve the shipment

Correct Answer: C. Place the transaction on hold and escalate it through the approved process

Question 5

Which control is primarily preventive?

A. A post-shipment internal audit

B. A system restriction preventing unauthorised users from changing bank details

C. A review of last year’s exceptions

D. A corrective credit note after an error

Correct Answer: B. A system restriction preventing unauthorised users from changing bank details

Question 6

Why is technical evidence important in export-control classification?

A. Marketing names always determine legal classification.

B. Technical characteristics and performance may determine whether an item is controlled.

C. Only the customer’s preferred description is relevant.

D. Classification is unnecessary for dual-use products.

Correct Answer: B. Technical characteristics and performance may determine whether an item is controlled.

Question 7

Which statement about retention schedules is most accurate?

A. One universal retention period applies to every trade record worldwide.

B. Records may always be destroyed when their ordinary period expires, even during litigation.

C. Retention must consider applicable legal, contractual, audit and investigation requirements.

D. Electronic records need not be retained if paper copies exist elsewhere.

Correct Answer: C. Retention must consider applicable legal, contractual, audit and investigation requirements.

Question 8

A false consulting invoice used to disguise an improper payment primarily creates which combined risk?

A. Anti-bribery and books-and-records risk

B. Only a transport scheduling risk

C. Only a product-quality risk

D. A risk that can be eliminated by changing the invoice font

Correct Answer: A. Anti-bribery and books-and-records risk

Question 9

What is an important limitation of AI-supported compliance screening?

A. It cannot process any documentary information.

B. It may produce false positives, false negatives or unexplained recommendations.

C. It automatically assumes legal responsibility for every decision.

D. It makes human review legally unnecessary.

Correct Answer: B. It may produce false positives, false negatives or unexplained recommendations.

Question 10

Which action best reflects ethical documentary governance?

A. Changing a product description to satisfy a customer’s request despite knowing it is misleading

B. Releasing goods first and creating supporting records later

C. Recording a truthful description, escalating uncertainty and preserving the decision evidence

D. Ignoring a concern when the transaction is commercially profitable

Correct Answer: C. Recording a truthful description, escalating uncertainty and preserving the decision evidence