Lesson 6 of 6
Testing trade compliance
9 min
Listen to this lesson
Trade compliance tests are regulated-grade: an auditor, a customs authority or a court may later ask what the company knew and when. The evidence must show that each control was designed to block what it should, that it did block in test, and that releases and overrides were made by authorized people for recorded reasons. A green test run is not enough; the trail behind it is the deliverable.
Designing the test set
| Control | Positive case (must block) | Negative case (must not block) | Evidence |
|---|---|---|---|
| SPL screening, partner | Exact and near match test parties | Clean partner; released false positive | Screening result, audit trail |
| SPL screening, document | Order with matching ship-to only | Order with clean partners | Blocked document, feeder block |
| Embargo | Order to an embargoed country | Order to Canada | Block reason, embargo situation |
| Legal control | Classified item without license; exhausted license | EAR99 item to Mexico | Determination log, license monitor |
| Customs export | Declaration created from goods issue | Domestic delivery creates none | Declaration and broker message |
| Preference | Expired supplier declaration changes result | Valid declarations keep origin | Determination log |
Contoso's compliance test matrix: every control has a case that must block and a case that must not.
Test data with care
Screening tests need names that match list entries. Use the entries in the test system's SPL data, or create entries in a manual list owned by a "Manual List" data provider as SAP's guide describes, so test parties match deliberately created test entries rather than real people. Keep the test parties and manual list entries out of production, and record in the test plan where they came from. Wei's test data team owns the recipes so every cycle uses the same data.
Evidence that holds up
- Who and when: user, timestamp and system for each run, release and confirmation.
- What the system knew: list upload date and version, classification and license data at the time of the check.
- What it did: block reason and check log from GTS and the feeder block.
- Who decided: release or confirmation with reason, by an authorized role.
- Segregation of duties: the person who created the order is not the person who released the block.
Parallel screening run
Before switching from GTS 11.0 to E4H, Contoso screened all 4,850 business partners in both systems against the same list version (illustrative use of Contoso's customer count). Hits were compared partner by partner. E4H, using SAP HANA search, produced 31 more possible matches than GTS 11.0 and missed none that GTS 11.0 found. Ingrid reviewed the 31, released 29 as false positives with reasons, and tuned one setting that had made a city name count too strongly. The decision rule agreed in advance: E4H may produce more hits than the old system, but never miss a hit the old system found without an explanation.
- Week 1List alignmentSame SPL list version loaded in GP1 and the E4H test system
- Week 1Full screeningAll partners screened in both systems
- Week 2ComparisonHits compared partner by partner; misses investigated first
- Week 2ReviewIngrid releases or confirms new hits with reasons
- Week 3Sign-offNo unexplained misses; settings frozen for cutover
Authorization tests
Compliance controls are only as strong as the roles around them. In E4H, roles and authorizations were redesigned, so Contoso tests them as controls in their own right. Each forbidden action gets a test user and an expected failure.
| Test | Expected result |
|---|---|
| O2C key user tries to release a blocked sales order in GTS | Not authorized |
| GTS administrator tries to release a blocked partner | Not authorized |
| Compliance specialist releases a false positive without a reason | Not possible; reason required |
| Compliance specialist tries to release a confirmed true match | Not possible |
| Customs specialist changes a license | Not authorized unless the role includes license maintenance |
Authorization cases in Contoso's compliance matrix.
What would you do?
In regression, the order with the near-match test party is not blocked. The tester notes that the test party is the ship-to, and the sold-to is clean. What is the most likely cause to check?
- Every control needs a must-block and a must-not-block case.
- Evidence covers who, when, what the system knew, what it did and who decided.
- Use deliberate test list entries and keep them out of production.
- Parallel screening: more hits may be fine, unexplained misses are not.
Check your understanding · not graded
Lesson check
1. Why does each control need a must-not-block case?
2. Where should screening test parties come from?
3. What was the decision rule for the parallel screening run?
4. A near-match ship-to is not blocked. What is the likely cause?