Carlson and Huneke explain the pitfalls of relying on traditional (often self-reported) inputs in conducting audits of companies’ or their distributors’ export control compliance programs. Although there is substantial political pressure from the U.S. Congress to conduct such audits across as many counterparties and as frequently as possible, trying to do such audits rapidly and at scale runs the risk of having to rely on inputs of limited value or veracity, creating costly potential liability landmines in the process. Instead, following recent U.S. cross-agency guidance emphasizing the “high probability” standard, U.S. companies should assess their greatest risks of export controls violations and direct their finite audit—and compliance—resources on those priority areas. Doing otherwise not only wastes time and money with increasingly material enterprise risk, but also will fail to bring to bear the right focus and critical thinking necessary to have a fighting chance of detecting and preventing the sophisticated diversion schemes that adversarial foreign powers support. The world has changed, and compliance tactics need to change with it.