Documented Import Compliance Program for AILPA

To import timber into Australia, you need a documented Import Compliance Program (ICP) a written due diligence system under the Illegal Logging Prohibition Act 2012. At minimum, this requires: a risk assessment for each shipment, species, and origin verification, chain-of-custody records from your supplier, and a customs declaration. New rules in effect since 3 March 2025 have strengthened these obligations significantly.

Here’s a scenario that plays out more often than you’d think: an Australian timber importer receives a Requirement to Give Information notice from DAFF. They have their invoices. They have their bills of lading. What they don’t have is a written due diligence system with documented risk assessments for each shipment. The audit fails.

This isn’t a fringe case. Over several years of compliance assessments, DAFF found that around 60% of importers assessed were non-compliant with some or all of their due diligence obligations (DAFF Statutory Review, 2024). And since March 2025, the rules have gotten harder, not easier.

This article breaks down exactly what documents you need to import timber into Australia, what a compliant ICP actually looks like, the real compliance challenges that trip importers up, and what the smartest operators are doing to stay audit-ready without drowning in paperwork.

Key Takeaways

1. 60% of Australian timber importers assessed were found non-compliant with some or all due diligence obligations (DAFF Statutory Review). The stakes are now higher under the 2025 rules.
2. An ICP isn’t just paperwork; it’s a documented, audit-ready system covering risk assessment, supplier records, species verification, and mitigation steps for every regulated shipment.
3. Digital traceability platforms from TraceX automate ICP documentation, flag high-risk suppliers in real time, and generate audit-ready reports, replacing the manual spreadsheet approach that causes most compliance failures.

What Is an ICP (Import Compliance Program) for Timber in Australia?

An Import Compliance Program, commonly called an ICP, is the documented due diligence system you’re legally required to maintain under the Illegal Logging Prohibition Act 2012 (as amended). It’s not a one-time document submission. It’s an active, ongoing system that must be applied to every regulated timber product shipment you bring into Australia.

The ICP must demonstrate that you’ve taken reasonable steps to minimise the risk of importing timber that was illegally harvested in its country of origin. The depth of those steps depends on your risk assessment findings, which vary by source country, species, supplier, and certification status.

Who Must Have an ICP?

Any person or business that imports regulated timber products into Australia is legally required to maintain an ICP. ‘Regulated timber products’ covers wood, pulp, and paper products defined by their Harmonized System (HS) tariff codes under Section 5 of the Illegal Logging Prohibition Rules 2024. This includes sawn timber, plywood, veneer, moulding, joinery products, and more.

Note: The ban on importing illegally logged timber applies to ALL timber products, regulated or not. ICP obligations, however, specifically apply to the regulated list.

What Does a Compliant ICP Look Like?

A compliant ICP is a written document that describes your system for identifying, assessing, and mitigating the risk of illegal logging in your supply chain. DAFF inspectors will ask for it if you’re selected for an audit. It must cover: your information-gathering process, your risk assessment methodology, your mitigation steps, and how you keep records. Generic templates won’t cut it DAFF has found that vague, non-specific systems frequently fail audits.

The 7 Key Documents Required to Import Timber into Australia

Getting timber through Australian border control requires two layers of documentation: standard commercial shipping documents and due diligence documents under the Illegal Logging Prohibition Act. Here’s what you need for every regulated shipment:

1. Written Due Diligence System (ICP) – Your documented process for risk assessment and mitigation. DAFF’s number one audit request. Must be product- and supplier-specific, not a generic template.

2. Risk Assessment Records – Per-shipment documentation showing how you assessed the risk of illegal logging. Under the 2025 rules, the pathway depends on whether your timber is certified or non-certified.

3. Risk Mitigation Documentation – Evidence of what steps you took to reduce identified risks e.g., requesting additional supplier documents, seeking third-party verification, or obtaining certification.

4. Chain of Custody / Supplier Records – Species name (common and scientific), country of harvest, volume, supplier details, and evidence of legal harvest (licences, permits, or certification documents from the country of origin).

5. Phytosanitary Certificate – Issued by the National Plant Protection Organisation (NPPO) of the exporting country. Required for solid wood products to certify freedom from pests and diseases.

6. Treatment Certificate – Proof of required treatment heat treatment (HT) or methyl bromide fumigation as mandated by DAFF’s BICON (Biosecurity Import Conditions) system for specific products.

7. Customs Declaration – Each time you import a regulated timber product, you’re legally required to declare whether you’ve complied with your due diligence requirements. An e-declaration system is being developed by DAFF and will be mandatory once live.

Additional documents for specific circumstances: Import Permit (via BICON) for CITES-listed or restricted species | CITES permits for endangered species | Manufacturer’s Declaration on species and origin for processed products. Always check BICON before each shipment as conditions change.

Don’t risk non-compliance under AILPA. Discover the exact due diligence steps required to legally import timber.

What Are the Biggest Challenges for Australian Timber Importers?

Most compliance failures aren’t the result of bad intentions. They’re the result of operational blind spots things that look manageable on paper but break down fast in practice. Here are the four challenges that cause the most ICP failures, based on DAFF audit findings and industry experience.

Challenge 1 – Species Mislabeling and Origin Fraud

This is the one most importers underestimate. In DAFF’s 2024 scientific timber testing trial, approximately 25% of tested products were inconsistent with their declared species and/or origin (PwC, 2025). One in four products. That’s not a rounding error, it’s a structural problem in the global timber trade.

Species substitution and origin falsification frequently occur in processing hubs like China and Vietnam, where raw timber from high-risk origins (Indonesia, Malaysia, parts of Africa, and Latin America) is processed and re-exported with documentation that obscures the original source. If your supplier’s paperwork looks clean but the species doesn’t match, you bear the compliance liability.

Challenge 2 – Multi-Country Supply Chains and Opacity

Complex supply chains are a recognised high-risk category under DAFF’s compliance framework. Each additional processing step between harvest and import represents another point where illegally logged timber can enter a product without detection. Sawn timber sourced through third-country processors is now one of DAFF’s primary audit targets.

For importers sourcing from multiple countries or through intermediaries, gathering credible, verifiable information about the actual harvest location and species becomes enormously difficult, especially when suppliers lack formal documentation systems.

Challenge 3 – Maintaining Records and Audit Readiness

An ICP isn’t set-and-forget. Under the 2025 rules, you must apply your due diligence system to every regulated shipment and keep records that demonstrate how it was applied, including risk assessments, the information gathered, and any mitigation steps taken. If DAFF requests a compliance assessment and you can’t produce shipment-specific records, your ICP fails regardless of how good your written system looks.

Many operators keep records in spreadsheets and email chains. When an audit notice arrives, reconstructing the paper trail for a specific shipment from six months ago becomes a crisis. This is where most non-compliance findings actually originate not from intentional wrongdoing, but from inadequate record management.

Challenge 4 – The Certification vs. Non-Certification Pathway Complexity

The 2025 rules replaced three risk assessment methods with two distinct pathways based on certification status. Certified timber (FSC, PEFC) follows a streamlined pathway with reduced documentation requirements. Non-certified timber requires a full risk assessment covering country-level risk, operator-level risk, and product-level risk, including verifying harvest legality through supplier documentation.

The problem? Not all certification claims are equal. DAFF has found cases where certified product designations were inaccurate. If you accept certification documentation at face value without verifying its validity through the issuing body, you may be applying the wrong due diligence pathway and failing your ICP without knowing it.

Explore the biggest challenges timber importers face today. Understand the risks, complexities, and compliance hurdles shaping global timber trade.

The March 2025 Rule Changes – What’s New and What’s Coming

Effective 3 March 2025, the grace period is over.

The Illegal Logging Prohibition Rules 2024 replaced the former Regulation. The six-month education-focused transition period concluded in September 2025. DAFF is now conducting full enforcement assessments.

Here’s what changed and why it matters for every timber importer operating in Australia:

Two due diligence pathways replace three risk methods: The old Country Specific Guidelines / Timber Legality Frameworks / Regulated Risk Factors approach is gone. You now follow either the certified pathway or the non-certified pathway, depending on your product’s certification status.

Repeat due diligence exception (12-month window): If you import the same timber product from the same supplier within 12 months and nothing material has changed, you can rely on your previous risk assessment. This reduces administrative burden for established supply chains.

Timber testing powers activated: DAFF can now take, test, and analyse samples of timber products using scientific techniques to verify declared species and origin. The 2024 trial found 25% of tested products inconsistent with their declarations. Expect this capability to expand.

Pre-import notification requirement (incoming): A requirement to notify DAFF before importing, providing species, harvest location, and other key data via e-declaration is legislated but not yet implemented pending new IT systems. Once live, this becomes a mandatory step for every shipment.

Strengthened enforcement options: DAFF now has injunctions, enforceable undertakings, and the ability to publish non-compliance cases publicly. Penalties include fines up to $165,000 and up to five years imprisonment for fault-based offences.

Understand how to achieve full compliance with Australia’s Illegal Logging Prohibition Act. Learn the steps required to legally import timber into Australia.

Certified vs. Non-Certified Timber – Which Due Diligence Pathway Applies?

The single biggest change in the 2025 rules is the shift to a certification-based pathway system. The pathway you take determines how much documentation you need and what your risk assessment must cover. Here’s the breakdown:

The certification pathway is not a simple tick-box. DAFF’s audit data shows that accepting certification documentation without independent verification is one of the most common compliance gaps.

Is FSC certification enough for AILPA compliance? Discover where certification falls short and what additional steps importers must take.

How Digital Traceability Closes the ICP Compliance Gap

The fundamental reason 60% of timber importers fail DAFF audits isn’t a lack of awareness, it’s a lack of systems. Manual processes, spreadsheet-based records, and email-dependent supplier documentation don’t hold up under audit scrutiny. They’re also slow, fragmented, and impossible to maintain at scale.

Digital traceability platforms purpose-built for commodity supply chain compliance solve exactly these gaps. The core capabilities that close the ICP compliance gap are:

• Automated risk assessment – Flag high-risk source countries, species, and supplier profiles before shipment arrives, not after an audit notice.
• Digital supplier onboarding – Collect GPS plot data, harvest licences, chain-of-custody certificates, and KYC documents directly from suppliers in a structured digital format, not loose email attachments.
• Blockchain-backed records – Every document, risk assessment, and transaction is recorded on an immutable ledger, tamper-proof and audit-ready from day one.
• Species and origin verification – Cross-reference declared species against satellite-verified geolocation data and reference databases to catch substitution risks before they become liability.
• Audit-ready ICP export – Generate a complete due diligence report for any shipment in one click, showing the ICP system used, information gathered, risk assessment outcomes, and mitigation steps taken.

How TraceX Helps Timber Importers Build Audit-Ready ICPs

TraceX’s ILPA Compliance Platform was built for exactly this challenge: commodity supply chains that span multiple geographies, involve smallholder or informal producers, and require verifiable, documented evidence of legal sourcing. Timber is one of its core commodity verticals.

Here’s how TraceX transforms a manual, fragmented ICP process into a robust, digital compliance system:

Beyond compliance, TraceX’s GPS polygon mapping and satellite-verified deforestation monitoring give timber importers defensible, verifiable proof of legal sourcing, not just paperwork that could be fabricated. This matters both for DAFF audits and for buyers increasingly demanding supply chain transparency.

Understand how supply chain traceability supports AILPA compliance. Learn how to track timber from origin to import with confidence.

Unlike generic compliance software, TraceX’s Agentic AI can auto-parse supplier documents, licences, KYC records, and certifications directly from email attachments, eliminating the manual data entry step that creates the most record-keeping gaps.

Compliance Isn’t Optional – But It Doesn’t Have to Be Hard

Australia’s timber import compliance framework has real teeth now. The 2025 rules bring stricter enforcement, scientific testing, public disclosure of non-compliance, and incoming e-declaration requirements. The 60% historic non-compliance rate isn’t a benchmark to accept it’s a warning.

The good news? An audit-ready ICP isn’t unachievable. The gap between failing and passing an assessment is mostly a systems gap, not a knowledge gap. The importers who get it right are the ones who treat their ICP as a live operational system, not a document filed in a folder.

Digital traceability is what makes that possible at scale. When your supplier records, risk assessments, and chain-of-custody documentation are structured, verified, and stored in a system purpose-built for compliance, audit readiness becomes the default state, not an emergency exercise.

Frequently Asked Questions (FAQ’s)