Auditing Your Trade Secrets: A Practical Checklist

Intellectual Property > Trade Secret | Published 7 February 2026 - Updated 14 June 2026 | UpLaw - uplaw.us

A trade secret audit answers the two questions every misappropriation case eventually forces: what, precisely, are your trade secrets, and what have you actually done to keep them secret? This checklist turns those questions into a repeatable, defensible workflow, and explains why the paper it generates is both operational hygiene and courtroom evidence.

Keywords: trade secret audit, trade secret inventory, reasonable measures, DTSA, 18 U.S.C. § 1839, Uniform Trade Secrets Act, identification with reasonable particularity, access review, crown jewels, classification, maturity model, access creep, independent economic value, DTSA whistleblower notice, remediation, IP due diligence, negative know-how

---

A patent is a public document with a number on it. A registered trademark has a certificate. A copyright can be looked up in a government database. A trade secret has none of that. It exists only for as long as the owner keeps it secret and can prove, when challenged, that it did so deliberately. That single structural fact drives everything in this checklist: because a trade secret has no registry, the audit becomes the registry. It is the closest thing to a certificate of title that trade secret law allows, and it is one the company issues to itself.

Most companies discover the absence of that title at the worst possible moment. A star engineer resigns on a Friday and starts at a competitor on Monday. A supplier that saw part of a manufacturing line launches a suspiciously similar product. A data-room reviewer in an acquisition asks, politely, to see the list of trade secrets being sold. In each case the first question is the same: what exactly are we talking about, and can you show me you treated it as secret? A company that cannot answer within hours is not merely disorganized. It is legally exposed, because trade secret status is judged at the moment of the dispute, against the company's actual practices, not its aspirations.

This resource treats the audit as the operational counterpart to the work described in building trade secret protection from the ground up and cataloged in the trade secret protection toolkit. Where those resources explain how to build a program, this one explains how to test it, refresh it, and generate the contemporaneous record that makes it enforceable. For the underlying doctrine, see how secrecy becomes protectable intellectual property. Run the audit at least annually, and after every event that changes who holds what.

Why an audit is a legal instrument, not a filing-cabinet chore

Three doctrinal pressures make the audit worth doing well. Each maps onto an element the company will have to prove if it ever sues, and onto a defense it will have to defeat.

The reasonable-measures element

Both governing regimes condition trade secret status on secrecy efforts. The Uniform Trade Secrets Act, adopted in some form by every state except New York, defines a trade secret as information that "derives independent economic value ... from not being generally known" and "is the subject of efforts that are reasonable under the circumstances to maintain its secrecy." UTSA § 1(4). The federal Defend Trade Secrets Act tracks the same idea in different words, protecting information only where "the owner thereof has taken reasonable measures to keep such information secret." 18 U.S.C. § 1839(3)(A). New York, the lone holdout, still applies the six-factor test of the Restatement (First) of Torts § 757 cmt. b (1939), which asks, among other things, "the extent of measures taken by [the owner] to guard the secrecy of the information" and "the amount of effort or money expended ... in developing the information."

"Reasonable measures" is not a fixed checklist the law hands you; it is a cost-benefit judgment the court makes after the fact. Judge Posner's opinion in Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174 (7th Cir. 1991), remains the canonical explanation: perfect secrecy is prohibitively expensive and usually unnecessary, so the law asks only for precautions proportionate to the value of the secret and the cost of guarding it. The owner "must" take some precautions, Posner wrote, but "only" those that are reasonable. That is a standard an audit is uniquely built to satisfy, because an audit is precisely the exercise of matching precautions to value, item by item, and writing down that you did it.

The corollary matters just as much: the absence of measures is what most often sinks a claim. Courts routinely deny protection where the "reasonable measures" story is contradicted by the company's own conduct. In Abrasic 90 Inc. v. Weldcote Metals, Inc., 364 F. Supp. 3d 888 (N.D. Ill. 2019), the court denied a preliminary injunction because the plaintiff had done almost nothing to protect the information it now called secret, cataloging a litany of omissions and observing that the failure to require confidentiality agreements "often dooms" a trade secret claim. In Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018), a customer list lost protection in part because the company had encouraged an employee to store the very data on his personal devices, undercutting the claim that it treated the information as confidential. The audit is where a company finds those contradictions before its adversary does.

The identification problem

Because trade secrets have no registry, a plaintiff must describe what it is suing about, and describe it well. Courts require identification of the asserted secrets "with reasonable particularity" before discovery proceeds, both to frame the dispute and to prevent a plaintiff from reverse-engineering its claim out of the defendant's documents. California codifies the requirement: no discovery "relating to the trade secret" may begin until the claimant "identif[ies] the trade secret with reasonable particularity." Cal. Civ. Proc. Code § 2019.210. Even without a statute, federal courts enforce the same discipline. See IDX Systems Corp. v. Epic Systems Corp., 285 F.3d 581 (7th Cir. 2002) (a 43-page description that failed to separate the secret from the general was inadequate); Imax Corp. v. Cinema Technologies, Inc., 152 F.3d 1161 (9th Cir. 1998) (plaintiff must identify the specific trade secrets, not gesture at a category).

Here is the trap the audit resolves. Identify too vaguely ("our manufacturing process"), and the case gets dismissed or stalls. Identify too precisely in a public filing, and you have just published the secret. A current, well-structured inventory is the escape hatch: it lets the company describe each secret at the right altitude, with the metadata to support particularity, without dumping the crown jewels into a complaint. A company that has already done this work walks into litigation able to answer the identification question on day one. A company that has not will spend its first months in discovery trying to reconstruct, under pressure and in public, something it should have written down in private years earlier.

The value element and the contemporaneous-record point

The final element, "independent economic value," is at bottom a valuation question, and a company that can articulate what a secret is worth is answering an element of its own claim while seeding a damages theory. See WeRide Corp. v. Huang, 379 F. Supp. 3d 834 (N.D. Cal. 2019) (concrete development-cost evidence supported the value element on a motion for preliminary injunction). More broadly, everything the audit produces is contemporaneous evidence: it shows a court that the company managed its secrets deliberately, on a schedule, before any dispute arose, rather than assembling a self-serving narrative after the theft. That timing is what disarms the defense bar's favorite arguments, that the plaintiff never really treated the information as secret, or slept on rights it did not know it had.

One empirical note underscores why this is not academic. In the first year after the DTSA's 2016 enactment, trade secret plaintiffs invoked the new statute constantly, but courts frequently faulted them for thin secrecy showings and vague identifications. See David S. Levine & Christopher B. Seaman, The DTSA at One: An Empirical Study of the First Year of Litigation Under the Defend Trade Secrets Act, 53 Wake Forest L. Rev. 105 (2018). The cases that failed usually failed on the two things an audit fixes: proof of measures, and a usable description of the secret.

A framing note before you begin

Call it an "assessment," not an "audit," when you talk to the people who actually know where the secrets live. "Audit" summons images of compliance, blame, and finding people who did something wrong; engineers and salespeople who fear being caught storing files on a personal laptop will quietly route around it. "Assessment" invites the candor you need. Whatever you call it, run it honestly. An audit that inflates the portfolio, that labels the lunch menu a trade secret, is worse than no audit at all, because over-inclusion is itself evidence that the company treated nothing as genuinely secret. Courts notice when everything is a crown jewel.

And run it under privilege where you can. The most valuable audit findings are the embarrassing ones, the access nobody revoked, the NDA nobody signed, the source code on a former contractor's GitHub. Those candid conclusions are exactly what an adversary would love to read back to a jury. Structuring the audit as legal work, directed by counsel for the purpose of legal advice, gives the findings the best available claim to attorney-client privilege and work-product protection. It does not guarantee it, and the privilege can be waived or pierced, but an unprivileged audit that documents every weakness in the program is a discovery gift you never have to give.

Phase 1: Scope and govern the audit

• [ ] Name an owner and a cadence. Assign a single accountable person and a fixed schedule: annually at minimum, plus event triggers (a financing round, an acquisition or divestiture, a reorganization, a system or cloud migration, a major hire from a competitor, a shift to remote work, or a security incident).
• [ ] Decide the privilege posture. Determine whether counsel will direct the audit so that findings about gaps are protected, and instruct participants accordingly. Mark work product. Route sensitive conclusions through legal.
• [ ] Map the business units to survey. No central team knows the whole portfolio. Plan interviews across R&D, engineering, product, sales operations, finance, manufacturing, procurement, HR, and IT. The secrets live where the work happens, not where the org chart says they should.
• [ ] Write a short charter. State the audit's purpose, scope, method, confidentiality expectations, and the obligations of participating employees, then circulate it. A one-page communication that defines expectations up front is what turns scattered interviews into a coherent record.
• [ ] Score the program on a maturity model. Locate where the company sits today so you can measure movement next year.

A trade secret audit is not a single act but a sequence: planning and charter, a general communication that sets expectations, interviews of the people who hold the knowledge, gathering of documents (the trade secret policy, product and process descriptions, key employment agreements, HR and IT policies), analysis, a findings report, and a wrap-up that resolves loose ends. The point of naming the phases is repeatability. An audit is only useful if this year's results can be laid beside last year's; a one-off snapshot tells you where you are but not whether you are getting better or worse.

The maturity model. Borrowed from software process maturity and adapted to trade secrets, a six-level scale gives management a common vocabulary and a target:

Level	Description
0	No trade secret policy, process, or governance at all.
1	Ad hoc and chaotic; protection happens by accident or individual habit.
2	Basic written policy, process, and governance exist.
3	Formal policy, process, and governance are defined, followed, and actively managed.
4	Level 3 extends beyond the company's walls to suppliers, contractors, and collaboration partners.
5	Level 4 plus alignment with tax and transfer-pricing rules (the OECD's base-erosion and profit-shifting framework) so the accounting for intangibles matches the legal reality.

A two-year-old startup does not need Level 5. It needs to get off the floor, out of Level 0 and 1, where the most damaging and most preventable failures live. A mature manufacturer that shares process know-how with a contract fabricator should be aiming for Level 4, because a program that stops at the company's own perimeter ignores the relationships where secrets most often leak. The honest answer to "what level are we?" is usually "lower than we thought," and that discomfort is the audit working as designed.

Why this phase matters. Governance is what converts a good intention into evidence. A court asked to find reasonable measures wants to see a deliberate, repeated, documented practice, not a heroic one-time cleanup performed the week before the complaint was filed. The cadence, the charter, and the maturity score are the skeleton of that showing.

Phase 2: Inventory the crown jewels

The inventory is the heart of the audit. Everything else, the access review, the controls verification, the valuation, hangs off it. Build it to be lived in, not admired once and abandoned.

• [ ] List the technical secrets. Formulas, recipes, and chemical processes; manufacturing methods and machine settings; source code, algorithms, and model architectures; training data and data-labeling schemes; system designs and integration know-how; and negative know-how, the catalog of approaches that were tried and failed. Negative know-how is often the single most valuable and least appreciated asset a company owns, because it saves a rival years of the same dead ends, and it almost never gets written into an inventory unless someone asks for it directly.
• [ ] List the business secrets. Curated customer lists that pair identities with non-public preferences, buying histories, and decision-maker contacts; pricing models, cost structures, and margin data; strategic plans, roadmaps, and M&A targets; supplier terms and sourcing arrangements; and internal financial metrics not otherwise disclosed.
• [ ] Attach metadata to each item. For every secret, record a compact record: what it is (at a useful level of description); where it lives (which systems, repositories, file shares, cloud buckets, and physical locations); who created it and when; who is authorized to touch it; why it has value; and which agreements and controls govern it. This metadata is the workhorse of the whole exercise, it feeds the access review, supports particularity in litigation, and can be maintained without exposing the underlying secret itself.
• [ ] Tier each item by sensitivity. Not every secret deserves equal protection. Separate the few genuinely critical assets, the loss of which would be existential, from the merely useful. The tiering is what makes proportionate protection possible in the next phase.
• [ ] Ruthlessly exclude the non-secret. Cut anything generally known, readily ascertainable by proper means, or lacking real economic value. Public specifications, information disclosed in a patent, data a competitor could buy or reverse-engineer, and stale material that no longer confers advantage do not belong on the list. Over-inclusion is not a harmless hedge; it dilutes the inventory and suggests the company never distinguished the truly secret from the merely internal.

Worked example. Suppose Marrowbone Ferments, Inc., a hypothetical maker of a shelf-stable probiotic beverage, runs its first audit. Its instinct is to declare "our entire fermentation process" a trade secret. The audit forces precision. The published nutrition panel and the general fact that the drink is fermented are public, out. The specific bacterial strain ratios, the two-stage temperature curve, and the proprietary stabilizer that gives the product its shelf life are secret, in. The list of ingredients that failed to stabilize the product across eighteen months of R&D, the negative know-how, is the crown jewel nobody thought to write down, and it goes in tier one. The customer list of 400 grocery buyers is public; the subset of 30 buyers who have signed private-label deals with confidential pricing is not. After the audit, Marrowbone can describe its secrets with the particularity a court demands, and it has stopped calling the nutrition label a secret, which would have poisoned its credibility on the parts that matter.

Why this phase matters. The "which agreements and controls govern it" field is, quite literally, the documentation of reasonable measures the company will point to in court. And a current inventory is what lets the company answer, within hours of a breach or departure, the only question that matters in the first day of a crisis: were the crown jewels touched, and by whom? A stale inventory sends investigators to the wrong servers while the real exposure widens. For a deeper treatment of how to think about which regime protects which asset, see copyright, trademark, patent, and trade secret compared; for software specifically, where the same code may be simultaneously copyrighted and secret, see how the law protects software.

Common mistakes in the inventory. Building it once and letting it rot until it misdescribes where the secrets live. Cataloging information the way a privacy data-map catalogs personal data, by regulatory category, when a crown-jewels inventory catalogs value. Forgetting negative know-how. And confusing "confidential" (a contractual label the company applies) with "trade secret" (a legal status the law confers), so that the inventory swells with routine internal documents that would never survive the readily-ascertainable test.

Phase 3: Map where the secrets live and who can reach them

Inventory tells you what you have. Mapping tells you how exposed it is. This phase is where audits most often surface the failures that actually lose cases, because the gap between the policy and the practice is almost always an access gap.

• [ ] Trace each tier-one secret to every location. Follow it into production systems, code repositories, shared drives, cloud storage, email threads, chat channels, backups, personal devices, and third-party platforms. Secrets sprawl; a formula that "lives" in a controlled document also lives in the six emails that attached it and the vendor portal where it was uploaded for a quote.
• [ ] Run an access review for each crown jewel. Enumerate who can reach it today and test each entry against genuine business need. The question is not "who was granted access" but "who still needs it," and the two lists are never the same.
• [ ] Hunt for access creep. Find the employee who rotated to a different team two years ago and never lost the old permissions; the contractor whose engagement ended but whose credentials still work; the shared service account nobody owns. Access creep is both a live security hole and an evidentiary liability, because it contradicts the "need to know" story that anchors the reasonable-measures defense.
• [ ] Account for the perimeter you no longer have. Remote work, personal devices, and cloud platforms have dissolved the office as a boundary. Confirm that secrets accessed from home run through managed devices or controlled access, that personal-device storage is either prohibited or governed, and that departing-employee forensics can actually reconstruct what left.

Why this phase matters. The classic failures here have names in the case law. In DM Trans, LLC v. Scott, 38 F.4th 608 (7th Cir. 2022), the court probed whether the plaintiff's actual access practices matched its confidentiality claims, part of a growing body of decisions in which sloppy access discipline undercut the secrecy showing. Yellowfin Yachts turned on data the company let an employee keep on personal devices. The lesson is consistent: a policy that says "need to know" while the reality is "everyone still has the keys" is not a reasonable measure; it is evidence against one.

The remote-work and cloud dimension deserves its own treatment, and gets one in guarding trade secrets without a perimeter. One doctrinal wrinkle worth flagging during the mapping phase: when access is governed by contract and computer authorization rather than physical locks, the reach of the Computer Fraud and Abuse Act narrowed considerably after Van Buren v. United States, 141 S. Ct. 1648 (2021), which held that an employee with authorized access who misuses it does not thereby "exceed authorized access" under the CFAA. The practical consequence for the audit is that access controls must do real work at the point of authorization, because a downstream misuse theory under the CFAA may not be available. The interaction of the CFAA, contract, and other doctrines in the access context is developed further in web scraping and the law after hiQ v. LinkedIn.

Phase 4: Verify the measures protecting each item

For each tier of the inventory, confirm that four categories of control are actually in place and actually operating. The recurring theme is the difference between a control that exists on paper and one that exists in practice; courts weigh the latter.

• [ ] Physical controls. Locked storage for sensitive materials; access-controlled spaces for areas where secrets are used or discussed; visitor logging and escort policies; and conspicuous marking of confidential documents and prototypes. Marking is cheap and disproportionately persuasive; a document stamped "Confidential" is a small, contemporaneous act of secrecy the company can point to years later.
• [ ] Technical controls. Least-privilege access provisioning; strong authentication, ideally multi-factor, on systems that hold crown jewels; encryption at rest and in transit; logging and monitoring sufficient to reconstruct who touched what; and data-loss-prevention tooling calibrated to the highest-value repositories rather than sprinkled everywhere and ignored.
• [ ] Administrative controls. A written confidential-information policy; onboarding and periodic training that actually reaches the people who handle secrets; documented education records; and clear procedures for classification, handling, and destruction. Training records are underrated evidence, they show a court that secrecy was a managed institutional practice, not a slogan.
• [ ] Contractual controls. Confirm that every employee and contractor with access has signed a confidentiality and invention-assignment agreement; that every third party with access, supplier, vendor, joint-development partner, is under an NDA appropriate to the exchange; and that those agreements are current, signed, and findable.
• [ ] Verify the DTSA whistleblower notice. Confirm that the immunity notice required by 18 U.S.C. § 1833(b) appears in every confidentiality or invention-assignment agreement entered into or amended after May 11, 2016. Its absence does not void the contract, but it forfeits the ability to recover exemplary (double) damages and attorney's fees against an employee under the DTSA, § 1833(b)(3)(C), a self-inflicted wound that costs nothing to prevent and everything to discover mid-litigation.

Why this phase matters. Contracts are the load-bearing wall of a trade secret program, and their absence is the most common defect an audit finds. Abrasic 90 put it bluntly: the failure to secure confidentiality agreements often dooms the claim. Where a secret is shared with an outsider under no obligation of confidence, the secret can simply evaporate, disclosure without a confidentiality obligation may destroy the secrecy the whole edifice rests on. Compare Farmers' Edge Inc. v. Farmobile, LLC, 970 F.3d 1027 (8th Cir. 2020), where information shared in the course of a business relationship, without adequate secrecy protections, lost trade secret status.

For the anatomy of the agreements this phase checks, UpLaw's clause-by-clause NDA checklist and the guide to non-disclosure agreements for technology deals cover the substantive drafting, including the § 1833(b) notice, residual-knowledge clauses, and reverse-engineering carve-outs. On the invention-assignment side, clean chain of title is its own audit finding, present-assignment language ("hereby assigns," not "agrees to assign") and the state carve-out statutes are the difference between owning an employee's work and merely hoping to; see employee invention assignment agreements. And because non-competes are now a fractured and shrinking tool, the audit should confirm the program does not lean on them where they are void; the current state of play is mapped in the future of non-competes.

Phase 5: Value and prioritize

An audit that treats every secret as equally important is not an audit; it is a list. Valuation is what lets the company protect ruthlessly rather than uniformly, and it does double duty as the foundation of both the value element and a future damages case.

• [ ] Capture a value note for each secret. Record whatever rough measure fits: development cost in person-months or dollars, the price premium the secret sustains, the licensing revenue it could command, or the head start it denies a competitor. Precision is not the goal at this stage; a defensible order of magnitude is.
• [ ] Prioritize protection to match value. Concentrate the expensive controls, MFA, DLP, tight access, active monitoring, on tier-one assets. Accept proportionate, lighter controls on lower-value information. The law does not demand that a company spend more guarding a secret than the secret is worth; Rockwell forbids exactly that kind of disproportion in reverse.
• [ ] Escalate valuation where money will change hands. For secrets headed into a license, a financing, or an acquisition, commission a more rigorous valuation, cost-based, market-based, or discounted-cash-flow, because at that point the number will be negotiated, taxed, or litigated, and a back-of-envelope figure will not survive scrutiny. Note that transfer-pricing and base-erosion rules (the reason Level 5 of the maturity model exists) increasingly force companies to account for the value of intangibles whether they want to or not.

Why this phase matters. "Independent economic value" is an element the plaintiff must prove, and a company that can already say what a secret is worth is answering that element from its own files rather than reconstructing it under deposition. WeRide illustrates how a concrete development-cost figure supports the showing. Valuation also seeds damages: trade secret recovery can run to actual loss, unjust enrichment, or a reasonable royalty, and in willful-and-malicious cases, exemplary damages and fees. How those measures are computed across the IP regimes, and why the trade secret measure is often the most flexible and the most fact-intensive, is developed in what an IP case is worth. The audit's value notes are where a damages expert will start.

Phase 6: Remediate and document

Findings without follow-through are worse than no findings, because they prove the company knew of a weakness and left it open. Close the loop, and preserve the record that you did.

• [ ] Build a prioritized remediation list. Rank the gaps: missing NDAs, missing § 1833(b) notices, over-broad access, unmarked sensitive files, unmanaged personal-device storage, orphaned service accounts, expired or unsigned agreements.
• [ ] Fix the cheap, high-impact items first. The best return on effort is almost always in low-cost, high-value corrections: standard confidentiality language in offer letters and contractor agreements, revocation of stale access, document marking, and enabling MFA on the crown-jewel systems. These are days of work that move the maturity needle and harden the reasonable-measures showing at once.
• [ ] Update the inventory and controls record. Reflect every remediation in the metadata so the next audit starts from truth, not from last year's aspirations.
• [ ] Preserve the audit work product. Keep what triggered the audit, what was gathered, what it found, and what was fixed. Under privilege where possible. This paper trail is the contemporaneous diligence record that answers the "you never really treated it as secret" and "you slept on your rights" defenses.
• [ ] Calendar the next audit and its accelerants. Set the annual date and list the events that would pull it forward.

Why this phase matters. When an acquirer or investor runs IP diligence, a documented, current audit converts a source of deal friction into a selling point, it demonstrates clean title and real protection, and it heads off the chain-of-title and secrecy gaps that routinely retrade or kill transactions. Inside litigation, the remediation record shows a court a company that manages its secrets as an ongoing discipline. The audit's own timestamped existence is often the best rebuttal to the argument that the company's secrecy was an afterthought invented for the lawsuit.

Phase 7: Tailor the audit to the setting

The framework above applies everywhere, but a handful of settings put distinctive strain on the reasonable-measures inquiry and deserve targeted attention.

Startups and early-stage companies

• [ ] Get the near-free foundations in place from day one. Confidentiality and invention-assignment agreements (with the § 1833(b) notice), a one-page written policy, and basic access discipline cost almost nothing and prevent the most common early-stage catastrophe: a co-founder or early engineer who leaves with the product in their head and no agreement in the file.
• [ ] Protect the most critical information with size-proportionate measures. No court expects a two-year-old company to run a security operations center. It does expect the founders to have papered their relationships and locked down the core.

A startup that postpones trade secret hygiene until it is "big enough" usually confronts the subject only after a departure has already cost it something irreplaceable, and by then the question is not how to protect the secret but whether a protectable secret ever legally existed. For companies whose entire value is confidential technology, the audit and the IP strategy are nearly the same exercise; see intellectual property strategy for mobile apps for how the regimes stack in a software-first business.

R&D environments

• [ ] Audit the line between the publishable contribution and the protectable embodiment. Confirm that researchers consciously distinguish the general advance they may present or publish from the specific implementation the company must keep secret, and that they draw the line before the paper goes out, not after.
• [ ] Flag the patent-versus-secret fork. A secret disclosed in a patent application will, on publication, destroy trade secret status as to what was disclosed. The audit should confirm that the decision to patent or to keep secret is made deliberately, asset by asset, and not by accident of who filed what. The strategic calculus, why some computer-implemented and cloud innovations are now kept as secrets precisely because they are hard to protect or enforce as patents, is a live one. See R. Mark Halligan, Trade Secrets v. Patents: The New Calculus, 2 Landslide 10 (2010).
• [ ] Treat negative results as secrets. The failed experiments are assets. Capture them.

The invention-disclosure process is where much of this line-drawing happens in practice; UpLaw's invention disclosure checklist shows how to document conception and embodiments in a way that preserves both patent and trade secret options until the company chooses.

Manufacturing and the factory floor

• [ ] Confirm compartmentalization. A visible process is a vulnerable one. Verify that no single person, and no single visitor, sees the whole line, and that the arrangement is deliberate rather than accidental.
• [ ] Bind everyone with floor access. Employees, temporary workers, and contractors alike should be under confidentiality obligations. A janitor with a phone camera is a real vector.
• [ ] Paper the supplier relationships. Suppliers who must understand part of a process to perform should be bound by confidentiality provisions and required to return or destroy materials when the engagement ends. A process shared with an unbound supplier may simply cease to be secret, the risk Farmers' Edge crystallizes. In toll-manufacturing and joint-development settings, the audit should specifically confirm that IP-ownership and confidentiality terms survive the relationship.

M&A and financing diligence

• [ ] Run the audit as if a hostile reviewer will read it, because one will. In diligence, the buyer's counsel will ask for the trade secret list, the agreements that protect it, and the chain of title. A current audit answers all three and lets the seller negotiate from strength; its absence invites a discount, an escrow, or a walk. Treat the pre-transaction audit as a special-purpose refresh of the ordinary annual one, with extra attention to invention-assignment completeness and third-party obligations.

The audit questionnaire: a working instrument

The interviews in Phase 1 go better with a structured instrument. The following topics, adapted from professional trade secret audit practice, turn open-ended conversations into comparable, year-over-year data. Use them as prompts, not a script.

Topic	What to probe
Awareness and education	What is taught about trade secrets, to whom, by whom, and how is the material kept current? What education records exist?
Definition	What definition of "trade secret" does the company use, and is it consistent with the legal (and tax) definitions?
Policy and process	Is there a written policy and a documented process covering identification, review, protection, and maintenance? Is it actually used, consistently, across the whole company?
Ownership	Who owns the policy? Who owns the process? Are those real, accountable people or vacant boxes on a chart?
Qualification and classification	On what basis does information qualify as a secret, and how (if at all) are secrets classified and tiered?
Access and controls	How is access controlled, and what administrative, technical, and legal protection mechanisms are deployed and in use?
Third-party sharing	Are secrets shared with others, and how is that governed? Are third-party secrets entrusted to the company, and how are those handled to avoid contamination claims?
Valuation	Has the company valued its secrets? Why, how, when, and by whom?
Portfolio management	Is there a system or tool for managing the portfolio and its metadata, and what does it capture?

The questionnaire's quiet virtue is that it separates the company that has a program from the company that has a policy document. Many organizations can produce a handsome written policy; far fewer can answer "is the process actually in use, consistently, across every business unit?" The gap between those two answers is the audit's most important finding, because it is the gap a court will find too.

Common mistakes and failure modes

• Auditing once, then never again. The inventory rots, misdescribes where secrets live, and points a breach investigation at the wrong systems. An audit is a heartbeat, not a monument.
• Claiming everything is a secret. Over-inclusion persuades a court that the company treated nothing as genuinely secret and cannot tell its crown jewels from its cafeteria menu.
• Skipping the access review. Access creep quietly dismantles the need-to-know narrative that the reasonable-measures defense depends on.
• Forgetting the § 1833(b) notice. A one-paragraph omission forfeits exemplary damages and fees, and nobody notices until the damages phase.
• Running the audit without privilege. Candid findings about weaknesses become a discovery gift, handed to the adversary who most wants them.
• Confusing contractual "confidential" with legal "trade secret." Labeling a thing confidential does not make it a trade secret; only secrecy plus value plus reasonable measures does.
• Treating the audit as an IT project or a legal project, but not both. The secrets live in systems that IT understands and under legal standards that counsel understands; an audit run by either alone misses half the picture.

After the audit: feeding the rest of the program

An audit is not an endpoint. Its outputs are the inputs to everything else in a trade secret program. The inventory and access map become the reference the company reaches for the moment an employee resigns, structuring the offboarding, the access revocation, the exit interview, and the continuing-obligations reminder; that workflow is set out in protecting trade secrets when employees leave. The same map is what makes incident response fast and forensically sound when a breach hits, letting responders know instantly which repositories hold crown jewels and whose access to examine; see when a breach hits your crown jewels. And the whole audit record is the evidentiary spine of any misappropriation suit, supplying the particularity, the measures proof, and the value story that the DTSA's civil cause of action, 18 U.S.C. § 1836(b), and its remedies, including the extraordinary ex parte seizure of § 1836(b)(2), will demand.

A closing perspective on why the discipline pays off. Trade secret protection is not, in the end, about building an impregnable wall; walls fail, and the law knows it. It is about being able to prove, on the day it matters, that you knew what you had, you knew where it was, you decided who could reach it, and you took the precautions a reasonable company in your position would take. An audit is how a company earns the right to make that proof. The company that runs one every year is not merely tidier than its competitor; it is, in the eyes of the doctrine, the one that actually has trade secrets to protect.

Primary and secondary authority

Statutes. Defend Trade Secrets Act, 18 U.S.C. §§ 1836-1839, esp. § 1839(3)(A) (reasonable-measures definition), § 1833(b) (whistleblower-immunity notice and its damages consequences), § 1836(b) (civil cause of action, remedies, and ex parte seizure). Uniform Trade Secrets Act § 1(4) (definition). Cal. Civ. Proc. Code § 2019.210 (identification with reasonable particularity). Computer Fraud and Abuse Act, 18 U.S.C. § 1030.

Cases. Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174 (7th Cir. 1991) (reasonable-precautions cost-benefit); Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018) (personal-device storage undercut secrecy); DM Trans, LLC v. Scott, 38 F.4th 608 (7th Cir. 2022) (access practices versus policy); Abrasic 90 Inc. v. Weldcote Metals, Inc., 364 F. Supp. 3d 888 (N.D. Ill. 2019) (absence of NDAs "often dooms" a claim); Farmers' Edge Inc. v. Farmobile, LLC, 970 F.3d 1027 (8th Cir. 2020) (disclosure without adequate protection defeats secrecy); WeRide Corp. v. Huang, 379 F. Supp. 3d 834 (N.D. Cal. 2019) (development cost supports value element); IDX Systems Corp. v. Epic Systems Corp., 285 F.3d 581 (7th Cir. 2002) and Imax Corp. v. Cinema Technologies, Inc., 152 F.3d 1161 (9th Cir. 1998) (identification with particularity); Van Buren v. United States, 141 S. Ct. 1648 (2021) (scope of "exceeds authorized access" under the CFAA).

Secondary sources. Restatement (First) of Torts § 757 cmt. b (1939) (six-factor test, still the law in New York); Restatement (Third) of Unfair Competition §§ 39-45 (1995); David S. Levine & Christopher B. Seaman, The DTSA at One: An Empirical Study of the First Year of Litigation Under the Defend Trade Secrets Act, 53 Wake Forest L. Rev. 105 (2018); R. Mark Halligan, Trade Secrets v. Patents: The New Calculus, 2 Landslide 10 (2010). For the international dimension, Directive (EU) 2016/943 (the EU Trade Secrets Directive) harmonized member-state law and confirmed that reverse engineering and independent development remain lawful.

Related UpLaw Resources

Related Checklists

• Building an Enforceable NDA Clause by Clause: A Practical Checklist
• Protecting Trade Secrets When Employees Leave: A Practical Checklist
• When a Breach Hits Your Crown Jewels: A Trade Secret Incident-Response Checklist
• Drafting an Invention Disclosure: A Practical Checklist

Related Guides

• What an IP Case Is Worth: A Guide to Intellectual Property Damages

Related Toolkits

• Trade Secret Protection Toolkit: Building and Defending a Confidentiality Program

Related Articles

• Trade Secret Law: How Secrecy Becomes Protectable Intellectual Property
• Building Trade Secret Protection from the Ground Up: A Comprehensive Guide
• Guarding Trade Secrets Without a Perimeter: Remote Work and the Cloud
• Non-Disclosure Agreements for Technology Deals: Drafting for Enforceability
• Employee Invention Assignment Agreements: Securing Clean Title Across Jurisdictions
• The Future of Non-Competes: FTC Rulemaking and the State-Law Patchwork
• Copyright, Trademark, Patent, and Trade Secret Compared: A Practical Guide
• How the Law Protects Software: Copyright, Patents, Trade Secrets, and Contract Rights
• Intellectual Property Strategy for Mobile Apps: A Comprehensive Guide
• Web Scraping and the Law After hiQ v. LinkedIn: Where the CFAA, Contract, and Copyright Collide

---

This checklist is for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Trade secret law varies by jurisdiction and turns heavily on specific facts. Consult qualified counsel before acting.