Export control and sanction requirements have been around for years, but are taking on increasing prominence. As a follow-up to Part VI of this series (Basic export control compliance principles [September, Aftermarket Business World]), this article highlights some of the considerations that go into implementing an effective compliance program for export controls regulations.
Establishing and implementing an effective compliance program
Shipping goods abroad directly confronts the myriad controls on shipment of goods. Although many goods can be shipped EAR99 (no license required, except for suspect users or controlled destinations), exporters still need to carefully ensure that their goods are properly classified so that they can determine the appropriate way to proceed. Ensuring compliance with export control regulations has seven basic steps:
• determining whether the shipment or sale raises concerns about embargoed destinations, suspect users or re-export risks;
• determining which agency has jurisdiction and which set of export-control regulations is applicable;
• determining the proper classification of the product and what type of export authorization is required;
• determining whether there are destination or end-use controls that would prohibit or restrict export;
• determining whether special export authorization is required and obtaining same;
• monitoring the export to ensure that it is completed in accordance with the terms of authorization; and
• maintaining all required records for the required period or longer.
In implementing these steps, a company should:
• Promulgate a clear policy that takes away decision-making in “gray areas” from employees who are not experts in export controls and gives it to people, either at corporate headquarters or in the general counsel’s office, who are well versed in the laws and regulations.
• Provide comprehensive training, which should be given to all new hires and regularly supplemented, at least for key employees who are more likely to confront export control issues, such as people involved in contract negotiations, sales and shipping.
• Require employees to sign an acknowledgement that they have received training and are committed to compliance with all applicable regulations and company export-control policies.
• Prepare a written compliance policy that includes both a recitation of the law and real-world examples that are relevant to the industry and business.
• Create routine systems that catch most errors while avoiding mechanical over-reliance on systems where common sense would indicate further inquiry.
• Prepare procedures in advance for dealing with questions about potential problems.
• Develop procedures to ensure the retention of all due diligence compliance actions.
• Set up a structure for deciding whether potential problems exist, with resolution by people who are independent of the transaction and who have no pressure to approve suspect transactions.
• Establish procedures where employees can, without fear of retaliation, confidentially report suspected problems.
• Establish procedures to evaluate potential violations and to investigate them.
• Preserve a record of complaints received and how they were resolved.
• Set up a system to discipline individuals who have willfully violated the compliance program and put in place procedures to prevent recurrence of the issue.
• Conduct periodic self-assessment of risk and audit procedures to flag areas for improvement.
Equally important is to avoid common pitfalls that can trip up even well meaning companies:
• Implementing a compliance program without adequate oversight by the board of directors or a visible commitment by senior management.
• Providing inadequate resources—staffing, information technology support, training funding, funds for consultants or outside counsel—to develop and implement the program.
• Implementing a program that is not well tailored to a company (generally, either implementing one that is too complex to be easily understood or follow, or implementing one that is too legalistic, without clarification from real-world examples).
• Failing to follow up time-of-hiring training with periodic (generally annual) updates to allow refreshment of compliance procedures and communication of new policies and regulations of the agencies.
• Failing to allow for regular auditing to check on the performance of the program.
No compliance program can succeed without proper training. Training methods should, at a minimum, include: (1) orientation for new employees; (2) formal training materials, in the form of a compliance manual, frequently asked questions, and intranet resources; (3) circulation of written memoranda and emails as situations arise and are solved; and (4) refresher courses, conducted at least annually. Proper training in the use of the interdiction software, including how to follow up on red flags, is essential. Companies also should keep records of all training conducted.
Companies should give consideration, as well, to record retention. Companies should have procedures to ensure that all documents relating to controlled shipments are properly retained, including purchase orders, invoices, shipment (AES) records, airway bills and other export transaction documents. They also should maintain documents relating to each transaction, such as email, correspondence, contracts and any due diligence. Where shipments are made under a license, these records should be linked to the license and used to monitor fealty to the license’s requirements.
Finally, most companies should conduct an independent review of compliance at least annually. In performing this testing, the company should: (1) perform transaction testing designed to ensure reasonably that the institution is following the ITAR, the EAR, and the OFAC Regulations; (2) review processes to assess employees’ knowledge of regulations and procedures; (3) review written procedures and training programs for completeness and accuracy; (4) compare written procedures to operational procedures, to make certain that procedures are being followed; (5) either randomly sample or 100 percent verify the accuracy of export or financial transactions; (6) evaluate whether changes to relevant regulations have been promptly reflected in the compliance program; (7) confirm that correct export authorizations are consistently used for each transaction; (8) confirm that all required documents are properly stored and in the proper format; (9) review each transaction where a stop or hold was required to confirm that the decision to review was carried out as expeditiously as possible; (10) review records of past audits as compared to current procedures to determine that earlier problems have properly been rectified; and (11) report findings to the company’s audit committee. The review can determine risk areas before violations can occur and help ensure that all policies, processes and procedures of the program are being followed. A written report of the results of the audit should be reviewed by top management and potentially the board of directors.
