Elements of a Comprehensive Export Compliance Program (ECP) Manual

In the export compliance world, classification is often referred to as Job #1 since it lays the groundwork for a company’s export compliance risks and requirements. However, once classification is complete, companies need to have written policies and procedures to not only document their commitment to the government’s laws and regulations, but more importantly, to delineate who, what, when, where, and how the company will ensure its compliance. Companies that rely on informal, unwritten procedures risk violations due to errors, omissions, personnel changes, and various other transitions that can affect their compliance readiness. The specifics of each company’s Export Compliance Program (ECP) manual will vary depending on its size, location(s), products, services, clients, markets, etc., but the fundamental components are always the same. With this in mind, the Bureau of Industry and Security (BIS) has identified eight elements of a comprehensive Export Compliance Program (ECP) manual.

1. Management Commitment

Establishing and maintaining an export compliance program requires companies to devote time and financial resources to ensure continuing compliance. A Management Commitment Statement should state unequivocally to the employees the importance of the company’s compliance program. It should include an explanation of the relevant U.S. laws and regulations, an affirmation of the company’s commitment to compliance, an overview of potential consequences for export violations, and a call to action for employees to remain aware and vigilant about export compliance. The statement should also include the name and contact information of the company’s Export Compliance Officer (ECO) so that employees can readily reach out with questions, comments, or possible concerns (aka red flags).

2. Risk Assessment

Companies should assess their export compliance areas of risks and requirements early in the policies and procedures (P&P) development process to ensure there are no gaps in the system. Areas to assess and address in the compliance program include whether the company develops export-controlled products or information (i.e., EAR technology or ITAR technical data), typical end users, customer end uses and destinations, use of distributors, and whether the company generally has a proactive approach to compliance. Communication between employees is key since effective compliance requires cooperation across various departments.

3. Export Authorization

To know its licensing requirements and overall compliance sensitivity, the company first needs to classify the products it provides, including hardware, related technology/ technical data, software and services. In this process, the company will determine its product’s respective commodity jurisdictions (i.e., whether its products fall under the jurisdiction of the Department of State or the Department of Commerce), and its products’ various classifications (i.e., Export Control Classification Number (ECCN). Once the classifications are complete, the company will know what regulations apply to the respective items and how to determine licensing requirements for specific international transactions. Related to licensing, the manual should also specify who, when, and how the company screens parties to the various transactions and also when/how to verify the end use of the exported item.

4. Recordkeeping

Under U.S. export control laws and regulations, exporters are required to maintain certain documents for no less than five years from the latest date of export from the U.S. The recordkeeping section of the ECP manual should address which documents need to be maintained, who will collect and store them, where and how they will be stored, how long they will be stored, and how the company will respond if the documents are ever requested by the U.S. government.

5. Training

Creating and maintaining a culture of compliance requires regular training and ongoing awareness of export controls. In the ECP manual, companies should commit to training their employees regularly depending on their level of involvement in day-to-day compliance tasks. All employees should receive a general awareness training on the fundamentals while employees designated with specific responsibilities should receive more frequent and detailed trainings. The employees should be aware of the company’s current compliance status as well as what to anticipate in the future.

6. Audits

Conducting periodic audits ensures that the compliance program remains efficient, effective, and responsive to changes to U.S. laws and regulations. Audits should be conducted more frequently at a department or function level. For example, companies can assess a sample of transactions from a shipping or recordkeeping perspective to ensure there are no gaps. Internal audits are recommended on an annual basis, and it is a best practice to conduct third-party audits periodically to ensure an unbiased assessment.

7. Violations and Corrective Actions

If an individual and/or company suspects that a violation may have occurred, the manual should guide their response. The manual should encourage employees to report potential violations, provide an internal procedure for reporting their concern, address how (and by whom) potential violations will be investigated, outline an external reporting procedure including a Voluntary Self-Disclosure (VSD), and state the company’s commitment to implementing corrective actions once a violation has been discovered. If the concern involves an ongoing activity or transaction, that should be halted immediately until an investigation is completed.

8. Building and Maintaining the ECP

Every company manual will vary in content and level of detail depending on the company’s export compliance risks and requirements. When developing an ECP manual, it is important to keep the manual functional and accessible to all employees. Including unnecessary details for a company with a low level of risk will make the manual difficult for employees to understand and lower the likelihood that it will be used actively. On the other hand, insufficient detail on company-specific procedures will lead to misunderstanding on specific requirements and responsibilities. Ideally, it will be right-sized and tailored for the company’s actual needs, written with clear guidance and a minimum of “legalese”. Most importantly, once the ECP manual has been developed and approved, it should be distributed to all employees and stored in a place accessible to all for future reference.

The Export Compliance Program manual is a key document for company employees to reference; therefore, it is critical that it include all necessary elements to avoid future misunderstanding and potential violations. Companies need to dedicate the time and resources to not only establish their compliance policies and procedures, but also to update them as circumstances change.

To learn more about building and maintaining your compliance system, please visit our web site, review our Compliance Services, or request a no-obligation exploratory call.

Click Here to learn more about CTP’s Export Compliance Services