Too many times, export compliance procedures are a meaningless clump of definitions and a menagerie of content collected from seminars or templates found on the internet. What you are left with is a set of written documents that do not reflect your unique business culture. Other times, export compliance procedures are so detailed and restrictive that, following them as part of your day-to-day activity, becomes a full-time job in itself. Here are six (6) tips to help you develop procedures that work for your company:
Tips for Effective ITAR Export Compliance Procedures:
1. You Actually Do Need Procedures
Export compliance procedures are not a specific requirement of the International Traffic in Arms Regulations (ITAR). However, the U.S. State Department, Directorate of Defense Trade Controls, expects all ITAR Registered Companies to follow their Compliance Program Guidelines. The Guidelines describe the basic elements of a compliance program including the statement that “comprehensive operational compliance programs include manuals that articulate the processes”. Applying this to your business often means a combination of Policy Statements, Procedures, and desktop procedures, where applicable. In some instances, the State may actually ask for a copy of your company’s procedures so make sure you have them… and follow them!
2. Export Compliance Procedures Should Be a Reflection of Your Business
Your procedures should be customized to fit what your business does and to address the compliance risks it may actually face. If your company does not manufacture products or have an engineering department, then your procedures do not have significant content about how those areas will incorporate ITAR compliance into their operations. The procedures should define compliance measures for the personnel, departments, and activities within your company and delineated the requirements appropriately. As your business changes, then you can add or modify your procedures accordingly (see Tip #5)
3. Make The Procedures Useful
You want to make the procedure useful and user-friendly. While defining the requirements is important, including checklists and forms with steps to follow helps to ensure that the procedures will be utilized and not just filed in the back of a drawer. Familiarization with, and the use of, procedures help to greatly reduce the risk of unauthorized deviation. And when it comes to the ITAR and other export regulations, deviations may mean violations that can have serious consequences.
4. Don’t Include Too Much Detail
Some companies make the mistake of incorporating too much information into the procedures. This includes the duplication of entire sections of the regulations, step-by-step descriptions of compliance decisions, etc. I have witnessed companies that have developed ~ 200 pages of information into their export procedures and had all employees attest to the fact that they had read them and agree to abide by them. This was their entire compliance plan. I call it their “disaster plan”.
Forms and checklists attached to the procedures are a great way to incorporate the details of a process, but the procedures are best reserved for addressing key compliance elements and important requirements. An experienced export compliance consultant can help you navigate between too much and too little.
5. Update Export Compliance Procedures Often
Products, services, customers, and employees often change within a business and your export compliance procedures are no different. Regularly review your procedures and make modifications to accommodate changes in your business or to adopt improvements. Modifications to your procedures will also give a Compliance Officer an opportunity to send out updates and reminders to the employees that should be using them.
6. Make Export Compliance Procedures Audit Friendly
A good compliance program will include internal and external audits on a regular basis. On occasion, you may be required to hire an outside consultant to audit your compliance program. Regardless of the reason for an audit, your procedures will be one of the major focuses. Make sure that: What you have in the procedures is what you do; and, What you do is in the procedures. Having extraneous requirements in the procedures that don’t help to mitigate risk or do not align with current and effective compliance practices, should be removed or modified.
I call this the “Green Tennis Shoe” test. If for some reason your procedures state that every Tuesday, all employees will wear green tennis shoes (even though it has nothing to do with export compliance), then that requirement should be enforced and tested in an audit. If that requirement is not being followed and does not affect compliance, then modify or remove the requirement. Having onerous requirements in your procedures that don’t support a good compliance program can only lead to findings and issues during an audit.
