The Export Control Reform (“ECR”) initiative is in full swing. On October 15, 2013, businesses will wake up operating under a completely revised export control system. Some the changes have been in works for several years, but will quickly gain notoriety in the near future. The intended effect of the ECR is to simplify the regulatory structure for the export of defense articles and services, as well as to reduce the number of export licenses required. However, changes are not always smooth, appreciated or completely understood. Companies and other stakeholders should take the opportunity to understand the ECR and make necessary changes to any export control policies and procedures.
There is not a law or regulation that actually requires a company to have an export control policy or even written procedures. Rather, the government has multiple laws and regulations that control exports and it is up to the individual company to determine the best way to comply. So, although policies are not “required,” governmental guidelines on the topic and “best practices” reflect that such policies are de facto required. Almost every governmental inquiry related to a possible violation of the export control laws and regulations starts out with a request for the company’s export control policies.
Having formal, written export control policies are even more necessary now. The ECR changes are meant to increase exports by limiting the need to seek licenses. However, although the purpose is to ease export controls, the fact is that many of the regulations are difficult to decipher. Therefore, a good policy will provide a “layman’s” perspective of how the export control regulations are applied to a business unit.
There is no “one size fits all” export compliance program. But, the foundation for a good export control policy remains the same even after the implementation of ECR. Most importantly, the policy must reflect the senior management’s goal of developing a “culture of compliance” within the company. Thus, the policy should include a statement from senior management about the importance of compliance, a listing of resources the company is dedicating toward compliance and the consequences related to failing to comply.
In addition to the global policy statements, a good policy also includes specific procedures the company requires to be carried out in regard to export controls. This includes determining the proper jurisdiction and classification of the company’s items or services. In addition, to the extent that items are export-controlled, a good policy would delineate the process and responsibility for determining whether an export license is required or whether an exemption or exception is warranted. Furthermore, a good policy would reflect the necessity for proper documentation of a transaction. To the extent that the policy (or the law) may be violated, a company should include a mechanism for anonymous reporting and a company determination process in deciding whether a voluntary disclosure to the applicable government authority is warranted.
A policy is only as good as management, employees and other stakeholders are trained on that policy, including its procedures and expectations. Due to ECR, this is an optimal time to have key employees trained outside of the company and all affected employees re-trained with respect to any changes to the law (and related company policies). The training should be documented and maintained. The main reason is that, in addition to a request for applicable policies, the government, in its course of audit or other enforcement activities, also requires and expects detailed information about the company’s training activities. The existence of a training program will help mitigate any potential violations of the export controls. The failure to have a training program has the opposite effect.
During times of change, companies usually look inward to determine the impact of the change. However, in complying with the export controls, a company must be aware of what its stakeholders are doing. Therefore, agreements with third parties (especially in regard to the ITAR changes related to “brokering”) should be reviewed and possibly updated. Notices to stakeholders about ECR and what changes the company is taking in regard to its supply chain may also be warranted. In fact, it may well be a third-party agent representing the company’s interests in a remote part of the world for which the greatest non-compliance risk exists.
Although there are several other actions that should be taken in regard to ECR, a company should seriously consider conducting an audit once any changes are made. If possible violations have occurred in the past and were only caught due to the changes, it may be appropriate to file a voluntary disclosure with the government. Such voluntary disclosures may also be appropriate if ECR is not properly implemented. Although many companies utilize consultants for external audits, companies should consider having the audits done under the supervision of an outside law firm to ensure that privileges are properly protected and that the intent and requirements of new regulations are understood.
Although it may not be fully appreciated during the change period, ECR does provide an opportunity for a company to start fully appreciating export compliance. The criminal and civil ramifications (let alone the lost business opportunities) resulting from any export violation can be severe. A company should appreciate the opportunity, take advantage of the changes and gain a competitive advantage in expanding its overseas business in full compliance with the law.
