In the first two parts of this series, we covered companies’ obligations under U.S. export control laws, such as the Export Administration Regulations (“EAR”) governed by the Department of Commerce, Bureau of Industry and Security (“BIS”), and military or defense exports governed by the International Traffic in Arms Regulations (“ITAR”) under the auspices of the State Department’s Directorate of Defense Trade Controls (“DDTC”), and common ways to mitigate your organization’s risk against violations. Unfortunately, no compliance program can prevent all violations, and this final part of our series addresses the key considerations your organization should keep in mind in the event you discover that an apparent violation may have occurred. How your company addresses apparent violations are as important as anything else, because they end up determining the repercussions that your organization may face from these and other enforcement agencies.
Even the best compliance programs will not be perfect. Compliance departments are typically overworked and mistakes and oversights can and do happen. When an incident happens, often the best advice is to slow down and develop a plan to examine the potential issue. It is imperative not to assume the worst and jump to a conclusion. Rather, start by gathering the basic facts—what happened, why did it happen, when did it happen, what countries are involved, and who was involved. Even some answers to these questions can help your organization quickly understand whether the issue is minor or more serious. For example, if the company shipped a product to an approved country a few days after its license expired and does not involve any national security concerns, your organization should be far less concerned about disclosing the issue or whether your company will face any ramifications, which should be unlikely under these circumstances. However, if you exported a sensitive defense article to a sanctioned country, that understandably and considerably changes the calculus.
Accordingly, the severity of the potential violation should shape your company’s response. Minor civil issues such as an oversight in paperwork to an approved country can and will likely to be handled by your company’s compliance team and, generally, will not require the involvement of counsel to resolve. In these instances, many companies will not report the incident to the government, as most of export regimes do not have a mandatory disclosure requirement. However, for more serious violations, and certainly those that may implicate criminal conduct, you should retain counsel to investigate the matter, preserve documents, and make a disclosure to the government even if no disclosure is required. Self-reporting a potentially serious matter allows your organization to get ahead of the issue, gives you the opportunity to shape the message to the government, and prevents any accusation of trying to conceal or delay the matter. However, because investigations take time, you should submit an initial disclosure that advises the government that the matter is being investigated, provides a high-level summary of the issues, and a statement that a complete report will be furnished upon the completion of the investigation. An early disclosure of this type serves the twin purposes of demonstrating that your company takes compliance seriously and is being proactive in its investigation, which will enhance your credibility with the government. However, once a disclosure has been made, you must be prepared to conduct a fulsome investigation, determine whether corrective action or enhancements are needed to prevent any reoccurrences of violations, and assess whether you need to change your existing business relationships. You should be prepared to address follow-up questions, requests for information, and other requests from the government after you have submitted your disclosure. Moreover, while the first two considerations are obvious important mitigating factors from the government’s perspective, the last consideration is also very important. Once you are on notice about (and thus have knowledge of) a potential violation, you should examine whether any current or prospective business arrangements will create further violations. For example, if you shipped an exported defense article to a sanctioned country and the buyer asks you to repair or service the equipment, doing so would only create further violations, undermine your credibility, and ultimately exacerbate the situation. From the government’s standpoint, their most important considerations in favorably resolving your case will be how quickly your company accepted responsibility, whether your compliance systems are adequate to prevent reoccurrences, and that you are committed to adhering to U.S. export laws.
