Perhaps the information came from a colleague or a customer or an anonymous tip left on your company's "tip line." Or it could have been a comment made during a presentation at a professional meeting. Something caught your attention and triggered the realization that you may have a U.S. export controls violation. Whether or not you have experienced that sinking feeling, prudent compliance requires that you be prepared to take appropriate action at the first sign of trouble.
So, what to do if you have concluded that there may have been an export control violation? Managing a possible export control violation means taking on the situation directly. A systematic and comprehensive response will enable your company to most effectively deal with the situation. The response actions fall into three parts.
The first part of the response focuses on establishing the scope of the violation(s). If ongoing, the conduct that has given rise to the suspicion of a violation must be stopped at once. The investigation into the possible violation(s) will require the cooperation of all the operationally involved parts of the company. Accordingly, a credible internal investigation is characterized by demonstrable support from senior management, including a commitment to supply the necessary financial and personnel resources to mount the investigation.
There are many factors to consider when shaping the investigation process. Important considerations include: (1) the possible points of contact associated with the violation(s); (2) the nature of the goods, technologies and services; and (3) the recipient countries.
Evaluating which points of contact may have contributed to the violation will help establish the scope of the problem. To use an extreme illustration: The failure of an individual employee to ascertain the correct product classification suggests a different problem than would a general lack of awareness of applicable EAR or ITAR controls. Similarly, it is important to know at what point in the customer relationship the violation occurred. For example, was the violation in the context of a sale to a new customer, a transaction with an existing but recently listed/sanctioned customer, or through technology transfer in the context of post-sale customer support? Uncovering the violations and tying them to operational activities assists in establishing the scope of the violations and may assist in identifying appropriate compliance fixes.
The nature of the company's activities will also guide the course of the investigation. Companies engaged in manufacturing must consider supply chain exposure as well as exposure created by the exports. Transacting in sensitive technology (whether EAR or ITAR-controlled), which may involve transmitting information without a "box," creates specific compliance risks. Note also that compliance obligations include not only the shipment or transfer of goods and technology to the customer (such as proper classification, know-your-customer diligence and licensing assessments/acquisition), but also reporting and recordkeeping requirements.
The structure of the investigation is also influenced by the countries involved. A concentration of business with countries subject to tighter controls or subject to U.S. embargoes increases the likelihood of violations in the absence of a robust compliance effort.
The second part of the response to an export violation focuses on corrective action. As noted, the conduct at issue should be terminated as soon as possible after the potential violation is detected. But corrective action should extend beyond termination of the specific conduct to include taking steps to prevent the recurrence of the violation.
Any corrective action must start with the compliance plan. If the company does not have compliance policies and procedures, a plan must be created and implemented as soon as possible. If a plan is in place, the flaws in the plan that allowed the violations in question must be corrected. The investigation of the scope of the violations may identify appropriate fixes. Going forward, ongoing monitoring may speed up the detection of violations and simplify the compliance program improvement process. In any event, the compliance plan should include regular internal reviews or audits designed to catch plan flaws before violations are committed.
Further, a critical component of any comprehensive compliance strategy, and any response to a violation, is training. A robust compliance plan will respond to changes in compliance obligations as well as changes in the company's operational and business activities, ideally prior to committing a violation. Training for new personnel in implicated operational positions as well as ongoing refresher training for current employees will ensure that those with compliance responsibilities are equipped with the current knowledge necessary to properly execute their responsibilities. Further, keeping those directly responsible for compliance fully engaged in the process improves the likelihood that the compliance plan will be properly executed and empower personnel to identify and raise concerns before a violation occurs.
Whether to voluntarily disclose the suspected violation to the appropriate U.S. government agency or agencies is the third part of the response, but the question itself hovers throughout the process. The U.S. government encourages disclosure. Companies may disclose a suspected violation as soon as it is detected and then submit complete reports once the investigation is completed. A company's decision-making concerning a possible disclosure may change over time (based, for example, on information uncovered during the investigation) but may touch on many factors, including the scope and sensitivity of the violation and the likelihood of ongoing, similar conduct. Other factors may include the company's appetite for the potential fallout, in terms of negative publicity and penalties, and tolerance for risk, including the likelihood that the relevant government agency would learn of the violation through means other than self-disclosure. A company investigated as a result of a tip from a business competitor, a former employee, or notification from another government agency would be denied self-reporting penalty mitigation and may face an increased risk of criminal penalties.
The complex web of laws and regulations that govern U.S. export controls is rendered more challenging by the volatility of the current regulatory and trade environment. Conducting business in this environment requires a full commitment to compliance, incorporating a comprehensive understanding of developments and current requirements, in order to minimize the risk of potentially expensive and embarrassing violations. Securing the assistance of experienced trade counsel can position your company to detect and manage possible violations and to develop a comprehensive compliance strategy. Torres Law provides assistance with all aspects of import and export regulatory compliance.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
