EXPORT COMPLIANCE IN 11 WORDS (Part 3 of 12):
A SERIES ON EXPORT COMPLIANCE ESSENTIALS
EDUCATE!
To ensure full compliance with U.S. export controls
you need to educate and train your employees
If you are a U.S. exporter, I have four critically important questions for you:
Does everyone who works for your company have a basic awareness of U.S. export laws and regulations – ITAR, EAR, OFAC Sanctions – and understand why their requirements need to be taken very seriously?
Do they all know who is responsible for the company’s export compliance and how to contact them?
Does every employee involved in export transactions understand his or her individual compliance responsibilities clearly?
Do all those employees have the appropriate competencies, skills, and resources to carry out their compliance responsibilities effectively?
If you confidently answered “Yes” to any or all of these questions, I have one more for you: How do you know that? Unless you have a good answer for that question, scratch the previous “Yes” answers.
In the first post of this series, I said that safeguarding corporate export compliance in today’s world is impossible without substantial and ongoing education and training – not just for empowered officials, export compliance managers, and licensing officers, but for every employee. I cannot emphasize this too strongly: if you are responsible for compliance with export controls in your company, you must make employee education and training your number one priority.
Number one, not number two.
If I seem to be harping on this point, it’s because so many companies don’t seem to get it, and then end up behind the eight ball. If you won’t take my word for this, there’s a simple way you can see for yourself just how crucial a role employee education and training plays in assuring export compliance.
Export Compliance Training: What the Fuss Is All About – and Why You Need to Know
On its web site, the DDTC publishes copies of the final settlement documents – draft charging letters, consent agreements, remediation measures, etc. – for recent ITAR administrative enforcement cases. A close look at exactly how the U.S. Government has dealt with these firms who were found to have committed export violations provides important information about what the DDTC expects from every company when it comes to ITAR compliance. What are the agency’s foremost priorities and concerns? What types of negligence or misconduct are their investigators on the lookout for? What weaknesses or “gaps” in a firm’s internal control processes do they consider to be especially egregious?
In particular, the lists of “directed remediation measures” in these settlement agreements – the specific corrective and preventive actions mandated by the DDTC – contain valuable pointers to the “best practices” that every company ought to consider implementing when reviewing its compliance program.
I’ve examined those lists thoroughly for you, but you can peruse them for yourself, if you wish. Here’s one thing you’ll discover if you do:
The U.S. companies involved in export violations differed greatly in size and in the products and services they exported, and the weak points in each company’s compliance processes were also different. But the DDTC evidently found that their corporate export compliance programs had one major weakness in common: in practically every case, the employees had received inadequate or ineffective training on compliance with U.S. export controls.
Almost every DDTC settlement letter contains language similar to the following:
“Strengthen compliance policies, procedures, and training within ___________ months of settlement, with a focus on the areas of ________________ .”
“Commission an independent evaluation of the effectiveness of the training within prescribed timelines.”
“Implement a formal ITAR compliance program that includes annual training and a compliance manual.”
“Submit a training program proposal . . . within one hundred twenty days, which includes: (a) obligations imposed by federal export laws and regulations, including disclosure obligations; (b) proper internal controls and procedures; (c) discovering and recognizing export compliance issues; and (d) obligations assumed by, and responses expected of, employees upon learning of improper or potentially illegal acts relating to export compliance.”
“Undertake a training program no later than ninety days after ____________, such that all respondent employees engaged in ITAR-regulated activities are familiar with the AECA and the ITAR, and their own and respondent’s responsibilities thereunder, . . .”
“Maintain records of training programs provided, including the names and titles of individuals who received training, for at least five years.”
The examples above all come from cases published on the State Department/DDTC web site. But BIS Export Enforcement regularly posts similar information on how the Commerce Department has dealt with EAR violations. Don’t Let This Happen to You! – a 64-page compilation of reports on recent BIS investigations – makes for interesting and instructive, if sometimes scary, reading. If you’re an export compliance officer, it ought to be on your required reading list. In addition to the multiple references to employee training – or the lack thereof – in these case reports, the BIS web site repeatedly spotlights “ongoing compliance training and awareness” as one of the Nine Key Elements of an Effective Export Compliance Program, and includes “adequate training provided to employees” on its short list of Export Enforcement Mitigating Factors.
OFAC Enforcement also publishes the details of selected settlement agreements on the Treasury Department web site. Those OFAC reports belong on your required reading list as well. [Content Warning: A few of these agreements and enforcement reports contain high settlement amounts and penalties that some compliance officers may find disturbing. EOs and ECOs are advised to sit down before reading.] In each case, OFAC explains how they decided the appropriate penalty for the company, explicitly stating which findings their investigators considered to be “mitigating factors,” “aggravating factors,” or (in some cases) evidence of “reckless disregard.” Since the Treasury Department has taken great pains to provide you with this extremely useful information, wouldn’t it be wise to read it carefully . . . with a pencil or yellow highlighting pen in hand?
In case after case, you’ll see poor (or non-existent) compliance training cited as a significant contributing cause of the violations. In settlement after settlement, you’ll find phrases and sentences similar to these:
“Failing to provide training to its employees regarding export controls and sanctions”
“Compliance program did not include any training on OFAC regulations”
“Failed to adequately train its employees”
“Training is sporadic and does not cover important regulatory and risk areas”
Question: What effect do you think those findings had on the severity of the penalties that OFAC assessed?
On the other hand, in a recent case in which some rather serious sanctions violations occurred, OFAC highlighted their investigators’ finding that the company’s employees had received “frequent training, including in-person training by high-ranking persons within the organization,” and laid the principal blame for the violations on a “rogue employee,” who was found to have made extensive efforts to evade the firm’s internal controls. In this instance, the presence of a robust compliance education and training program (note well: with senior management commitment and involvement!) unquestionably helped save a company from potentially serious damage.
So, why do I keep underscoring the importance of employee education and training in a corporate export compliance program? Because all the U.S. Government regulatory agencies have made it plain that their agents will look at this element closely, and they keep warning us that they consider it to be both a critical factor in preventing export violations and a reliable measure of the seriousness of your commitment to compliance.
“Education” vs. “Training”: What’s the Difference?
Education and training are usually thought of as synonyms, and it is true that they are often used interchangeably. But the terms can be distinguished, and in some contexts the difference between them is far from negligible or irrelevant. The University of Pennsylvania, for example, is proud of its Department of Criminology, where students can get an education about crime that prepares them to deal with criminals and understand the U.S. justice system. The university would probably sue you for defamation, however, if you went around calling their campus a “training ground for crime”! Here’s another example: as some wag has said, when parents are asked to sign a consent form to allow their child to participate in sex education classes at a public school, they generally understand this to mean something different from sex training.
Education is helping someone understand something. It’s about learning the theory; gaining insight into principles of a subject; being able to see the Big Picture and distinguish between the essentials and the details; understanding well enough to analyze, think critically, make judgments, and share your understanding with others. That’s always been the rationale for education in the traditional professions. Lawyers need a legal education – a thorough understanding of the principles of law and how the U.S. legal system operates – before they start offering legal services to the public or defending clients in the courtroom. Surgeons need a medical education – a solid grasp of anatomy, physiology, biochemistry, and many other medical subjects before they pick up a scalpel.
Training is showing someone how to do something; it’s about acquiring the practical skills and competencies needed to carry out a specific task. A training program is designed for people who need the know-how they will acquire in order to perform their jobs more effectively or solve certain problems they are facing. When employees are charged with implementing a new system, they will generally need training that will equip them to do it. Because training focuses on practical knowledge, it normally involves learning-by-doing, coaching or mentoring by an expert practitioner, hands-on practice, drill, and repetition, as well as ongoing feedback with a view to improving performance. That’s why surgeons and lawyers are required to supplement their law school or medical school education with a period of training – as an intern, resident, or associate – before they can be licensed and admitted to their professions.
“Education” vs. “Training”: Which Is More Important?
When it comes to corporate export compliance, which of the two is more important—education or training? The best answer, of course, is that both are equally vital.
For employees at all levels, a mandatory program of company-wide export compliance awareness education will supply the necessary background and lay the groundwork for subsequent practical training in specific skills and competencies. This kind of foundational understanding throughout the company is essential, because the actions of all your employees can have a great impact on the effectiveness of your company’s compliance program – positive or negative.
Employees in departments such as human resources, public relations, purchasing, accounting, engineering and design, research and development, manufacturing, quality assurance, information technology, sales and marketing, logistics, planning, maintenance, shipping, and customer service could inadvertently cause the company to violate U.S. export laws and regulations, even if their jobs do not involve export transactions and even if they never have occasion to interact directly with foreign customers. These employees need to have an awareness of and basic education about U.S. export controls – their rationale, their scope, how they operate, how they impinge on the company’s business, which company officials are responsible for ensuring compliance, and other matters – so that they can recognize potential issues and avoid careless violations.
Managers and administrators who are responsible for planning and goal-setting, risk analysis and mitigation, compliance decision-making, and program development need a more advanced education in export controls and a wide range of related issues in order to do their jobs effectively and safeguard compliance.
All these employees, whatever their responsibilities or level in the organizational hierarchy, will also need hands-on, experiential training – via live seminars, interactive lecture-demonstrations, small discussion groups, workshops, case studies, example scenarios, role-playing, on-site one-on-one instruction, personal coaching/mentoring, and other modalities – to acquire the practical skills and competencies specific to their jobs.
The following examples may help you see how education and training can be distinguished from one another. The lists below are by no means complete; these topics are just a sample of the kinds of knowledge, information, and practical skills your employees need in order to safeguard full compliance with export controls. But I hope these examples will persuade you that both education and training are essential to mitigate the risk of export violations and build a successful corporate export compliance program.
Export Compliance “Education” Topics
(“about” knowledge, understanding what the regulations are, insight into how the agencies work, awareness of company policies & job responsibilities)
Overview of the U.S. Export System
Licenses & Export Authorizations Under the ITAR
Licenses & Export Authorizations Under the EAR
Understanding OFAC Sanctions Programs & the SDN List
Understanding the CCL: Categories, Product Groups, ECCNs
The Role of the Empowered Official
Risk Assessments & Compliance Audits
Deemed Exports & the Hiring of Foreign Nationals
Cybersecurity & Export Compliance
Export Compliance Issues in Mergers & Acquisitions
Current Export Enforcement Trends
Export Control Reform: Recent Developments
Export Compliance “Training” Topics
(“how-to” knowledge, specialized skills, practical expertise, ability to perform specific tasks, use relevant software & available resources, identify potential issues)
How to Fill Out a DSP-5 License Application
Classifying a Commodity
Identifying Encryption Items
Filing a Shipment in the Refactored AESDirect System
How to Recognize Export Control “Red Flags”
Marking of Documents That Contain ITAR-Controlled Data
Compliance with EAR & ITAR Recordkeeping Requirements
Steps for Performing a Restricted Party Screening
Visitor Access, NDAs, & Escort Procedures
How to Submit a Voluntary Disclosure
Drafting a Technical Assistance Agreement
In the next post of this blog series on export compliance essentials, “CLASSIFY!” we’ll discuss the importance of properly identifying and classifying the categories of products, services, and technical data that are subject to export controls and understanding the regulatory requirements that apply to each category.