Earlier this month, I was reading some articles online and found the following statement about a company and its ITAR requirements (bold emphasis mine):
"Export-controlled technical data has a unique set of rules designed to ensure that it is not inadvertently released or “exported” to foreign persons either inside or outside the United States. As an ITAR-registered company, [company name redacted] is required to have procedures in place to trace processing steps of ITAR-controlled transactions from the time it receives controlled parts to the time they are shipped."
Savvy readers of this blog and experienced trade compliance practitioners will immediately notice the flaw in this bolded statement. Simply put, there is no legal “requirement” for an ITAR-registered company to have procedures that trace processing steps for ITAR transactions. (For that matter, there’s no legal requirement that an ITAR-registered company have any procedures at all!) With that being said, are procedures necessary? The answer is categorically “yes!”
The importance of having policies, procedures and processes for ITAR- and EAR-controlled transactions cannot be understated. This is true for any company engaged in controlled work, regardless of size, and irrespective of whether the company ships items to foreign locations (because, as we all know, deemed export violations can occur just as easily within the United States as they can outside of our borders). Not only will a documented compliance program – we call it an Export Management and Compliance Program, or EMCP – help your employees know what to do for ITAR/EAR-controlled work, but it will also go a long way if a government agency starts asking questions or investigating your company’s transactions.
Is simply having ITAR procedures enough? No! Once you have a system in place, training your employees on how to follow it is the next logical step. After that, we suggest periodic audits (whether they be internal or external, likely a combination of both), to make sure that your EMCP is operating effectively and avoiding violations. These follow-on audits or assessments can also help you refine your company’s procedures to continually improve. That’s because simply having procedures isn’t enough. Following those procedures is the critical step that many companies overlook.
Bottom Line: Your company is not legally required to have ITAR procedures (with one caveat – if you’re under a consent agreement with DDTC, part of that agreement will likely require you to have a documented compliance program.) That being said, having a compliance program is still a really, really good idea!
Jim McShane is a Sr. Consultant, Trade Compliance for Export Solutions -- a full-service consulting firm specializing in ITAR and EAR regulations.