1.0.0 EXPORT MANAGEMENT & COMPLIANCE PROGRAM Introduction This self-assessment tool is created for exporters to aid in the development of

Transcription

1 U.S. DEPARTMENT OF COMMERCE BUREAU OF INDUSTRY & SECURITY, OFFICE OF EXPORTER SERVICES, EXPORT MANAGEMENT & COMPLIANCE DIVISION Audit Module: Self-Assessment Tool Export Management and Compliance Program ( EMPC ) Released March, 2006 Selecting Response: Compliance Status if Regulation Implement As Stated 1. To respond to any statement or requirement, 2. The first option is always blank. place the curser in the "Select" cell and a drop-down selection box will appear. 3. Responses to specific criteria/requirements are: Not Compliant, Partially Compliant, Compliant, Exceed Requirement, and N/A. 4. When you make a selection the Color Flag cell will change to a specific color. The purpose of been completed and areas where you have or do not have potential compliance issues. this is to make it easier for you to focus on what has or has not 1 of 34

2 1.0.0 EXPORT MANAGEMENT & COMPLIANCE PROGRAM Introduction This self-assessment tool is created for exporters to aid in the development of an Export Management and Compliance Program ( EMPC ) It may be used to create a new program or to assess whether internal controls have been implemented within an existing program with the purpose of eliminating common vulnerabilities found in export compliance programs Each company has unique export activities and export regulations, restrictions, and, prohibitions This tool is a combination of best compliance practices requirements Methodology An effective EMCP consists of many processes that connect and intersect The connections and intersections must be planned, and then, clear directions Without maps (instructions), chances are that personnel will all go in their own directions, leaving them vulnerable to getting lost on the way and chancing that key connections are missed, resulting in violations of the intended rules of the program To use this self-assessment, first look to see if your program includes written instructions that create the connections and intersections needed to maintain compliance Pre- and Post-Audit Checklists Pre-Audit Checklist Identify business units and personnel to be audited Send notification to affected parties Develop a tracking log for document requests Prepare audit templates such as interview questions, transactional review checklist, audit report format, etc EXPORT MANAGEMENT & COMPLIANCE PROGRAM programs; therefore, this is an example to build upon and does not include all export administration implemented by U.S. companies, auditing practices, and Export Administration Regulations Each business unit should provide their written procedures related to export compliance before the audit. Personnel at all levels of the organization, management and staff, should be interviewed to compare written procedures with actual business practices. Identify gaps and inconsistencies. must be given to those who are to follow the rules of the program. 2 of 34

3 2.2.0 Post-Audit Checklist Write draft audit report in the format of: Executive Summary [Purpose, Methodology, Key Findings]; Findings and Recommendations [Organize in Priority Order]; and, Appendices [Interview List, Document List, Process Charts] Conduct post-audit briefing for affected business units to discuss audit findings and recommendations. Provide draft report. This is an opportunity for business units to address inaccuracies in report. Obtain commitment from business units for corrective action. Include in audit report. Brief executive management on audit findings and recommendations. Track corrective actions. Within the year, audit corrective actions. 3 of 34

4 3.0.0 ELEMENT 1: Management Commitment Management Commitment Management's commitment is communicated on an ongoing basis by the use of Company publications Management's commitment is communicated on an ongoing basis by the use of Company awareness posters Management's commitment is communicated on an ongoing basis by Daily operating procedures Management's commitment is communicated on an ongoing basis by other mean (e.g., bulletin boards, in meetings, etc.). S elect Comment Management issues a formal Management Commitment Statement ( Statement ) that communicates clear commitment to export controls. The Statement is distributed to all employees and contractors. The person responsible for distribution of the Statement has been identified. There is a distribution list of those who should receive the Statement. The method of communication used includes letter, , intranet, and other methods as appropriate. The distribution of the Statement includes employees signed receipts and personal commitment to comply. The Statement from current senior management is communicated in a manner consistent with management priority correspondence. The Statement explains why corporate commitment is important from the Company s perspective. The Statement contains a policy statement that no sales will be made contrary to Export Administration Regulations. 4 of 34

5 The Statement conveys the dual-use risk of the items to be exported The Statement emphasizes End- Use/End-User prohibitions. The Statement specifically emphasizes End- Use/End-User prohibition concerns against the proliferation of Nuclear. The Statement specifically emphasizes End- Use/End-User prohibition concerns against the proliferation of Missile Systems and Unmanned Air Vehicles. The Statement specifically emphasizes End- Use/End-User prohibition concerns against the proliferation of Chemical and Biological Weapons. The Statement contains a description of penalties applied in instances of compliance failure as imposed by the Department of Commerce. The Statement contains a description of penalties applied in instances of compliance failure as imposed by the Company. The Statement includes the name, position, and contact information, such as: e- mail address & telephone number of the person(s) to contact with questions concerning the legitimacy of a transaction or possible violations. The Statement includes what management records will be maintained to verify compliance with procedures and processes (including the Statement). The Statement includes the person(s) responsible for keeping each of the management records. The Statement includes how long the records must be retained. includes where will the records be The Statement maintained. 5 of 34

6 The Statement includes in what format the records be retained. Adequate resources (e.g. time, money, people) are dedicated to the implementation and maintenance of the EMCP Management is directly involved through regularly scheduled meetings with various units responsible for roles within the EMCP Management is involved in the auditing process Management has implemented a team of EMCP managers who meet frequently to review challenges, procedures and processes and who serve as the connection to the employees who perform the EMCP responsibilities The Statement describes where employees can locate the EMCP Manual (on the company intranet or specific person, and location of hard copies). There are written procedures to ensure consistent, operational implementation of the Management Commitment Element. A person has been designated to update the Management Commitment Element, including the Management Commitment Statement, when management changes, or at least annually. The name of the person designated to update the Management Commitment Element has been recorded. Other employees who are held accountable for specific responsibilities under this Element have been designated. Specifically, the Company Official charged with EMCP oversight and ongoing commitment to the program has been designated. 6 of 34