An Internal Compliance Program (ICP) (also known as Internal Control Program, Export Management and Compliance Program, Code of Practice, or Export Management System) is a set of in-house practices that entities’ adopt to facilitate compliance with strategic trade control requirements. More precisely, it is a series of operational compliance policies and procedures and a written set of guidelines an enterprise implements to minimize the risk of legal violations. The purpose of an ICP is to ensure that the appropriate transactional decisions are consistently being made; that employees know their strategic trade control responsibilities and obligations; that proper procedures are followed; and that the right questions are being asked to ensure that transfers involving strategic items are being made in compliance with national STC laws and regulations, and are therefore in your enterprise’s best interest.

ICPs typically include a set of defined procedures that enterprise officials must satisfy before an item can leave the company/institution. At a minimum, enterprises should enact procedures that require a thorough examination of all parties to the transaction, the end-user of record, the final destination and intended route (including any transit/transshipment points), and the ultimate end-use of the items prior to the shipment of a purchased item.

There is no “one-size-fits-all” solution for designing and implementing your ICP. The structure of your ICP is contingent on the unique characteristics of your enterprise. The size, location, organizational structure, type of business activities, and production/distribution networks of your enterprise are key determinants in how to design and implement your ICP. There are, however, certain “core” ICP elements that are recommended for all enterprises, whether small, medium or large, because they provide a foundation for accountability within the enterprise and minimize the risk for unauthorized transfers.

Depending on your organization type and activities, an effective ICP will contain the following eight core elements, as well as “additional or discretionary” elements that may be worth review and consideration by your enterprise.

The following elements provide a foundation for the design and structure of your ICP:

1. Management Commitment to Compliance
2. Organizational Structure and Responsibilities
3. Transaction Screening Processes and Procedures
4. Shipment Control
5. Auditing and Internal Review
6. Training and Education
7. Recordkeeping & Documentation
8. Reporting and Corrective Action
9. Additional ICP Elements for Consideration
   • International / Domestic Communication and Information-sharing
   • Technology Transfer and Management Safeguards
   • Guidance for Subsidiaries and Foreign Offices and Operations
   • Integration with Quality Assurance (QA) and Corporate Social Responsibility (CSR) Systems
   • Merger & Acquisition Due Diligence Checks