Organizational Structure and Responsibilities

Next, you must assign responsibility for strategic trade control within your enterprise. Delegating strategic trade control functions to the appropriate personnel in your enterprise is essential to ensuring that all the components of the ICP are executed properly. The inability to assign STC responsibilities to specific, empowered compliance personnel could result in their failure to perform key tasks and instances of non-compliance.

The purpose of this element is to ensure that all compliance-related functions, duties, and responsibilities in your enterprise are clearly defined, identified, and assigned; that the relevant positions and incumbents are known throughout the organization; and that there are internal records of these assignments that are routinely updated and distributed to employees.

Implementing this element requires your enterprise to complete three tasks:

Determine who has responsibility for each of the STC compliance tasks (including a back-up person) within your enterprise;
Document compliance-related positions, assignments, and roles; and
Disseminate organizational assignments and roles to all relevant personnel.
Get Implementation Aids >

Task 1: Selecting Personnel for STC Compliance Related Responsibilities

The organizational structure of an ICP refers to the hierarchy an enterprise establishes to guide and oversee the development, implementation, and day-to-day operation of the ICP. In order to designate the appropriate personnel, your enterprise must first assess the current organizational structure and operations and determine the most effective placement of the various STC compliance functions. Your enterprise should seek to determine the compliance responsibilities, location, and quantity of compliance personnel and whether compliance functions will be centralized or de-centralized within your enterprise.

Determine Compliance Functions

First, identify the STC responsibilities attributable to each position and function of your enterprise. Each STC compliance task should have a specific person assigned who is responsible for assuring that it is performed.

The following strategic trade control responsibilities should be delegated to appropriate personnel within your enterprise:

Oversight of the day-to-day operations of the ICP.
Maintaining all appropriate STC laws and regulations (domestic and where appropriate, foreign) and any guidance issued by the competent national authorities.
Making any necessary changes to the enterprise ICP or STC compliance policies and procedures and disseminating all relevant changes to enterprise personnel.
Classifying all the enterprise’s products and assigning the applicable commodity classification number or offering input to those individuals/units charged with product classification.
Conducting diversion risk, end-use, end-user, and destination screening and ensuring the accuracy of transaction screening and due diligence measures.
Making determinations about whether to approve a transaction or seek authorization from higher levels of the enterprise’s management or empowered compliance officials.
Establishing, overseeing, and administering, training programs to assure all personnel are knowledgeable of the enterprise’s STC compliance policies and procedures.

Conducting internal reviews and audits of the enterprise's ICP and instituting corrective actions, when necessary.
Ensuring that all activities and transactions are conducted in accordance with the enterprise’s stated compliance policies and procedures.
Ensuring that intangible transfers of technology and technical data are conducted in compliance with relevant regulations and the enterprise’s technology control policies and procedures (where applicable).
Maintaining records of all strategic trade-related transactions including: all transactional and administrative records as well as internal correspondences related to controlled transactions.
Notifying management or the appropriate empowered compliance official of potential STC violations or issues.
Communicating and cooperating with the national authorities on issues related to STC and controlled goods and technologies.

Adherence to STC policies and procedures is incumbent upon every employee within your enterprise, and all employees are likely to have some role to play in the STC compliance process.

Determine the Location of Empowered Compliance Personnel

As with the other “core” elements of an ICP, it is at your enterprise’s discretion to determine where STC compliance functions and personnel should reside. The size and location of your business will largely dictate the structure of your enterprise’s compliance functions. Larger enterprises (particularly MNCs) typically decentralize STC compliance responsibilities, by tasking an office or administrative department, but exercising sufficient corporate oversight to ensure compliance. Larger enterprises sometimes establish multiple compliance organizations – with an ICP Office that is responsible for day-to-day compliance, product classification, recordkeeping, and training, and another unit that is responsible for supervising the activities of the ICP Office and developing and maintaining the enterprise’s trade compliance policies. In some MNCs, it may be appropriate to create separate ICP offices or designate specific compliance personnel for each subsidiary, business unit, or affiliate. These individuals may be referred to as Trade Compliance Managers (TCM) or Trade Compliance Officers (TCO).

By contrast, small and medium-sized enterprises (SMEs) often choose to centralize the responsibilities for STC compliance in one or a few individuals. This may necessitate establishing an STC Compliance Committee, or if the size and activities of the enterprise warrant, simply task one individual with overall responsibility for STC compliance within the organization (commonly referred to as a Chief Compliance Officer). Where possible, it is recommended that your enterprise centralize key compliance functions (particularly SMEs). Many enterprises centralize the administration of training, recordkeeping, dissemination of regulatory material, notification of non-compliance, and audits. However, due diligence checks and transaction screening measures are usually performed by personnel throughout the enterprise.

Determine STC Compliance Assignments and Positions

Next, your enterprise must establish STC compliance positions. First, a single individual should be assigned a leadership role with overall responsibility for STC compliance functions within the organization. The individual charged with this responsibility should be a senior director, manager or other individual of corresponding status. This individual will carry personal responsibility for STC compliance within the enterprise and typically reports directly to the Chief Executive Officer (CEO) or Chief Operations Officer (COO). This individual is often referred to as the Chief Compliance Officer (CCO). The management of, and ultimate responsibility for, the enterprise’s ICP is vested in the CCO and this individual is generally responsible for coordinating compliance activities with other enterprise officials and/or departments that are involved in STC trade or compliance-related issues (e.g. legal, contracts, or shipping departments). For most enterprises, it is appropriate to name the empowered and authorized CCO in the compliance policy statement issued by management. Note: Depending on the legal structure of the enterprise (e.g. partnership or corporation), the CCO might be a member of the board of directors, a managing director or a managing partner.

Chief Compliance Officer

A Chief Compliance Officer's duties might include some or all of the following, but keep in mind that senior management or the CCO may delegate some of these responsibilities to other empowered compliance officials within the enterprise, when deemed necessary or appropriate.

Maintaining current knowledge of STC laws and regulations, and keeping abreast of any regulatory changes.
Assignment of personnel in charge of various STC compliance functions and responsibilities. The CCO should seek to ensure the appointment of an adequate number of employees with suitable legal and technical expertise.
Overseeing and monitoring the implementation of the ICP, including direction and communication with various business units or other empowered compliance officials.
Identifying STC compliance risks and enterprise vulnerabilities and developing plans to monitor and address them.
Providing guidance and direction to the board of directors, senior management, and employees on STC compliance issues.
Determining the records to be kept, their format, and the period of retention.
Granting ultimate approval authority for business transactions involving controlled items (often this responsibility is delegated to TCMs/TCOs).
Development, administration and provision of training programs and educational resources which focus on the elements of the ICP, and seek to ensure that all appropriate employees and management are knowledgeable of, and comply with, relevant STC requirements.
Managing and coordinating audits and internal reviews of the enterprise ICP.
Development and periodic revision of the ICP or operational procedures in response to audit findings, changes in the needs of the enterprise, or in STC laws, policies, and procedures.
Developing policies and procedures that encourage employees to report suspected or known acts of non-compliance, without fear of reprisal.
Receiving reports of non-compliance and responding to internal inquiries related to STC compliance or the enterprise ICP. Note: Responses are generally coordinated with the legal department, management, and other empowered compliance officials.
Communicating with the national authorities and serving as the principal point of contact (POC) within the enterprise that is tasked with responding to STC queries or information requests from the national authorities.
Independently investigating potential and proven acts of non-compliance (e.g. responding to reports of suspected STC violations), investigating known STC violations, and implementing any necessary corrective actions.

Next, in support of the CCO, management may appoint capable support staff (as well as competent back-up personnel) that can oversee the day-to-day STC compliance functions of the enterprise. The CCO can be supported by the establishment of a STC Compliance Committee (usually staffed by management or department heads) and/or by Trade Compliance Managers / Officers (TCMs or TCOs) at each business unit.

Trade Compliance Managers / Officers (TCMs or TCOs)

TCM/TCOs maintain primary responsibility for all STC compliance requirements applicable to that specific business unit but may be further assisted by deputies where the size of the enterprise mandates it. TCMs/TCOs may be tasked with day to day operation of the ICP and responsibility for applying for STC licenses. In some firms, an authorization or written confirmation from a TCM/TCO is required before enterprise employees may export or transfer any item to another country. The TCM/TCO may determine whether a license/permit is required and, if it is required, initiate the process to obtain one from the national authorities. TCMs/TCOs should also have the authority to halt a transaction if there are non-compliance concerns. Finally, the TCO/TCM may act as the primary internal (for colleagues) and external (towards the national authorities) point of contact for STC compliance-related issues (in some enterprises this responsibility resides with the CCO).

To avoid potential conflicts of interest, empowered compliance officials should generally be positioned within the enterprise so their sources of salary, bonuses, and performance evaluations are separate from the business(es) or units they monitor. Trade compliance personnel should be independent of the sales and marketing departments and should have sufficient authority and discretion vested in them to prioritize STC compliance in the face of other potentially conflicting or competing business interests. Many enterprises have attempted to ensure the independence of their STC compliance personnel by placing them in the legal department or having them report directly to the CEO/President.

In addition to appointing a CCO, TCMs/TCOs, and/or a STC Compliance Committee or Office, your enterprise might also consider establishing other STC compliance positions. The following are some examples of possible STC compliance positions and the accompanying duties of each position:

Other Empowered Compliance Personnel

Product Classification Engineers: Employees responsible for classifying enterprise commodities. These persons work with the CCO or TCMs to determine the appropriate license requirements. These employees are the technical experts or lead engineers who can be called upon to provide technical expertise, on an as-needed basis, on specific products and their technical capabilities.
Technology Compliance Officer (TCO): Employee responsible for classifying technology and software and assessing whether or not a proposed technology (or software) export/transfer requires a license. This person can also serve as the enterprise’s policy and licensing liaison with the national authorities on matters related to technology exports and transfers.
Sensitive Commodities and Countries Export Tracking Manager: Employee responsible for classifying sensitive enterprise products, overseeing, and tracking all enterprise exports of sensitive, high-risk commodities and/or to high risk destinations. This would include tracking compliance with all requisite license parameters and conditions.
Foreign Visitor/Travel and Foreign National Employee Coordinator: Employee responsible for coordinating and managing foreign visits and foreign travel. Coordinator would also be responsible for internal oversight of foreign national employees and visitors. Additionally, this individual would be responsible for screening employee laptops prior to travel abroad.
Legal Counsel: Lawyer responsible for providing legal guidance on STC compliance-related issues within the enterprise.

In all cases, the STC compliance hierarchy should be easily comprehensible, and there should be no confusion as to the line of responsibility and accountability stretching from the highest levels of management (President, CEO, board of directors, etc.) to the legal, HR, compliance, sales, marketing, and order-processing offices and staff members, as well as personnel not directly employed in a trade or compliance-related capacity. The organizational structure should be sufficiently clear so that employees know which office or individual(s) to consult if they have a question or concern related to strategic trade control compliance.

Determine the Optimal Number of STC Compliance Personnel

Irrespective of the type of organizational structure adopted by your enterprise, management should seek to ensure that STC compliance functions are staffed with appropriate and adequate personnel. Your enterprise should seek to ensure that a sufficient number of personnel are dedicated to STC compliance functions. To determine the optimal number of personnel required to properly staff the STC compliance functions within your enterprise, management should assess and estimate the demands posed in critical areas such as technical review, commodity classification, license applications, license implementation, transaction screening, internal security (physical and IT), training, recordkeeping, and internal audits.

The ultimate determination of how many personnel should be involved in STC compliance functions requires a thorough analysis of your enterprise. Specifically, the analysis should take the following factors and variables under close consideration when determining compliance staffing needs:

Volume of trade in controlled commodities;
The likely number of strategic trade control licenses to be applied for annually;
The geographic scope of the enterprise’s international operations;
Amount of activities/transactions subject to economic sanctions or embargoes;
The extent of STC training activities and location of trainings;
Extent of intangible transfers of technology;
IT and physical security requirements for controlled technologies; and
Any potential merger or acquisition activity.

With these details in hand, your enterprise will be well positioned to quantify the number of personnel required to effectively manage STC compliance requirements and the ICP.

In addition, management should designate knowledgeable back-up personnel that can maintain the compliance structure in the temporary absence of key personnel. Backup personnel are essential during periods of employee turnover and your enterprise’s organizational structure documentation should include a description of the steps and procedures to be followed if someone with STC compliance responsibility is absent.

Note: The “Organizational Structure” link within the “ICP Implementation Aids” sub-section contains a contact list template, examples of compliance organizational charts, and a description of titles and responsibilities for various STC compliance positions.

Task 2: Document Compliance-related Positions, Assignments, and Roles

The STC organizational hierarchy should be transparent, and management should communicate it clearly to all employees in a format that is unambiguous and easily understood. Enterprises should draft and provide lists and/or charts to convey the organizational structure to all employees. Lists are superior for presenting specific strategic trade control compliance duties, while organizational charts are preferable for illustrating reporting lines and structures within the enterprise.

Your enterprise should consider documenting compliance-related positions by developing:

Compliance position descriptions that describe the authority, function and duties of responsible compliance personnel in the day-to-day operations and STC compliance efforts of your enterprise. Empowered compliance personnel should be identified by name, title, and telephone number or extension. The amount of detail provided in the list of responsible officials depends on the size of the enterprise. For SMEs, it is probably not necessary to go into a great amount of detail. However, at a larger firm that has numerous employees involved in STC compliance issues, it may be very important to clearly identify responsible parties in great detail.
Organizational charts that clearly describe the structure and the chain of command for reporting issues related to strategic trade control compliance.
Compliance contact lists that identify the name, title, email, phone number, address or other pertinent contact information for all primary and backup compliance personnel.

Note: These organizational charts and contact lists should be widely distributed throughout the enterprise and updated periodically to reflect staff changes. Lists and charts can be displayed and updated on the enterprise website, intranet and/or in internal publications.

STC Compliance: Incentives and Penalties

Your enterprise might also consider developing incentives for employees that meet and surpass their compliance responsibilities, such as enterprise-wide recognition or a raise in pay. Some enterprises will evaluate the compliance record of an employee during performance appraisals and factor it into promotion decisions. Similarly, an effective organizational structure will make the consequences for failing to meet one’s compliance responsibilities clear in the form of pre-established penalties or punishments. Punishments can range from a negative mark on an employee’s personnel evaluation to a demotion, or in more severe circumstances, employee termination. Moreover, your enterprise should inform all new and current employees that they will be subject to legal action for STC violations.

These incentives and penalties should be clearly defined and distributed to all new employees at the time of hiring and contained in new hire contracts and employee paperwork. The information should also be readily available to all employees – either through your enterprise’s intranet and/or in hard-copy with the human resources (HR) department.

Task 3: Distribute the List of Responsibilities

Lastly, it is incumbent upon your enterprise to distribute an organizational chart identifying all personnel with strategic trade control-related responsibilities. Employees and customers should be made aware of the name of your enterprise’s Chief Compliance Officer (CCO) and other relevant empowered compliance officials and should be encouraged to direct questions or concerns to these individuals when they arise.

This information should be kept current to account for any changes in personnel or your enterprise’s business activities. When updates do occur, your enterprise should re-distribute the organizational chart to all concerned parties.