INTERNATIONAL TRADE LAW
How to Build an Export Compliance Program
An export compliance program is a written system that builds export-control checks into the way your company takes orders and ships goods — and the cleanest blueprint is the nine elements BIS publishes. A program turns ad-hoc judgment calls into a repeatable process, which is exactly what regulators look for and what keeps an honest mistake from becoming a violation. Here is how to build one and what each piece does.
Why a Written Program Matters
A compliance program is not paperwork for its own sake. It is the difference between catching a problem before a shipment leaves and explaining it to BIS afterward. A documented program lowers the chance of a violation, gives every employee a clear procedure to follow, and — if something does go wrong — demonstrates good faith that regulators weigh when deciding how to respond. The Bureau of Industry and Security frames an effective program around nine elements, and they map neatly onto how goods actually move through a business.
The Nine Elements of an Effective Program
| # | Element | What it looks like in practice |
|---|---|---|
| 1 | Management commitment | Leadership funds the program and sets the tone in writing |
| 2 | Risk assessment | Map your products, customers, and destinations to their risks |
| 3 | Written procedures | A manual that tells staff exactly what to do, step by step |
| 4 | Training | Regular, role-specific training for everyone who touches exports |
| 5 | Screening | Check items, parties, and end uses before every shipment |
| 6 | Recordkeeping | Retain export records, generally for five years |
| 7 | Auditing | Periodic internal or external checks that the program works |
| 8 | Handling violations | A clear path to report, investigate, and disclose problems |
| 9 | Corrective action | Fix the root cause so the same gap does not recur |
Build It in Order
Start with management commitment. Without budget and visible support from the top, a program stays theoretical. A short, signed policy statement that names a responsible compliance officer is enough to begin.
Assess your risk. Inventory what you ship, to whom, and where. A company selling EAR99 office supplies domestically faces very different exposure from one shipping controlled electronics abroad. The assessment tells you where to spend effort. Classification work — confirming each product’s ECCN or EAR99 status — belongs here.
Write the procedures. Convert the risk picture into a manual: how to classify a product, how to screen a customer, when to seek a license, who signs off, and how records are kept. The test of a good manual is that a new employee can follow it without guessing.
Train the people who use it. Procedures only work if staff know them. Train order-entry, sales, shipping, and engineering on the rules that apply to their role, and refresh the training as regulations change.
Screen every transaction. Before each export, check the item’s classification, screen all parties against the Entity List and the SDN List, and confirm the end use is permitted. Watch for diversion red flags — vague end-use answers, illogical shipping routes, buyers indifferent to the product’s function.
Keep records, audit, and correct. Retain your classifications, screening results, and export documents — generally for five years. Audit periodically to confirm the controls are actually being used. When you find a gap or a violation, investigate it, consider a voluntary self-disclosure to BIS, and fix the underlying cause.
What Happens Without One
The cost of skipping the program is measured in real penalties. Under the Export Control Reform Act of 2018, criminal violations can carry fines up to $1 million and up to 20 years in prison per violation; civil penalties, adjusted annually for inflation, reach the mid-six figures per violation or twice the transaction value. BIS can also deny a company’s export privileges entirely. A compliance program is far cheaper than any of those outcomes — and it is the same discipline that keeps routine export shipments moving without delay.
Frequently Asked Questions
Is an export compliance program legally required? No single rule mandates a written program for every exporter, but the obligation to comply with the EAR is mandatory. A program is how companies meet that obligation reliably, and BIS treats one as a strong sign of good faith.
How big does the program need to be? It should be proportional to your risk. A small exporter of low-tech goods may need only a short manual and a screening routine; a company shipping controlled technology needs the full nine elements with depth.
What is denied-party screening? It is checking your customers, consignees, and other parties against U.S. government restricted-party lists — such as the Entity List and SDN List — before you ship, to avoid dealing with a prohibited party.
Should we self-disclose a violation? Often, yes. A timely voluntary self-disclosure to BIS is a recognized mitigating factor. Because disclosure has legal consequences, review the situation with counsel first.
Building or stress-testing a compliance program? Reidel Law Firm prepares flat-fee Import/Export Compliance Memos that pressure-test your classifications, screening, and licensing approach against the rules that apply to your goods — with direct access to the trade attorney handling your matter. Get a flat-fee compliance memo →
