Navigation

Internal Compliance Program example: an ICP for Juice GmbH

Sample ICP

Sample Internal Compliance Program: an ICP for Juice GmbH

There’s nothing like a good example to explain the proper way of doing something. Here’s a step-by-step guide for how to set up an export controls ICP.

Ulrike Jasper

01.02.2024

ICP: intro and basics
Steps for implementing an ICP
ICP case study
Step 1: Risk assessment for company J
Step 2: Status analysis for company J
Step 3: Documentation for company J
Step 4: Implementation in company J
In a nutshell: setting up an ICP

ICP: intro and basics

The term “Internal Compliance Program” (ICP) is used in export controls to describe a company’s internal operational and organizational procedure for export controls. There is no one-size-fits-all, plug-and-play ICP template appropriate for any and all companies.

Quite the contrary: The challenge that companies face is to develop a distinct document tailored to their unique business processes that defines internal processes in a way that ensures compliance with export control regulations and can also be put into practice internally.

For additional general information and some examples of official recommendations, please refer to this article: Export controls 101: Internal Compliance Programs (ICP)

Steps for implementing an ICP

When it comes to practical implementation, it’s certainly helpful to keep general criteria in mind, but this only makes sense when adapted to the specific context of the company. The size, structure, and internal divisions of the company must be key considerations in the development of an ICP. It’s important to establish a distinct organization that fits the company and can also be put into practice.

We recommend focusing on the following four steps when creating an ICP:

Step 1: Risk assessment

The risk assessment must analyze which export control restrictions are relevant to the company based on its specific business activities. This is possible only if the provisions of the applicable export control laws are understood. That means that the analysis must encompass the business partners, the countries where the company does business, the product portfolio, and the potential uses of the products. The risk assessment reveals which departments must be integrated into the ICP.

Note: The vetting of business partners is part of restricted party screening, which should be run automatically for all countries using specialized screening software. We recommend defining the business partner screening in a separate ICP for restricted party screening.

Step 2: Status analysis

The status analysis asks the question: “Where are we now, and where do we want to go?” It’s important to establish the target status of the departments identified in the risk assessment. This means not only defining the procedures but also creating an organizational model with an org chart, selecting the right personnel, and providing the necessary training.

Step 3: Documentation

The target status established during the status analysis is put down in writing in a distinct document, the ICP, including specific measures to be taken and obligations to be met.

Step 4: Implementation

The ICP must be rolled out internally. That means that all organizational measures defined in the ICP must be put into practice in the company, and this step certainly represents the biggest challenge. Export controls affects many different parts of the company, from Sales and Purchasing to Product Development, Support, and Exports – and possibly other areas as well, depending on how the company is structured. An ICP becomes part of a company’s culture only if the organizational measures are accepted by the employees. A big part of this – in addition to time, knowledge sharing, understanding, and tools for export control checks – is the commitment of management to export controls.

ICP case study

The following case study uses a specific example to illustrate the steps in implementing an ICP. A comprehensive study is not possible here, but we can offer a brief look at the main points.

Company profile

Company: Juice GmbH (J)
Headquarters: Stuttgart
Type of company: Food production
Products manufactured: Filters for juice centrifuges

Export scenario

J does business around the world
It has also supplied one embargoed country to date: Russia
The filters are non-listed goods
J has not yet had to apply for any export licenses

What should be kept in mind when setting up the ICP for J?

Step 1: Risk assessment for company J

J must identify the potential risks of violating goods-related export control laws. Specifically, this means that J must use the following three “W” questions to check which of its business transactions may be subject to bans or licensing requirements.

Note: There are four “W” questions relevant to export controls. We’ve set aside the first question (“Who am I shipping to?”), since it concerns the screening of business partners, which should be handled in a separate ICP for restricted party screening as previously mentioned.

Question 1: Where am I shipping to?

Answering this question checks for compliance with the restrictions in place under the EU’s embargo regulations. J maintains business relations with Russia. J must take appropriate organizational measures to protect against the risk of violating the embargo against Russia.

Question 2: What am I shipping?

Answering this question checks for compliance with the license requirement for exports and movements of listed goods. The filters in J’s product portfolio are mass-produced filters whose technical parameters are far removed from those of the filters described in the dual-use list. The risk of unauthorized dual-use or arms exports is assessed as less critical for J.

Question 3: What will the goods be used for?

Answering this question checks for compliance with the license requirement under the catch-all clauses for non-listed goods. The non-listed filters can be used militarily, and J has one country under arms embargo (Russia) among its business partner countries. That means that J must take appropriate organizational measures to protect against potential violations of the catch-all clauses.

Step 2: Status analysis for company J

J now defines the organizational measures and responsibilities to protect against the identified risks.

Restrictions arising from business transactions with critical countries

All Russia-related inquiries received by J must undergo an embargo check by the team responsible for export controls prior to further processing. For inquiries from other critical countries, J must sensitize the relevant employees – typically, those who work in Sales. An overview of countries currently under embargo should be made available. When inquiries are received from these countries, Sales may only proceed after consulting with the export control team.

License requirements for listed goods

The product portfolio of a food manufacturer mostly contains products that are freely available on the world market. Given this, and given the fact that the filters manufactured by J are far removed from a dual-use classification, there is no need for detailed classifications.

The persons responsible for filter development should be informed, however, that there are civil filters with certain technical characteristics listed as dual-use goods. These technical characteristics of listed dual-use items should therefore be available for reference in new developments.

It’s important when classifying goods to raise awareness of design requirements from the military sector. All products specifically designed or modified for arms must be passed on to the export control team for classification.

Another department that plays an important role in the classification of goods is Purchasing. Here, too, it is necessary to raise awareness of dual-use classifications. Information on classification can be found on business documents such as the order confirmation. Purchasing must share this information with the appropriate office.

License requirements for non-listed goods from critical end-use

J must ensure that all information relating to critical end-uses is checked for any license requirements. Information about the use of the products may be received in different parts of the company. It’s important to raise awareness and broadly sensitize company employees around this issue. This is the only way for J to ensure that relevant information is not buried. J must define channels to ensure this information is shared with the export control team.

J can minimize risk by requesting final destination declarations. Germany’s Federal Office for Economic Affairs and Export Control (BAFA) offers various templates that J can use to request this information from its business partners. The decision as to whether to obtain final destination declarations for business transactions not subject to license requirements is at the discretion of each company and serves to mitigate risks internally.

Personnel selection and organizational model with org chart

J must decide whether to appoint an export officer to liaise with BAFA. Companies that need to request individual export licenses (EAG) from BAFA are required to appoint an export officer. J’s business transactions have not yet required individual export licenses, so this appointment is not mandatory.

Creating an export control team with the role of an export control officer is not legally required but is essential for actual implementation of the ICP in the company. The export control officer is available for all questions relating to export controls within those parts of the company that deal with operations. The export control officer must be given broad-based authority to issue instructions. Above all, export transactions must be stopped until a final assessment can be made.

The export control team should be a staff-level unit that reports directly to management. Export controls should be under the sole authority of management.

Secure and efficient export controls with AEB

Export Controls from AEB automatically checks all your relevant transactions for license requirements and embargo restrictions worldwide. Ad hoc, fully automated, or company-specific. In the cloud or integrated in your ERP.

More information

Step 3: Documentation for company J

The process and structure defined in step 2 will now be documented in a written ICP. Depending on the structure of the company, it may be useful to coordinate certain processes through standard operating procedures added as annexes to the ICP.

Step 4: Implementation in company J

The final step in setting up an ICP is implementation. The management of J must sensitize employees at all relevant levels. J must provide training to ensure that all employees affected by export controls are provided with the necessary knowledge and notified of changes.

The ICP should be audited at least once a year and adapted as needed. Any changes made during the year to J’s legal situation or processes must be incorporated into the ICP.

Anything that impacts decisions must be documented in such a way that it can be made available to internal or external auditors as needed. Export-related documents from all phases of the application process must be retained in accordance with the terms of the EC Dual-Use Regulation and Germany’s Foreign Trade and Payments Ordinance (AWV).

Free tips and trends on export controls

Monthly updates by email from AEB on relevant export controls, customs, and supply chain management topics. Sign up and don't miss out.

In a nutshell: setting up an ICP

The company's ICP must be a distinct document tailored to the company’s business activities. General explanations of export controls of the kind found in handbooks do not belong in an ICP. Ideally, the ICP should only cover the areas of risk identified within the company.

An ICP has value only if the processes it describes can actually be rolled out and put into practice in the company. Experience shows that the shorter and more comprehensible an ICP is, the greater the probability that it will actually be put into practice.