Export controls 101: Internal Compliance Programs (ICP)

Export controls 101: Internal Compliance Programs (ICP)

What makes an effective ICP? Are there official guidelines on Internal Compliance Programs? This useful overview may help you get things right.

What exactly is an ICP?

In the context of export controls, ICP stands for “Internal Compliance Program”. Compliance management programs generally serve to support an organization’s adherence to legal regulations – in this context specifically regarding foreign trade. As such, an ICP documents a company’s internal control measures for complying with relevant export control legislation. It serves as an in-house manual and includes internal protocols and standard operating procedures that must be observed to efficiently and compliantly manage all risks relating to export controls.

ICP recommendations and guidelines vary by jurisdiction. It is therefore important to refer to the export control legislation applicable to the jurisdictions that apply to your company. An ICP may need to be in place when, for example, companies want to apply for certain types of export licenses. Outside of legal provisions in national foreign trade laws and export control regulations, a legal basis for ICP requirements may also be found in due diligence requirements of general company management.

Basic elements of an Internal Compliance Program

1. Management commitment

Compliance should be a cultural factor within a company. This relies on visible commitment of senior executives and management. Making required resources available and appointing a dedicated compliance officer forms an essential part of this.

2. Training and awareness

To further support the cultural attitude towards compliance, regular employee training is of paramount importance to ensure all teams involved from offer to delivery are aware of their responsibilities and contribute accordingly.

3. Screening and checking

To ensure trade does not take place with individuals or entities on relevant restricted party lists, continued screening against all applicable, published entity lists. The same applies to checking business transactions regularly against applicable embargoes, product lists, and end-use restrictions and prohibitions.

4. Recordkeeping

To support audits, identification of violations, and voluntary disclosures, records should be easily accessible to support efficient and effective audits. It is therefore vital to keep records of all checks that are relevant for export controls.

5. Written policies

It is essential to define and thoroughly document corporate policies on export controls as part of an ICP. These also need to be communicated and repeated as necessary, which ties in with the requirements for training and awareness.

6. Self-audits

To support the ongoing maintenance of a compliance program and to minimize the risk of violations coming to light during an external audit, a company should perform their own, internal audits periodically.

7. Change management

Internal Compliance Programs must be configured to cater for changing policies, legislation, technologies, etc. An ICP must be robust and adaptable enough to deal with uncertainty and unpredictability.

8. Software automation

Considering the significant volumes and frequent changes of export control regulations across the globe, automation of required checks delivers security and efficiency. Software solutions are a very cost-effective means of ensuring export control security without slowing down business processes. You can read more about the return on investment on export control compliance software in this article

Risk Assessment Software
Compliance Screening Software
Export Controls Software
License Management Software

Internal Compliance Program (ICP) guidelines

In general, there is no standard format for Internal Compliance Programs. The content of an ICP is typically customized and highly company-specific – tailored to the specific products and processes of an organization and the jurisdiction it is subject to. 

Want to deep dive further and get a tangible example? Then take a look at my colleague's article: Sample Internal Compliance Program: an ICP for Juice GmbH

With regards to general criteria, various export control authorities across the globe have issued official guidelines around Internal Compliance Programs. In the following section, you can find some examples – by country, in alphabetical order.

European Union
United Kingdom
United States

End-to-end trade compliance with AEB

AEB's export control solutions deliver comprehensive security for your business with always available and up-to-date software for Compliance Screening, License Management, Export Controls, and Risk Assessment. In the cloud and integrated in systems such as SAP®, Salesforce, or Microsoft Dynamics 365.