ITAR Certification is a misnomer; it isn’t like being ISO Certified or achieving a CMMI rating; there isn’t a standard to be rated against to achieve “ITAR Certification.” Of course, you can include your ITAR Compliance program in the ISO Certification and auditing process but that’s not going to prove you are following the ITAR regulations; it will only demonstrate to DDTC Compliance or BIS Enforcement that your Company is following the Company’s policy, procedures and work instructions consistently.
Being registered with DDTC seems to be the trigger for some Companies believing they are “ITAR Certified.” The reality is the ITAR imposes a requirement for Companies who, either manufacture or export defense articles or furnish defense services to register with the Directorate of Defense Trade Controls (DDTC)1. In our experience, many companies do not have a clear understanding of what they are signing up for when registering with DDTC. Just Google “ITAR Certified” and click on Images; you will find many companies have posted their DDTC registration letters with their registration codes. This only conveys that the Company is registered with DDTC.
Companies should be aware that by submitting the registration package to DDTC, an officer or board member of the company is telling DDTC that the Company knows how to work within the regulations, at a minimum will or has designated an Empowered Official 2 and has a subject matter expert on‐site or on call. When a Company registers with DDTC, DDTC expects that the Company will stand up a Trade Compliance Program and employ or engage a subject matter expert to address these basic elements:
Determine export jurisdiction of the products, data and services;
Determine classification of the products data and services;
Licensing of items when/if being exported;
Marking of export controlled materials;
Denied Party Screening of parties to ANY transaction;
Training employees on the basic elements of compliance of the USG export regulations. This is especially important – even when a Company doesn’t have an extensive compliance plan in place, awareness training is key. If your employees don’t know what an export is, how are they going to know what to watch out for;
Auditing of Company compliance plan, and auditing of any USG authorizations in place;
Last but not least, specific policy regarding what the Company will do when a potential issue of non‐compliance is raised. Who will conduct the investigations, provide the reports to management and prepare the disclosure to the USG?
With the above plan in place, having on site experts or SME’s on‐call, you can feel more confident about completing the forms for “ITAR Certification”.
In the end, let’s call “ITAR Certification” by its real name, a Trade Compliance Program, and no matter your company size it really boils down to risk adversity. While the regulations don’t specifically state you must have a documented program in place but with DOJ cracking down on individuals in Corporations for flubbing things up [see (Yates, 2015) Memo] and DDTC and BIS both detailing their expectations for compliance programs on their websites, how can you not? Please contact FD Associates at 703‐847‐5801 or Tell Us Your Needs, for support in enhancing your compliance program so you can be more confident when requested to complete the “ITAR Certified” forms for your customers.