Posted in 2016, very relevant today and worth a second read!
Updated by Jenny Hahn, President
Today many prime defense contractors and others involved in the manufacture and sale of defense articles regulated by the ITAR require evidence that companies in their supply chain are registered with the Department of State, Directorate of Defense Trade Controls (DDTC), or, my personal favorite, be “ITAR Certified.” “ITAR Certified” is not defined within the regulations, thus creating more confusion among the small and medium size companies as they try to understand how to become “Certified”.
A company cannot become “ITAR Certified”, although its trade compliance employees can take courses in which they can receive titles like CUESCO, which means they individually are a "certified" export compliance officer. The better question is how did “certification” become an expectation imposed on supply chain?
ITAR Certification is a misnomer; you cannot gain an ITAR Certification like you can an ISO Certification or a CMMI rating. There isn’t a specific standard or set of criteria to be rated against to achieve “ITAR Certification.” Of course, you can include your ITAR Compliance program in the ISO Certification and auditing process but that’s not going to prove you are following the ITAR regulations; it will only demonstrate that your Company is following the Company’s policy, procedures and work instructions consistently.
Some companies have believed that being registered with DDTC is all that is required to allow them to complete the prime contractor questionnaire that will demonstrate they are “ITAR Certified”.
The reality is much more than a simple registration with DDTC. The ITAR imposes a requirement for companies to register, if they meet one of three conditions, manufacture defense articles, export defense articles or furnish defense services, or broker defense articles.
In our experience, many companies do not have a clear understanding of what they are signing up for when registering with DDTC. Just Google “ITAR Certified” and click on Images; you will find many companies have posted their DDTC registration letters with their registration codes. This doesn't make them "ITAR Certified". In fact, a seasoned trade compliance professional will wonder what the company doesn't know by this bold statement.
When a company registers with DDTC, its certifying that a corporate officer or board member of the company understands the obligations of the ITAR, and has established an export compliance program, which includes designation of an ITAR Empowered Official and a trade compliance program. Each year with a company registers or renews its registration with DDTC, DDTC will provide the company with the letter acknowledging their registration and a 4 page compliance program guideline.
What the prime contractors are really concerned with beyond the registration of your company with DDTC, is does my supplier understand that the ITAR imposes licensing obligations if they have a foreign person working at their facility that have access to and release of my technical data? Does my supplier understand if they send my technical data offshore to fulfill the purchase order or contract obligation that an ITAR export license is going to be required? Is my supplier in any way ineligible to participate in an ITAR export transaction because they have become ineligible under the ITAR?
In addition to the prime contractor concerns triggering the "ITAR Certified" form, once a company registers with DDTC, DDTC expects that the Company will stand up a Trade Compliance Program that is clearly documented in writing, tailored to the business, regularly reviewed/updated and fully supported by management. Your program should address these basic elements:
Registration
Determine export jurisdiction of your products, data and services;
Know the end user and end use of defense articles and services (not limited to international transactions);
Know the intermediate parties to a transaction, including supply and title chain
Know what countries are prohibited destinations
Conduct denied party screening of all parties to the transaction, this includes banks, freight forwarders, supply chain (U.S) and all foreign parties;
Ensure party names and address are accurate;
Licensing of items when/if being exported or use an exemption if its applicable to the transaction and conditions imposed in the ITAR;
Ensuring reporting requirements related to the payment of fees and commissions associated with the export transaction are researched and made as part of licensing filing;
International travel by employees
Foreign Visitors to the company facilities
Marking of export controlled materials internally and externally for domestic use and for exports;
Maintaining records of the manufacture and disposition of defense articles. Having a policy that addresses which records need to be maintained, who is responsible and where they are to be maintained;
Ensuring administrative reporting requirements of the ITAR are met, such as the reporting of the initial export of technical data or the performance of defense services against an ITAR license, submitting executed Technical Assistance Agreements, providing annual sales reports for Warehousing Distribution Agreements or Manufacturing License Agreements or making semi annual reports related to exports authorized by the ITAR 126.5 Canadian Exemption;
Training employees on the basic elements of the regulations and how to comply. Irregardless of the size of you company, if your employees don’t understand the many ways an export can take place how are they going to know what to watch out for?
Auditing of Company compliance program, exports and any USG authorizations in place;
Last but not least, having a specific policy regarding what the Company will do when a potential issue of non-compliance is raised. Who will conduct the investigations, provide the reports to management and prepare the voluntary disclosure to the DDTC?
If you have a compliance program that addresses these elements and have appointed trade compliance responsibilities within your company and on your organization chart, when asked to complete the forms for “ITAR Certification” you can do so with more confidence.
In the end, let’s call “ITAR Certification” by its real name, a Trade Compliance Program, and no matter your company size it really boils down to risk adversity. While the regulations don’t specifically state you must have a documented program in place but with the DOJ taking a position regarding the individual responsibility of Corporate employees [see (Yates, 2015) Memo] and DDTC and BIS both detailing their expectations for compliance programs on their websites, how can you not?
Contact FD Associates at 703-847-5801 or Tell Us Your Needs, for support in enhancing your compliance program so you can be more confident when requested to complete the “ITAR Certified” forms for your customers.