Internal Compliance Program Examples:

1

• Internal Compliance Program Examples
• Case Study 2 Oerlikon

Ralf Wirtz Head of Global Trade
Control Oerlikon
Industry-Government Seminar on Strategic Trade
Management Dusit Thani Hotel, Bangkok,
Thailand 22 October, 2008
2
Definition of Internal Control Program (ICP)
A Total Quality Management system, aiming at a
companys full export compliance
Other terms for the same kind of system
are ECS Export Control System EMS
Export Management System
3
......a few examples from other countries

• Taiwan ICP
• Korea IP
• USA ICP
• Singapore ICP
• Hongkong ICP

Now to our ICP
4
South Korea ICP recommendations
5
USA ICP recommendations
6
Taiwan ICP recommendations
7
Singapore ICP recommendations
8
Hongkong ICP recommendations
9
Internal Control Program

1. Appoint Chief Export Control Officer German
law
2. Policy Statement/Management commitment (top
level)

3. Appoint suitable employees and give them
time/power/resources

4. Define clear roles/responsibilities
(guidelines and job descriptions)
5. Screen all goods (incl. technology) against
export list
6. Check your customers (Red flags/end use
control/Sanctioned Party Lists)
7. Seminars/Training
8. Licensing process, reports and record keeping
9. IT Support
10. Internal Audit (supervise adherence to ICP)
10
Departments/functions needed for the ICP
Management provides resources, re-iterates
importance, supervises, initiates corrective
action Trade Control Officer regulatory
updates, trainings, transactional decisions,
license applications
project work (IT), circulars, contact with
authorities, maintains ICP Engineering/RD
screen commodities, review export list changes,
help TCO with application related
questions design
reviews Shipping Customs documents, contact
with customs, last check point HR screen
empoyees against terrorist lists, help organize
trainings, maintain training record Sales/order
management contribute awareness, screen
business partners, train agents,
communicate with
customers to obtain required documents Service
similar to sales/order management Purchase
qualify supplier, obtain foreign trade data
(country of origin, ECCN), certain
certifications IT supports with customizing,
definition of business blue prints, reports, new
tools etc. Internal Audit / TQM process
improvement, compliance measurement
11

• ICP Assessment
• Element 1 Appointment of Chief Export Control
  Officer
• Most important criteria personal responsibility
• (Hopefully not) the only employee with genuine
  commitment to Trade Compliance
• Responsibilities
• to select of qualified/reliable compliance
  personnel
• supervision of compliance personnel
• Organisation of Trade Compliance within the
  entity or group
• Enabling resp. encouragement of
  trainings/further education (knowledge of
  regulations)
• A responsibly acting Top Manager is the best
  Enabler!

12

• ICP Assessment
• Element 2 Policy Statement
• A written statement of the Top Management with
  their and employeescommitment to a company
  policy of compliance (leave no doubt)
• No statutory provision in Germany, but
• helpful to communicate company philosophy
• to business partners (customers, suppliers,
  representatives)
• to existing and new employees
• OLV provides policy statement together with work
  contract and
• additional documents (company agreements)

13

• ICP Assessment
• Element 3 Compliance personnel (Trade Control
  Officers)
• Definition of authorizations of Trade Control
  Officers
• Adequate time/resources to perform functions
• Equipped with authorizations to stop each
  critical export
• Access to all necessary documents
• Compliance department should be organized
  independently within company organisation
  (avoid collision of interest)
• Compliance staff should report directly to CECO
  (element 1)
• The functions should be well-defined within the
  organisation.

14

• ICP Assessment
• Element 4 Written documentation (incl.
  roles/responsibilities)
• Documentation with activities, processes,
  responsibilities
• Its not essential, whether there a one or more
  working instructions.
• Documentation should be clear and all
  inclusive (if necessary, translated)
• Documentation must include clearly defined
  functions and responsibilities
• Trade Compliance should be part of job
  description of all concerned
• Documentation should include version number,
  date and signature
• Should include internal contact persons (with
  telephone number)
• Should always be up to date
• In case of foreign trade/enforcement audits
  documentation has to be available

15
Our ICP consists of several written procedures
S AM P L E
26
16
Excerpt from End Use Examination element
S A M P L E
27
17

• ICP Assessment
• Element 5 Screen all goods/technology against
  export list
• One time exercise at the beginning, then
• Continuous/permanent check of all new parts
• Screening shall be performed by well trained
  engineers/technicians
• Goods subject to authorization should be blocked
  in the data processing system (if any)
• Entry of control data/results etc. in product
  data base (documentation)
• All business partners should have access to
  information
• Data processing system should generate revision
  notifications
• Export lists subject to continuous modifications
  (pay attention!)
• In cases of doubt please contact authority
• If you are not producer, please ask supplier.

18

• ICP Assessment
• ELement 6 Screening of business partners
• Please mind for red flags in inquiries and
  orders (usage, by-passing etc. Does anything
  look suspicious???)
• Search in the internet, commercial register and
  the Yellow Pages etc. about customer
• Special caution when dealing with trading
  companies
• Insist in enduser declarations providing
  unambiguous references to the end user, if
  required.
• Take care when dealing with certain countries
• In case of doubt regarding the enduse, please
  contact the authorities
• If you have to reject a delivery, please forward
  information within your organisation (possible
  purchase via foreign daughter companies)
• Inform your authorities
• Enter a delivery block for sensitive/critical
  companies
• No business transaction is profitable enough to
  buy yourself a new, stainless
• reputation.

19

• ICP Assessment
• Element 6 Check of business partners
  (....continued)
• Use up to date Sanctioned Party Lists (ongoing
  modifications)
• Screening process of business partners can be
  automated
• If process is automated, generate log
  files/audit logs.

20

• ICP Assessment
• Item 7 Education and trainings
• Regulatory knowledge requires continuous updates
• Compliance staff should participate in seminars
• Certificates of attendance document the
  participance in seminars (confirmation for
  supervising CECO)
• Export control staff read and comprehend the
  according laws and regulations
• They have to be translated in the (simple)
  language of the company
• Export Controllers should train their colleagues
  in internal seminars and
• workshops (not only by means of newsletters)
• Use of web casts, training videos etc. possible,
  but
• Prefer personal meetings for immediate
  clarification of questions
• Have attendance sheets / participant lists
  signed (evidence of training)
• Ask HR to support with invitations and
  administrative preparations

21

• ICP Assessment
• Element 8 Export License Applications
• Guarantee that export license application is
  complete in all details
• (accompanying documentation about goods and end
  use respectively end user)
• Evaluate the supply transactions, comment on it
  and the reasons why end use appears to be
  plausible. Its mandatory that all data and
  information are true and correct
• Export applications are handled with a strict
  4-eyes-principle
• If the Licensing Authority imposes conditions,
  check if you can fulfill these
• (prior to delivery, 4-eye-principle)
• It can be helpful to keep/archive export
  applications and approvals beyond
• the officially required period (in Germany
  max. 7 years)

22

• ICP Assessment
• Element 9 IT support in Export Compliance
• No obligation, but highly recommendable
• If you want to use IT support, you should
• have an appropriate authorization concept (no
  data access for everybody)
• have highly qualified users to maintain the data
  bases
• have access to all log files for all field
  entries/modifications
• be aware that internal and external auditors
  review the IT
• IT support for Export Compliance is mostly
  uncomplicated and
• not necessarily expensive (standard ERP software
  available).

23
Electronic data processing in Export Compliance

• Use for
• - Sanctioned Party List Screening (different
  software solutions incl. SAP)
• - Customer and vendor data base (500.000
  business partners)
• - Product data base (approx. 3 Mill.)
• Blocking of transactions (40.000 supply
  transactions/day) and for blocked countries
• Internal documentation (Export Control Check
  List)
• - Log files and audit logs
• - AES (Automated Export System, replaces export
  documents)
• - Further necessary reporting system (e.g.
  INTRASTAT in EU)
• - EDI with carriers (mainly commercial usage)
• - Electronic license application (USA, UK,
  Germany etc.)

23
24

• ICP Assessment
• Element 10 Internal Audits
• Trust is good, control is even better
• Your employees tend to forget the processes
  introduced by you
• Export compliance should be audited like all
  other compliance aspects
• If there is no audit team in your company
  available internal audits can be conducted by
  your quality manager
• The compliance personnel should not be in charge
  of audits (controllers
• must not control themselves)
• Forward the audit report to all concerned,
  including Top-Management
• You should implement re-audits with pursuance of
  the progress.
• Objectives Audits will help your company to
  avoid violations (The punishment of employees is
  not the prime task)

25
Thank you for your attention!

• for your attention and support!

Page 25 14.08.2007 Presentation