An export compliance program (ECP) is how a company turns the Export Administration Regulations into daily practice. The Bureau of Industry and Security (BIS) publishes guidance built around eight elements: management commitment, risk assessment, export authorisation, recordkeeping, training, audits, handling violations with corrective action, and a compliance manual. You do not need a large team to use them. You need each element in proportion to your risk.
A program is not generally mandatory. BIS treats an effective program as a significant mitigating factor in enforcement, though, and some licences and exceptions assume one exists.
What are BIS's eight elements of an export compliance program?
1. Management commitment
This means a written statement from senior management that the company will comply, named responsibility for export compliance, and resources to match. The owner should be a named person with authority to stop shipments, reporting to senior management. Without that commitment, compliance loses every argument with a shipping deadline.
2. Risk assessment
Map where the risk is: which products are controlled (and how), which destinations, customers and channels you sell through, and where technology is shared. A company exporting 3A001 components through distributors has different risks from one selling EAR99 goods to domestic customers.
3. Export authorisation
This is the core process, and it runs for every transaction:
- Settle jurisdiction (ITAR or EAR) and classification (the ECCN or EAR99). See how to find the ECCN for your product.
- Decide whether a licence is needed, using the Country Chart, licence exceptions and Parts 744/746.
- Screen every party. See sanctions screening.
- Review red flags such as unusual orders, evasive answers and mismatched end uses.
- Set who can stop a shipment and who can approve its release.
4. Recordkeeping
Part 762 generally requires export records to be kept for five years. That covers classifications, licences and exception use, screening results, shipping documents and communications. Records are also your defence: a documented classification shows diligence.
5. Training
Everyone who touches exports needs training at the right depth. That includes sales, engineering and logistics, and HR for deemed exports. Refresh it annually and when rules change.
6. Audits
Periodic internal or external reviews test whether the process works in practice. Reviewers sample transactions, re-check classifications and confirm that screening ran against current lists. Many companies audit annually, with focused reviews after major changes such as new products, markets or regulations. See common classification mistakes for what reviewers often find.
7. Handling violations and corrective action
Staff need a clear route for reporting suspected violations. The company then investigates, fixes the cause and, where appropriate, makes a voluntary self-disclosure to BIS. Disclosure and effective corrective action are significant mitigating factors in penalty decisions.
8. The compliance manual
Write it down: policies, procedures, responsibilities, forms. Keep it current and easy to reach. A manual that describes what people actually do is worth more than a long one that nobody reads, so make it long enough to describe the real procedures and stop there.
How big should an export compliance program be?
The elements are the same for every company; the depth differs with the risk.
| Company | What the program usually includes |
|---|---|
| Small exporter | One owner, a one-page procedure, a classification record per product, screening before each shipment |
| Growing company | A classification matrix, automated screening, a hold process, annual training |
| Controlled-technology company | Technology control plans, deemed-export licensing, formal audits and management reporting (see deemed exports) |
For a small or medium exporter starting from nothing, the 30-day starter plan turns the first row into a sequence of tasks.
Signs your program is working
- Every product has a recorded classification with its reasoning.
- Shipments are held automatically on screening matches.
- Staff know whom to ask, and they ask.
- Audit findings are closed and do not come back.
Where ECCN.help fits
ECCN.help supports elements 3 and 4 directly. The rule-based ECCN.help Classification Workflow produces classifications with the reasoning, the rule and the regulation version recorded. The licence check applies the Country Chart, and screening runs against current OFAC lists. For organisations that need this inside their own network, see Enterprise Solutions.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.