- Grappling With Incoherent Export Controls and the Art of Voluntary Disclosures
- October 13, 2014 | Author: Brett W. Johnson
- Law Firm: Snell & Wilmer L.L.P. - Phoenix Office
United States industries have long complained about overbearing, difficult to understand and contradictory export control regulations. Many of the complaints are substantiated due to the multiple U.S. governmental agencies involved in export (and import) controls and the constant changes related to industry requests for long-term reform or responding to unfolding events within the international community. Companies regularly use outside consultants to perform the audit. However, there are significant risks associated with such audits, even though the consultant may be a trained export professional.
The art of drafting a voluntary disclosure does not start when the alleged export control violation occurs. Rather, a good voluntary disclosure begins in the creation and maintaining of a comprehensive export control policy and program, supported by senior management. A dedicated compliance manager also is a key best practice.
A good program will ensure proper classification of a company’s products, services and technical data according to either the Commodity Control List of the Export Administration Regulations or the U.S. Munitions Lists of the International Traffic in Arms Regulations (ITAR). Many companies will have goods and services that are covered by both regulations, which is sometimes an ordeal in itself.
A good program will require products and services to be classified for import and export purposes against the Harmonized Tariff Schedule, which is maintained by the Customs and Border Protection, and the Schedule B, which is maintained by the Census Department. Finally, a company following a good program will ensure that the product is properly classified as to the regulations of other niche agencies, such as the Food and Drug Administration, the Department of Energy or the Bureau of Alcohol, Tobacco, Firearms and Explosives.
Once the products and services are classified (which may continuously change) and the company understands what controls are necessary in regard to facility tours, transfer of technical data to foreign partners, or licenses to export goods and services, a company following a good program will ensure that it is screening its vendors, customers and other stakeholders, such as consultants, sales representatives or distributors, against the various export control lists. There are several lists maintained by the U.S. Department of Commerce, U.S. Department of State and the Office of Foreign Asset Control, among others. If an individual, entity, or country is on the lists, then the company either cannot do business with the identified party or it is required to obtain a governmental license to conduct such business. In addition, if the ITAR is implicated, the third party stakeholder may need to register as a broker to be involved in the transaction.
As part of a good export control program, a company will ensure that its agreements and purchase orders include either required language as to export controls or other language to mitigate against unforeseen violations by the third-parties (or someone else within the supply chain). Unfortunately, in the rush to conclude a deal (some of which are not even that lucrative), companies allow contractual terms to be made that provide minimal to no protection as to export controls or anti-corruption, among other issues.
Once the policy and program are put into place on paper, the company should train its employees and stakeholders on the policy, the law and the ramifications for violations. These ramifications could include losing the privilege to export, extra scrutiny on export shipments, civil fines, government contract debarment, and even criminal penalties for the company and individuals involved. No business transaction is worth going to prison. Training should occur regularly. If ITAR is implicated, the empowered official should ensure additional training.
A good program will also include audits. A best practice is to conduct an internal audit every six months, along with an outside audit by a trained professional every three years. Companies regularly use outside consultants to perform the audit. However, there are significant risks associated with such audits. The primary risk is if a possible violation has occurred, the consultant is not bound by the duty of confidentiality and the attorney-client privilege is not applicable. Thus, everything the consultant may have learned (even if incorrect) can be disclosed not only to the government, but also to competitors, shareholders or other third parties during litigation. Courts have recently heavily scrutinized audits and internal investigations conducted by non-lawyers, even if the company’s in-house general counsel directed the audit or internal investigation.
Although the purpose of this article is to discuss voluntary disclosure, the fact that term is only now being referenced reflects how important preparing for a voluntary disclosure begins well before an alleged violation occurs. But, violations of export controls do regularly occur. A company can never eliminate the risk of an export control violation due to so many unknowns, including rogue employees, unscrupulous independent parties, and unwary so-called end-users that do not understand the importance of export control due diligence, let alone know how the export control regulations are actually applied.
As part of a good export control program, a company will have a game plan established as to how to deal with alleged export control violations and determining whether a voluntary disclosure is warranted. First, the facts of the alleged violation need to be established and compared against the regulations allegedly violated. Depending on the degree of risk associated with the violation, many companies retain outside counsel to conduct an internal investigation as to the allegations and make a report as to what occurred and what violations may exist. Time is of the essence as to such investigation and deciding midway through an internal investigation that an outside counsel should be leading the effort is difficult because of the possibility that witnesses (and documents) are tainted. Regardless, the facts should be gathered and analyzed quickly.
Once an alleged violated has been confirmed (which is different from whether a violation has been verified), the company should consider, with the assistance of counsel, whether or not to make a voluntarily disclosure to the government agency that has jurisdiction. Even if a violation is not verified, but the company is concerned that the government may investigate (or a future deal, such as an acquisition or merger, will be at risk), then a voluntary disclosure might be warranted. There are rare occasions not to voluntarily disclose.
The main reason that a company might wish to make a voluntary disclosure is because it is able to first establish the facts upon which any future inquiry is made. It is also able to describe the export control program that it has put in place and that the violation was a variation. Then, the company is able to explain what action it took in response to the alleged violation, including mitigating the transaction (e.g., recovering the goods, ceasing the transaction, etc.) and disciplinary action, if warranted, against the employees involved.
Another primary reason to voluntarily disclose a violation is the mitigation of any potential penalty. In some rare cases, a voluntary disclosure may actually be required by law. Most governmental agencies want to see that the violation was fixed and issue a letter not to do it again. But, some violations do warrant penalties. By voluntary disclosing, a company is more likely to get a warning or lesser penalty than the company that does not disclose. In fact, the U.S. Sentencing Guidelines and applicable governmental agency regulations specifically highlight the mitigation benefits earned due to a voluntary disclosure.
Once a company decides to make the voluntary disclosure, it must be done correctly. There is an art to voluntary disclosures. But, it is not a secret. Most governmental agencies have specific regulations that discuss how and to whom a voluntary disclosure should be made. It is possible that a voluntary disclosure will need to be made to multiple governmental agencies, not only in the United States, but also in foreign countries. For example, an export violation may be considered a breach of a government contract. Both the agency responsible for the violation and the contracting officer responsible for the breach would need to be notified - using different regulatory frameworks.
It is important to provide all the relevant facts as required by the regulations. The failure to provide adequate facts can lead the government to determine that the voluntary disclosure was inadequate (or even false) and not only eliminate any mitigation benefit, but cause additional violations. In addition, the mitigation steps discussed above should not be window-dressing. Rather, the company needs to ensure such mitigation steps actually took place. Finally, a company should retain the right to supplement the voluntary disclosure if new facts arise.
After a voluntary disclosure is submitted, the governmental agency will review the submission as to adequacy. The disclosure may be shared with other agencies to assist in the review or determine additional jurisdiction. The government may request additional information from the company or require that the company perform an outside audit by an approved third party. They may require their own investigation, which would include interviewing personnel. In a worst case scenario, the matter may be so egregious that criminal investigators serve a search warrant. A company must understand that a casual call from the government after a voluntary disclosure is not actually casual. All contact should be coordinated through one company representative and any information provided can and will be used against (or for) the company in the future. All of these scenarios should be discussed before the voluntary disclosure is submitted, regardless of how remote. This discussion is important to ensure a game-plan is in place as to how to respond to future governmental action.
As referenced above, the voluntary disclosure may result in just a warning letter, with the caveat that the government can use the incident against the company in the future if another violation occurs. But, the company may face administrative or judicial proceedings (civil or criminal). The voluntary disclosure (or lack of one) could be used during these proceedings to either assist or hinder the company. If the voluntary disclosure is well written, factually inclusive and accurate, and meets the regulatory requirements, it can be used as a shield during such proceedings and shape the entire proceedings. A poorly written voluntarily disclosure will have the opposite effect and would be considered an admission against the company during the proceedings. Again, if penalties are considered, a well-written voluntary disclosure will help in mitigation.
Some large companies routinely make voluntary disclosures to the government. However, most companies will not have such experiences. A voluntary disclosure should not be taken lightly and it may be a “bet the business” endeavor because the company’s inability to export or bid on government contract opportunities would be a death sentence. A person who dabbles in art is not likely to paint museum worthy masterpieces. The same principal applies to drafting, submitting, and addressing the long-term impact of voluntary disclosures. Companies should prepare well in advance for a possible violation. When necessary, a company should consider seeking outside assistance in trying to grapple with the myriad government regulations related to international trade in general and the need to submit a voluntary disclosure when necessary.