Today, in the third article in the hands-on practical advice series on Internal Compliance Programs for Export Control:
Part 3: How to choose an external consultant for the ICP process
If you are struggling with compliance and have unanswered compliance questions, if your export department is understaffed, if time is missing to approach the drafting of a company's ICP, you may want to engage an external consultant. The process of selecting a compliance consultant should not be taken lightly, as your choice may have a significant impact on your business both financially, and operationally. Here are a few things to think about when going through this process.
Verify if the consultants have the necessary experience and qualifications to help you and your company.
The consultants should have many years of highly relevant experience in export control compliance. If he (she) is a lawyer, ask him (her) what type of companies he has already assisted in setting up an ICP. If he (she) has an industry qualification, ask him (her) about publications or interpretations of legal texts. A good consultant should have both: excellent legal skills, and understanding of corporate issues acquired through relevant work in industry or by assisting industrial companies.
Test the consultants’ knowledge.
Ask them questions about export compliance. An excellent one: "What is catch-all for dual-use”? The consultant should be able to answer all your questions (also that one) in a way that you understand it clearly. A No-Go: using only legal language. Required: a structured reply, with a clear statement at the end, and ready to be taken forward in your compliance work, without any further need for clarification.
Check if the consultant keeps up-to-date with regulations.
Good consultants advise and train clients all day long. They provide clients or general public with newsletters and speak on conferences. They attend external seminars. Every day, they review all new rules and regulations in the field of export control.
To check if they are up-to-date, ask a recent export control compliance question. For example, about the goods for which the EU is in the course of adopting export limitations in relation to Hong Kong. The reply should be concise and clear: “Sensitive equipment and technologies for end-use in Hong Kong, in particular where there are grounds to suspect undesirable use relating to internal repression, the interception of internal communications or cyber-surveillance. This on the basis of the EU Council conclusions of 24 July 2020, but not yet integrated into binding EU decisions or regulations.”
Ask for references.
Consultants are normally not releasing clients’ name without their prior consent. But appropriate references or client testimonials may be given. Ask licensing authorities in your country if they know the consultants who you want to engage. Google the consultants’ name and see if search results (should be top ranked) are related to their specific experience in export control compliance. Refrain from engaging consultants who offer compliance services, but in other fields (like finance, where there are a lot of them around).
Be sure that the consultants offer all services required for an ICP.
Convenient consultants have provided and are offering services related to product classification, customer due diligence and screening, risk assessment, training, audit, transaction structuring, license management, record-keeping, IT and physical security. All these points have their place in an Internal Compliance Program and your consultants should be perfectly knowledgeable therein. A consultant working in a small consultancy practice can do the job as well as a big firm, what is important is that they are reliable and able to help you in the complex ICP process. Ask them also if they offer ongoing services after the ICP has been adopted and validated, and on what basis. Good compliance guys should be around all day long and able to react fast.
Understand the consultants’ approach to the ICP process.
Good consultants should be able to explain in a few words how they will structure the work with your company (working closely through workshops is recommended) and the exact timeline until completion. If they do not insist on a team work, never want to visit your premises and do not ask for your regular input, pay attention. Avoid consultants who want to sell you a ready-made ICP manual (their value is not worth the paper on which it is written).
Confirm an engagement only on the basis of written quote
All services should be described in detail, with a clear price calculation (per hour, per day, per ICP chapter, per whole ICP) with a possibility to stop the engagement underway in case you are not satisfied. Ask when and how document ownership will be transferred.
Three last points:
Number 1: Even if you hire a consultant, remember that your company shall not cease to stay responsible for its own compliance.
Number 2: Good consultants are worth the price they are asking. Put the price in relation to your risk level and possible fines or loss of reputation in case of non-compliance.
Number 3: Put consultants into competition. Do not engage consultants who do not respond to the criteria above. Engage only the best ones.