# Export Control Program Maturity Assessment for Defense Suppliers > Source: https://netray.co/tools/export-control-program-maturity-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Ten questions that score how well your export control program covers classification, screening, licensing, training, records and oversight. ## Category compliance-legal ## Industry Aerospace & Defense ## Audience - Export compliance officer - Operations manager - Executive ## Tool **Kind:** assessment **Questions:** #### How are your products and technical data classified for export? **Help:** Jurisdiction (ITAR or EAR) and the USML category or ECCN. **Options:** ##### No formal classification **Score:** 0 ##### Some items classified from supplier or customer information **Score:** 1 ##### Most items classified by us with a written rationale **Score:** 3 ##### All items classified, reviewed on change, and stored in the item master **Score:** 4 #### How do you screen customers, suppliers and other parties? **Options:** ##### We do not screen **Score:** 0 ##### Occasional manual checks **Score:** 1 ##### Screen at order entry against consolidated lists **Score:** 3 ##### Automated screening at setup and ongoing, with documented dispositions **Score:** 4 #### How are foreign shipments and exports controlled? **Options:** ##### Logistics decides case by case **Score:** 0 ##### A written procedure exists but is not enforced in systems **Score:** 1 ##### Compliance approves foreign controlled shipments before release **Score:** 3 ##### Systems hold controlled items for foreign destinations until approved **Score:** 4 #### How do you track licenses, agreements and exemptions? **Options:** ##### We do not track them **Score:** 0 ##### A spreadsheet maintained by one person **Score:** 1 ##### A shared log with balances and expiry reviewed monthly **Score:** 3 ##### Balances decremented from shipment transactions with expiry alerts **Score:** 4 #### How do you manage foreign person access to technical data? **Options:** ##### No review **Score:** 0 ##### Reviewed informally at hiring **Score:** 1 ##### Documented review and a technology control plan for each case **Score:** 3 ##### Review, plan and system-enforced access with periodic checks **Score:** 4 #### How is IT protection of controlled technical data handled? **Options:** ##### Controlled data is on general shares and email **Score:** 0 ##### Some folders restricted **Score:** 1 ##### Defined boundary with access control, encryption and logging **Score:** 3 ##### Boundary independently assessed with evidence for NIST SP 800-171 controls **Score:** 4 #### What training do employees receive? **Options:** ##### None **Score:** 0 ##### One-time orientation **Score:** 1 ##### Annual training for all relevant roles **Score:** 3 ##### Annual role-based training with tests and tracked completion **Score:** 4 #### How are export records kept? **Options:** ##### Scattered or not retained **Score:** 0 ##### Kept by individuals **Score:** 1 ##### Central repository with the required retention period **Score:** 3 ##### Central, indexed to orders and shipments, retrievable within a day **Score:** 4 #### How do you handle suspected violations? **Options:** ##### No process **Score:** 0 ##### Raised informally with a manager **Score:** 1 ##### Written escalation process to compliance and counsel **Score:** 3 ##### Defined process including disclosure decision, root cause and corrective action **Score:** 4 #### How often is the program audited? **Options:** ##### Never **Score:** 0 ##### After an incident or customer request **Score:** 1 ##### Internal audit yearly **Score:** 3 ##### Yearly internal audit plus periodic external review with tracked actions **Score:** 4 **Bands:** #### Ad hoc: high exposure **Min:** 0 **Max:** 29 **Verdict:** Your program relies on individuals and memory. Controlled items may ship or be shared without a documented decision, which is the pattern behind most enforcement cases. **Recommendations:** - Name an empowered export compliance owner and get counsel involved this month. - Classify the products and technical data you handle, starting with items on defense programs. - Put basic party screening in place before the next shipment. - Write the foreign shipment and foreign person access procedures. #### Developing: gaps remain **Min:** 30 **Max:** 59 **Verdict:** Some controls exist but are manual or inconsistent. Gaps in classification data, license tracking or access control mean problems may go unnoticed. **Recommendations:** - Complete classification of the item master and record it in the ERP. - Move license balances from personal spreadsheets to a shared log or system. - Document technology control plans for foreign person roles. - Schedule annual role-based training. #### Established: tighten and automate **Min:** 60 **Max:** 84 **Verdict:** A functioning program is in place. The next gains come from system enforcement, evidence quality and testing of the program. **Recommendations:** - Enforce holds for controlled foreign shipments in the ERP. - Automate screening and keep dispositions on file. - Run an internal audit with a sample of shipments and access decisions. - Link IT controls to your 800-171 evidence. #### Managed: sustain and verify **Min:** 85 **Max:** 100 **Verdict:** Controls are documented, enforced and reviewed. Keep evidence current and test the program against changes in regulation, products and organization. **Recommendations:** - Commission a periodic external review for an independent view. - Track metrics such as hold releases, overdue classifications and training completion. - Review the program after each acquisition, new product or new site. ## Content **Intro:** An export control program is only as strong as its weakest control. This assessment scores ten areas that regulators and primes look at when they judge whether a defense supplier is managing ITAR and EAR obligations in practice. **Sections:** #### How to use the assessment **Body:** Answer each question for how things work today, not how the procedure says they should. If two sites differ, answer for the weaker one. The score is a percentage of the maximum, and the band you land in gives a verdict and next steps. Print the result and share it with leadership, since export compliance needs resources and an empowered owner to succeed. #### What the ten areas reflect **Body:** The questions follow the elements of the compliance program guidance published by export regulators: management commitment, risk assessment, classification, screening, licensing, training, recordkeeping, audits and handling of violations. IT protection of controlled technical data is included because storing controlled data on an unprotected system can itself cause an unauthorized release. **Bullets:** - Management commitment and an empowered owner - Classification and screening before shipment - License management and foreign person access - Records, training and audits #### Reading the result **Body:** A low score does not mean you have violated the rules, but it means you may not know. The highest value fixes are almost always the same: classify the item master, enforce holds in the ERP for foreign controlled shipments, and track license balances against shipments. Improvement in those three areas usually moves the score by a full band. #### Common mistakes **Body:** Programs fail by relying on one person, by writing procedures that systems do not enforce, and by skipping audits until a customer or regulator asks. A self-assessment also tends to be generous, so have someone outside the compliance team challenge the answers. Repeat the assessment after major changes and keep each result. **Cta:** If the weak areas in your score are about ERP data and enforcement, we can discuss a private, read-only review of how classification, holds and licenses are handled in your system. The assessment stands alone. **Faq:** #### Is this assessment a legal audit? **Answer:** No. It is a self-assessment to show where your program is strong or thin. It does not determine compliance with the ITAR or EAR. Use counsel or a qualified consultant for formal audits and for any suspected violation. #### Who should complete it? **Answer:** The export compliance owner should complete it with input from logistics, IT, HR and contracts. Answers from one person tend to miss gaps in other functions, so a short working session usually produces a more honest score. #### How often should I repeat it? **Answer:** At least once a year, and after major changes such as a new product line, an acquisition, a new site or a change in ERP. Keep the results so you can show improvement over time. #### What score should I aim for? **Answer:** Aim to move into the Established band first, then work on automation and independent verification. The right target depends on your risk: a firm shipping ITAR hardware abroad needs a stronger program than one that only machines parts for a domestic prime. ## Search terms export compliance program assessment, itar compliance self assessment, ear compliance audit checklist, export control program maturity, export compliance gap analysis, itar ear program score, export control audit readiness, defense supplier export compliance --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json