Compliance & ContractsFree assessmentPDF, Excel, Word exportAerospace & Defense

Export Control Program Maturity Assessment for Defense Suppliers

An export control program is only as strong as its weakest control. This assessment scores ten areas that regulators and primes look at when they judge whether a defense supplier is managing ITAR and EAR obligations in practice.

0 of 10 answered0%

1. How are your products and technical data classified for export?

Jurisdiction (ITAR or EAR) and the USML category or ECCN.

2. How do you screen customers, suppliers and other parties?

3. How are foreign shipments and exports controlled?

4. How do you track licenses, agreements and exemptions?

5. How do you manage foreign person access to technical data?

6. How is IT protection of controlled technical data handled?

7. What training do employees receive?

8. How are export records kept?

9. How do you handle suspected violations?

10. How often is the program audited?

How to use the assessment

Answer each question for how things work today, not how the procedure says they should. If two sites differ, answer for the weaker one. The score is a percentage of the maximum, and the band you land in gives a verdict and next steps. Print the result and share it with leadership, since export compliance needs resources and an empowered owner to succeed.

What the ten areas reflect

The questions follow the elements of the compliance program guidance published by export regulators: management commitment, risk assessment, classification, screening, licensing, training, recordkeeping, audits and handling of violations. IT protection of controlled technical data is included because storing controlled data on an unprotected system can itself cause an unauthorized release.

Management commitment and an empowered owner
Classification and screening before shipment
License management and foreign person access
Records, training and audits

Reading the result

A low score does not mean you have violated the rules, but it means you may not know. The highest value fixes are almost always the same: classify the item master, enforce holds in the ERP for foreign controlled shipments, and track license balances against shipments. Improvement in those three areas usually moves the score by a full band.

Common mistakes

Programs fail by relying on one person, by writing procedures that systems do not enforce, and by skipping audits until a customer or regulator asks. A self-assessment also tends to be generous, so have someone outside the compliance team challenge the answers. Repeat the assessment after major changes and keep each result.

Frequently Asked Questions

Is this assessment a legal audit?

No. It is a self-assessment to show where your program is strong or thin. It does not determine compliance with the ITAR or EAR. Use counsel or a qualified consultant for formal audits and for any suspected violation.

Who should complete it?

The export compliance owner should complete it with input from logistics, IT, HR and contracts. Answers from one person tend to miss gaps in other functions, so a short working session usually produces a more honest score.

How often should I repeat it?

At least once a year, and after major changes such as a new product line, an acquisition, a new site or a change in ERP. Keep the results so you can show improvement over time.

What score should I aim for?

Aim to move into the Established band first, then work on automation and independent verification. The right target depends on your risk: a firm shipping ITAR hardware abroad needs a stronger program than one that only machines parts for a domestic prime.

If the weak areas in your score are about ERP data and enforcement, we can discuss a private, read-only review of how classification, holds and licenses are handled in your system. The assessment stands alone.

Talk to an Expert Explore More Free Tools

Related Tools

Aerospace & Defense

More Compliance & Contracts tools

See all

Back to All Tools