BIS strongly encourages voluntary self-disclosure to OEE of possible EAR violations: it is a mitigating factor, while a firm's deliberate decision not to disclose a significant apparent violation is an aggravating factor. A VSD counts only if made with senior management's full knowledge and authorisation and received before the government learns the information elsewhere. Minor or technical violations (no aggravating factors, e.g. immaterial EEI errors) go in an abbreviated narrative by email, which may be bundled quarterly; significant violations need an initial notification as soon as possible, a thorough review (BIS recommends five years back) and a full narrative within 180 days (extensions only if requested before the deadline) describing the violations, when and how they occurred, all parties, licence numbers, item details and mitigating circumstances and remedial measures, with supporting documents and a signed certification of truth. OEE resolves minor VSDs within about 60 days (no action or warning letter) and may, for significant ones, take no action, warn, propose or issue charges, or refer for prosecution. Disclosers may request permission to deal further with unlawfully exported items; AES errors are corrected with Census after notification.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.