In settling administrative cases, OEE takes account of the existence, nature and adequacy of the respondent's risk-based BIS compliance programme at the time of the apparent violation, measured against BIS's Export Compliance Guidelines, whether the programme uncovered the problem and prevented further violations, and what was done in response (voluntary self-disclosure, preventive steps); a firm's deliberate failure to disclose a significant apparent violation its programme found is aggravating. The Guidelines' eight elements are: management commitment (a signed management commitment statement re-issued annually and acknowledged by staff and communicated to contractors, adequate resources and authority); risk assessment (item, operations and customer risks such as unlicensed exports, unauthorised technology release and deemed exports, servicing items abroad, weak structure, poor forwarder relationships, weak clearance procedures, unknown end users and end uses, diversion through transshipment hubs and antiboycott exposure); export authorisation (jurisdiction, classification, licence determination and screening of all parties, with hold and release authority for questionable transactions); recordkeeping (Part 762 with assigned roles, retrieval, technology control plans and visitor records); training (tiered by role, with accountability); audits (functional and annual programme-level audits, external audits, tracked corrective actions, reports kept five years); handling violations and corrective action (early detection, internal and external reporting, senior management support); and building and maintaining the compliance manual.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.