Neither regulation mandates a written compliance programme in general terms, but both reward one. DDTC lists whether a person has instituted or improved an internal compliance programme among the mitigating factors for disclosed violations, and asks disclosures to describe compliance measures, processes and training in place (127.12(b)(3)(iv), (c)(3)). BIS's penalty guidance weighs the existence, nature and adequacy of a risk-based compliance programme measured against its Export Compliance Guidelines, whether the programme uncovered the problem, and remedial steps (Supplement No. 1 to Part 766, III.F). A programme covering management commitment, risk assessment, jurisdiction and classification, screening, recordkeeping, training, audits and handling of violations is the practical vehicle for every other leaf in this set.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.