The State Department’s Office of Defense Trade Controls Compliance has relaunched its Company Visit Program, which is designed to allow DTCC to better understand defense trade control and compliance programs and assess and disseminate industry best practices.
The CVP entails visits by Directorate of Defense Trade Controls officials (and occasionally representatives of other State Department or other federal entities) to U.S. entities registered as manufacturers, exporters or brokers of defense articles and defense services as well as others involved in activities regulated by the International Traffic in Arms Regulations, including foreign companies and foreign governments. DTCC considers a variety of factors when selecting companies to visit, including proximity to other activities DDTC is participating in, registration status, volume of licensed activity, perceived effectiveness of compliance program, experience conducting ITAR activities, nature of business, type and sensitivity of technology, geographic location, monitoring of an existing consent agreement, and value to ongoing DDTC work. Companies selected for a potential CVP visit may elect not to participate. DDTC generally aims to conduct between two and four CVP visits per quarter.
There are two types of CVP visits: CVP-Outreach and CVP-Compliance. CVP-O visits are designed to help DTCC understand how companies implement ITAR compliance requirements and provide an opportunity to discuss challenges (such as adapting to changes associated with export control reform) and offer suggestions or best practices; they are not intended to evaluate compliance failures or violations. CVP-C visits are designed for DTCC oversight activities (e.g., as part of consent agreement monitoring) and may include a more in-depth look at a company’s compliance program.
DDTC states that neither CVP-O nor CVP-C visits are an audit or an inspection. Visits do not produce a grade or pass/fail assessment for internal or external use and generally do not include review of transactional records, though companies are requested to provide an overview of their ITAR activities and compliance programs. Visits generally last one to two days, depending on the purpose, and occur on the company's premises and through tours of business operations within the facility (e.g., business development, contracts, procurement, design, manufacture, security, IT, personnel and shipping).
Following a CVP visit DDTC will send a close-out letter that summarizes the visit, indicates strong compliance practices, recommends areas for improvement or suggests best practices, and addresses feedback, questions or concerns raised by the company. If DDTC discovers or learns of a violation during a CVP visit it will recommend that the company review the issue and submit a disclosure if appropriate.