Companies that export dual-use goods sooner or later come across the term Internal Compliance Programme (ICP) — often in the small print of a licence application. For some licences, an ICP is a hard requirement. Even without that obligation, it is one of the most effective ways to manage export control risks structurally.
What is an Internal Compliance Programme?
An ICP is an internal policy and control system that enables an organisation to demonstrably stay in control of its export control obligations. It goes further than a written policy document: an ICP covers the actual processes, responsibilities and controls applied to every transaction that may fall under export control.
A full ICP usually includes:
- Management commitment — a designated person responsible and visible involvement of senior management in export control.
- Classification processes — a structured way of assessing whether products, software or technology are dual-use or otherwise require a licence.
- Screening procedures — for customers, end users, destinations and transactions, including attention to the catch-all clause.
- Internal approval procedures — clear escalation points when a transaction carries an elevated risk.
- Training — so that staff in sales, logistics and purchasing recognise red flags.
- Documentation and record keeping — an auditable trail of decisions taken.
- Internal audits — periodic checks on whether the programme is actually applied in practice.
When is an ICP mandatory?
For certain types of licence under the EU Dual-Use Regulation, such as a Union General Export Authorisation (UGEA), a demonstrably effective ICP is a formal condition. Without an ICP, a company is not eligible for this type of licence and must submit a separate, more time-consuming licence application for each individual export.
Even where an ICP is not formally required, the competent authority may take the existence and quality of internal controls into account when assessing licence applications and in any enforcement.
Why an ICP is valuable even without an obligation
Apart from the formal licensing condition, an ICP offers practical benefits:
- Faster and more consistent assessment of new customers and transactions, instead of ad-hoc decisions.
- Demonstrable due care towards banks, regulators and customers — relevant now that enforcement through administrative law is becoming faster and more direct.
- Less dependence on individual knowledge within the organisation, because the process is documented rather than living in the heads of a few employees.
Example from practice
An exporter of industrial electronics wants to use a general export authorisation to avoid repeated, time-consuming individual applications. During the application, a demonstrably effective ICP turns out to be a requirement. Without documented classification, screening and approval processes, the organisation still has to apply for a licence separately for each shipment — with the associated delays for commercial planning.
Frequently asked questions
Is an ICP only relevant for large exporters?
No. Smaller companies that export licensable goods can also benefit from an ICP, scaled to the size and complexity of the organisation.
How long does it take to set up an ICP?
That depends on the existing internal processes. An organisation with some form of customer acceptance and screening usually has a shorter run-up than a company that has not yet organised export control in a structured way.
Does an ICP need to be externally certified?
Certification is not always required, but the competent authority may test, during a licence application or inspection, whether the programme actually works, for example on the basis of documentation and internal audits.
TradeRisk helps companies set up an Internal Compliance Programme within Compliance Frameworks. Also read more about when you need an export licence and what the catch-all clause involves.