13 September 2007
PROPOSED CHECKLIST FOR THE AUDIT OF INTERNAL COMPLIANCE PROGRAMMES 1. It is good practice to carry out a regular audit to ensure that standards in Non- Proliferation control compliance are maintained. For businesses without a central auditing function the following checklist of points may be helpful. It is recommended that management evaluate their ICP at least once every year. 2. Personnel (a) Are records of your personnel involved in controlled and activities and or controlled goods, up to date? (b) Has your security section vetted them? (c) Have all employees who have taken on control responsibilities received the necessary induction training or retraining? (d) Does the Performance Agreements of these personnel include their control responsibilities as derived from your ICP? 3. Documents Available. Does the staff have access to: (e) Your up-to-date ICP; (f) An up-to-date version of the NPC Act, Regulations and Notices; (g) Guidance notes/contact details; (h) This Guideline for an ICP; and (i) NPC website. 4. Business Are the details of your business in relation to your original registration details at the NPC up to date? 5. Product / Permit Does your business have a workable product/service/country/permit matrix? Is it up to date? Were your business’ product and or activity range recently checked against South Africa’s Non-Proliferation legislation or other relevant legislation? 6. Customer Information (a) Is the necessary information relating to your business’ customers reaching those responsible for permit processing within your business, for example do they have access to information to answer end-use and end-user enquiries? South African Non-Proliferation of Weapons of Mass Destruction Guidelines: Industry Internal Compliance Programme. 60 of 80 (b) Does your business alert your customers at an early stage of the need for end-use information (e.g. on quotation documents)? (c) Is credit control information on customers' status being fed through for export control checks? 7. Permit Processing (a) Are NPC permits held by your business to trade in controlled goods and activities still valid? If not, has the NPC been notified and the permit re-issued or amended? (b) Has the particulars relating to your controlled activity or goods contained in the NPC permit changed? If so, has the NPC been notified and the permit reissued or amended? (c) Has any information about your business appearing on an NPC permit changed? If so, has the NPC been notified and the permit re-issued or amended? (d) Are end-use undertakings valid? (e) Have all your business’ sub-contractors, handling controlled goods and activities, been registered with the NPC and where relevant any other appropriate control authority? (f) If open NPC permits are used, has your business kept proper record of all exports and/or imports of controlled goods and has the NPC been notified, as required by the permit? 8. Transferring/Exporting (a) Are your business’ instructions to your despatch department and/ or freight forwarder / agent / transporters up to date? (b) Are your business’ instructions being adhered to (e.g. does your freight forwarder / clearing agent / transporters return copies of export documentation within reasonable time)? If there are non-compliance on the part the abovementioned entities, does your business revise or restate your requirements and set a date to check on improvement. If this non-compliance persists does your business report the entities to the NPS. 9. Record Keeping (a) In selecting two or three cases at random, are the records (required to be kept under the permits) accessible? (b) Are all related documents filed together or accessible through common filing fields? (c) Are proper records of all imported controlled goods and activities, subject to end-user control by a foreign supplier or its Government, being kept? This South African Non-Proliferation of Weapons of Mass Destruction Guidelines: Industry Internal Compliance Programme. 61 of 80 includes end-user requirements by the RSA control authority. 10. Visits to your business or contacts by persons outside your business, in relation to controlled activities and goods (a) Do you have a policy and process in place to monitor visits to your business that has relevance to controlled goods and activities? (b) Do you have a policy and process in place to monitor training at your business that has relevance to controlled goods and activities? If necessary, do you vet persons/companies receiving training on your site(s)? (c) Do you keep records of visitors (foreign and local) to your business’ site(s) where controlled activities take place or where controlled goods are manufactured or kept? (d) Although not required by law, would you consider communicating sensitive visits to the NPS? (e) Although not required by law, would you consider communicating to the NPS particulars of foreign citizens undergoing training that has relevance to controlled goods and activities at your business? 11. Visits by your employees abroad (a) Do you keep record of each visit abroad by employees of your business that has relevance to controlled goods and activities? (b) Do they have authority from your business to visit customers abroad? (c) Do they receive authority as to what they may discuss or market abroad? (d) Do you keep record of any controlled goods, technology (tangible or intangible) and activities that is taken abroad or rendered during a visit? (e) If controlled, do you have the necessary authority from the NPC? 12. Resolution of Problems (a) If aspects of procedures have been found unsatisfactory in the course of this check, or if problems have been encountered in the operating procedures, is there a plan in your business for improvements? Have the necessary revisions or amendments been made known to the relevant personnel? (b) Have the necessary revisions or amendments been made known to the NPS and or other relevant control authority?
CAclubindia
