ITAR Compliance Advisory
Duty to Disclose/Report ITAR Infractions by Consultants/Auditors outside Attorney-Client Relationship
The duty to disclose/report requirement applies to violations that involve so-called “denied countries” or ITAR embargoed countries. Pursuant to Section 126.1 of the ITAR, U.S. persons and persons acting on behalf of U.S. persons (wherever located) are prohibited from exporting or importing defense articles or related technical data, or providing defense services, to/from certain countries or to any person acting on behalf of such countries. Even proposed sales are prohibited without first obtaining a license or approval. The regulations go on to provide that “[a]ny person that knows or has reason to know of such a proposed or actual sale, or transfer of such articles, services or data must immediately inform the Directorate of Defense Trade Controls.”
A fairly lengthy list of countries subject to this policy of denial / embargo is included in the regulations. The list is subject to periodic change. Of particular note is the inclusion of China on the list, given the large amount of trade between the U.S. and China. This is one of the reasons it is critically important that companies understand when they are involved in ITAR controlled work.
As noted above, the language requires that any person that knows (or has reason to know – a subject beyond the scope of this communication) of a proposed or actual sale or transfer involving one of the listed countries immediately notify the DDTC. Accordingly, if an auditor discovers such a proposed or actual sale involving a denied / embargoed country, he/she is required to report the finding to the DDTC. Very importantly, however, the attorney-client privilege trumps this rule. That is, an attorney engaged by a company to perform an audit is not required to disclose such a finding to the DDTC. By extension, a non-legal auditor that has been engaged by an attorney to perform the audit on the attorney’s behalf is not required to disclose, subject to strict rules regarding the manner in which the engagement is established and carried out. Put another way, a non-lawyer auditor that is engaged in an audit and discovers a violation of Section 126.1 must report the violation to the DDTC, unless the auditor was working properly under the direction of an attorney.
When our exclusive legal resource engages in audits directly with companies, they are free from the 126.1 reporting obligation by virtue of the attorney-client privilege. Their obligation is to advise the company of its own mandatory reporting obligation. That is when they provide advice on the manner in which the company should make the disclosure so as to minimize the damage and not engage in further violations of law (including avoiding making false statements, and framing the disclosure in such a way as to minimize penalties (including developing effective remedial measures).
