Direct answer: an export-control ICP turns nine elements—policy, responsibility, risk assessment, transaction review, response, training, audit, records and a manual—into an operating, documented and improvable company system.
China's regulators encourage exporters to build and effectively operate an ICP. Effective operation is one basis for applying for facilitation measures such as general licences, but does not guarantee approval.
The nine elements at a glance
| Element | In one line | Minimum viable action |
|---|---|---|
| 1 Policy statement | Signed by the top leader; compliance over commercial interest | One page, chairman's signature, announced to all, reaffirmed yearly |
| 2 Organisation | Three tiers: decision / management / execution | Designate a compliance owner; grant veto power in writing |
| 3 Risk assessment | Grade by item, customer, route, etc. | Yearly; product × market matrix scored high/medium/low |
| 4 Review procedures | Product → counterparty → end-use → shipping | One checklist per shipment; hard stops at key nodes; recorded |
| 5 Emergency measures | Prevent → detect → respond | A one-page plan: who stops it, who to report to, how fast to handle |
| 6 Training | By role, with re-training if a test fails | At least yearly training with a test for sales/logistics/R&D |
| 7 Compliance audit | Annual routine + ad-hoc special | One internal audit a year; log findings and close each one |
| 8 Records | Categorised, kept 5+ years | Review records, licences, statements filed and searchable |
| 9 Compliance manual | The system's "operating instructions" | A written manual, department sign-off, updated at least yearly |
Three common mistakes
- Treating the policy statement as decoration. Its point is that "compliance over commercial interest" comes from the top leader's own mouth — so that when business and compliance conflict, front-line staff have the standing to say no. Signed but not communicated is as good as unsigned.
- Review by the salesperson's "feel". Review must be a process, not a test of judgment: checklist, hard stops, records. People make mistakes; the process has to catch them.
- Records "kept but scattered". At a regulatory check or customer due diligence, "cannot produce it" and "never did it" have almost the same consequence. The standard for records: for any single export, you can pull the full review chain within a reasonable time.
A suggested order from zero
With limited resources, build in this order: first 4 (review procedures) and 1 (policy statement) — lowest cost, widest risk coverage; then 2 (organisation) and 8 (records)— give the process an owner and an evidence trail; then 3, 6, 9; and finally 5, 7to close the loop. Our self-check tool quickly locates the element you are missing most.