Empowered Official on Paper vs. Real Compliance Culture

There is a moment I see repeatedly in ITAR compliance engagements. A company has done everything the regulations visibly require: they've registered with the Directorate of Defense Trade Controls (DDTC), they've designated an Empowered Official (EO), and that person's name sits proudly in the company's export management and compliance program (EMCP) binder. On paper, the box is checked.

Then something goes wrong — a shipment leaves without the right authorization, a foreign national employee accesses controlled technical data, or a license condition is quietly overlooked — and suddenly the company discovers that a name on a form is not the same as a functioning compliance culture.

This distinction is not semantic. It is the difference between a company that survives a DDTC enforcement inquiry and one that faces civil penalties reaching $1,386,166 per violation under 22 U.S.C. § 2778(e), or criminal penalties of up to $1,000,000 and 20 years imprisonment per violation under the Arms Export Control Act (AECA). Understanding why paper compliance fails — and what genuine compliance culture looks like — is one of the most valuable things any defense contractor, aerospace manufacturer, or dual-use exporter can do.

What the Regulations Actually Require of an Empowered Official

Under 22 C.F.R. § 120.76, an Empowered Official must be a U.S. person who is directly employed by the registrant, is legally empowered to sign export license applications, and who understands the penalties for ITAR violations. The regulations further require that the EO have independent authority to inquire into any aspect of a proposed export or temporary import and refuse to sign export authorizations if they have reason to believe a violation would occur.

That last piece — independent authority to refuse — is frequently cited in regulatory guidance but rarely operationalized in practice. It is not enough that someone technically holds the title. The regulations envision an official who can, without fear of internal reprisal, halt a transaction, escalate a concern, or request a compliance review even when it delays a shipment, frustrates a customer, or costs the company money.

The regulatory standard for an Empowered Official is behavioral, not merely positional. DDTC has made clear through enforcement actions and published guidance that it evaluates the effectiveness of compliance programs, not just their existence.

The Paper Compliance Trap: How It Happens

Paper compliance is rarely the product of bad intentions. Most companies that fall into it started with good ones. The pattern typically unfolds in three stages:

Stage 1: Designation Without Integration

A company registers with DDTC and appoints a compliance officer or legal counsel as EO. That person receives the title and is listed in the EMCP. However, they are not integrated into the operational workflow. Purchase orders, shipping requests, technology transfer decisions, and foreign visitor approvals all flow through other channels. The EO finds out about potential compliance touchpoints after the fact — if at all.

Stage 2: Authority Without Resources

Even where the EO is aware of their role, they often lack the resources to execute it. No dedicated budget for training. No license tracking system. No mechanism for employees to flag concerns confidentially. In many small-to-mid-sized defense suppliers, the EO role is a collateral duty — stacked on top of a full-time job in legal, HR, or operations. The DDTC's 2023 administrative debarment statistics show that resource-deficient compliance programs are a common thread across enforcement cases.

Stage 3: Culture of Compliance Theater

Over time, the compliance function becomes performative. Training is delivered once a year as a checkbox. Audits are scheduled and "prepared for" rather than treated as honest assessments. Employees learn that raising compliance concerns creates friction, not protection. The EO signs export authorizations because they are in the queue — not because they have independently verified the transaction. At this stage, the company has a compliance program in form but not in substance.

What Real ITAR Compliance Culture Looks Like

A genuine compliance culture is observable, measurable, and — critically — resistant to business pressure. Here are the defining characteristics that distinguish it from paper compliance.

1. The EO Has Real Authority and Uses It

In companies with true compliance cultures, the Empowered Official has documented authority to halt transactions and has exercised it. There are records of the EO raising concerns, requesting additional information, and delaying authorizations pending clarification. These aren't signs of dysfunction — they are evidence that the compliance function is working. If an EO has never once delayed or questioned a transaction, that is a red flag, not a success metric.

2. Compliance Is Embedded in Business Processes

Export control reviews are not a separate lane that transactions enter after decisions are made. They are embedded in the decision-making workflow from the beginning. New customer onboarding includes a denied party screening step. Product development reviews include a USML/CCL classification discussion. Hiring decisions for roles involving controlled technical data include foreign national review protocols. When compliance is upstream of the decision, it shapes the decision. When it is downstream, it only delays it.

3. Employees Know What to Do and Aren't Afraid to Do It

According to KPMG's 2023 Global Integrity Report, 49% of employees reported feeling pressure to compromise ethics or compliance standards to meet business objectives. In the defense and aerospace sector, that pressure often manifests as urgency — a customer needs a part shipped, a deadline is looming, a key contract is at risk. A compliance culture trains employees not just on what the rules are, but on how to navigate pressure situations — and provides an anonymous reporting mechanism for when they can't.

4. Leadership Tone Is Demonstrated, Not Declared

Leadership's commitment to compliance is measured not by what they say in an all-hands meeting, but by what they do when compliance creates cost or inconvenience. Does the CEO support the EO when they push back on a business decision? Does the board receive compliance metrics as a standing agenda item? Research from the Ethics & Compliance Initiative (ECI) consistently shows that organizations where senior leaders model ethical behavior have significantly lower rates of observed misconduct — typically 50–70% lower than organizations where that modeling is absent.

5. The EMCP Is a Living Document

A compliance program that was written three years ago and hasn't been updated is not a compliance program — it is a historical artifact. Regulations change. The USML underwent a major overhaul with the Export Control Reform (ECR) initiative. DDTC interpretive guidance evolves. New foreign national employees join. Licensing portfolios expand. A living EMCP reflects these changes, assigns ownership for maintaining each section, and has a documented review cadence — at minimum annually, and following any material change in the company's business or the regulatory landscape.

The Gap Between Designation and Culture: A Diagnostic Framework

The table below summarizes the key observable differences between a paper compliance program and a genuine compliance culture. Use it as a self-assessment tool.

Why DDTC Looks Beyond the Org Chart

The DDTC's enforcement posture has evolved significantly over the past decade. Enforcement actions increasingly reference the quality of a company's compliance culture as a mitigating or aggravating factor in penalty determinations. The DDTC Compliance Guidelines (2023 revision) explicitly state that a company's compliance culture — including tone from the top, resource allocation, and voluntary disclosure history — is weighed in determining penalties and whether debarment is appropriate.

This isn't abstract. In several publicly available Consent Agreements, DDTC has required companies to hire external compliance auditors, establish compliance committees with board-level reporting, and implement compliance training programs — all remedies directed at culture, not just the paperwork deficit.

A consent agreement is, in practical terms, a court-ordered compliance culture intervention. The goal of every defense contractor should be to build that culture voluntarily before enforcement makes it mandatory.

The Empowered Official's Role in Culture-Building

The EO should not be a lone compliance officer trying to hold back the tide. In companies where the compliance culture is strong, the EO functions more like a compliance architect — designing systems, training staff, escalating risks, and building the infrastructure that makes individual employees capable of making correct decisions without being asked.

Specifically, a high-performing EO:

• Conducts or commissions regular internal audits against the EMCP and license conditions
• Maintains a licensing portfolio tracker with expiration dates, conditions, and usage metrics
• Leads or coordinates role-specific compliance training — not just the annual all-hands slide deck
• Develops and maintains a Technology Control Plan (TCP) for any facility where controlled technical data is accessed
• Establishes a voluntary self-disclosure (VSD) protocol so that when incidents occur, they are handled proactively rather than reactively
• Reports directly to senior leadership and/or the board on compliance status, risks, and metrics

This is not a part-time role. For any company with a meaningful ITAR footprint — active licenses, foreign national employees, international customers, or classified or controlled manufacturing processes — the EO function requires dedicated time, resources, and organizational authority.

A Common Misconception: "We've Never Had a Problem"

One of the most dangerous sentences in export compliance is "We've never had a problem." It is usually said by a company that hasn't looked hard enough — not by a company that genuinely has none.

Over my eight-plus years serving 200+ clients across the defense, aerospace, medical device, and dual-use technology sectors at Certify Consulting, I have yet to encounter a first-time client who had zero compliance gaps upon initial assessment. What I have found is that companies with genuine compliance cultures find and fix gaps before they become violations. Companies with paper compliance find them after DDTC does.

The DDTC received over 1,100 voluntary self-disclosures in a recent reporting period, a figure that reflects both the prevalence of compliance gaps and the benefit of proactive self-reporting — DDTC's guidelines indicate that VSDs can significantly reduce penalty amounts and likelihood of formal enforcement action.

How to Move From Paper to Culture: Practical Steps

If you recognize your organization in the "paper compliance" column of the diagnostic table above, the path forward is structured and achievable. It does not require a complete organizational overhaul. It requires honest assessment, leadership commitment, and deliberate action in the following sequence:

1. Conduct a gap assessment against your current EMCP and 22 C.F.R. Part 120–130 requirements. Identify the delta between what your program documents say and what employees actually do.
2. Clarify and document the EO's authority in writing — including explicit authority to halt transactions and escalate to senior leadership without prior approval.
3. Embed compliance checkpoints into existing workflows — sales, procurement, engineering, HR — so that export control decisions are made in real time, not after the fact.
4. Invest in role-specific training that goes beyond regulatory overview and addresses the actual decisions employees make in their roles.
5. Implement or upgrade denied party screening to an automated solution integrated with your CRM, ERP, or procurement system.
6. Establish a voluntary self-disclosure protocol and communicate it company-wide so that employees know how to escalate potential violations without fear of retaliation.
7. Schedule a third-party compliance audit to get an objective view of your program's effectiveness — not just its documentation.

For organizations that need to build this infrastructure from scratch or close critical gaps quickly, working with an experienced ITAR compliance consultant can compress the timeline significantly and ensure the program is built to withstand regulatory scrutiny.

The Bottom Line

An Empowered Official on paper is a regulatory checkbox. An Empowered Official in practice — backed by real authority, embedded in business workflows, and supported by a leadership team that treats compliance as a core business function — is a compliance culture.

The AECA and ITAR don't just require you to have a compliance program. They require you to have one that works. The distinction matters not only for regulatory survival, but for the integrity of the U.S. defense industrial base that these regulations are designed to protect.

If you're uncertain whether your EO designation reflects genuine compliance infrastructure or just the appearance of it, that uncertainty is itself an answer — and it's worth addressing before DDTC provides one for you.

Jared Clark, JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, RAC, is Principal Consultant at Certify Consulting, where he has helped 200+ defense contractors, aerospace manufacturers, and dual-use exporters build compliant, audit-ready programs with a 100% first-time audit pass rate. To assess your current compliance posture, visit itarconsultant.us.

Last updated: 2026-04-06