Start with registration and jurisdiction
The first lines of any useful checklist ask whether the company is registered with the State Department's Directorate of Defense Trade Controls when its activities require it, and whether the registration reflects current ownership and locations. Next comes jurisdiction: which products, parts, software, and technical data are on the U.S. Munitions List, which fall under the Commerce Department's export rules instead, and who made each call. A classification that was never documented, or that rests on a guess by sales staff, is one of the most common gaps. If a determination is genuinely uncertain, the checklist should note it rather than pick an answer. Formal jurisdiction requests to the government exist for exactly those cases.
Follow the technical data, not just the shipments
Many companies audit their physical exports carefully and overlook how controlled drawings and specifications move inside the business. A good audit checklist asks where technical data is stored, whether cloud and email systems allow access from abroad, and which foreign person employees, interns, or contractors can open restricted folders. It compares each license, technical assistance agreement, and manufacturing license agreement against what the team actually did, including visits, training, and meetings with foreign customers. It also checks that required records exist and can be found. Brokering activity, offshore repair work, and parts sent to foreign subsidiaries deserve their own lines, since they are easy to miss.
Turning findings into decisions
A checklist produces a list of issues, and the harder work is deciding what each one means. Some gaps are paperwork that can be corrected internally; others may be violations that call for a decision about voluntary disclosure to DDTC. Because those conversations can be sensitive, companies often run the audit at counsel's direction so the analysis is protected to the extent the law allows. When we review a checklist with you, we agree on scope, identify who should be interviewed, and set a plan for handling a serious problem if one appears mid-review. We also help rank fixes by risk, so your team spends its time where exposure is greatest.
