The Nine Elements of an ICP: from “Words on a Wall” to “Gates in a Process”
Direct answer: an export-control ICP turns nine elements—policy, responsibility, risk assessment, transaction review, response, training, audit, records and a manual—into an operating, documented and improvable company system.
China's regulators encourage exporters to build and effectively operate an ICP. Effective operation is one basis for applying for facilitation measures such as general licences, but does not guarantee approval.
The nine elements at a glance
| Element | In one line | Minimum viable action |
|---|---|---|
| 1 Policy statement | Signed by the top leader; compliance over commercial interest | One page, chairman's signature, announced to all, reaffirmed yearly |
| 2 Organisation | Three tiers: decision / management / execution | Designate a compliance owner; grant veto power in writing |
| 3 Risk assessment | Grade by item, customer, route, etc. | Yearly; product × market matrix scored high/medium/low |
| 4 Review procedures | Product → counterparty → end-use → shipping | One checklist per shipment; hard stops at key nodes; recorded |
| 5 Emergency measures | Prevent → detect → respond | A one-page plan: who stops it, who to report to, how fast to handle |
| 6 Training | By role, with re-training if a test fails | At least yearly training with a test for sales/logistics/R&D |
| 7 Compliance audit | Annual routine + ad-hoc special | One internal audit a year; log findings and close each one |
| 8 Records | Categorised, kept 5+ years | Review records, licences, statements filed and searchable |
| 9 Compliance manual | The system's "operating instructions" | A written manual, department sign-off, updated at least yearly |
Three common mistakes
- Treating the policy statement as decoration. Its point is that "compliance over commercial interest" comes from the top leader's own mouth — so that when business and compliance conflict, front-line staff have the standing to say no. Signed but not communicated is as good as unsigned.
- Review by the salesperson's "feel". Review must be a process, not a test of judgment: checklist, hard stops, records. People make mistakes; the process has to catch them.
- Records "kept but scattered". At a regulatory check or customer due diligence, "cannot produce it" and "never did it" have almost the same consequence. The standard for records: for any single export, you can pull the full review chain within a reasonable time.
A suggested order from zero
With limited resources, build in this order: first 4 (review procedures) and 1 (policy statement) — lowest cost, widest risk coverage; then 2 (organisation) and 8 (records)— give the process an owner and an evidence trail; then 3, 6, 9; and finally 5, 7to close the loop. Our self-check tool quickly locates the element you are missing most.
Frequently asked questions
What does ICP mean here?
ICP means an export-control Internal Compliance Program: a documented system covering policy, responsibility, risk assessment, transaction review, emergency response, training, audit, records and the compliance manual.
Does a small company need all nine elements?
Controls should be proportionate to product, customer, destination and transaction risk. A small company can begin with a signed policy, one review checklist, a named owner with stop authority and central records, but should not omit critical controls entirely.
Does an ICP automatically qualify a company for a general licence?
No. A well-designed and effectively operated ICP is an important basis for facilitation, but any licence or facilitation measure remains subject to the competent authority's legal review and approval.
- MOFCOM Announcement No. 10 of 2021 and the attached Guidelines on Internal Compliance for Dual-Use Item Export Control
- MOFCOM dual-use export licence application guide: questions and answers on the nine ICP elements
- Theory and Practice of Export Control Compliance, Chinese Academy of International Trade and Economic Cooperation · Investment Security Institute, 2024
This article is general compliance information and does not constitute legal advice; regulations are governed by the current official text.
Not sure where your company stands? 3-minute self-check → Have a specific question? Contact us →