When the Commerce Department's Office of Inspector General (OIG) finds that regulators verify less than 1% of controlled exports to China and Hong Kong, you can expect two things: agencies will tighten oversight, and companies with weak compliance programs will face preventable consequences.
The OIG's recent audit of the Bureau of Industry and Security (BIS) didn't just identify gaps in government monitoring. It set in motion a chain reaction: recommendations for stronger quality-control mechanisms, supervisory reporting requirements, and accountability metrics. These recommendations translate directly into increased enforcement pressure on exporters.
Most companies don't fail export compliance because they're deliberately reckless. They fail because they make predictable, avoidable mistakes in how they structure due diligence, document decisions, and respond to risk signals. Here's what goes wrong and how to fix it.
Why These Mistakes Keep Happening
Export compliance operates in a gray zone where commercial pressure meets national security policy. Sales teams want transactions to close. Compliance teams want complete documentation. Engineering groups focus on technical specifications, not end-use restrictions. When China's military-civil fusion strategy blurs the line between civilian and defense applications, these organizational tensions create gaps that regulators will exploit.
The OIG's findings make clear that BIS will face pressure to demonstrate measurable enforcement outcomes. Companies that haven't fixed these six mistakes will become those outcomes.
Mistake 1: Stopping Due Diligence at the Immediate Customer
Why it happens: Your contract is with Company A. Company A passes your screening checks. The transaction looks clean, so you approve it.
The real consequence: Company A is a distributor with fifteen downstream customers, three of which have military affiliations your screening never touched. When BIS conducts a post-shipment verification and discovers your controlled item reached an unauthorized end user, your "but we vetted the customer" defense collapses.
The fix: Map the full ownership and control structure before export. Identify related entities, examine downstream users when the technology has dual-use applications, and document why you believe the stated end use is legitimate. If your customer won't disclose their customer base for sensitive technologies, that's your red flag.
Mistake 2: Treating Diversion Risk as a Checkbox
Why it happens: You have a diversion-risk policy. Someone checks a box confirming they reviewed it. The transaction proceeds because no one said "stop."
The real consequence: Unusual shipping routes, third-country intermediaries, and inconsistent end-use descriptions don't trigger escalation because your process asks "did you consider diversion risk?" instead of "what specific diversion indicators did you evaluate and how did you resolve them?"
The fix: Build diversion-risk analysis into transaction workflows with specific triggers: routing through non-standard jurisdictions, requests involving technologies with military or surveillance applications, changes to end users late in the process, or involvement of intermediaries in transshipment-risk countries. Document what you found and why you concluded the risk was acceptable or required additional controls.
Mistake 3: Creating Documentation That Explains Nothing
Why it happens: You keep records because regulations require it. But your records show approvals without showing reasoning.
The real consequence: When BIS asks why you approved a transaction, your documentation shows that someone clicked "approve" on a certain date. It doesn't show what due diligence was performed, what risks were identified, how concerns were resolved, or who made the final decision. You can't reconstruct your compliance reasoning six months later, and neither can regulators.
The fix: Document the decision-making process, not just the decision. Your records should answer: How was this customer approved? What due diligence was performed? Were diversion risks identified and how were they addressed? Who reviewed and approved the transaction? If concerns were raised, how were they escalated and resolved? Contemporaneous notes matter more than perfect policies.
Mistake 4: Building Escalation Procedures No One Uses
Why it happens: Your compliance manual describes when employees should escalate concerns. But sales teams don't want to delay deals, logistics groups don't recognize compliance red flags, and no one's sure what qualifies as "suspicious."
The real consequence: Warning signs accumulate without triggering review. A customer changes the stated end user after initial approval. Product specifications shift toward military applications. Shipping instructions route through unexpected jurisdictions. Each signal alone seems minor, so no one escalates until it's too late.
The fix: Train every function that touches export transactions to recognize specific escalation triggers: changes in end users, conflicting information about product use, unusual routing requests, indications of military or government connections, or efforts to bypass established review procedures. Make escalation the default when anyone is uncertain, and remove penalties for raising concerns that turn out to be unfounded.
Mistake 5: Assuming Silence Means Compliance
Why it happens: You haven't received enforcement inquiries, so you assume your program works.
The real consequence: The OIG audit revealed that BIS wasn't consistently conducting or managing post-shipment verifications. That gap is closing. When BIS implements the OIG's recommendations for supervisory monitoring, regular management reporting, and accountability metrics, your quiet period ends. Agencies under pressure to demonstrate enforcement results don't start with companies that have bulletproof programs.
The fix: Conduct internal export controls readiness assessments before regulators arrive. Test whether you can quickly produce transaction records, shipment documentation, and compliance analysis for recent China-related exports. Simulate a government inquiry: Can you explain who the end user was, how the product was expected to be used, what due diligence you performed, and why your compliance decisions were reasonable? If you can't answer those questions with documentation in hand, fix that gap now.
Mistake 6: Separating Compliance from Commercial Reality
Why it happens: Compliance operates as a separate function that reviews transactions after commercial terms are negotiated. By the time compliance sees the deal, customer expectations are set and delivery timelines are promised.
The real consequence: Compliance becomes a bottleneck that sales teams route around rather than a function that shapes transactions from the start. High-risk deals don't get enhanced scrutiny because they're not flagged as high-risk until it's too late to restructure them.
The fix: Integrate compliance review into commercial processes at the opportunity stage. For China-related transactions involving advanced technologies, dual-use items, or military-adjacent applications, compliance should evaluate end-use risks and diversion potential before anyone quotes pricing or delivery dates. This doesn't slow deals down; it prevents deals that will fail compliance review from consuming resources in the first place.
Prevention Checklist
Review your export compliance program against these questions:
- Can you map ownership structures, related entities, and downstream users for your China-related customers?
- Do your diversion-risk assessments document specific indicators evaluated and how concerns were resolved?
- Would your transaction records allow someone unfamiliar with the deal to understand your compliance reasoning six months later?
- Can employees in sales, logistics, and procurement articulate when and how to escalate export control concerns?
- Have you simulated a BIS inquiry to test whether you can quickly produce complete documentation?
- Does compliance review happen early enough to shape transactions rather than just approve or reject them?
The BIS has agreed to implement quality-control mechanisms requiring supervisors to monitor post-shipment verifications from approval through closure and to provide regular reporting to leadership on unresolved verifications and accountability actions. That institutional pressure will flow downstream to exporters.
You can wait for an enforcement inquiry to reveal gaps in your program, or you can fix them while you still control the timeline. The companies that treat this audit as an early warning will be better positioned than those that treat it as someone else's problem.
