VALUES

UPDATE

September 9th 2014 Waterside House

Assessing your Customs & Trade Compliance Risk

C5’s 6th Annual Conference on Customs Compliance

19th November 2014

Mark Corby – Marks & Spencer Charles Barber – Kuehne + Nagel

Where does risk fit?

• We have a “Trade Compliance Program/Policy” Delivery...

Implemented – sure...

Common interpretation of requirements

Language / Culture

• We Assess (or we audit)

Against the Program / Policy

How often

We always disclose

• We conduct training at all our facilities...

Who, how, where, how often...

3

Does this approach demonstrate due diligence...

Ex Co., UK

10% Time Spent

10000 Transactions

Risk Score

Duty Spend $256k

No

1

Related Role

Additional

resources

Re Exported 38%

65% Routed

Exp Cont’d

items <1%

32 ERP items

growth per

week

$? K Duty Saved

ERP IBS

HTS

ECCN

Origin

Export 69%

EU 15%

Domestic 16%

Sales $55,440,772

Import 25%

EU 1%

Domestic 74%

Purchases $23,888,169

Imports

Exports

Restricted Party Screening

Completed / When / Who

End Use / End User

Verified / Contractual Protection

Desk-Level Procedures

Trade Program

Policy, Assessment, Training

GSP imports

Bi-lateral FTA

Import from Export to

Qatar

Actual

84% Potential

60%

Hong Kong

Kuwait

Understanding how to fix & maintain = opportunity

Recommendation Responsible Party

Management Response

& Corrective Action Target Date

1

Does the business have a competent trade compliance person.

If not, what solutions can we offer (auditing, outsourcing,

safety net, training, job description, objectives, etc.

2

SAO – UK legislative requirement underpinning existing

EU legislation. Assessing transactional activity

– external audit

3 Training – maintain and increase awareness across key

Policy Areas and functional role compliance -

4

Policy/Standards/ - create, review…

Contractual Export Control/Diversion/Sanctions language…

Operational Desk-top procedures…

Restricted Party Screening/End Use Identification

5 Verify practice – annual external audit of specific areas

Re-work metrics post corrective actions for lower risk score

6

Identify & Report Customs related savings on import

Identify & Report cost to market savings on export

Ensure management of legislation securing such savings is correct

Explore potential for any retrospective opportunities

7

Confidential

• Informed Commercial Decisions Are supported in good businesses by thorough research....

• Finding out the facts / reality over theory

So the person that knows about “this” is engaged at initial planning – right

• Who knows about this... When we merger or acquire

Change source markets

Expand or contract activities market to market

Move production / produce in different markets

Re-design supply chain operations

When we apply customs processes

• And in your business... Where does engagement happen...

Informed decision making considers FTA applicability p. 6

• The Program/Policy is required – it makes a statement, but

• Risk happens every day where you conduct transactions Demonstrate diligence there as the delivery of the Program

It becomes meaningful to the location/local leaders

It connects Program and Reality

• People, Process & Tools Bring those together

In the places it is needed

Create competency and awareness – why is this required

Be accurate and consistent

Demonstrate it – procedures, flows, training, audit, corrective actions, closure

And walk through it in operational terms to see how it works...

7

Delivering Strategy through Understanding Reality

£3,130,890,970

Time Spent

Transactions

Risk Score

Duty Spend

Related Role

Re Exported

Routed

Exp Cont’d items

ERP items growth

per annum

Duty Saved

Imports

Exports

Restricted Party Screening

Completed / When / Who

End Use / End User

Verified / Contractual Protection

Desk-Level Procedures

Trade Program

Policy, Assessment, Training

GSP imports

Bi-lateral FTA

Import from Export to

Qatar

Hong Kong

Kuwait

£9,502,375,684

68.33% 56.67%

1,500,000

260,000,000

61,600

85%

5.00%

0%

300000

100%

Yes

Home Country

Macao

Singapore

HTS SA

ECCN

Origin

ERP SAP

US Virgin Isles

1%

AEO

8,000,000 Duty Suspend

Customs 1% 1%

NO

IL Quota CVD/ADD

3%

Excise

Import 54.3%

Domestic 44.7%

EU 1.0% Export 2.14%

Domestic 94.71%

EU 3.15%

Risk means different things to different people and there

are plenty of different models available.

This is just an example....

• Can’t exist in a vacuum. Ideally the model ‘tree’ could look like this:

Business model defined

Strategy defined

Policy defined

Risk assessment #1

Gap analysis/Risk review #1

Procedures, tools, measures implemented

Risk assessment #2

Gap analysis/Risk review #2

Final adjustments – further implementations etc.

Audits (internal/external, peer, senior etc.), scorecards

Impose metrics & ongoing monitoring

Annual risk review

etc.

• However, you’re unlikely to ever have a clean slate:

Business Model, Strategy, Policy may be set.

There will be existing, possibly entrenched, practises and

processes

Anything else should be capable of adjustment – according to

what the risk says

If the risk is great enough, everything can be / has to be changed

• The risk assessment will likely have to be inserted into existing

practises and then move up and down the ’tree’ as best it can.

Be Legal, but be prepared to compromise

• Everything should be aligned:

Everything supports the business model and the strategy

Can be set at whatever level is required

Risk basics

• Generic (1st Tier)

These are top level areas of risk. General risk, if you like.

E.g. Misclassification of goods is a generalised risk.

These do not require individual control actions if they are fully

controlled by actions applied to 2nd Tier risks

Useful for generic discussions and top level (e.g. SAO)

• Specific (2nd Tier)

These are the more detailed breakdowns of the Tier 1 risk.

E.g. the classification issue above could be broken down into:

information held on database, customs rulings sought, risk of

more than one heading being applied to the same goods etc.

These are the individual questions identified under each of the top

level sections in Tier 1.

• These two risks are usually sufficient to assess against

• Dynamic

This is an attempt to look pro-actively at risks that may not be

current but that might be expected given changes in circumstance.

It can be used to assess risks in upcoming legislative changes e.g.

UCC implementation – loss of First Sale.

Do not overuse at the expense of the generic and specific risk –

these are risks now.

• Human Factors

This is a 'soft' risk and should be used with caution as it can prove

to be a ‘rabbit hole’.

It can form part of the specific risk (2nd Tier) and typically relies on

training and awareness, tools, automation and process, metrics

and KPIs to mitigate the risk of someone not understanding, not

implementing or skimping checks etc.

Risk assessment process

1. Identify the risks (or hazards) associated with a given task,

activity or area of work

2. Identify what is at risk - the scope of the risk, what it would affect

3. Quantify the following items using a weighting system

Severity - What is the level of harm that may occur as a result of

exposure to the risk?

Likelihood - What is the probability that exposure to the risk will

arise?

Population - What is the spread of impact? Is it limited, widespread

or in-between?

Use 1, 4, 7, 10 weighting to avoid dithering (“Is it a 2 or a 3? Maybe

it’s a 4?”). Use 0 for N/A.

4. Unless the nature of the risk changes (and the risk assessment

needs to reflect such changes) then the only item that can

change is Likelihood.

5. A 'Risk Rating' is auto-generated (from the weighted score) for

the current control measures. Make it visual to enhance impact:

Severe Immediate Action is required

High Immediate Action is required

Medium-High Actions required to minimise the risk within 3-6 weeks

Medium Actions required to minimise the risk within 3-6 months

Low-Medium Actions required to minimise the risk within 6-9 months

Low or None Monitor & Review

6. Identify and prioritise risks for additional control measures.

7. Describe/enter the additional control measures required

8. Re-assess the risk as at point 4) above. This will give the

'Residual Risk Rating‘. The Severity & Population will not change (unless there is a

change in the nature of the work or task giving rise to the risk),

the Likelihood should reduce as a result of the additional controls

and the Residual Risk Rating should lower accordingly.

9. Record

10. Make an action plan – who will do what, by when

11. Monitor & Review all risk. Include this as part of a regular formal

review cycle or audit plan.

E Eliminate the Risk

R Reduce the Risk

I Isolate the Risk

C Control the Risk

So what does this look

like in practise?

• M&S assess 20 Generic Risk Areas such as:

Customs & Trade Compliance Organisation

Internal Controls

Classification, Valuation, Origin

Supply Chain Security

Documented Procedures & Processes

• Below that there are 216 Specific Risks identified

Very variable – Import licensing has just 2 specific risks,

classification has 15, Supply chain security has 32

• Even then, we recognise that in key areas such as Import

Valuation, Classification, Excise, AEO or Export Controls this is

insufficient so even more detailed assessments are made

• M&S probably assess around 500 detailed level requirements

19th November 2014 Mark Corby – Marks & Spencer Charles Barber – Kuehne + Nagel C5 – 6th Advanced Forum – Customs Compliance

Assessing your Customs & Trade Compliance Risk