Study Guide

Enforcement and recognition strategies are designed to address identified non-compliers and recognised compliers. For identified non-compliers, there is a range of enforcement strategies. For recognised compliers, strategies include increased levels of self-assessment, reduced regulatory scrutiny, less onerous reporting requirements, periodic payment arrangements, simplified procedures, and increased levels of facilitation. This approach is reflective of a compliance improvement approach, the principal focus of which is the achievement of future compliance and ensuring that an appropriate balance exists between incentives for compliance and sanctions for non-compliance. 

An effective compliance management strategy seeks to find the cause of non-compliance and identify ways of preventing its recurrence. This is achieved through the application of the risk management process, the key elements of which are shown in Figure 2 below. 

Figure 2: Risk management process | Source: Modified from ISO 31000 (ISO, 2018) 

Context and scope 

The context and scope of the risk being managed is defined by the context and scope of the audit (or other compliance assessment activity) itself. For example, the audit may be focusing on a trader's compliance with Customs requirements in general, or with particular aspects of the regulations such as those relating to transit, export or warehousing activities. 

Risk identification 

Risk identification — the first step of the risk assessment process — essentially involves answering two questions: 

The first question helps clarify the nature of risk; the second provides valuable information about potential causes.  

Note that the error identified during the course of the audit has already answered the first question. The next task is to determine how and why the error has occurred — for example, whether the company made an inadvertent error, whether its procedures are flawed, whether there is a general misconception within the industry sector, or whether the error resulted from an intentional act. On the other hand, the legislation may be unclear, or the administrative requirements may be ambiguous. 

Risk analysis and evaluation. 

The next step is to analyse the risk by considering two discrete elements — the likelihood of the risk occurring, and the impact if it does in fact occur. The impact of a risk occurring is relatively easy to quantify in the context of revenue compliance; in other situations, there is generally a need to make qualitative assessments — for example, failure to obtain import or export permits. Determining the likelihood of a risk occurring depends on two factors: those which Customs can control, and those which it cannot. When examining these factors in a criminal context, the effectiveness of existing controls is often referred to as 'vulnerability', whereas the factors over which Customs has little or no control are referred to as the 'capability' and 'intent' of the criminal organisation. In the intelligence community, the assessment of capability and intent is generally referred to as a threat assessment. 

Both the likelihood and impact of a risk are considered when determining the overall level of risk. This leads to the risk evaluation stage, which involves determining whether a risk is acceptable or unacceptable, and how the unacceptable risks are to be prioritised. 

Risk treatment 

Having identified the risks that require mitigation, the next step is to identify effective strategies that will eliminate or minimise the likelihood of the risk recurring, its potential impact, or both. The appropriate mitigation strategy will depend on how or why the risk occurred. It may be necessary to address systemic problems within the company, to review the administration's published guidelines, or to provide formal clarification of the law through binding rulings. As such, one or more stages of the Integrated Compliance Management Framework will need to be reviewed. 

The WCO Customs Risk Management Compendium contains a wealth of practical information to assist administrations to assess risk and identify effective risk mitigation strategies. The compendium includes guidance on developing an organisational framework for managing risk; embedding risk management in the organisational culture; risk assessment, profiling and targeting; risk indicators; and guidelines for intelligence analysis. 

Enforcement 

In the process of assessing compliance, Customs authorities will encounter two situations: compliance and non-compliance. The non-compliance spectrum will range from innocent mistakes to blatant fraud. If the error nears the fraudulent end of the spectrum, some form of sanction will need to apply, including administrative penalties or, in the more severe cases, prosecution and licence revocation. 

Before determining the need for or nature of a sanction, Customs should identify the true nature of the risk by establishing the root cause of the error. The error may be the result of a control problem within the company, due to flawed systems and procedures, or it may be the result of a deliberate attempt to break the law. On the other hand, the relevant legislation may be unclear, or the administrative requirements may be ambiguous. 

The mitigation strategy adopted will depend on the nature of the identified risk. Unless the error is found to be intentional, Customs will typically seek to systemic problems within the company, or provide the company (or an entire industry sector) with advice on compliance issues, or provide formal clarification of the law through binding rulings or other means. 

It is important to recognise that different solutions will be used to address honest mistakes on the one hand, and deliberate non-compliance on the other. Industry familiarisation seminars and information brochures may adequately address errors that result from a lack of understanding of the relevant regulatory provisions. However, if someone is actively seeking to commit fraud, seminars and information brochures will have absolutely no impact on their activities. Indeed, such members of the trading community are likely to have a very good understanding of their obligations and entitlements. To treat the risks posed by such organisations, Customs is likely to adopt a rigorous enforcement approach. 

Recognition 

A finding of compliance by the audit team is a legitimate and useful operational outcome. For every instance of compliance identified, the population of potential non-compliers reduces. It is now widely accepted that traders who can demonstrate high levels of compliance require a lower level of scrutiny than those with a history of poor compliance, or those about which little is known. There is also an increasing realisation that compliant behaviour should not only be recognised through a reduction in regulatory scrutiny, but through various forms of positive reinforcement. 

The concept of recognising trusted traders has evolved from a single RKC standard into a binding international obligation: 

Potential Benefits for Authorized Operators

TFA Article 7(3) lists the following benefits that WTO members shall provide to Authorized Operators — in each case, “as appropriate” to their context: 

The SAFE Framework formally recognises the need to provide benefits to compliant companies in the context of its AEO concept. Authorized Economic Operators are expected to benefit from faster processing of goods by Customs, e.g. through reduced examination rates. These processes will ensure that AEOs see a benefit to their investment in good security systems and practices, including reduced risk-targeting assessments and inspections, and expedited processing of their goods. The WCO further specifies that such benefits should be clear, tangible and documented in order to provide members of the trading community with an incentive to seek AEO status, and to justify the costs incurred in achieving such. As such, the WCO provides a formal link between a trader's low risk rating and the provision of regulatory benefits. 

Note

It is worth noting here that the concept of Authorized Operators is different from the concept of Authorized Economic Operators as proposed in the SAFE Framework, which we will look at in Module 3.