A Mile Wide and an Inch Deep? A Fresh Look at Post-Settlement Export Controls Audits in the New Age of Enforcement

by Brent Carlson

Photo courtesy of the author

Amid war and simmering geopolitical tensions, the age of export controls enforcement has arrived. Enforcement activity is up. Corporate penalties have climbed.[1] Pre-enforcement activity signals much more to come.[2] And the enforcement drive at the Commerce Department’s Bureau of Industry and Security (“BIS”) has outlasted changes in administration and in control of Congress.

Two recent BIS corporate settlements share a telling feature. Cadence Design Systems (July 2025, a $95.3 million BIS civil penalty) and Applied Materials (February 2026, a $252.5 million civil penalty) must each complete two annual internal audits of their export controls compliance programs and submit the results to BIS. For Applied Materials, the stakes are explicit: a three-year denial of export privileges is suspended, and then waived, only if the audits are completed and submitted on time.[3] In the age of enforcement, post-settlement audits are the new normal. Expect them. Expect them to be scrutinized. In some cases, expect a monitor as well.[4]

The audit itself is not the worst outcome. The worst outcome is a clean audit report followed by BIS discovering evidence that the company’s items are still reaching prohibited end users.

That would call the audit’s integrity into question and invite the escalation the settlement was meant to close off: greater penalties, an activated denial order that could stop a business dead in the water, and more distraction for officers and directors. BIS will read the audit report against whatever it learns on its own. Getting it right starts with leaving legacy assumptions at the door.

Both settlements require the audits to be “in substantial compliance with” the sample audit module in BIS’s Export Compliance Guidelines.[5] The module is a sensible starting point, but it dates to January 2017. It predates the Export Control Reform Act of 2018, the October 2022 semiconductor and advanced computing rules, and BIS’s recent guidance emphasizing “high probability” knowledge.[6] In export controls terms, 2017 is a different planet.

More fundamentally, the module asks whether controls exist, not whether they worked. In Foreign Corrupt Practices Act enforcement, industry and government long ago moved past program design to program effectiveness. Export controls audits should too. Instead, the module’s questions stop at design:  Is there a screening process? A “hold” function when a match occurs? A checklist on file for every order? A company can answer yes to all of it and still ship to the wrong customer. The two settlements show how.

Cadence China sold and loaned electronic design automation hardware, software, and technology to Central South CAD Center (“CSCC”), which BIS found to be an alias for the National University of Defense Technology (“NUDT”), an Entity List party since February 2015.[7] CSCC itself was not listed. Screening it would have come back clean, and the module’s screening boxes checked.

The evidence of the alias sat elsewhere. Cadence China addressed training invitations for CSCC personnel to NUDT, stating that NUDT would cover their expenses. An expense report named NUDT as the customer. Field engineers supervised installations on what one technician called a “military based campus.” And a credit manager observed that CSCC could be found neither in English or Chinese on the internet, nor in commercial credit databases.

BIS’s own 2017 red flags template lists a customer with “little or no business background.”[8] Cadence’s finance team spotted exactly that. The flag was resolved as a credit question rather than escalated as an export question, and more exports followed. Cadence had also obtained a letter of assurance from CSCC, a self-representation from the very party under diligence.[9] Even Cadence’s own audit process faltered: an employee who knew CSCC and its successor account, Phytium, were “the same customer” sent two separate audit letters because the process called for two documents.

The module tells auditors to interview “all key export-related personnel.” Cadence’s warning signs came from sales, finance, field service, and expense records, functions a conventionally scoped audit—based on the BIS sample audit module—would never reach.

On September 25, 2020, BIS sent Applied Materials an “is-informed” letter requiring licenses for certain items to Semiconductor Manufacturing International Corporation (“SMIC”). The next day, a managing director urged the company to “go into hyper drive” on moving production to South Korea. The resulting “dual-build” process, unique to SMIC, began ion implanter production in Massachusetts, and finished it in Korea. The trade group concluded that the Korean work “substantially transformed” the equipment into foreign-made items outside the EAR. But substantial transformation is a customs concept. It appears nowhere in the EAR.[10]

Measured against the module, Applied Materials’ controls look strong. It had automated blocks on SMIC shipments, a written checklist governing releases, and documentation of each one. Every relevant module item gets a check mark. The module never asks whether the legal premise behind an override was right (or even existed), or what changed in the business right after a regulatory pivot point. That is where the violations sat.

One legacy assumption persists: that “knowledge” under the EAR means actual knowledge of a violation. It does not. The EAR define it this way:

Knowledge of a circumstance (the term may be a variant, such as “know,” “reason to know,” or “reason to believe”) includes not only positive knowledge that the circumstance exists or is substantially certain to occur, but also an awareness of a high probability of its existence or future occurrence. Such awareness is inferred from evidence of the conscious disregard of facts known to a person and is also inferred from a person’s willful avoidance of facts.[11]

The Cadence charges turned on exactly this: “reason to know, including awareness of a high probability.”[12] Under the collective knowledge doctrine, what the credit manager knew and what the field technician saw can be aggregated and attributed to the company.[13] An audit that tests only what the compliance function knew will miss what the company is deemed to know. The module never mentions the knowledge standard, so the audit must supply it. The checklist provides the ingredients; “knowledge” is the salt in the stew. And no one, least of all the auditor, wants to be played the fool.

Treat the 2017 module—one that BIS is likely to update soon—as the beginning point for “substantial compliance.” Then build the audit around risk:

1. Start where the violation sat. Cadence’s audits must cover its oversight of Cadence China; Applied Materials’ audits are scoped to semiconductor manufacturing equipment going to or within China. Focus on the root causes: aliases and affiliates for Cadence, “subject to the EAR” determinations for Applied Materials.
2. Look hard at pivot points. For each regulatory change, Entity List addition, or is-informed letter, compare what happened before and after. Did a new customer or location pick up the slack? Did a new legal opinion, workaround, or production route appear?
3. Audit the overrides and the opinions behind them. Sample every manual release of a hold. Read the memos and checklists that unlocked business, and test their legal premises against the EAR rather than against what the business hoped they would say.
4. Go beyond the compliance function. Pull credit files, sales account reviews, expense reports, field service tickets, and installation records. Apply the Fraud Four-Circle Framework℠: pressure, opportunity, something almost too good to be true at a critical time, and signs of concealment such as aliases and parallel email domains.[14]
5. Document how red flags were resolved, not just that parties were screened. BIS will read the audit record. It should show who saw each flag, what they did, and why the resolution was reasonable. Used this way, the “knowledge” standard protects the company.
6. Focus and finish strong. Not every module line deserves equal time. Organize the work around the Justice Department’s three key questions: Is the program well designed? Is it adequately resourced and empowered? Does it work in practice?[15] Spend the most time on the third.
7. Plan for China. Fieldwork, interviews, and data transfers involving PRC operations now run into PRC data and anti-foreign-sanctions laws. Resolve data access and alternative approaches with counsel before fieldwork begins, not after.[16]
8. Brief the board. Export controls are now a central compliance risk under directors’ duty of oversight, and a post-settlement audit is exactly what a board must monitor.[17]

BIS would do industry and itself a service by updating its 2017 Guidelines. Until then, read it through the lens of recent BIS settlements. A post-settlement audit that goes a mile wide and an inch deep satisfies no one: not BIS, not the board, and not the company that must live with what the audit missed. Focus on where the real risks—not only to national security but also to the bottom-line—lie. The resulting audits will be less disruptive, shorter, cheaper, and more effective—a result industry and government should both welcome.

[1]See Brent Carlson, From Peanuts to Elephant-Sized Penalties: A Fresh Look at Recent U.S. Export Controls Enforcement Developments & Future Trends, NYU PCCE Blog (Oct. 31, 2025); see also Kate Koren & Kevin Kurland, Trump Administration Ratchets Up Export Control Penalties, Ctr. for Strategic & Int’l Stud. (Sept. 24, 2026) (noting that a growing share of BIS penalties in 2025 and 2026 approached the statutory maximum).

[2]See Brent Carlson & Michael Huneke, Avoid Kicking the Hornet’s Nest: A Fresh Look at How to Anticipate, Avoid, and Respond to BIS Administrative Subpoenas (Parts 1 & 2), NYU PCCE Blog (Sept. 19 & 26, 2024).

[3]BIS, Settlement Agreement, In the Matter of Cadence Design Systems, Inc. (July 27, 2025) (“Cadence Settlement Agreement”), at 17–18; BIS, Settlement Agreement, In the Matter of Applied Materials, Inc. and Applied Materials Korea (Feb. 11, 2026) (“AMAT Settlement Agreement”), at 14–15.

[4]See Brent Carlson & Michael Huneke, Monitoring What Matters: A Fresh Look Proposal to Government and Industry for How Post-Resolution Oversight Can Best Deny Hostile Actors the Means to Cause Deadly Harm, NYU PCCE Blog (Mar. 28, 2024).

[5]BIS, Export Compliance Guidelines: The Elements of an Effective Export Compliance Program (Jan. 2017) (“Guidelines”), at 35–44.

[6]BIS, Guidance to Industry on BIS Actions Identifying Transaction Parties of Diversion Risk (July 10, 2024).

[7]Cadence Settlement Agreement at 9–16.

[8]Guidelines at 48.

[9]See Brent Carlson & Michael Huneke, It May Not Be Worth the Paper (or Pixel) It’s Written On (Part 1): A Fresh Look at Letters of Assurance Used to Bolster Sanctions and Export Controls Compliance, NYU PCCE Blog (Aug. 2, 2024).

[10]AMAT Settlement Agreement at 6–10.

[11]15 C.F.R. § 772.1.

[12]Cadence Settlement Agreement at 5; see also Brent Carlson & Michael Huneke, How Not to Stand Out Like a Sore Thumb (Part 2): A Fresh Look at the “High Probability” Definition of Knowledge Applied to Export Controls and Sanctions Enforcement, NYU PCCE Blog (Feb. 21, 2024).

[13]See Brent Carlson & Michael Huneke, Trust, But Verify…Therein Lies the Rub: A Fresh Look at Audits of Export Controls Compliance Programs, NYU PCCE Blog (Nov. 19, 2024).

[14]See Brent Carlson, A Light Shines Through the Darkness in Disputes, Investigations, and Trade Compliance: A Fresh Look at the Classic Fraud Triangle with the Fraud Four-Circle Framework℠, NYU PCCE Blog (Jan. 8, 2026); AMAT Settlement Agreement at 9.

[15]U.S. Dept. of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (Sept. 2024).

[16]See Carlson & Huneke, supra note 13; Todd Liao et al., China Issues New Regulations on Countering Foreign Extraterritorial Jurisdiction: What MNCs Need to Know, Morgan Lewis LawFlash (Apr. 15, 2026).

[17]See Brent Carlson & Michael Huneke, Boards of Directors Lovin’ It after McDonald’s? A Fresh Look at Directors’ Duty of Oversight in the New Era of Sanctions & Export Control Corporate Enforcement, NYU PCCE Blog (Jan. 12, 2024).

Brent Carlson is the founder of Red Flags Rising Solutions LLC and co-host of the Red Flags Rising podcast.

The views, opinions and positions expressed within all posts are those of the author alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with the author.

by Brent Carlson

Photo courtesy of the author

Amid war and simmering geopolitical tensions, the age of export controls enforcement has arrived. Enforcement activity is up. Corporate penalties have climbed.[1] Pre-enforcement activity signals much more to come.[2] And the enforcement drive at the Commerce Department’s Bureau of Industry and Security (“BIS”) has outlasted changes in administration and in control of Congress.

Two recent BIS corporate settlements share a telling feature. Cadence Design Systems (July 2025, a $95.3 million BIS civil penalty) and Applied Materials (February 2026, a $252.5 million civil penalty) must each complete two annual internal audits of their export controls compliance programs and submit the results to BIS. For Applied Materials, the stakes are explicit: a three-year denial of export privileges is suspended, and then waived, only if the audits are completed and submitted on time.[3] In the age of enforcement, post-settlement audits are the new normal. Expect them. Expect them to be scrutinized. In some cases, expect a monitor as well.[4]

The audit itself is not the worst outcome. The worst outcome is a clean audit report followed by BIS discovering evidence that the company’s items are still reaching prohibited end users.

That would call the audit’s integrity into question and invite the escalation the settlement was meant to close off: greater penalties, an activated denial order that could stop a business dead in the water, and more distraction for officers and directors. BIS will read the audit report against whatever it learns on its own. Getting it right starts with leaving legacy assumptions at the door.

Both settlements require the audits to be “in substantial compliance with” the sample audit module in BIS’s Export Compliance Guidelines.[5] The module is a sensible starting point, but it dates to January 2017. It predates the Export Control Reform Act of 2018, the October 2022 semiconductor and advanced computing rules, and BIS’s recent guidance emphasizing “high probability” knowledge.[6] In export controls terms, 2017 is a different planet.

More fundamentally, the module asks whether controls exist, not whether they worked. In Foreign Corrupt Practices Act enforcement, industry and government long ago moved past program design to program effectiveness. Export controls audits should too. Instead, the module’s questions stop at design:  Is there a screening process? A “hold” function when a match occurs? A checklist on file for every order? A company can answer yes to all of it and still ship to the wrong customer. The two settlements show how.

Cadence China sold and loaned electronic design automation hardware, software, and technology to Central South CAD Center (“CSCC”), which BIS found to be an alias for the National University of Defense Technology (“NUDT”), an Entity List party since February 2015.[7] CSCC itself was not listed. Screening it would have come back clean, and the module’s screening boxes checked.

The evidence of the alias sat elsewhere. Cadence China addressed training invitations for CSCC personnel to NUDT, stating that NUDT would cover their expenses. An expense report named NUDT as the customer. Field engineers supervised installations on what one technician called a “military based campus.” And a credit manager observed that CSCC could be found neither in English or Chinese on the internet, nor in commercial credit databases.

BIS’s own 2017 red flags template lists a customer with “little or no business background.”[8] Cadence’s finance team spotted exactly that. The flag was resolved as a credit question rather than escalated as an export question, and more exports followed. Cadence had also obtained a letter of assurance from CSCC, a self-representation from the very party under diligence.[9] Even Cadence’s own audit process faltered: an employee who knew CSCC and its successor account, Phytium, were “the same customer” sent two separate audit letters because the process called for two documents.

The module tells auditors to interview “all key export-related personnel.” Cadence’s warning signs came from sales, finance, field service, and expense records, functions a conventionally scoped audit—based on the BIS sample audit module—would never reach.

On September 25, 2020, BIS sent Applied Materials an “is-informed” letter requiring licenses for certain items to Semiconductor Manufacturing International Corporation (“SMIC”). The next day, a managing director urged the company to “go into hyper drive” on moving production to South Korea. The resulting “dual-build” process, unique to SMIC, began ion implanter production in Massachusetts, and finished it in Korea. The trade group concluded that the Korean work “substantially transformed” the equipment into foreign-made items outside the EAR. But substantial transformation is a customs concept. It appears nowhere in the EAR.[10]

Measured against the module, Applied Materials’ controls look strong. It had automated blocks on SMIC shipments, a written checklist governing releases, and documentation of each one. Every relevant module item gets a check mark. The module never asks whether the legal premise behind an override was right (or even existed), or what changed in the business right after a regulatory pivot point. That is where the violations sat.

One legacy assumption persists: that “knowledge” under the EAR means actual knowledge of a violation. It does not. The EAR define it this way:

Knowledge of a circumstance (the term may be a variant, such as “know,” “reason to know,” or “reason to believe”) includes not only positive knowledge that the circumstance exists or is substantially certain to occur, but also an awareness of a high probability of its existence or future occurrence. Such awareness is inferred from evidence of the conscious disregard of facts known to a person and is also inferred from a person’s willful avoidance of facts.[11]

The Cadence charges turned on exactly this: “reason to know, including awareness of a high probability.”[12] Under the collective knowledge doctrine, what the credit manager knew and what the field technician saw can be aggregated and attributed to the company.[13] An audit that tests only what the compliance function knew will miss what the company is deemed to know. The module never mentions the knowledge standard, so the audit must supply it. The checklist provides the ingredients; “knowledge” is the salt in the stew. And no one, least of all the auditor, wants to be played the fool.

Treat the 2017 module—one that BIS is likely to update soon—as the beginning point for “substantial compliance.” Then build the audit around risk:

1. Start where the violation sat. Cadence’s audits must cover its oversight of Cadence China; Applied Materials’ audits are scoped to semiconductor manufacturing equipment going to or within China. Focus on the root causes: aliases and affiliates for Cadence, “subject to the EAR” determinations for Applied Materials.
2. Look hard at pivot points. For each regulatory change, Entity List addition, or is-informed letter, compare what happened before and after. Did a new customer or location pick up the slack? Did a new legal opinion, workaround, or production route appear?
3. Audit the overrides and the opinions behind them. Sample every manual release of a hold. Read the memos and checklists that unlocked business, and test their legal premises against the EAR rather than against what the business hoped they would say.
4. Go beyond the compliance function. Pull credit files, sales account reviews, expense reports, field service tickets, and installation records. Apply the Fraud Four-Circle Framework℠: pressure, opportunity, something almost too good to be true at a critical time, and signs of concealment such as aliases and parallel email domains.[14]
5. Document how red flags were resolved, not just that parties were screened. BIS will read the audit record. It should show who saw each flag, what they did, and why the resolution was reasonable. Used this way, the “knowledge” standard protects the company.
6. Focus and finish strong. Not every module line deserves equal time. Organize the work around the Justice Department’s three key questions: Is the program well designed? Is it adequately resourced and empowered? Does it work in practice?[15] Spend the most time on the third.
7. Plan for China. Fieldwork, interviews, and data transfers involving PRC operations now run into PRC data and anti-foreign-sanctions laws. Resolve data access and alternative approaches with counsel before fieldwork begins, not after.[16]
8. Brief the board. Export controls are now a central compliance risk under directors’ duty of oversight, and a post-settlement audit is exactly what a board must monitor.[17]

BIS would do industry and itself a service by updating its 2017 Guidelines. Until then, read it through the lens of recent BIS settlements. A post-settlement audit that goes a mile wide and an inch deep satisfies no one: not BIS, not the board, and not the company that must live with what the audit missed. Focus on where the real risks—not only to national security but also to the bottom-line—lie. The resulting audits will be less disruptive, shorter, cheaper, and more effective—a result industry and government should both welcome.

[1]See Brent Carlson, From Peanuts to Elephant-Sized Penalties: A Fresh Look at Recent U.S. Export Controls Enforcement Developments & Future Trends, NYU PCCE Blog (Oct. 31, 2025); see also Kate Koren & Kevin Kurland, Trump Administration Ratchets Up Export Control Penalties, Ctr. for Strategic & Int’l Stud. (Sept. 24, 2026) (noting that a growing share of BIS penalties in 2025 and 2026 approached the statutory maximum).

[2]See Brent Carlson & Michael Huneke, Avoid Kicking the Hornet’s Nest: A Fresh Look at How to Anticipate, Avoid, and Respond to BIS Administrative Subpoenas (Parts 1 & 2), NYU PCCE Blog (Sept. 19 & 26, 2024).

[3]BIS, Settlement Agreement, In the Matter of Cadence Design Systems, Inc. (July 27, 2025) (“Cadence Settlement Agreement”), at 17–18; BIS, Settlement Agreement, In the Matter of Applied Materials, Inc. and Applied Materials Korea (Feb. 11, 2026) (“AMAT Settlement Agreement”), at 14–15.

[4]See Brent Carlson & Michael Huneke, Monitoring What Matters: A Fresh Look Proposal to Government and Industry for How Post-Resolution Oversight Can Best Deny Hostile Actors the Means to Cause Deadly Harm, NYU PCCE Blog (Mar. 28, 2024).

[5]BIS, Export Compliance Guidelines: The Elements of an Effective Export Compliance Program (Jan. 2017) (“Guidelines”), at 35–44.

[6]BIS, Guidance to Industry on BIS Actions Identifying Transaction Parties of Diversion Risk (July 10, 2024).

[7]Cadence Settlement Agreement at 9–16.

[8]Guidelines at 48.

[9]See Brent Carlson & Michael Huneke, It May Not Be Worth the Paper (or Pixel) It’s Written On (Part 1): A Fresh Look at Letters of Assurance Used to Bolster Sanctions and Export Controls Compliance, NYU PCCE Blog (Aug. 2, 2024).

[10]AMAT Settlement Agreement at 6–10.

[11]15 C.F.R. § 772.1.

[12]Cadence Settlement Agreement at 5; see also Brent Carlson & Michael Huneke, How Not to Stand Out Like a Sore Thumb (Part 2): A Fresh Look at the “High Probability” Definition of Knowledge Applied to Export Controls and Sanctions Enforcement, NYU PCCE Blog (Feb. 21, 2024).

[13]See Brent Carlson & Michael Huneke, Trust, But Verify…Therein Lies the Rub: A Fresh Look at Audits of Export Controls Compliance Programs, NYU PCCE Blog (Nov. 19, 2024).

[14]See Brent Carlson, A Light Shines Through the Darkness in Disputes, Investigations, and Trade Compliance: A Fresh Look at the Classic Fraud Triangle with the Fraud Four-Circle Framework℠, NYU PCCE Blog (Jan. 8, 2026); AMAT Settlement Agreement at 9.

[15]U.S. Dept. of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (Sept. 2024).

[16]See Carlson & Huneke, supra note 13; Todd Liao et al., China Issues New Regulations on Countering Foreign Extraterritorial Jurisdiction: What MNCs Need to Know, Morgan Lewis LawFlash (Apr. 15, 2026).

[17]See Brent Carlson & Michael Huneke, Boards of Directors Lovin’ It after McDonald’s? A Fresh Look at Directors’ Duty of Oversight in the New Era of Sanctions & Export Control Corporate Enforcement, NYU PCCE Blog (Jan. 12, 2024).

Brent Carlson is the founder of Red Flags Rising Solutions LLC and co-host of the Red Flags Rising podcast.

The views, opinions and positions expressed within all posts are those of the author alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with the author.