Imagine any of the following items landing on your desk on a Monday morning:

• You are forwarded an email from a Chinese software distributor asking to push out a bug fix to an end user in Iran.
• In the course of selling your company, the buyer asks about sales to Huawei, and you realize certain products have been sent to Huawei by a foreign subsidiary.
• Your bank reaches out to tell you that a recent payment to a supplier has been blocked because of a connection to a sanctioned party.

You generally know that these activities could expose the company to liability, but how should you proceed?

U.S. economic sanctions and export controls compliance issues arise in many different ways. At a high level, sanctions prohibit dealings with certain countries and persons, whereas export controls restrict the provision of goods, software, technology, and certain services to countries or persons without appropriate licenses. Both regulatory regimes are highly complex, and how a company responds to red flags is critical to mitigating the impacts of identified issues. Depending on the circumstances, this response may include the initiation of an internal investigation.

While there is no "one size fits all" approach to conducting an investigation, below are some dos and don'ts to keep in mind.