First, let's study standard number (1) and (2), by looking at Canon Inc. control framework.
The internal framework needs to be headed by the President, because violation of any legislation or involvement in any incident will entail substantial legal and social responsibility and impact.
Recognition of its importance by the President will enable the establishment of a robust control framework.
The central administrative function needs to be separated from the sales department and be given the authority to cancel any suspicious transaction. That's because robust control requires the determination to stop all suspicious transactions even if they would bring sizable profits. The security trade control function doesn't always have to be assigned to a department dedicated thereto. It can be determined in light of the scale of the company or business field concerned.
Transaction screenings by the sales department alone tends to result in generous decisions. Such decisions should therefore great re-aexamined by an independent central administrative department.