Global Effects of SOX and Compliance

We’re currently working on a project with a customer who is a long-time user of Formtek | Orion RepositoryLink, Formtek’s certified integration of SAP R/3 and the Formtek content repository.  This customer has been using SAP’s ALViewer to view unstructured content stored in the repository.  The archived documents provide supplementary data that can be viewed alongside the more structured data that’s managed within SAP. 

Moving forward this company determined that it would be more cost-effective to convert the TIFF images and SAP proprietary file formats that are being archived, like OTF and EDI, into PDF file format.  ALViewer will be replaced with Formtek’s Product Interface and Connector for SAP, a plug-in for Adobe Reader.

While working with our customer on this viewer migration project we determined that it would be necessary to make some changes in the SAP configuration.  We wanted to create a new SAP document class for the PDF file data.  But we learned to do that wasn’t a good idea because to get that kind of change approved internally by their SOX compliance group would take a long time.  I was a little surprised since this is a company that’s based in Europe.

We’ve since come up with an alternative approach for configuring their system that wouldn’t require a review by their SOX (Sarbanes-Oxley) team, but it got me thinking about the effects that SOX and compliance in general are having on companies.  The effects are global and they’re reaching beyond just public companies.

Solutions for compliance regulations like SOX and HIPPA typically center around the combination of an audit tool with a document management repository that can securely manage the review, revision and approval of documents.  Beyond basic document library services, the repository can be further enhanced with capabilities like collaboration, records management, and workflow.

SOX regulations were enacted in 2002 and since then the impact that it’s had on businesses probably exceeds what anyone had thought at the time.  Now nonprofit organizations are also under pressure from SOX with potential for additional regulation, especially in healthcare.  SOX is also becoming seen as ‘best-practice’, even for organizations where the adoption is not mandatory.

Globally there are reports of many small to medium-size companies that are avoiding the listing on the US stock exchanges because of the high costs that SOX regulations would impose.  But the effect of SOX beyond the US borders is only likely to grow in the future.

Japanese companies, for example, are beginning to brace for the Japanese version of SOX to go into effect.  It will only affect publicly traded companies and be in full operation in 2008.  IDC is predicting that by 2009 more than 7% of all IT money spent in Japan will be for compliance-related projects.

For Records Management there are many global standards that already exist, like 5015.2 in the US, the UK Public Record Office Approved Electronic Records Management Solution, and Australia’s Victorian Electronic Record Strategy.  It seems inevitable that in this post-Enron environment that Compliance and Records Management requirements will spread worldwide.