SPOTLIGHT ON SARBANES-OXLEY - FROM CONCEPTION TO RECORDS MANAGEMENT COMPLIANCE

The Sarbanes-Oxley Act of 2002 (SOX) has changed the way companies, both publicly-held companies and their suppliers, do business, creating new standards for corporate accountability and mandates for consistent, trustworthy records management practices. Understanding SOX compliance, why it exists and its impact on today's corporate environment are the first steps towards creating and implementing a comprehensive compliance strategy.

SOX In A Nutshell

The Sarbanes-Oxley Act dictates that corporate financial departments or outside accounting firms must be able to certify that financial statements represent accurate operations and financial conditions. In addition, companies must provide second-day reporting of insider trades and disclose changes in finances or operations on an updated and immediate basis.

Entities affected by SOX are U.S. and international companies listed on the U.S. Stock Exchanges, accounting firms and any of the suppliers and organizations that do business with these companies. SOX noncompliance can result in penalties ranging from substantial fines to imprisonment, not to mention intense public scrutiny and loss of consumer and shareholder confidence.

The Birth of SOX

After the tragedies of 9/11 and corporate scandals such as Enron, Arthur Anderson and Martha Stewart, all involving some type of slanted accounting or reporting of financial transactions resulting in severe losses to stakeholders, employees and a decline in public perception and investor confidence, the government decided to implement practices that would make organizations more accountable to investors, employees and the public. In addition, what began as regulation for publicly-held companies, has expanded to include private organizations that supply goods to those companies.

SOX was created to make changes in federal securities regulation, corporate governance, and the regulation of auditors to deter insider trading, questionable accounting practices and reporting activities; the improper destruction of records; information tampering; and other non-compliancerelated issues. It places greater scrutiny on publicly-held organizations and their suppliers that have a responsibility to both internal and external groups.

The affect on business/RIM

Some feel that SOX calls attention to what organizations should have been doing all along to better manage their informational assets. When a company is SOX compliant, litigation risk is reduced, the organization is held more accountable for financial practices, and internal, shareholder and public trust are established.

The largest challenge of SOX compliance, both universally and in the area of records management, is the difficulty of implementation, including upgrading filing systems or implementing record management technologies. The time needed to achieve compliance is a strain on small businesses, and the physical and financial resources to maintain compliance are just not available.

AMR Research, a leading advisory firm focused on the intersection of business processes with supply chain and enterprise technologies, cites that companies spent $6 million on SOX compliance in 2006 and estimates they will spend the same in 2007. Even with such substantial investments, many small businesses are still not compliant, and Congress has repeatedly extended deadlines to accommodate the challenges facing these organizations.

While obstacles are many, SOX is still a force to be reckoned with and understanding its varying nuances will help public and private businesses alike put the necessary steps in place to achieve and maintain regulatory compliance.