Johannesburg, 25 May 2004
Every executive should, by now, realise the importance of complying with new reporting and governance regulations. But, asks Paul Mullon, marketing director of Metrofile, how many have investigated whether their companies can deal with the information burden these new rules bring?
South African companies with US parents, or those with substantial dealings with American firms, will soon find themselves affected by some or all of the new governance and reporting laws in effect in the US, such as the Sarbanes-Oxley Act, HIPAA and others. In addition, they will have to handle similar local regulations that will place an added and unexpected data management burden on their businesses.
What this means for executives is overseeing stricter reporting procedures, directorial accountability and the ability to find and provide any information gathered by the business over any number of years in a relatively short period of time.
Businesses attempting to meet these requirements are in for a tough time if they do not have an efficient records management system in place. Unfortunately, even for organisations with a records management solution, the Catch-22 is that most of these solutions were designed before the regulations were created and they do not completely meet compliance rules.
This lack of preparedness is borne out in a US study commissioned by ARMA International and conducted by opinion research firm International Communications Research (ICR). Even though it is more than a year since the Sarbanes-Oxley Act became law, the survey shows that US companies are still struggling to understand and comply with its provisions.
According to the survey, only 30% of the executives surveyed believed their companies would be prepared to face the challenge of a Securities and Exchange Commission (SEC) investigation into their information control practices right now. Moreover, about 37% of the surveyed companies have not even assessed their own internal controls for managing information - now a required part of a US company`s annual financial audit. And about 55% of the business leaders interviewed remarked that their companies had only made "some" progress toward Sarbanes-Oxley compliance.
The real eye-opener from the survey, however, is that 95% of the executives expect that their companies will have to make some changes to their records management procedures if they are to comply with Sarbanes-Oxley alone. Of those, 25% expect to have to make extensive changes.
South African companies are probably less prepared for these new rules as stricter compliance, governance and reporting regulations are not yet as entrenched here. In addition, defined records management procedures are not as advanced a science here as they are in America.
Worse yet, local companies could find they are facing a crisis if they leave compliance to information laws to the last minute. The rules will be more complicated than they first appear since they have been promulgated by politicians and lawyers without due regard for the real business world the rest of us have to function in.
In real terms then, there is no basis for determining that a certain set of processes is correct, as none have been tested in court, yet. Even in the ICR survey, only 7% of the respondents thought the provisions of Sarbanes-Oxley requiring more extensive record keeping and control were very clear.
The main elements of new regulations that have garnered the most attention and action are the clauses requiring business leaders to certify company results and accept accountability for them.
However, in their quest for self-preservation, many have forgotten about the requirements around certifying records management controls. This is not an unrelated annoyance: managing data efficiently will smooth the process of ensuring all regulations are met. Easy and reliable access to information is the foundation to compliance.
Companies doing the minimum to meet regulations will save money and frustration in the short-term, but will find they are constantly experiencing the same problems and hurdles every time they need to report figures, respond to requests for information and meet other compliance requirements. On the other hand, those taking the plunge and improving or implementing new records management strategies designed specifically to meet regulatory requirements will find the initial cost outlay more than pays for itself over the medium-term as compliance becomes just another facet to doing business.
Share