Ask FERF about ... using enterprise content management for Section 404 compliance.

Sarbanes-Oxley Section 404 has put renewed emphasis on good internal control over financial reporting. Yet, in year one of compliance, many companies still relied on simple spreadsheets to document process controls for their Section 404 efforts.

Those same companies are now looking for business process improvements, standardized systems and automated controls to work more efficiently. (See the article "Year-Two Section 404 Compliance: Smart Companies are Working Smarter," Financial Executive, November 2005.) Many companies have found that Enterprise Content Management (ECM) can be a useful solution for Section 404 compliance.

In fact, many think that ECM--around for years and primarily used by financial services companies--will become the future for document management.

The international authority on ECM is the Association for Information and Image Management (AIIM). ECM is defined by AIIM as: "The tools and technologies used to capture, manage, store, preserve and deliver content and documents related to organizational processes. ECM enables four key business drivers: continuity, collaboration, compliance and costs."

Seven 'Keys' for IM Frameworks

In March 2004, AIIM published Information Nation: Seven Keys to Information Management Compliance, by Randolph A. Kahn, Esq., and Barclay T. Blair. This book makes the case that organizations need to adopt a framework for information management compliance that includes the following seven "keys:"

1. Good policies and procedures;

2. Executive-level program responsibility;

3. Proper delegation of program roles and components;

4. Program dissemination, communication and training;

5. Auditing and monitoring to measure program compliance;

6. Effective and consistent program enforcement; and

7. Continuous program improvement.

In April 2004, AIIM and Kahn Consulting Inc. commissioned a survey of end-user organizations to quantify the current status of adoption of these seven keys. The results of this survey were published in The Emperor's New Clothes: The Current State of Information Management Compliance, by John F. Mancini, president of AIIM. This report, available as a free download from the AIIM website (www.aiim.org), concludes that the reality of compliance is far more complex than most organizations will admit.

In the report, Mancini asserts that "90 percent of the information that organizations must manage is unstructured--information that does not neatly fall into the rows and columns of a traditional database. Moreover, unstructured information is at the heart of business processes. Processes cannot be improved until this flow of information is standardized, digitized, and managed."

One of the questions in the survey is: "In the last 18 months, has your organization made, or does it plan to make in the next 18 months, changes to the way the records and information are managed as a result of the following...."

The number one response to this question was "The Sarbanes-Oxley Act," indicated by over a third (36.7 percent) of the respondents.

In 2004, Doculabs published Sarbanes-Oxley: Challenges and Opportunities in the New Regulatory Environment, a white paper that describes the challenges faced by organizations as they develop strategies for compliance. This white paper is available as a free download from the Hyland Software Inc. website under "Downloads" (www.onbase.com/English/Products/OnBaseProductModules/Downloads).

This white paper notes that "storage and archival of financial information and related content is central to the mandates of Sarbanes-Oxley Section 404." Thus, "with their ability to manage and track the flow of information, enterprise content management technology solutions provide the critical capabilities to help meet the requirements of Sarbanes-Oxley Section 404 compliance."

The white paper then describes the OnBase SOX Solution, as offered by Hyland Software, which can be used to document and test internal controls.

A number of software vendors now offer ECM software. In November 2005, Gartner Inc. published Magic Quadrant for Enterprise Content Management 2005. This industry research report, also available as a free download from the Hyland Software website, assesses the ECM vendors and their products' completeness, maturity and interoperability. Gartner's Magic Quadrant evaluates 18 different ECM vendors on two scales: "completeness of vision" and "ability to execute."

For more information on ECM, visit the FERF website (www.ferf.org) for an Issue Alert (free to FEI members).

William M. Sinnett ([e-mail]) is Director of Research at Financial Executives Research Foundation (FERF).

contributed by FERF