The world is watching: can the U.S. and Western European regulatory environment help predict future global initiatives?

Regulatory compliance is no longer a new concept, especially in the United States. It is one of today's most popular buzzwords and a topic that is in the forefront of many business and IT professionals' minds. American companies are intimately familiar with legislation such as Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HIPAA), and the SEC 17A-4 regulation and how these are dramatically changing the way organizations manage, secure, and store their information. In addition, many companies are knee-deep in establishing and reengineering policies and processes, and implementing technology to facilitate compliance with numerous regulations.

That is not the case, however, around the world. In many countries, compliance is an emerging trend that users and IT vendors are feverishly trying to understand due to the globalization of the business community. In doing so, the international community is closely watching the types of regulations being adopted in both the U.S. and Western European environments and asking a lot of questions, such as:

* How is compliance affecting U.S. companies?

* What steps are organizations taking to address the requirements?

* Are best practices emerging?

* What role does technology play in compliance?

U.S. organizations have been asking these same questions for the past 12 to 24 months.

The international feeling is that the regulatory environment has been primarily U.S.-driven and it is only a matter of time before others follow suit. Anticipating an increase in regulatory initiatives and laws in their own countries, companies in different regions are using the current regulatory activity to predict and prepare themselves for emerging regulations. Also, many believe that, as appropriate, their mandates will harmonize with U.S. initiatives.

This approach makes sense because the core elements and focus of many current regulations fall into a few categories, including information integrity, privacy, and records retention. Therefore, the high-level business and technology requirements will be similar throughout the world. It is for these same reasons that IT vendors have turned their attention worldwide. To reach the global market, technology providers want to ensure that their products and solutions address these emerging regulations.

Two categories of regulations are receiving the most attention worldwide:

* Internal controls: The United States leads the charge in terms of legislation such as SOX that attaches strict penalties and accountability to process and internal controls requirements around financial reporting. In Europe, the Basel Committee on Banking Supervision is taking similar steps to revise international capital measurement and capital standards as part of Basel II. Basel II introduces a new risk to measure: operational risk, broadening the scope of risk management for the international banking community beyond product-related risk to include internal processes and systems. Basel II will force firms to look at risk management from an enterprise perspective. Consequently, several countries, including Canada, Germany, and France, have passed their own internal controls regulation.

* Privacy and data protection: In many respects, Western Europe is the region that initially led the charge in terms of privacy and data protection regulations with the European Union Data Protection Directive. Several European countries, such as the United Kingdom, Ireland, and Sweden, have in turn integrated parts of the directive into their own localized laws. The United States additionally passed many privacy regulations, including Graham-Leach-Bliley, HIPAA, and CA SB 1386 that have significantly increased the scope and reach of the privacy mandates.

Early IDC research shows that the Asian Pacific region is the next to be impacted by the compliance wave. For example, in April 2005, two new regulations will go into effect in Japan. The first is a privacy regulation, the Information Protection Law, which will greatly impact how Japanese companies that maintain personal information databases manage their information. The second regulation is called the eDocument law. Japanese companies have long been required to retain certain documents such as contracts in paper form for seven years. The new law that takes effect in April will allow Japanese companies to retain the information in electronic format, however, it does not make it a requirement. These two regulations may have a noteworthy effect on how Japanese companies manage, secure, and retain their information, although the effect may be slow because neither carries strict penalties. In fact, most countries in the Asian Pacific region do not have regulations carrying strict penalties.

The question is: Will the notion of increased social responsibility drive other cultures to adopt as intense of a regulatory environment as the United States has? Many U.S. compliance-related initiatives are the result of public scandals and expensive lawsuits, but such business issues are not as prevalent in many countries around the world.

However, there are several factors pointing to the expansion of regulatory compliance worldwide. For starters, multinational and international companies that either trade on the U.S. stock exchange or do a significant amount of business in the United States must comply with some of the U.S. regulations. Therefore, many local offices around the world have had to make changes to their processes and procedures. In addition, some U.S. companies are starting to require their partners throughout the world to comply with SOX and other regulations to decrease their risk and increase their operational transparency and efficiency. This requirement will lend itself to a situation where international companies use U.S. regulations as best practices, similar to what U.S. private companies are doing with SOX.

So what does this mean for U.S.-based organizations? Unfortunately, it means that the compliance landscape may become even more complex. Multinational companies already struggle with reconciling disparate and, in many cases, contradictory local requirements. The addition of regulations around the world will further "muddy the water" and increase the cost of compliance. The complexity and cost of compliance may also emerge as a barrier to global expansion for some companies.

Julie Rahal Marobella is Senior Research Analyst, Records Management and Compliance Infrastructure, at IDC. She may be contacted at [e-mail].