eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Its good to be optimistic, and CIOs have some reason to be. More than 87 percent of respondents think their top executives take Sarbanes-Oxley compliance seriously, and, since executive sponsorship is the single most important success factor for any project, its not surprising that almost the same percentage of CIOs think their companies will be compliant by their deadline.
Most CIOs, however, think theyll get something more than bare compliance for their efforts, and we wonder if thats being a bit too optimistic. Almost half the CIOs who responded to the survey said their companies will do the minimum necessary to achieve compliance. Can those CIOs really get value—improvements in business processes—that they havent paid for?
CIOs cite problems with data structures, difficulties ensuring adequate security and business continuity, and variations in infrastructure between business units as three of the top four obstacles to compliance. These issues are closely related; they are the result of years of building information systems one-by-one in complex organizations, where data definitions, business rules and operating procedures are set department by department. A big company might have dozens of definitions built into its information systems for something as fundamental as a “product” or a “customer,” and it might have hundreds of conflicting business rules for managing the data. For a company thats grown rapidly via mergers and acquisitions—as many have over the past decade—the problem is compounded.
Next Page: Just another data warehouse project?
Can Real Business Value Be Gained from Sarbanes-Oxley? – Page 2
In theory, dealing with these issues should be straightforward: Analyze and document data definitions, values and business rules; then compare and reconcile as necessary. In practice, however, this is a demanding, time-consuming exercise that requires knowledgeable business analysts and programmers. Gartner Research estimates that over 70 percent of the effort spent on a typical data-warehouse project is devoted to data analysis. And where the data is concerned, complying with Sarbanes is not much different.
Have CIOs underestimated the effort required to do all that analysis? There are signs that some CIOs are feeling the kind of pressure that goes with an unexpectedly big job. CIOs also cited “inadequate IT budget” as one of the top four obstacles to compliance—and thats just another way of saying that the problem is bigger than the solution. There are three ways to deal with the situation: Get a bigger budget, exceed the budget (for time, money, or both), or cut the scope of the project down to something that can be done within the budget.
It appears that many CIOs in our survey are choosing the third approach. Almost half said that their enterprises would do the minimum necessary to become compliant. In effect, that means theyll focus primarily on financial data and systems.
the minimum enough? Only if you want minimum returns. In March, Gartners Executive Programs group published a survey of almost 1,000 CIOs worldwide. Respondents cited enabling new products, business intelligence and process improvement as the biggest new IS priorities. Standardized data about customers, products, services and operations are essential to these ambitions. Limiting the Sarbanes-Oxley cleanup effort to financial data may cost CIOs, and those costs may not be very far down the line. Those survey respondents who see Sarbanes-Oxley as a significant business disruption—meaning theyre putting more effort into it—are also most likely to think theyre going to get business benefits. We think theyre right.
In the last decade, businesses have funded big waves of IT spending—on client-server technology, e-business, Y2K, ERP, CRM, and now Sarbanes-Oxley. Its not surprising that many businesses want to spend as little as possible to solve this one. Its probably too late for many CIOs to scope their compliance projects to include information that would really improve their customer- facing business processes. But theyll get another chance, because the need to do so will remain long after compliance deadlines have passed.
Richard Hunter and Marcus Blosch are vice presidents at Gartner Executive Programs.