Compliance is the buzzword of late The world is becoming increasingly concerned with compliance, transparency and risk management.

Transcription

1 Strategic Planning, D. Logan, K. Shegda, H. El-Gabri, T. Bell Research Note 24 November 2003 Sarbanes-Oxley Will Boost Content and Process Management Content and process management software has been extended to help companies comply with new laws like the U.S. Sarbanes-Oxley Act. Managers now have a much stronger business case for deploying these tools in Core Topic Knowledge & Content Mgmt., Collaboration & E-Learning: E-Workplace Systems and Technology Key Issue What innovations will disrupt the e- workplace during the next five years, causing shifts in workplace behavior and technology investment? Strategic Planning Assumptions Companies with poor content management and largely manual business processes will spend at least three times as much on compliance per year as those with good records management (0.9 probability). Oracle, SAP and Microsoft will each purchase one or more of the specialist content management vendors by YE04 (0.7 probability). Companies that don't have internal process controls documentation for Sarbanes-Oxley compliance complete by YE03 will miss the 2004 deadline for full compliance with the law (0.8 probability). Companies that purchase Sarbanes-Oxleyspecific solutions in 2003 and 2004 will retire or replace those systems by YE05 (0.8 probability). Compliance is the buzzword of late The world is becoming increasingly concerned with compliance, transparency and risk management. Many companies have made a great effort to comply with the U.S. Public Company Accounting Reform and Investor Protection Act of 2002, known as the Sarbanes-Oxley Act. This was passed in response to the sensational corporate fraud cases of Enron and WorldCom. It is designed to reduce fraud and conflicts of interests, while increasing financial transparency and public confidence in the markets. The first section to be implemented requires the auditing of internal processes for financial statements. Content and process management vendors now include much more prepackaged functionality in vertical and horizontal applications. Content, people and process are interdependent in many areas, including compliance, loan origination, insurance claims processing, contract management, legal case management, and patient records. Vendors are using regulatory compliance and its associated processes and documents to drive business. This isn't new, but has become more intense in the wake of Sarbanes-Oxley. Enterprise content management (ECM) and business process management (BPM) vendors will sell their products as a means of meeting their clients' basic compliance needs and will use the opportunity to expand. This will give organizations that have not yet embraced ECM a clear reason to do so. We believe regulatory compliance will be very important in this market across all verticals in Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 Prediction: Compliance requirements will account for 50 percent of spending on content and business process management systems from Most companies that implement ECM and BPM systems in 2004 will be influenced by compliance issues. Implementation activity will not pick up until 2H04, but will be strong through 2005, as companies realize how time-consuming it is to comply manually. Content and process management technologies may help organizations, but it is not always easy to make a financial business case for them. Controlling content can save time and effort and help manage "information overload." But these benefits are indirect and ill-defined. It is easier to make a financial case for content and process management as a business process. Targeted applications like electronic insurance claims processing can save an organization a lot of money. Vendors are missing the business need that ECM meets process-specific content management. Controlling content has become equated with controlling risk. Recent stock market scandals have shown how important it is to manage properly. Complying with Sarbanes-Oxley requires better control of both electronic and paper documents. Automating a financial process, in full or partially, has a number of benefits. It provides an audit trail, allows rules to be applied automatically and can track the responsibility and actions of individuals via metadata. Strategic Planning Assumption: Companies with poor content management and largely manual business processes will spend at least three times as much on compliance per year as those with good records management (0.9 probability). Use tools to control unstructured content, especially . Audit and document business processes, subjecting them to the same management principles as content. To prevent these activities from becoming isolated, IT departments should consider developing a competence center that focuses on how best to address general and technical compliance issues. Develop expertise in specifying and building content and process management applications. Architecturally, it may make sense to store process logic and the associated content within a stand-alone or logically isolated compliance content archive. Content integration can then be managed via application integration protocol standards, such as 24 November

3 XML, SOAP and HTTP. This approach allows the compliance archive to be isolated for security and data retention purposes. Prediction: To address compliance issues, storage and infrastructure vendors will buy CM and BPM vendors, changing the market drastically. All the major ECM and many BPM vendors will use compliance, especially with Sarbanes-Oxley, to market their products in Technologies that address business rules will be kept separate from other process control applications. Consolidation in the ECM market will speed up as infrastructure vendors purchase smaller content and process control vendors and the remaining vendors settle into best-of-breed roles. Events in 2004 will shape thismarketforsometimetocome. Strategic Planning Assumption: Oracle, SAP and Microsoft will each purchase one or more of the specialist content management vendors by YE04 (0.7 probability). Evaluate your infrastructure vendors' ECM and BPM capabilities. IBM, SAP, Microsoft and Oracle will all provide some level of ECM capabilities, but check if the integration between the components suits your needs. Each vendor needs to extend a different part of their ECM offering (see "The Reality Behind Enterprise Content Management"). Best-of-breed players will still be viable for many applications for example, high-volume imaging and workflow, and sophisticated collaboration between groups, like product design and development groups. If you need to purchase a content management solution to support a specific business process, don't wait for the big infrastructure vendors. Their offerings will not be mature in Prediction: Sarbanes-Oxley will yield competitive benefits for those who comply. Business leaders have complained repeatedly about the Sarbanes-Oxley Act. It has been denounced as too vague, too harsh, too hard to comply with and a tax on business. Some hope the regulators will back off as the economy recovers and the excesses of the past are forgotten. That will not happen in Confidence in the U.S. economy has not yet returned. The law exists and politicians have other problems to deal with. Financial issues will be ignored in favor of Iraq and the 2004 presidential election. The U.S. Securities and Exchange Commission is already using the mechanisms it has been given to investigate, 24 November

4 sanction and jail those that do not comply. Meanwhile, the Public Company Accounting Oversight Board is issuing documents that clarify the legal requirements. Institutional investors are beginning to see the advantages of Sarbanes-Oxley and lending institutions are beginning to realize that compliant companies, with well-documented financial processes, are better financial risks. Strategic Planning Assumption: Companies that don't have internal process controls documentation for Sarbanes-Oxley compliance complete by YE03 will miss the 2004 deadline for full compliance with the law (0.8 probability). Consider the vendors now entering the market. In mid-2004, the focus will turn to Section 409 of Sarbanes-Oxley, which mandates rapid disclosure of financial information. Companies must continue compliance work after the first deadlines have passed. Prediction: Consulting firms and auditors will benefit the most from the rush to implement Sarbanes-Oxley. Most major applications software vendors have used Sarbanes- Oxley in their marketing, but not all of them will benefit. Companies with ECM and BPM products will use them to meet their basic needs. Compliance and corporate governance specialists will tailor their tools as adjuncts to a growing corporate governance consulting market and vie for dominance. Consulting ranks will be dominated by the big consulting firms IBM Global Services (which has acquired the consulting arm of PricewaterhouseCoopers), Deloitte and Touche, BearingPoint and Accenture. Some system integrators and niche players will compete for business. Niche players may ally themselves with one of the larger firms and resell their products, but they will continue to get more revenue from services than they do from licenses. Bigger services vendors will bill themselves as being neutral about tools, but three or four close alliances with vendors will heavily influence their choice. The biggest published compliance checklist tools during the first wave of panic about Sarbanes- Oxley. These tools were offered free of charge and almost all of them are now unsupported. We expect that all Sarbanes-Oxleyspecific tools from auditors will be unsupported by the end of November

5 Strategic Planning Assumption: Companies that purchase Sarbanes-Oxley-specific solutions in 2003 and 2004 will retire or replace those systems by YE05 (0.8 probability). You will still need the advice of specialists in More sophisticated software offerings will be created to help you comply with relevant legislation. Evaluate these offerings in light of Gartner's Sarbanes-Oxley vendor evaluation framework and compliance architecture advice to avoid dead-end point solutions (see "Sarbanes-Oxley Vendor Evaluation Framework"). Bottom Line: The content management and business process management markets in 2004 will be shaped by users concerns over compliance, transparency and better corporate governance. These concerns will accelerate consolidation in these markets, allowing content and business process management to become an integral part of the IT infrastructure. 24 November