SOX and Micromanagement
How regulations are used as an excuse for costly disempowerment.
CIO — Last night on the airplane, the fellow sitting next to me spoke candidly on the condition that I’d mention his son’s name in print. Hi, Brian!
He also demanded anonymity. We’re not talking about a national political intrigue here, but the facts are disturbing.
Wallace (not his real name) is an ERP consultant. On his last two projects—major implementation programs in two different huge corporations—he conservatively estimated that one-third of the costs of the project were wasted in the name of Sarbanes-Oxley (SOX) compliance.
That’s a 50 percent increase in project costs over what they otherwise would have been! I was skeptical. Sure, there are costs of compliance with all regulations. But “wasted”? Corporate accountability isn’t a waste.
No, he protested. He insisted he wasn’t talking about the costs of complying with SOX. Rather, he was saying that these companies could have complied to the same degree for far less money. Now he had my interest. As I probed, I learned that the real issue was not SOX, but instead was micromanagement.
<> Let’s look at how SOX and other regulatory requirements are sometimes implemented in a way that”s disempowering and expensive.Two Dimensions of SOX Compliance
As with many regulations, SOX generates two distinct requirements. On one hand, it causes clients to buy applications from IT that help them report data in a truthful, transparent and timely manner. From the IT perspective, this is nothing more than a driver of systems requirements. The regulation generates “sales” for IT internal service providers, at a cost to the company. But one would expect that clear data should be useful to leaders and shareholders as well as regulators, so the cost of these systems isn’t a total waste.
On the other hand, SOX (and other regulations such as validation in the pharmaceuticals industry) requires that IT produce documentation of its development and testing processes, among other internal controls. These are additional work products—“artifacts” if you like buzzwords—that become another deliverable inherent in any development project affected by the regulations. And of course, they have a cost too.
But again, documenting processes isn’t a total waste. Doing so should help IT improve its processes and produce better and more maintainable systems.
The waste that Wallace was talking about is more subtle.
The End Does Not Justify the Means
Wallace gave me an example. In the name of SOX compliance, one of the companies that Wallace had mandated the use of a specific documentation method, UML (Unified Modeling Language), for all systems built by IT. UML, incidentally, is an excellent way to describe an object-oriented system’s specifications.
