Firms 'confused and ill-informed' about compliance regulations

Companies are still woefully ill-informed about the compliance impact of regulations such as Sarbanes-Oxley (SOX), with many believing they can hand over responsibility by simply outsourcing it, according to new research.

The snappily titled study, Organisational Trends in Sarbanes-Oxley and Regulatory Compliance Issues by Meta Group also shows widespread confusion throughout businesses about the impact of compliance regulations.

Meta Group claims most firms are woefully ill-informed about the pervasive effects of acts like SOX, with only 55 per cent of those surveyed saying compliance measures will change their use of external business or outsourcing services.

Execs are also split on the nature of changes expected with 21 per cent saying they are more likely to outsource functions as a result of compliance with SOX, and 19 per cent expecting to outsource less. A quarter said they had no way of calculating the impact and 17 per cent said they did not expect compliance to have any effect on outsourced work.

John Van Decker, VP in Meta Group's enterprise application strategies service, said in the report that companies are treading dangerous ground if they think outsourcing functions will abdicate them of compliance responsibilities.

"Organisations are just as responsible for ensuring the compliance of outsourced IT systems and processes as they are for those systems maintained internally," he said. "This accountability will present a challenge to organisations, since they must assess whether their outsourcers' controls are compliant and adequately documented. Companies cannot do this without first understanding the fundamental impact compliance measures will have on all business processes, particularly outsourcing."

Meta Group questioned a random sample of nearly 300 executive, finance, and IT decision-makers for the research.