Gartner Warns Sarbanes-Oxley ''Quick Fix'' Solutions Won't Last

Enterprises that purchase Sarbanes-Oxley targeted solutions in 2004 will retire or replace those systems by the end of 2005, according to Gartner Inc., Stamford, Conn."Enterprises that choose one-off solutions for each regulatory challenge that they face will spend 10 times more on compliance projects than their counterparts that take a proactive approach," says French Caldwell, research vice president at Gartner. "Although there are times when adopting a 'quick-and-dirty' solution may be necessary to meet deadlines, enterprises should avoid committing too much time, effort or data to such systems."

Gartner will provide additional analysis on the impact Sarbanes-Oxley compliance will have on enterprises during Gartner's Midsize Enterprise Summit East 2004, April 18-21 at the Gaylord Opryland Resort in Nashville, Tennessee. The Summit will include nearly 500 IT decision makers, more than 60 sponsors and vendors, as well as approximately 30 Gartner analyst presentations.

Gartner analysts recommend that 50% of a company's Sarbanes-Oxley budget be allocated for implementation and remediation issues, including directors' and officers' insurance and increased consulting fees. Thirty percent of the budget should be spent for internal analysis, including redundant audits for the next three quarters. The remaining 20% of the budget should be spent on software upgrades and new purchases.

"While many large companies see Sarbanes-Oxley compliance as a way to improve risk management and to rationalize IT management, midsize enterprises are less likely to see the opportunity and return on investment (ROI) in Sarbanes-Oxley. That's a mistake," Caldwell says. "Focusing just on compliance misses the big picture of improving corporate governance and transparency that will lead to better business decisions and real ROI."

Gartner defines the traditional midsize enterprise market as companies with 100 to 999 employees or revenue between $50 million and $500 million, and larger midsize enterprises as companies with revenue of $500 million to $1 billion.

Midsize Enterprise Summit will also take place on the West Coast, September 19-22 in San Diego. The Summit will be presented to the midmarket community in Europe, June 16-18, in Dublin, Ireland.

For more information, visit www.midsizeenterprise.com.

Source: Gartner Inc.

For reprint and licensing requests for this article, click here.
Security risk Data security Compliance Core systems
MORE FROM DIGITAL INSURANCE