The key to a successful compliance strategy is integrating the idea of compliance success into your business—not viewing compliance as a project that can be completed and then considered “finished.” While painful, complying with regulations should be viewed as an opportunity to improve common business processes and not just an ongoing cost to the business.

It is no secret that there can be high costs associated with your compliance initiatives for both technology and employees. Only securing compliance for one regulation such as Sarbanes-Oxley or HIPAA will cause your costs to continue to grow as each new regulation is delivered over the years. To help limit the risk and cost, proactive ECM strategies must be developed within key areas, such as records management and business process management, ensuring that the proper business practices are followed and that content is properly captured, stored, managed, and disposed of at the appropriate and legal time in its lifecycle.
Developing a compliance initiative properly will tap many areas of expertise, particularly legal, IT, and records management; all in support of the overall business objectives of the organization. Individuals from each of these areas must contribute their knowledge and perspectives to ensure the benefits of a sound compliance program. While compliance is not always a technology problem, information technology, and the massive growth of unstructured content, contributes to corporate exposure.
The tools of ECM, properly used, can help reduce the overall cost of compliance to the business.
| Industry |
Regulations |
Penalties |
Challenges |
| Financial Industry |
SEC 17-a3/4 NASD 3010/3110 Sarbanes Oxley Gramm-Leach-Bliley SB1386 in CA PIPEDA (in Canada) EU Data Protection Act FDIC Security Guidance |
Litigation Public Discontent Fines Probation Terms Imprisonment |
Email / IM Retention Document Retention Corporate Governance Information Security Discovery |
| Healthcare |
HIPAA Sarbanes Oxley Gramm-Leach-Bliley PIPEDA (in Canada) EU Data Protection Act |
Litigation Public Discontent Fines Probation Terms Imprisonment |
e-PHI Retention Electronic Security Discovery |
| Legal |
Sarbanes Oxley PIPEDA (in Canada) |
Public Discontent Probation Terms Imprisonment |
Document Retention Litigation Preparedness Discovery |
| Utilities |
FERC/SOX/SEC Federal Power Act PIPEDA (in Canada) NASD (if trading) |
Litigation Public Discontent Fines Imprisonment |
Email / IM Retention Document Retention Corporate Governance Discovery |
| Life Sciences |
21 CFR Part 11 Sarbanes Oxley Gramm-Leach-Bliley EU Data Protection Act |
Litigation Public Discontent Fines Imprisonment |
Email / IM Retention Corporate Governance Process Auditing Discovery |
| US Public Sector |
Freedom of Information Act 5015.2STD |
Litigation Public Discontent Fines |
Email / IM Retention Email / IM Auditing Internal Controls Process Checks Discovery |
| Insurance |
HIPAA Sarbanes Oxley SEC Rule 39a-1 NASD 3013 |
Litigation Public Discontent Fines |
Email / IM Retention Document Retention Corporate Governance Information Security Discovery |