With compliance emerging as one of today's most prevalent business issues, multiple corporate functions are beginning to converge in a federated approach to addressing quality, risk and overall compliance management. This convergence, though arguably a more efficient approach, may not be an intuitive state for policies and processes traditionally created in silos. Nor is convergence always a logical process for the people who operate, manage, and implement those policies and processes.

As the visibility of compliance continues to rise, there is a concurrent increase in the importance placed on information technology and the role of the CIO. Like other parts of the enterprise responsible for risk and compliance, IT's mandate has expanded in the post-Sarbanes-Oxley (Sox) environment. Beyond the traditional charge that comprises the fundamentals of keeping the lights on and the company out of trouble, IT and the CIO now share responsibility for making the business better. Ironically enough, one of the most "siloed" of functions has become one of the most well-positioned to do just that.

A Look at the Compliance Landscape

Understanding how IT's role is evolving comes best with an understanding of the compliance landscape. Every company operates with rules and regulations, which may vary by industry, geography, size or other factors or may even have been self-imposed in a proactive effort to improve operational efficiency. Historically, the majority of compliance criteria have centred on financial or environmental issues. Many were created and implemented in response to a particular issue; likewise, they may have been executed and monitored at the business-unit or departmental level via spreadsheets or other manual means.

As the regulatory environment continues to change with marked frequency and measurable complexity, so do the requirements for automated, repeatable controls and processes around the classic information compliance drivers - internal controls over financial reporting, controls to protect and govern the use of personal information, protection of intellectual property, records management and e-discovery rules. What's more, the "shrinking earth" is giving rise to a set of standards that are global in scope, with Sox in the US spawning similar legislation in Japan, Canada, Australia, France, Italy and the Netherlands. The UK's Financial Services Authority's foray into outcomes-based regulation has also sparked interest in a similar approach in other countries.

Legal risk and the implications of non-compliance are also expanding, with the potential for what could be called catastrophic consequences ranging from significant fines and irrevocable damage of company brand and reputation to jail time for executives. Information itself has become a regulated asset, with specific criteria for its protection, privacy, use and retention.

Inefficient processes, the increasingly complex regulatory and business environment, and shortage of talent are placing unprecedented demand on current systems and procedures. The "typical" organization has core compliance accountabilities for multiple functions and business units, with HR, security, finance, legal, risk, internal audit and others, each addressing compliance differently. Against the backdrop of this ever-expanding compliance environment and the increasing number of business functions and operational areas it encompasses come the growing expectations of stakeholders. They want not only effective compliance risk management and transparency in their strategies but also a reasonable return on the significant investments made in information technology, plus measurable means for improving the business overall.

The Convergence Conundrum

The proactive CIO can leverage IT capabilities to help achieve sustainable compliance by designing and implementing an effective, integrated program with built-in components to align and coordinate compliance functions, processes, and activities as well as provide adequate oversight and appropriate risk coverage. That, however, may be easier said than done.

In an effort to see how far the reality of convergence has gone and how companies operate in that environment, Ernst & Young chats with clients as well as conducting formal studies and surveys, such as the 10th annual "Global Information Systems Security Survey". One such survey focused on the financial services industry, a group accustomed to and well entrenched in the process of operating in a highly regulated environment. While there was universal familiarity with the concept of streamlining governance, risk and control processes, most companies were in the early stages of the convergence process and their activities driven by short-term objectives. While improving efficiency and reducing costs were common goals, there were the opposing forces of a corporation's natural tendency toward siloed infrastructures and people's natural resistance to change, particularly around the highly sensitive areas of risk management and compliance.

So who can help? With so many interests, functions and entities trying to reach the goal of compliance and converging in the process, whether intentionally or not, it takes no great leap to envision overlaps, redundancies and conflicts. Also, with information as the common denominator, it's easy to see the role of information management, IT and the CIO taking on new importance and new responsibility.