Compliance catch

Considering regulatory compliance is likely to drive the next wave of tech investments in India, corporates don't really have a choice but to fall in line.

Jeffrey Skilling, Enron's former chief executive, faced 28 counts of fraud, conspiracy, insider trading and lying to auditors for allegedly trying to fool investors into believing Enron was healthy, before the firm crashed.

Enron's founder and former chairman Ken Lay faced six counts of fraud and conspiracy for perpetuating the scheme after Skilling quit in August 2001.

Both pleaded not guilty and claimed ignorance of the fraud schemes. Undoubtedly, it was the biggest in a series of scandals that damaged the reputation of corporate America.

Six years down the line, Indian corporates are fumbling in the dark as far as information management and data protection is concerned.

With no regulatory framework to adhere to, the corporate information and data misuse list is the biggest threat for any Indian corporate. Sarbanes-Oxley (SOX) was a direct result of Enron, imposing stricter rules on auditors and making corporate directors criminally liable for lying about their accounts. Defaulters have to fork out a fine of up to $5 million or spend 20 years in jail.

"The message sent to businesses was that corporate governance is no longer optional, and ignorance is not an excuse," emphasises Steve Leonard, senior vice president, EMC Corporation. "Indian businesses that do not ensure appropriate corporate governance policies, processes, procedures and controls are courting disaster," he warns.

India has successfully adapted and followed the Westminster model over the years to suit the local business environment, explains Pavan Duggal, advocate, Supreme Court of India and cyberlaw expert.

He adds, "With the introduction of the Securities and Exchange Board of India's (SEBI) Clause 49 on January 1, 2006, corporate governance has taken on a new meaning in this country. It's time now for Indian corporates to invest in information management and compliance tools."

Nishith Seth, director, Seth Services "" a digital forensic, information security audit consultancy company, believes that while compliance tools may not become mandatory "due to sheer size of operations, complications in business process, data size, organisations shall be left with no other option than to be compliant".

Recognising the fact that regulatory compliance will drive the next wave of IT investments in India, EMC has launched two solutions, which include an email archival and a document management tool.

Both solutions are personally tested by Duggal who believes that "2006 brought issues like data theft in BPOs and electronic documents being stolen from multinationals to the fore. 2007 would be the year when Indian businesses would have to fortify data management issues to prevent financial losses, penalties and loss of reputation."

According to IDC, worldwide information management for the compliance market is forecast to cross the $20 billion mark by 2009, marking a compounded annual growth rate of 22 per cent.

For Sunil Mehra, sales director (Fusion Middleware), Oracle (India), corporates are eager to clean up their act. He says, "While regulatory, legal compliance typically applies to public companies, many private firms consider compliance as a considerable benefit, if not a requirement, to stay competitive."

Companies with plans to go public or those looking to be acquired need to preemptively establish and articulate internal controls and financial reporting practices, he explains.

"Even companies that rely on lenders or venture capital must have effective governance practices and financial transparency in order to gain funding. Beyond this, many private and non-profit companies have established compliance programmes simply because they see it as good business," says Manoj Chugh, president, EMC (India & SAARC).

Clause 49 expects listed companies in India to report to SEBI on a quarterly basis, a confirmation of the compliance of all provisions of Clause 49.

This includes 15 categories of reports about a company's performance in the areas of financial management, human resources management and business processes.