Nearly Half Of SOX-Affected Businesses Unlikely To Meet Deadline

by Glen Shapiro, LawAndTax-News.com, New York

30 September 2005

According to a survey recently published by instant messaging security and management firm, Akonix Systems Inc., almost half of the public companies questioned do not expect to meet the message retention requirements subject to the July 15, 2006 Sarbanes-Oxley (SOX) compliance deadline.

Akonix revealed that 45% of the listed firns polled may be facing jail time for company executives and officers, as well as hefty financial fines, as a result of this failure.

According to SOX Section 404, public companies are required to undergo an annual evaluation of their internal controls and procedures for financial reporting, as well as an assessment for the effectiveness of these controls. When electronic communications like instant messaging (IM) are involved in that process, those communications need to be logged, archived and available upon request.

In Akonix’s survey of 157 executives at public companies, conducted in August, only 29% felt they would be able to meet the deadline for archiving messages, while a further 26% did not know if they would be prepared.

The survey explained that the cost of SOX compliance is a major barrier for organizations. Email and IM logging and archiving requirements are adding to this cost, with many companies scrambling to add more storage capacity to house the growing number of daily emails and instant messages created at their firms.

“It’s alarming that almost half of the companies in our survey anticipate they will fail to meet the message retention requirements set forth in the next year’s SOX deadline, even with 10 months still remaining to get their systems in place,” observed Francis Costello, chief technology officer at Akonix, going on to add that:

“Businesses must realize that by not logging and archiving all electronic communications, including IM, it can result in corporate legal liability. Rulings from regulatory agencies encourage organizations to regularly disclose policies for email management and IM services, but many popular software applications aren’t equipped with features for enforcing compliance, which leads some organizations to neglect or ignore their own policies.”

Recommended