It's a People Problem
So it's a problem—one of those dreaded "people problems." So how are companies addressing this problem? Looking at current software compliance-management solutions from a programmer's perspective, the phrase "heck of a job" comes to mind.
Companies have frequently ignored developer concerns or made them secondary. Very often what has been put forth as a solution looks like a whole new set of problems to the programmers who are just trying to get the job done.
There's certainly room for improvement in communication. In a survey by CFO-IT magazine last year, executives overwhelmingly agreed that government regulators didn't understand IT and IT personnel didn't understand government regulations, and that the situation was so bad that a reliable audit was simply not possible.
Developers have every reason to resent policies that complicate their jobs if the necessity for the policies has not been effectively communicated. Developers also have reason to resist burdensome policies when they can see that those policies are poorly conceived and inefficient. Jim Duggan of the Gartner Group recently pointed out that, while good automated tools do exist for at least parts of the compliance-management puzzle, "[t]o date, IT organizations have relied on manual integration and human handoffs." While that might be fine for small, one- or two-person projects, Duggan is talking about much bigger operations.
Looking at the glass as half full, I guess you could say that many companies now have enough experience with the problem that they should have gained valuable insights in how not to manage compliance.
So how do you manage compliance effectively? Catalyst Systems' Tracy Regan has some suggestions in "Compliance Scorecards" for companies on how to do compliance management without making the developers crazy.
A few other general points:
- SOX compliance requires something like COBIT, a set of best practices for IT governance, or COSO, a similar framework better suited for risk evaluation. Implementing the right practices is certainly a key to success.
- In managing compliance to project objectives, "[u]se cases are a big help," Marasco says. "Almost everyone agrees on this." Nice to see agreement on something.
- Then there are tools. The right tools for automating aspects of the process are crucial.
