Compliance: process and content

Providing real-time monitoring and then using alerts to identify potential problems is the ideal scenario for compliance, and it also moves organizations toward best practices in their business processes.

Content for compliance

Compliance is a strong driver for companies to manage their content more effectively, and enterprise content management (ECM) vendors have taken great interest in developing solutions for compliance.

"Issues of lost productivity that result from poor content management are now being made worse by risk considerations," says Rich Buchheim, senior director, product management for content products and strategy, at Oracle (oracle.com). "Companies need to get their content into a life cycle management that provides accountability."

Oracle Internal Controls Manager is designed for audits, including internal, financial and operational ones. The software keeps track of risk factors, submits audit reports and reviews financial statements.

"Oracle is in a unique position because it provides solutions at the database, middleware and application levels," says Wynn White, senior director of identity management and security. "No one technology will make you compliant. A stack of different technologies needs to work together."

Oracle had not previously pursued the unstructured content market aggressively, but now sees it in more strategic terms. That is in part because like others, Oracle recognizes that the great majority of corporate data is in unstructured form, and also that much of it remains unmanaged. In today's regulated environment, getting control of content is critical. Oracle's Content Database (DB) is geared toward capturing all elements of the content, including metadata, indexes, relationships and the content itself.

Identity management, another one of Oracle's strengths, is a fundamental technology that helps enforce regulations. For example, it helps determine whether user access to transactions creates a conflict.

"The person who is in charge of accounts payable should not also be in charge of selecting vendors," says White, "and authorization management can help an auditor to catch that conflict."

Expert system aids compliance

Expert systems can facilitate compliance by guiding people through the complex regulations that are an inevitable part of running nearly any business today. A large food manufacturer is using an expert system based on Exsys to meet the voluntary ISO 14001 standard for environmental management systems.

 "The Exsys application asks questions about the environmentally-related management activities in the manufacturing facility," says Walter Carey, an environmental consultant who developed the system while working as an employee at the company. "For example, it asks whether the facility has a policy in place, whether it addresses pollution prevention and other questions related to ISO 14001."

When the user completes the sequence of questions, the Exsys application indicates whether the manufacturing facility has met the standards. If it has not, the system identifies actions needed for remediation. The application skips questions that do not apply, based on answers given as questions are posed.

Without the expert system, those responsible for environmental compliance at the facility would have to navigate a complex form and could not skip through irrelevant parts. Using an expert system ensures that each employee evaluating an environmental management system does so using the same criteria, and expedites the review process.