Section 409 of SarbOx calls for quick data crunching

There is a dark cloud looming on the horizon called Section 409 of the Sarbanes-Oxley Act , which many companies have been trying hard not to think about.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Section 409 calls for real-time reporting of material events that could affect a company's financial performance. CFOs and CIOs have put it on the back burner for a couple of reasons. First, the deadline for reporting such an event is still not official: The Security Exchange Commission has proposed a 48-hour deadline for filing an 8K, a notice of material change. Second, the proposed events that trigger the requirements for filing an 8K are still changing. Currently there are 11 triggers,  but there are 11 proposed additions, including entry into a material agreement not made in the normal course of business, and events triggering a direct or contingent financial obligation that is material to the company, including any default or acceleration of an obligation.

Of course, all of this is subject to interpretation. Look at the trigger that requires notification for an acceleration of an obligation. If a company takes advantage of a 2 percent discount for paying net 10 instead of net 30, if the discount is large enough, must it be reported? And within 48 hours no less? But I digress.

The bigger issue, that dark cloud, is the longer-term architectural issues. Companies will not only have to create an infrastructure for the rapid assessment of which critical events materially affect the company, but support real-time data as well.

Vendors from many different market segments will offer real-time, rapid assessment solutions. Among them is ERP vendor PeopleSoft, which offers its Material Event Manager for rapid disclosure and Global Consolidations for consolidating data across financial systems -- both  part of its SarbOx suite.

Then there are best-of-breed BPM (business process management) vendors such as  HandiSoft, which launched SOXA (SarbOx Accelerator), which sets up a notification process and tracks who it is communicated to and whether or not the issue is resolved.

"[Section 409] is a significant transformation for enterprises that function in a five- to seven-day business process," said Daryn Walters, vice president of global marketing and strategy at HandiSoft.

AMR Vice President of Research John Hagerty has a different take. He thinks IT should look to the traditional BI vendors, calling Section 409 compliance an analytic issue as opposed to a problem that can be solved by ERP or document management solutions.

Perhaps, but I disagree if for no other reason than it is getting harder and harder to tell who sells what anymore. Over time, enterprise applications vendors will be just that: enterprise software vendors that create and sell application solutions that cut across traditional market segments.

Susan Foley Cane, vice president of product marketing for financials at PeopleSoft, tells me that the expenses required to continue to document and monitor under Section 404 could run companies up to $8 million per year. Section 409 will have an even bigger impact.

Nevertheless, I do agree with Hagerty when he says that nothing in real-time assessment is bad. Most companies should want to improve their information architecture. The only issue is how to manage the cost of deployment.