Need of Document Management System (DMS)

Document Management or Enterprise Informationagency. This would call for holding all documents in
Management is perhaps one of the mosta secure system where absolutely no one in the
important of the enterprise solutions that willcompany can alter them once they are finalized.
provide a solution to the various requirements ofAlso this calls for a formal document retention
SOX. Several sections of SOX have a directand destruction policy which is strictly adhered to
bearing on the manner in which the digital(in fact, can be proven to be adhered to) and
documents/records of the enterprise are created,which involves making sure that no document
reviewed, approved, stored, retrieved,which any investigating agency would require is
transferred, and destroyed.being destroyed or deleted. Furhter, the act
Knowledge Management: Document &requires that as soon as the company comes to
Records Managementknow about a potential investigation all documents
Estimates have been made calculating that apertaining or somehow germane to that
significantly large proportion (some say, more thaninvestigation are immediately ordered
70%) of the documents owned by an enterpriseindestructible to or unalterable by anyone--including
are in digital format and might never be seen inthe CxOs of the company. This makes it
hardcopy.important to have a feature related to creat!ing
According to Gartner's Editor in Chief Jamesand accepting "alerts" from the legal department
Lundy: Records management will become a topof the company about any ongoing or upcoming
10 issue for many CIOs in the coming year.potential investigations and as a consequence
In the following, we will discuss the variousimmediate information "vaulting" of all related
sections of SOX that a document managementdocuments. This feature will ensure compliance
solution might help in complying with.with this particular section and save a potential
SOX Sections:prison term and a large monetary fine and of
Section 302: According to Section 302, the CEOcourse loss of credibility.
and CFO have to personally certify the financialThis section has a strong bearing on a records or
statements and disclosures made by thedocument management policy of a company. The
company on authenticity and accuracy. Thiscompany should develop a proper document
requires a system in place that will make the CEOmanagement policy and adhere to it in a timely
and the CFO confident that all the disclosures thatand rigorous manner. If this is not done, the
the company makes are accurate and authentic.company is exposed to severe costs and
This can be done in two ways:damage in terms of providing documents to
One is to trickle-down the responsibility of thehostile parties in "pre-trial discovery"--the legal
CEO and the CFO to the lower managementprocess of providing all relevant documents to the
levels and in response bubble-up the sign-offsopposing party in a legal suit. It also exposes the
from the lower management levels on allcompany to accusations of hiding or destroying
documents that are inputs to the company filings.relevant documents--if done at a later
Second is to design comprehensive businessstage--even before any legal proceedings are
processes that produce the company filings. Thebegun against the company--a la Arthur
business processes will be designed in a veryAndersen's Enron-related documents.
rigorous manner to comply with all the provisionsDocument Management systems provide several
and proper implementation and training of all thebenefits to the company. Since an IT system is a
personnel related to the business processes will bebusiness process frozen in a particular software
carried out and tested on a periodic basis. Further,and hardware implementation, it proves that the
the business processes themselves will be openparticular business process is being consciously and
to stringent internal audits that will be carried outdiligently adhered to. In the worst case, this
from time to time.proves that the compliance is being followed in
One, or a combination of both these practices willspirit. Now whether the compliance is being
go a long way towards ensuring properfollowed in form can be found out from the
compliance.results of the particular system and also from the
For both these options it is clear that a strongaudits of it at various stages of the business
enterprise-wide document management systemprocess. The capability to follow an audit trail on all
will provide the foundation on which thedocuments created or processed through it is
compliance will actually be carried out. In the firstextremely useful in executing compliance activities
case, the sign-offs can be configured using aand also in proving compliance at a later stage.
workflow module of the document managementThe capability to create workflows automatically
system. In the second case, the business processcreates auditable process paths.
itself will be configured in the documentThe DMS also makes possible to access any
management system and all the relevantdocuments at any point of time with relative
supporting or input documents too will be part ofease. It also acts as a centralized repository of
the DMS and appropriate subordination and linkingdocuments (both structured and unstructured). All
will be done between the official company filingspublicly disclosed documents can be locked in the
and all the input documents to it.final form as images and can not be tampered
As proof of the records supporting the finalwith later on. These can be stored and deleted
company financials--as filed or reported--it isaccording to the schedules of various regulatory
important to archive all the emails, excel sheets,and compliance Acts of the Government.
instant messages or other communications andDocument and information which is supposed to
documents that were exchanged which led to abe for limited consumption at the top
final certified filing by the CEO and CFO. This willmanagement level can also be strictly screened
safeguard the CxO's claim that all the financialand internal controls on these can be enforced
reports are true to their knowledge and duerigorously. At the appropriate time the documents
diligence was carried out before certifying thecan be "published".
reports.Whistleblower: For this section of the act, it is
Section 404: The CEO and CFO need to provide aimportant that a document management system
report assessing and certifying that the "internalis provided to log all whistleblower
controls" have been assessed and are workingcommunication--absolutely securely where no
fine or that there are weaknesses andunauthorized personnel may be able to access
appropriate action is being taken. Complying withit--and store all communications.
this requirement is one of the most difficult partsAn indirect requirement for Document
of SOX and requires a whole slew of people,Management Systems in the enterprise is for the
processes and technologies. However, DMS haspurpose of storing the documents related to
an important role to play in this.enterprise compliance policies, their updates,
All the emails and attached documents in theamendments, the internal control policies of the
chronological sequence will need to be archived forcompany and other documents of a similar nature
the purpose of proving that the internal controlsthat help in proving the compliance process at the
are appropriate. Ideally, a workflow module willenterprise.
provide added assurance that the internal controlsThe company needs to make policies about the
are implemented.following aspects of documents:
Section 103: requires storing the documents for a- Creation
period of 7 years for audit companies. The- Approvals
company being audited would naturally want to- Publishing
replicate the documentation to guard against any- Retention
discrepancy or miscommunication or- Access
mismanagement. Also another part of the act- Distribution
requires- Lifecycle
Section 409: requires near-real-time reporting of allThis policy will help in implementing the
material events--whether internal or external tocontradictory requirements of document retention
the investors and the regulatory bodies. This canfor compliance purposes and document deletion
be accomplished by using a single enterprise-widefor reducing the cost of document retention and
document management system with appropriateimproving operational efficiency.
"alerts" and notifications and workflow configuredInitial step is to define the document retention
according to the design of the compliance-basedpolicy. The second step is to survey the existing
business processes. This system would makedocument management systems in place in the
sure that all relevant information is immediatelyenterprise and the third step is to create a proper
relayed to the top management (CEO and CFO)document management system.
and the compliance committee and advisors withHave a centralized repository of documents.
minimum delays and latency. DMS providesHave a structured and hierarchical architecture
appropriate capabilities to the compliance advisorsHave security & access control
to provide a recommendation (within the*A Report Distribution System or Document
stipulated time frame) linked to each alert andManagement & Workflow System will
escalate the reports to the CxOs with thedisburse this to the CEO and the CFO within the
appropriate recommendations. The CxOs can thenprescribed time-frame and allow them enough
decide whether it merits disclosure under thetime to make their own final judgments about the
compliance act based on recommendations ofsituation.
their Compliance Committee or Advisors.Finally, a Public Information Distribution System
Section 802: provides for criminal penlties forshould exist to quickly disburse this information--if
knowingly altering, destroying, concealing andjudged important by the CEO & the CFO--to
other activities, such as introducing false records,the investors & other stakeholders or
related to impeding or influencing an ongoing orrelevant authorities prescribed by SOX.
potentially upcoming investigation by a federalAuthor: Dr. Vikas V. Gupta.