Comply Or Fry?

Much has been written and said recently about Sarbanes Oxley and other major regulatory initiatives that hold corporate executives accountable for lapses in judgment that result in harm to stockholders. To date, the focus of most efforts to spread the gospel of compliance and adherence to governance standards has been on line of business managers and the folks in finance.

Notwithstanding the fact that there are a slew of new products and services that offer technological solutions to SarBox, HIPAA, et al, most corporate technologists think governance is, for the most part, someone else's problem. How do I come to this conclusion?

I had an opportunity last week to chat with several senior IT execs at a network technology roundtable hosted by a PR firm in Washington DC. I posed the following question to several of them:

Is compliance with regulations something you really care about?

The answer was a universal yes. As corporate citizens, there was a strong sense of duty to help their organizations do the right thing. However, when I followed up with the question:Are you worried you will be personally liable should your organization be found to be out of compliance?

There, I was surprised at their frank response -- which was: Not really. When push comes to shove, the consensus among this small group was that the folks who do the handcuffed "walk of shame" in front of the general print and broadcast press are not likely to come from ranks of tech. The more cynical among my subjects even suggested that the most ardent bearers of the "comply or fry" banner were the lawyers and vendors who had a vested interest in the issue.

It was an admittedly unscientific sample, and I would like to get a broader sense of the issue. Compliance is the topic of this week's Networking Pipeline poll, but beyond that, I would love to hear what you think are the responsibilities and liabilities of technology executives in this new age of governance awareness.

Shoot me a note at [email protected], and include your name, title and organizational affiliation. I will run the more interesting responses in an upcoming blog.