Those are just a few of the key findings in a comprehensive report issued by BPM Forum and compliance management software maker AXS-One Inc. The report, developed in partnership with Chief Executive Magazine and the IT Compliance Institute, is titled "Compliance Enabled Enterprise (CEE) the Future: Building the Compliance-Enabled Enterprise," and takes a close look at an issue that has assumed mission-critical status within corporate America.

While compliance issues around regulations such as Sarbanes-Oxley and related legal complexities have become a top management priority, many companies are still a long way from developing the IT infrastructure, policies and processes needed to align with compliance objectives. As a result, these companies remain seriously unprepared for a lawsuit, audit or request from a regulator.

The report paints a vivid picture of a business environment in which compliance is definitely a management concern, policies and procedures are yet to take hold, enforcement is a loose concept, and management's familiarity with the realities of information management is painfully lacking.

"In recent years, courts and regulatory agencies alike have been willing to impose harsh penalties on enterprises that are not up to par," said Donovan Neale-May, executive director of the BPM Forum. "This study indicates that the apparent corporate focus on compliance has not translated into strategic and tactical initiatives that have an impact on business operations, and this leaves many companies vulnerable."

In particular, the study reveals numerous potential weaknesses within corporate technologies and processes:

• 47 percent of all senior executives are concerned that their companies' failure to effectively archive and manage all of their electronic content represents a critical liability for their organization;
• 35 percent of the respondents remain in the dark as to how much of their IT budget is tied to compliance-related technologies;
• 33 percent say they have no corporate policy covering electronic records management (nearly 20 percent don't know whether they even have a policy);
• Barely 40 percent of the respondents feel their companies are effectively enforcing the electronic records management policies that actually are in place;
• While lawsuits supposedly represent a constant threat, 36 percent say their companies have no technologies or policies whatsoever in place to manage a legal discovery order involving electronic records
• Almost 41 percent of the respondents say it would take several days to a week or more to retrieve e-mails related to a particular transaction

"Each year there's a significant rise in government regulations and corporate guidelines, together with a steep climb in the amount of content generated, and it represents a collective migraine for compliance, legal and IT executives," said Bill Lyons, chairman and CEO of AXS-One. "Ultimately, this is a top-line management issue. From the CEO on down, the entire leadership team must take responsibility for providing the resources needed to develop compliance procedures, and ensure that the policies are not only enforced but effectively integrated into routine operations. Only then will companies be fully prepared for compliance investigations and legal orders, as well as reap the benefits that come with a complete overhaul of business procedures around content and compliance."

The full report -- "CEE the Future: Building the Compliance-Enabled Enterprise" -- is available by visiting www.bpmforum.org or www.axsone.com.