Much has been made of late of Sarbanes-Oxley (SOX), HIPAA and various other regulatory compliance related issues. Supposedly, these initiatives were going to drive Enterprise Content Management (ECM) sales in much of 2003 and 2004. Yet, for the most part, ECM vendors have left a lot on the table and not capitalized on this major trend to the greatest extent possible. Let’s examine why I believe vendors are struggling in this area, what they need to do to get the right message out, and the best way to approach compliance-minded organizations.

Now, don’t get me wrong, ECM vendors are out there making plenty of compliance-centric sales and companies are definitely buying. They are doing some things right. But if you really think about it, are the sales that have been made more a function of the robustness of compliance-related solutions and the vendor’s sales skills? Or are they more a function of the fact that many organizations have guns to their heads and feel they must do or risk serious sanctions and likely job losses? Seriously now, every once in awhile there are certain “sexy” and/or timely technologies that prospects don’t really need much motivation to buy. They are practically sold before a salesperson even walks in the door. Government mandates and the risk of non-compliance makes for a lot of very eager buyers.

First, a little background on the Sarbanes-Oxley Act. SOX aims to solve some the problems inherent in corporate governance, financial disclosure and public accounting. A couple of things leapt out at me when I first began researching SOX’s implications with regards to technology. First, there is no mention of software or any technology to be found. Becoming compliant does not require it. Second, the sections that apply to the corporation as opposed to an outsourced RPA (Registered Public Accounting Firm) are fairly easily described. Compliance involves a set of procedures, reports, records management and retention, and committees. The sections that are most commonly sited as the ones requiring compliance include:

Section 301 – Procedure and policy for anonymous complaints
Section 302 – Corporate responsibility for financial reports (Certification process)
Section 404 – Management assessment of internal controls
Section 409 – Real time disclosure (Authoring and review)

Even though only the larger, publicly traded companies are actually required to comply with SOX, many organizations are taking the opportunity to take one step or another to develop best practices and improve their risk management capabilities and internal control processes. Whether out of a legal need for compliance or just to be safe, Sarbanes-Oxley is driving many initiatives across many organizations.

From a marketing perspective, ECM vendors are drooling. The synergies between SOX compliance and ECM solutions are obvious. In fact, even prior to SOX, most ECM marketing messages revolved around the ability to bring together “content, people, and processes.” Whoa. Sound familiar? As noted above, corporate SOX compliance involves procedures (processes), records management and retention (content), and committees (people). The parallels between a proven ECM message and SOX compliance requirements are striking. This is why ECM is a natural solution set from which SOX compliance can be achieved. That message is not lost on vendors, to be sure.

In the world of solution selling, finding “pain” is one of the key steps in discovery. Without finding a pain that your solution can help ease, getting a prospect to understand why they should buy it is infinitely more difficult. ECM vendors don’t normally have a problem with finding need. There are so many possible real and money-saving ways that ECM solutions can be deployed, not finding some need somewhere in an organization should really scare sales managers. Add SOX to the equation and enthusiastic buyers should not be hard to find.

So given all of the reasons why ECM and SOX make great bedfellows, why isn’t the market going through the roof as many anticipated it would?

Well, regardless of the synergies, there are still some difficult challenges that vendors face when taking their compliance solutions to market. One big one is in the fact that SOX isn’t the easiest thing in the world for organizations to understand. The gist of it is certainly understood, but the details can be somewhat confusing nor is it completely definitive in its definition of what constitutes compliance. This confusion can lead to lengthier sales cycles as organizations are learning as they go.

A second hurdle that vendors may see in the market is that, still, no matter how much vendors wish it were the contrary, SOX compliance does not mandate a software solution. Once the details are understood, however, it does become apparent that it would be difficult to do without. How exactly would you propose being able to produce email without some way of managing said email? Well, it would be hard. Nevertheless, organizations are still going to investigate all possible options to be compliant, technical and otherwise. In some cases, because SOX is confusing and the solutions that address it are new, some organizations are looking at simple compliance first, with more automated and sophisticated compliance later. That reticence poses a potential problem for ECM vendors.

Another barrier has been the sheer volume of solutions that have suddenly appeared on the market. ECM vendors are not alone in attempting to address the need. Business Process Managment (BPM), Business Intelligence (BI), Email Management (EM), Customer Relationship Management (CRM), and many other traditional tools have all launched products that address compliance in one way or another. Throw in brand spanking new solutions that don’t do anything else and you get a market that is struggling to define itself. To a buyer, it can be daunting to compare solutions that are light years apart in approach. To the vendor, selling against solutions and competitors you have never heard of makes it very difficult to differentiate in a coherent, knowledgeable way.

So, how should vendors be approaching prospects with these concerns?

First, I think they need to focus more on compliance education and less on the technology. Most organizations are going to feel overwhelmed by jumping straight to a solution when they can’t quite even comprehend the problem. Imparting some wisdom and demonstrating that you understand the problem will help gain trust and confidence.

Second, recognize that your solution solves only a part of your prospects problem. ECM solutions generally operate under a central-repository metaphor. Complete control and complete compliance would require an organization manage 100% of compliance-related records in one or more repositories. While ECM solutions do this well, in some organizations it could be an absolutely monumental undertaking. Visibility into compliance policies and risk is the key, not centralization. Put ECM where it makes sense and establish good partnerships to fill the gaps.

The last, and in my estimation, most important message to consider is size and scope. I think this is where vendors have generally missed the boat. Remember, SOX really only involves information as it relates to financial reporting and best practices. Becoming compliant does not require looking past those specific processes and information. And while there is plenty of opportunity to sell compliance specific solutions, the deployment of said solution is still going to be somewhat limited in scope. I believe you should be thinking big as you aim small.

Compliance should be used as starting point for organizations to completely reevaluate their risk management policies and procedures on an enterprise scale. And don’t limit the discussion to Sarbanes-Oxley. There are plenty of additional compliance issues that affect various industries. The SEC, FDA, DOE etc. all regulate various industries in one way or another. Mix in different countries and their own versions of similar regulations and you should quickly see that the problem is much larger than any individual rule or piece of legislation. Each issue carries with it its own urgency and criticalness.

ECM solutions, by their very nature, are also flexible and open enough to position companies for future changes in regulations. The case could be made that they are nearly immune to obsolescence as many, more vertical, point solutions may be. ECM packages don’t need to be rebuilt to conform with new regulations, they just need to be repackaged. This has obvious benefits to the large organization looking to preserve what will likely be a significant investment.

While SOX in and of itself is finely focused, don’t miss the opportunity to do bigger and better things. There are plenty of nice, economical and very nimble solutions that address aspects of SOX compliance. ECM solutions differentiate with their scope. Don’t forget the ‘E’ in ECM. Organizations will quickly realize that as a platform, ECM solutions can help solve many compliance and records related problems, not the least of which is Sarbanes-Oxley.

There is a general willingness on the part of management to better understand how the organizations under their control are managing critical business information. You may never again have such focused attention of CXOs. They want your help. They will be good customers. Think big, but focus.

As you move forward with the ear of compliance minded organizations, try to make sure that Sarbanes-Oxley and other compliance related initiatives aren’t simply replacing traditional initiatives. Sure, it can be the proverbial “foot in the door” but a wider ranging analysis of risk management policies will yield additional opportunities. Economies of scale suggest larger deployments with broader reach will provide much more bang for the buck and provide better protection from additional regulation. CXO’s, now more than ever, are likely to be exceedingly willing to kill many birds with one stone.

Rick Taylor
rtaylor@ecmreport.com

The Vignette and Tower acquisition poll is closed and the results are in. This is a bit interesting…

Good for everyone [ 58% ]
Bad for everyone [ 16% ]
Good for Vignette, Bad for Tower [ 12% ]
Bad for Vignette, Good for Tower [ 14% ]

Totally everything together, the numbers could also be looked at like this.

Good for Vignette – 70%
Bad for Vignette – 30%
Good for Tower – 72%
Bad for Tower – 28%

Obviously, most agree this an equally good deal for both the Vignette and Tower communities.

I kept this poll open longer than normal for a couple of reasons. First, until Mobius acquired eManage, there hadn’t been another notable deal to track. But more importantly, I was a bit curious to see if opinions of the deal would skew over a period of time. There is frequently an initial optimism that disapates after a period of time. My poll did not reflect this nearly as much as Vignette’s share price.

There was a bit of an upswing near the announcement, but it has come crashing down since. On January 2, about a week prior to the announcement, the share price was at $2.29. Between then and January 21, about a week after the announcment, the price rose to $2.82. Since then, the price has steadily declined to where it is now in about the $1.50 range setting a new 52 week low in the process.

What does it mean? I certainly don’t have a clue, nevertheless, it doesn’t necessarily have to relate directly to the acquisition. Markets and tech in general are also seriously down over that same period. And while ECM is considered to be a hot technology, over this period of time, none of the primary players have done particularly well.

Though this deal will have little impact in the market, it nevertheless serves to further validate how the industry players define ECM and the components they feel are critical to realizing a complete vision and offering.

It is important to note that Mobius did not acquire eManage. Instead, they acquired certain assets including eManage’s records and email management technologies. As such, it remains to be seen how many (if any) deals this brings to Mobius. Regardless, eManage is a very small company and however the deal was done it is unlikely to add much to the Mobius bottom-line any time soon. 

While the deal may have little to no financial affect, it is nevertheless interesting to look at what the deal means in the broader scope of the ECM industry as a whole.

First, it is an obvious continuation of the convergence we have seen recently. Smaller, niche players, with tools that handle pieces of the ECM umbrella, have seen their technology become better suited as a portion of a broader offering.

Second, and in my opinion, more importantly, this deal reflects and helps further refine the actual definition of ECM. Few would dispute that records and email management are core components of a complete ECM offering. But when organizations like Mobius act on this definition it serves to clarify and remove doubt about where the industry is headed.

Simply defining ECM through practice and not press release is, nevertheless, a double-edged sword. On one hand, it helps consumers by making it easier to compare the merits of the various offerings. On the other hand, it can appear as if many of the vendors in the space are being reactive to market pressures instead of proactive. They are checking features off of lists instead of innovating bigger, better and broader levels of functionality.

What is happening in reality, however, is probably just a matter of how each player is executing their long term plans. The bar has been set and the big picture of ECM has been defined. A likely step one in a game plan would be to simply fulfill the designated requirements. Step two will likely take us to the next level of additional functionality and additional differentiation.

Records and email management, in particular, are two of the more timely and important areas of concern for many organizations. With Sarbanes/Oxley and other regulatory compliance issues being thrust to the forefront of corporate initiatives, these technologies have leapt out as a major catalyst for reviewing wider ranging ECM initiatives. To the ECM vendor with the right offering, email and records management is an excellent way to get a foot in the proverbial door. No doubt, Mobius and others see this and are executing accordingly.

I was recently posed an intriguing question regarding Stellent’s acquisition of Optika that I had not really given much thought to. The observation was that some in the industry might view the acquisition as a commitment by Stellent to the mid-market. I immediately gave an opinion but chose to dedicate some additional brainwaves to the topic. After giving it some additional thought I am happy to say that my original opinion has changed little. The answer was a resounding… maybe.

Maybe, but not necessarily. I can see where the sentiment would come from. Optika never made many waves at an enterprise level. They were certainly entrenched in the very definition of mid-market. But much of Optika’s presence there was a consequence of their suite of products and where they had the most success.

The Optika products lend themselves to more transaction-oriented business processes such as Accounts Payable. A natural side effect of transaction-oriented solutions is that they tend to be directed at a very focused set of business problems. These problems, by definition of their scope, often lead to deployments within the core group of users affected and not necessarily to the entire enterprise.

Now, I’m not saying these solutions don’t have wide audiences within an organization, they do. But they tend to not expose a tremendous amount of functionality above and beyond the basic need of the use case. Users tend to be in and out and they don’t linger. Need to pay a bill? Boom, there it is, paid, gone. Move on to something else.

With other, less transaction-oriented ECM initiatives however, users tend to live there and do lots of different things. They collaborate on documents, they send some emails, they review work items, whatever it is they need to do. Those sorts of ad hoc functions lend themselves a bit better to larger-scale, all-encompassing, enterprise-scale use cases when you need to share information with a broad range of people inside or outside of your organization. This capability is what Stellent brings to the table.

If you just look at the technology for the technology, Stellent acquired a piece of the ECM pie. But it’s the entire spectrum of their ECM offering that will dictate their message and their target market, not any individual component. As a piece of a larger solution, I believe the Optika products could play quite nicely.

Stellent’s challenge, however, is not messaging. They have been talking ECM and integrated components for awhile. Their challenge is going to be maintaining this vision and extending it to include the Optika suite within the product offering. That challenge could be made more difficult by the fact that the products do not share common infrastructures (J2EE/WIN). They can’t play in large enterprise data centers with mix and match back ends. I believe if you watch their integration plans closely, you will get a clear cut indication of their direction. Moving forward, common, integrated infrastructures will be key to playing on the enterprise level. If their plans don’t include this in a relatively short period of time, you may be able to translate that to a commitment to the mid-market.

Even still, is a commitment to the mid-market a bad thing? I am of the opinion that one of the side effects of the consolidating ECM market is a more well defined mid-market. Traditional players there are leaving to focus on the enterprise but there are still many excellent and viable alternatives that will rush in to fill the void.

One thing about the ECM market that I have always noted is that there is a tremendous amount of low hanging fruit. ECM is a very easy to understand concept with demonstrable ROI and it solves problems that every organization has, big or small. Catering to the middle of the market where good products can be had at good prices is not necessarily a bad thing. In fact, there is a lot of business to be done there.

In reality, the move by Stellent could be viewed in a couple of ways. Yes, it does expand their presence in the mid-market and could solidify them there. On the other hand, the Optika products bring Stellent that much closer to realizing the full ECM product vision, thus enhancing their potential attractiveness to larger organizations and more enterprise-scale deals. Stellent could go a number of ways and, ultimately, that flexibility could be the biggest and best reason to have done the deal.

Rick Taylor