The 17-page SEC disclosure statement represents what corporate management should have been asking about the costs and risks of all their IT ventures. As an intracorporate reporting requirement, what the SEC is asking is reasonable. But because corporate management, IT purveyors and insurance firms failed to address the potential consequences of year 2000 disruptions, we will now be stuck forever with the government telling us what to do and how to manage information systems with a sense of political accountability. I approve of what the SEC has done, though I dislike it, just as I hated taking spoonfuls of cod liver oil during World War II when it was the only vitamin supplement available. It was guided by congressional hearings that reflected politicians' anxiousness to divert any possible blame for failures of the U.S. information infrastructure.
Legislation is sure to follow, imposing constraints on information management practices.
This situation is analogous to the securities legislation of the 1930s, when failures in the financial markets induced Congress to create the Federal Trade Commission, the SEC and other regulatory agencies. The SEC Act of 1934 led to financial accounting standards and certification by independent auditors. It elevated the role of the chief financial officer. The entry of government into the systems arena would be positive if it limits itself to emphasizing the increased importance of IT standards and stimulating the creation of independent verification and validation institutions. Its most constructive consequence would be to encourage placing CIOs in positions of fiduciary responsibility for the custody of information assets.