There's Sarbanes Oxley (SOX), RoHS-WEEE, ITAR and FDA 21 CFR Part 11, just to name a few. As the list of acronyms surrounding regulatory compliance swells, manufacturers are struggling to get their financial and operational houses in order. Yet to keep efforts moving forward, companies are finding they have to make compliance part of the routine of conducting business, not just take it on as a series of projects crossed off the to-do list.

It's a two-part equation -- one piece organizational, the other technological. From an organizational perspective, experts advise building an enterprise compliance framework, complete with repeatable processes and ongoing metrics and accompanied by initiatives to link the compliance program to corporate strategy. From a technological standpoint, companies can look to retrofit existing applications with new business processes and workflows to address some of what's required along with considering fully integrated applications built from the ground up to facilitate compliance.

"Compliance is an ongoing process and not an endless set of tactical programs that are going to be done quarterly or annually," said John Hagerty, vice president of research for AMR Research Inc. (Boston), during a recent webcast conducted by Managing Automation magazine. MA's "Corporate Governance Series," a three-part discussion on regulatory compliance and corporate governance, is aimed at helping manufacturers navigate the still-murky terrain. "Making compliance repeatable, making it sustainable, and making it cost effective are going to be the three key initiatives that will allow you to breathe easier and sleep better at night," Hagerty said.

But resting easier doesn't come without a heavy price tag, both from a cost and human-resource perspective. While the primary focus these last two years has been on financial governance -- mostly a result of SOX -- and large, publicly traded firms, other regulations are moving front and center, and the trickle-down effect has made compliance a growing concern for smaller manufacturers who play a role in large-company supply chains. What's at stake is tremendous: AMR projects companies will dole out a whopping $80 billion on regulatory compliance between now and 2009. In 2005 alone, the cost will be a staggering $15.5 billion.

Along with the financial drain are a host of other challenges. Most manufacturers have a limited number of people skilled in dealing with compliance, and the roles and responsibilities are still ill-defined. To make matters more complex, most companies don't yet have standardized processes and tools around compliance, and even fewer are knowledgeable about how to create and measure value from compliance investments.

Clearly, it's a sea change that companies aren't going to master overnight. Experts say it can take years to create a successful compliance program that has legs for the future. "Most organizations, in the realm of Sarbanes-Oxley, for example, are looking at a two- to three-year program to build out their competencies and effectively begin to march the organization up a maturity curve," Hagerty said. "With the right programs, the right coaching, and the right tool sets around people, you can begin to make compliance a continuous process and drive improvement."

At Times, A Tricky Balancing Act

So where do manufacturers start? Experts say taking an enterprise-wide view of compliance lies at the heart of the changes. There are a number of initiatives associated with this transition, including fostering new communications processes throughout the organization to measure and monitor compliance issues and failures as well as factoring in compliance concerns at the onset when considering new business strategies. Ongoing education and training is also central to sustainable compliance, as is fostering top management commitment in tandem with active participation from the appropriate process holders. "One of the best practices we have seen is to drive compliance from a centralized function, but to deploy it locally within each of the business units," noted John Gimpert, a national partner at Deloitte & Touche LLP, during the MA webcast entitled "Automating for Compliance." "The key is to have an ongoing set of compliance activities across the organization. It helps to provide quick and timely feedback to where deviations may be, and enables management to respond to those on a timely basis."

Motorola Corp. (Schaumburg, IL) is among the many large companies that buy into this practice. The electronics giant applies its "architect and distribute" model for compliance, making heavy use of steering communities and communities of practice (made up of representatives from different parts of the business) to develop architectures that are then pushed out to the various operations units. The goal is to leverage Motorola's diversity into an architecture that can be distributed globally, explained Don Conrad, Motorola's IT director responsible for product realization shared services, who participated in the "Organizing for Compliance" webcast. "Motorola comprises diverse businesses subject to a very broad assortment of international product regulations," he said. "It's key to be consistent on a global basis across all our businesses to make sure that all of our products meet all the applicable regulatory statutes."

Take RoHS-WEEE compliance, for example, which came out of the European Union and governs hazardous substance reporting and treatment of waste. There are six teams within Motorola addressing this one compliance area, including a global RoHS coordination team composed of individuals involved in environmental health and safety issues. This team discusses legislation and strategies. There is also an Environmental Community of Practice populated with subject-matter experts and business champions from all of the business units along with representation from Motorola Labs.