The Sarbanes-Oxley Act Has Forced Many Companies To Review Email Retention Policies.

Four years have passed since President Bush signed the Sarbanes-Oxley Act and most analysts agree the law is working as larger companies are finally getting their accounting books in order.

The act was formulated to strengthen accounting oversight and corporate accountability. It did this by increasing accounting and auditor regulations, enhancing disclosure requirements, creating new federal laws and increasing penalties under existing federal laws.

An important aspect of the act focuses on the details of data security, retention and protection. So the question is, how does the Sarbanes-Oxley legislation impact email retention policies?

Surveys indicate that 93 percent of all business documents are created electronically and that has forced most corporations to address their retention policies. Businesses, small or large, can no longer consider email retention a non-priority.

Companies must develop a classification of data for off-site storage, such as an online storage service that encrypts and protect the data.

The Sarbanes-Oxley Act includes three provisions that deal with electronic documents, such as those communicated through emails. They include document alteration or destruction, mandatory document retention and obstruction of justice.

* In terms of document alteration or destruction, the Sarbanes-Oxley law states that people who knowingly alter, destroy, mutilate, falsify or conceal any document (electronic or paper) with the intent to impede proceedings involving federal agencies may be fined or imprisoned up to 20 years, or both. How does this impact email retention policies? If a company has an email retention policy in place, it must include a security plan. Only certain individuals should be given clearance to access the archived emails. A report with that person's name and purpose should be produced every time a certain email is accessed, and documentation of change to the existing document should be noted.