My response is normally:
1. SharePoint allows you to do a lot with governance and compliance and in some cases it’s an overkill and can turn a SharePoint administrator into the Compliance Officer. Your company probably has a compliance officer so they need to be very familiar with the SharePoint capabilities and implications, so SharePoint can assist their job, rather than the admin doing their job.
A good place to start would be what are you doing with SharePoint 2003 on this subject?