1. WHITE PAPER – WINTER 2014
ADVANCED
BUSINESS
CONTINUITY
SOLUTIONS, LLC
BUSINESS RESILIENCY BEST PRACTICES – “ RECORDS MANAGEMENT ”
The primary components of a high quality Records Management Program are:
1. Policies and Procedures for creating and storing records in both paper and electronic
format that are demonstrably supported by an organization’s executives, including the
Chief Executive Officer, Chief Financial Officer, Chief Information Officer, Chief
Legal Counsel, and Chief Compliance Officer.
2. A thoroughly documented Records Retention Schedule that lists Records Series
(categories) and the expected retention period in months and years (based on legal,
regulatory, and best practices research).
3. An organizational File Plan that lists primary records types by functional unit so
that information can be located without dependence on any one employee.
4. A Vital Records Program that identifies and protects those records that are critical for
immediate restart of an organization’s business processes following a disaster.
5. A Records Management Implementation and Training Program that works with
identified Records Coordinators in primary functional units to train them in the policies,
procedures, workflow, and systems required to assure quality recordkeeping occurs.
6. Increasingly, the presence of a dedicated hardware/software electronic records
system repository so that employees have a place to store personal computer files,
electronic mail messages, and any other electronic documents for long term retention based on a formally defined Records Retention Schedule and business Rules.
2. 7. Periodic Audits to assess the clarity of procedures, effectiveness of training, and that provide an enforcement vehicle Outsourced business services relationships often support a well-planned records management program. A contractual relationship with an off-site commercial records storage center enables inexpensive and secure long-term retention of paper documents, electronic media, or computer system backup tapes in a disaster-resistant environment.
OUTSOURCING – CONSULTANTS –
Commercial records centers can protect vital records from on-site disasters at their customers’ locations, and assure that expensive office space is not consumed by local storage of older low-value records. Records management consultants or expert business resilience firms often provide focused knowledge of records in highly regulated industries, skills in ongoing management of paper and electronic records programs, or expertise in electronic records management software selection and implementation.
Increasingly, records management program activities are outsourced to full-service document process management firms with specialized expertise in records management.
These outsourcing firms can provide some or all of these managed services. Since records
management is not the core competency of most organizations, outsourcing can free
internal resources and investment to focus on core business competencies.
Today, it is increasingly common to see record management staff working more closely with legal counsel, tax, auditors, compliance officers, and IT personnel to assure that records are preemptively identified, located, organized, and preserved before a crisis occurs. Organizations that anticipate impending litigation now are considered responsible for preserving records, even before receiving pending litigation hold orders from courts.
Destruction of evidence in advance of court appearances can be considered a federal crime as many discovered during the Arthur Andersen case. The 2002 Sarbanes-Oxley Act (Section 404) and other legislation often specify "working papers" and other forms of records such as financial reports that must be created with sufficiently a rigorous "chain-of-custody” platform.
This is evident in auditable internal workflow processes so that executives can demonstrate they have appropriate level oversight of the activities they manage. Bernard Ebbers, former WorldCom CEO, found this to be true when he was convicted of multiple counts of fraud, despite claims he was not aware of the accounting irregularities that occurred under his oversight.
IT personnel have for many years had the displeasure of appearing in court as witnesses regarding the presence of e-mails on backup tapes. Many of those e-mails could have been discarded during the normal course of business if a records management program