This chapter discusses records management and its relationship to information governance. It provides definitions for key concepts like records management, electronic records management, and information governance. Effective records management is important for regulatory compliance, litigation needs, and business continuity. However, implementing records management, particularly for electronic records, is challenging due to factors like changing regulations and platforms. Completing an inventory of electronic records is an important first step, though more difficult than for physical records. The inventory provides benefits like identifying record ownership and informing retention scheduling.
2. This chapter deals with the concept of records management. It is
sort of a crash course on records management. There are those
who have the mistaken idea that records management and
information governance is the same thing. It is not. Information
governance covers so much more than just records management.
This is a very long chapter. It should probably have been
divided or broken into two chapters, but there doesn’t seem to
be a good breaking place. If you look at the next two pages that
sort of summarizes what you need to take away from this
chapter. The chapter is an important one for your semester
project. Further, please don’t make the mistake of thinking that
everything you need to know from this chapter is included on
the power point slides. That is not the case. You have to still
read the book and understand what you are reading.
1
3. CHAPTER GOALS AND OBJECTIVES
Know what is records management
How to implement ERM (electronic records management
Benefits of ERM
Principles followed in ERM
Why is ERM so challenging?
What is involved in inventorying electronic records?
What are the steps in inventorying e-records?
What are the challenges associated with e-records inventorying?
What is the purpose or reason for e-records inventory?
Type of information to be collected in the inventory process
Who should conduct the e-record inventory?
Approaches to the e-record inventory process?
Be able to conduct an e-record inventory using the survey
method
Be able to conduct an e-record inventory using the
questionnaire method
Be ale to combine the survey method and then follow up using
the questionnaire method
What is record appraisal? What is it used for?
What principles are involved in retention scheduling?
What is retention scheduling?
How would you go about developing a records retention
schedule?
Why are retention schedules needed?
What type of information would be included on a retention
schedule?
What steps would you use to develop a retention schedule?
What is an information map? What is it used for?
What do you do if you don’t have an information map?
What are the basic classification of records?
What is the difference between a business function and a
business activity?
7. The ISO defines a business record as: “Record” – information
created, received and maintained as evidence and information
by an organization or person, in pursuit of legal obligations or
in the transaction of business – (ISO definition)
It then defines “Records Management” as the Field of
management responsible for the efficient and systematic control
of the creation, receipt, maintenance, use and disposition of
records, including the processes for capturing and maintaining
evidence of and information about business activities and
transactions in the form of records. Traditionally, used more
often in highly regulated industries such as banking, energy,
pharmaceuticals.
You will also see the acronym “RIM”. This stands for records
and Information Management – It goes beyond Record
Management to include information –data, e-documents and
reports. A professional in the area of Record and Information
Management will have greater responsibility over a wider area
as RIM managers must be proficient in the area of policies for
retention of records as well as disposition of legally
discoverable information and must know the relevant laws as it
relates to each.
Another term you will hear in this chapter is Electronic Records
Management (ERM) – This is more of a hot topic today. It has
moved to the forefront of business issues due to the increasing
automation of business processes and the growth of electronic
documents. Further, greater legislation is being passed out of
increased need. The definition of ERM is the “Organization,
management, control, monitoring, and auditing of formal
11. Traditionally, in the past the kinds of industries that you saw
implementing records management programs were those
engaged in things like banking, energy, pharmaceuticals. This
was because traditionally these industries were subject to
greater regulation. However, this is beginning to change.
There is an ever growing amount of regulation and legislation
that make it relevant to nearly every business, except possibly
only the very smallest business.
The things that have driven this increasing demand for records
management in industries that you didn’t always think of as
having a sophisticated formal records management program are
things like 1.Increased government oversight and industry
regulation. Consider Sarbanes-Oxley (SOX); 2. Changes in
legal procedures and requirements during civil litigation. For
example changes in the federal rules of civil procedure in 2006;
3. the idea of greater IG Awareness; and 4. Competition and
Business continuity concerns
6
Challenges for Records Management ?
Why has formal RM become so challenging and costly?
Changing and increasing regulation
Maturing IG requirements
Managing multiple retention and disposition schedules
Compliance costs and requirements with limited staff
Changing information delivery platforms
Security concerns
Dependence on IT department or provider
User Assistance and compliance
13. 7
Implementing and keeping up with a good records management
program is not easy. As a matter of fact it is very challenging.
Some of the reasons it is so difficult are listed on the slide:
Changing and increasing regulation-Just when you think you got
it all figured out and understand it, the laws change
Maturing IG requirements – senior management is becoming
more savvy about IG and the need for it, and for record
management
Managing multiple retention and disposition schedules – This is
difficult. Regulations change all the time and it is extremely
difficult to pin down what is appropriate for different record
types. Hard to convince management to retain records the
shortest time legally required due to change of opening
company up to greater risk of litigation by keeping records
longer.
Compliance costs and requirements with limited staff-
Departments responsible for this are generally understaffed
because they are not seen as one of the departments that directly
bring in revenue.
Changing information delivery platforms-More and more cloud
and mobile computing across different platforms make records
management more difficult because of where the different
records are stored and the need to maintain integrity and
security at the same time
16. It is difficult. And sometimes, particularly when you do not
receive cooperation from users in the organization you have to
ask yourself if it is worth it. But it is, the advantage or benefits
are as follows:
Time Savings
Cost Savings
Building Space Savings
Strategic Advantages
Improved capabilities to enforce IG
Improved, more complete and accurate searches
Improved knowledge worker productivity
Reduced risk of legal consequences for failure to be compliant
Improved record security
Improved ability to demonstrate that your organization is using
legally defensible RM practices
Increased working confidence in making searches
Improved decision making
These are the benefits that are more tangible. The things you
can see. But there are even more advantages or benefits, some
of which aren’t so readily identifyable or seen.
8
BENEFITS OF ELECTRONIC RECORDS MANAGEMENT
IS IT WORTH IT???...continued
18. These are referred to as intangible benefits. They include things
like the following:
Having Better control over the creation and growth of records
Having Improved ability to assimilate new record management
technologies
Having Increased ability to safeguard vital information
Having greater ability to preserve the “corporate memory”
Having an increased ability to foster professionalism in running
the business
9
INVENTORYING E-RECORDS
U.S. National Archive and Records Administration (NARA)
defines an “inventory” as: A descriptive listing of each
record series or system together with an indication of the
21. For a number of reasons. One is the fact that you Can’t see or
touch them (the e-records).
This means that You can’t just thumb through records to find
what you are looking for. You have to search online. They
aren’t just sitting in a file room where you can go pull them.
E-records will have metadata attached to them that will help
you distinguish similar looking records but they also will have
shadow records attached to them that makes it hard for you to
distinguish between the copy and the original.
But the inventory can also help you uncover certain types of
problems. For example, the inventory can help you uncover
problems with the following:
Inadequate documentation of official actions
Improper applications of technology
Deficient filing systems
Deficient maintenance practices
Poor management of non-record materials
Insufficient identification of vital records
Inadequate record security practice
Inventory of E-records continued…
We have said the purpose is the same as for inventory of
physical records….but what do we mean?
You want the completed inventory of records to contribute to
the pursuit of an organization’s IG objective in a number of
important ways……benefits of completing you records
inventory
Lets you identify ownership and sharing internally and
externally
Determines which records are physical and which are electronic
Provides a basis for retention and disposition
23. 12
We already know the e-records inventory is a pain. We already
know that it can be used to uncover certain types of problems.
Also, You want the completed inventory of records to contribute
to the pursuit of an organization’s IG objective in a number of
important ways……benefits of completing you records
inventory
Lets you identify ownership and sharing internally and
externally
Determines which records are physical and which are electronic
Provides a basis for retention and disposition
Improves compliance capabilities
Supports training objectives
Identifies vital and sensitive records needing more security
Assesses the quality and appropriateness of records
Supports the release of information under FOIA, Data
Protection Act and other release requirements
29. 16
In order to succeed you must Make sure the goal is attainable
Make sure the stakeholders know the goals
Segment your efforts into smaller units
This might mean define the scope as a certain time frame, or the
scope might be just a certain functional area of the business
Reinforce the goal periodically and in different ways
SO….How do you go about conducting and electronic record
inventory
This is according to
NARA guidelines:
Defines Inventory Goals
Define the scope of the inventory
Obtain top level management support
Decide on the information to be collected
Prepare an inventory form
Decide who will conduct the inventory
Proper training for those performing inventory
Learn where the organization’s business files are located
Conduct inventory
Verify and Analyze the results
34. 20
There are different tools you can rely on in conducting your
inventory. One useful took is records inventory survey.
But it only works if it is a good survey. It must ask the right
questions in the correct way of the appropriate people.
Sort of tricky. You don’t want to collect data that you don’t
need but you want to make sure that you do get all that you
need. You don’t want to begin tabulating your survey results
only to find that you didn’t collect certain information that is
necessary to evaluation of the rest.
Again, don’t reinvent the wheel. You will find these used in an
organization. Locate one as a starting point and modify it to fit
your requirements.
Who Will Conduct the Records Inventory Survey?
Generally – Records Management Project Team is formed to
conduct the survey
Assisted by others outside the business unit
May be IT staff members
Business Analysts
Legal Staff
Specialists/consultants
Important to those conducting the survey:
37. is possible that you may use only one technique, but more likely
you will use some combination of them. The three most
common include:
Approach I
Distributing and Collecting surveys. This is the Traditional
approach; it is Relatively inexpensive and Relatively fast.
However, Problem: Lack of Consistency
Approach II
Conducting in-person interviews. This is Frequently a follow-up
after initial survey
Approach III
Direct Observation. This will require more training and better
understanding of the process. If you use this technique then it
is better to Begin in central computer room and work your way
out
Example of Records Inventory Survey Form…Pages 161-163 of
text book
38. 23
Example of Records Inventory Survey Form…Pages 161-163 of
text book…continued
24
Example of Records Inventory Survey Form…Pages 161-163 of
text book…continued
40. 26
Interview is a good approach, but you have to be careful in
using it.
It is generally time sensitive, so…. You need to make sure you
have identified the proper people to interview. Don’t waste
anyone’s time including your own by selecting people to
interview who do not know the answer to your questions.
Make sure to interview representatives from all functional area
and levels of the program or service:
Managers
Supervisors
Professional/technical staff
Clerical or support staff
Make sure to include a cross-section who make decisions based
upon information contained in the e-records
Make sure to be considerate of the time of those you are
interviewing (and don’t make your executive sponsors think you
are wasting everyone’s time…Give advanced notice, follow-up
to confirm appointments, stay within scheduled time, keep
interviews under and hour …and DON’T BE LATE
Example of Interview Questionnaire
Page 167
from text book
43. 29
What can you do to insure the greatest chance of success in
your organization that the people who work there will buy into
the notice, adopt the policy, become and stay compliant?
Make sure that everyone in the organization is involved in
records management. Everyone buys in. –the person who creates
or receives the record is the best person to classify it
Don’t “micro” classify - Average worker does not want to
spend a great amount of time classifying records – have only a
few broad classifications
Talk the talk – from the top – have senior level steering
committee with at least executives from legal, compliance and
IT
Walk the walk – Communicate to everyone in the organization
what the policies and where they can find them. Adopt rigorous
training
Measure the measurable-measure the adherence to policy and
adoption of processes where possible.
GENERAL PRINCIPLES OF RETENTION SCHEDULING
A SERIES OF PRINCIPLES IS COMMON TO ALL
RETENTION SCHEDULES
The retention schedule must include all records regardless of
46. 31
Continuing on with those principles that will be common to
most records retention schedules:
The records must be retained in a repository (like a file room or
software system) where the record is protected in order to
maintain its integrity
Senior management must approve and sign off on the retention
schedule
Senior management must be able to readily review the policy,
schedule, policy documentation and audit results
There must be complete documentation for the retention policy,
requirements and activities
WHY DO YOU NEED A RECORD RETENTION SCHEDULE?
Allows for uniformity in the retention and disposition process,
regardless of the media or location of the records
Tracks, enforces and audits the retention and disposition of
records, optimizing the amount of records kept to the legal
minimum
SO WHAT? Why is that important?
Saves on capital costs
Saves on labor costs
Reduces liability
50. 34
We talk about “retention”. But retention is generally not
forever. What happens when you have flagged a record as no
longer being necessary for retention. You will never need the
record again for any purpose. So what becomes of the record
after the retention period?
Then it is disposed of. But this may not mean what you think it
does. It does not always mean destroying it for good.
Disposition can include different things depending on the
record:
Destruction-in this case it is permanently removed from all
media forever
Archiving- this is where you organize or index the records and
hand them over to the historical record keeping unit
Transferring-convert them from one medium to another for
backup.
Changing ownership-sometimes you are going to contract with
third parties to retain your records. Or you transfer them from
one department to another for purposes of preservation.
WHAT TYPES OF THINGS ARE INCLUDED IN THE
RECORD RETENTION SCHEDULE?
Title of the record
Description of the record series
Office responsible for retention of the record
By default this is the office of origin but can change
52. Remember the default is the minimum time legally required
Event(s) that trigger disposal – this is a date or the occurrence
of something that makes the time start to run on how long you
have to keep the record
Date(s) when schedule was agreed, signed and modified
Legal citations or a link to the citation that references the
retention requirement for that group of records-probably you are
going to need help with this from the legal department.
Example of Records Retention Schedule…From text book page
172
36
KEY STEPS IN DEVELOPING THE RETENTION SCHEDULE
(U.S. National Archives advises…)
Review the function and recordkeeping requirements for the
organization whose records will be included on the schedule
Inventory the records
Determine the period of time the records are needed for
55. 38
How do we determine which records are require to be included
in the retention schedule? Look at step one from the previous
slide.
We said review the function and record keeping requirements
was the first step in developing the retention schedule.
So what are you doing the review for?
We know we had to perform an inventory and we know we had
to classify the records based upon the inventory.
So we are now ready to develop an information map. This will
allow you to know where the information was created, where it
will finally reside and how it gets from the point of creation to
the point of residence.
This is vital in helping you see the big picture like what records
are created and who will use the records and how the records
will be disposed at the end of their useful life. You will want to
go out and confirm this information map is correct by talking to
every stakeholder. Don’t forget people in accounting and
auditing
But what if your organization does not have a formal
information map. The best solution is to create one. But what if
you do need to do something and there is simply no map and no
time to develop one.
QUICK FIX WHEN THERE IS NO “FORMAL INFORMATION
MAP”?
Compile list of all different record types for each business unit
with essentially same information mapping.
You will forfeit the benefit of having a pictorial map but will
58. 40
So what are the basic record classification groupings?
There are three primarily
Business function and activities
These are the Basic business departments or units (accounting,
legal, human resources, payroll…et.)
It should answer the questions “what were you doing when you
created the record”
Activities – tasks performed to accomplish the business
function. May be more than one activity related to each function
Then there is the Record Series
A record series involves Group or unit of identical or related
records that are normally used and filed as a unit that can be
evaluated as a unit
Third is the Document Type
This is a group of related records. For example when records
are created by similar processes their document types are
equivalent to the business function or activity. Yet, document
types can also refer to the format of the record. For
example…minutes of meeting, power point presentation,
WORD document. When you have this type of classification
there is generally not enough information to determine a
retention period because this is so ambiguous
SO WHY ARE RECORD GROUPINGS IMPORTANT?
Information Organization
Information Access
Completeness
Search Speed
Increases Organizational knowledge and memory by providing
context within which documents were grouped
Identification of owner of record and creator
Helps determine who to assign for tracking responsibility
Consistency in retention and disposition
62. 43
Do are emails business records that have to be retained? There
has been considerable debate about that for a period of time.
Some are and some are not.
But how do you know which are and which are not required to
be retained?
If it is a record it will document a transaction or business
related event that may have legal significance or legal
ramifications or may have historical value. More importantly
those that may be the subject of litigation.
Don’t get hung up on the form of the record. Whether it is an
email or not. Remember it is not the form that is important but
the content. You may have pictures or an audio recording of a
meeting or a WORD document, or even a sticky note, or an
email that may constitute a record depending on its content.
You can never be certain about all emails without reading them
and then there may be some question. But a general set of
guidelines to follow include
Does it document a transaction or progress toward an ultimate
transaction where anything of value is exchanged between two
or more parties
Does it document or provide support of a business activity
occurring that pertains to internal corporate governance policies
or compliance to externally mandated activities
Does it document other business activities that may possibly be
disputed in the future regardless of whether it leads to litigation
64. Lets say you know which emails have to be retained based upon
the criteria or guidelines set for in the prior screen. How long
do you have to keep them? Remember, emails can be a great
source of litigation so you don’t want to keep them longer than
necessary. They are used very very often with wrongful
termination cases..and others of course.
Depending on the type of organization you are dealing with the
retention period may be governed by law. Even then there is
no one definite answer. It will depend on the type of business,
the nature of the email, whether it is of a type that is governed
by state or federal law, and if by state law, then it will vary
depending on the state.
But what if it is not governed by law? Then your organization
can decide based on its own needs….and this can really be
damaging to litigation but keep as short as reasonable
DESTRUCTIVE/RETENTION OF EMAIL?
What is meant by “Destructive Retention”?
An approach to email archiving where email messages are
retained for a limited period of time followed by permanent
deletion of the message from the organization network so there
is no litigation hold or the email has not been declared a record.
What is generally the norm for retention of email?
Nearly ¼ of companies delete email after 90 days (Osterman
Research)
Heavily regulated industries generally retain archived email for
one year or more. Applicable to energy, technology,
communications, real estate. (Fullbright and Jaworski Rearch)
Most common period traditionally has been for 7 years but some
companies take a more defensive posture
69. 48
There is this concept of event based retention scheduling. It is
looked at a little differently depending on the industry.
Event based disposition is where there is an event that triggers
the beginning of the running of time for determining how long
you have to retain a record. An example might be the end of a
project. Another might be the termination of an employee. Yet
another might be a work related injury of an employee. Each of
these events might trigger the beginning of the period of time
running for determining how long you have to keep a record.
Alternate definition used by Department of Defense:
Disposition instruction in which a record is eligible for the
specified destruction upon or immediately after the occurrence
of an event. - no retention period is required
This concept is not a simple as it sounds. Documentation may
be poor as to when these events occur and may cause business
organizations to retain records longer than otherwise required.
PREREQUISITNS FOR EVEN-BASED DISPOSITION?
MUST HAVE A TRIGGERING EVENT
This is not always the case!
It is not always clear!
MUST BE ABLE TO HAVE AUTOMATED CAPTURE OF
TRIGGER EVENT
MUST SEND AUTOMATED TRIGGER TO ERM
ERM MUST HAVE RETENTION CAPABILITIES
ERM MUST HAVE DISPOSITION CAPABILITIES
74. 52
So now you are at implementation. There is automated software
that will interpret the retention periods and will make sure that
the right records are disposed of at the correct time and will
provide an audit trail of disposition.
You will want to insure approval and oversight. Upon
completion of the schedule you wil wna tot get an executive or
project sponsor to sign off on the retention schedule before it is
implemented.
You will most likely want major stakeholders to also sign off on
this. This records retention schedule should be updated as new
record types are introduced.
You will want to Verify Total and Complete Destruction. Just
because someone hits a delete key this does not mean that you
still can’t retrieve or reconstruct the record.
Consider having the authority to review and approve final
destruction once triggered automatically
Certification of record destruction. You may want to consider
having one final review for those records tagged for destruction.
Something may have come up that require you to change the
destruction policy for certain records.
Ongoing maintenance and review. There will be new record
types introduced over time, or the existing ones may change.
You want to review this at least once a year.
Implement IG policies to audit and ensure that policies are
being followed. You have to insure that you have a legally