Contents

Cover

Series

Title Page

Copyright

Dedication

Foreword

Preface

Acknowledgments

Part One: E–Records Concepts

Chapter 1: E–Records Definitions, Business Drivers, and Benefits

Records Management Business Rationale

Why Is Records Management So Challenging?

Benefits of Electronic Records Management

Additional Intangible Benefits

Notes

Chapter 2: Information Governance

First, Better Policies; Then, Better Technology for Better Enforcement

Defining Information Governance

Stakeholder Consultation Is Key

Accountability Is Key

Why IG Is Good Business

Impact of a Successful IG Program

Critical Factors in an IG Program

Who Should Determine IG Policies?

Notes

Chapter 3: Generally Accepted Recordkeeping Principles®

The Principles

Assessment and Improvement Roadmap

Generally Accepted Recordkeeping Principles® Benchmarks

Notes

Chapter 4: Managing E–Documents and Records

Enterprise Content Management

Document Management Principles

Electronic Document Management Systems

Electronic Records Management

Records Management Principles

ERM Principles in Detail

Notes

Part Two: E–Records Fundamentals

Chapter 5: Inventorying E–Records

The Generally Accepted Recordkeeping Principles®

E–Records Inventory Challenges

Records Inventory Purposes

Records Inventorying Steps

UK Approach to the Records Inventorying Process

Appraising the Value of Records

Ensuring Adoption and Compliance of RM Policy

Notes

Chapter 6: Taxonomy Development for E–Records

Importance of Navigation and Classification

When Is a New Taxonomy Needed?

Taxonomies Improve Search Results

Records Grouping Rationale

Business Classification Scheme, File Plans, and Taxonomy

Classification and Taxonomy

Metadata and Taxonomy

Prebuilt versus Custom Taxonomies

Controlled Vocabularies and Hierarchical Taxonomies

Thesaurus Use in Taxonomies

Taxonomy Types

Which Taxonomy Type Should You Use?

Taxonomy Project Planning

Leveraging Subject Matter Experts

Gather Existing Information Sources

Document Inventory

Business Process Analysis

Construct the Taxonomy

What to Do with Items That Do Not Neatly Fit

Taxonomy Testing: A Necessary Step

Taxonomy Maintenance

Taxonomy Management Tools for Continued Maintenance

Social Tagging and Folksonomies

Notes

Chapter 7: Developing Retention Schedules for E–Records

What Is a Records Retention Schedule?

Benefits of a Retention Schedule

General Principles of Retention Scheduling

Developing a Records Retention Schedule

Why Are Retention Schedules Needed?

What Records Do You Have to Schedule? Inventory and Classification

Rationale for Records Groupings

Records Series Identification and Classification

Retention of E–Mail Records

How Long Should You Keep Old E–Mail?

Destruction Retention of E–mail

Records Appraisal: Value Assessment and Prioritization

Legal Requirements and Compliance Research

Event–Based Retention Scheduling for Disposition of E–Records

Prerequisites for Event–Based Disposition

Final Disposition and Closure Criteria

Retaining Transitory Records

Implementation of the Retention Schedule and Disposal of Records

Ongoing Maintenance of the Retention Schedule

Audit to Manage Compliance with the Retention Schedule

Notes

Chapter 8: Managing Vital E–Records

Defining Vital Records

Types of Vital Records

Impact of Losing Vital Records

Creating, Implementing, and Maintaining a Vital Records Program

Implementing Protective Procedures

Cloud Computing Offers a New Option

Auditing the Vital Records Program

Additional Resources

Notes

Chapter 9: ERM Link to Business Process Improvement

Improving Processes, Improving Quality

Six Sigma

Learning from the Failures of the Past

Typical Components When Improving a Business Process

Business Process and E–Records Link

Documenting Business Processes

First Steps in Documenting a Process: Information Gathering

Creating a Process Narrative

Flowcharting

Process Analysis

Workflow

E–Records Are Very Personal to People

Change Management

Communicate, Communicate, Communicate

Find the Source; Avoid the Cycle

Avoid Scope-creep: Defining “The Project” and Its Scope

Changing Processes Gets Personal

Notes

Chapter 10: Workflow and Business Process Management Software

Workflow Software

Business Process Management Suites

Notes

Part Three: Information Delivery Platforms: Managing E–Records

Chapter 11: Managing E–Mail and IM Records*

Employees Regularly Expose Organizations to E–Mail Risk

E–Mail Polices Should Be Realistic and Technology Agnostic

E–Record Retention: Fundamentally a Legal Issue

Preserve E–Mail Integrity and Admissibility with Automatic Archiving

Instant Messaging

Best Practices for Business IM Use

Technology to Monitor IM

Tips for Safer IM

Notes

Chapter 12: Managing E–Records in the Cloud*

Defining Cloud Computing

Key Characteristics of Cloud Computing

What Cloud Computing Really Means

Cloud Deployment Models

Greatest Security Threats to Cloud Computing

IG Guidelines: Managing Documents and Records in the Cloud

Managing E–Docs and Records in the Cloud: A Practical Approach

Long–Term Content Migration Issues

Cloud Services Lack Basic Records Management Capabilities

Notes

Chapter 13: Managing Social Media Business Records*

Types of Social Media in Web 2.0

Additional Social Media Categories

Social Media in the Enterprise

Key Ways Social Media Is Different from E–Mail and Instant Messaging

Biggest Risks of Social Media

Legal Risks of Social Media Posts

Tools to Archive Social Media

IG Considerations for Social Media

Key Social Media Policy Guidelines

Records Management Considerations for Social Media

Emerging Best Practices for Managing Social Media Records

Notes

Chapter 14: SharePoint Governance for E–Records and Documents

Process Change, People Change

Where to Begin the Planning Process

Records Management Policy Considerations

Roles and Responsibilities

Establish Processes

Training Plan

Communications Plan

Notes

Part Four: Technical Issues

Chapter 15: International E–Records Standards

Benefits of Standards

Major International Standards

Additional Guidance from ANSI, ARMA, AIIM, NIST, BSI

Major National and Regional ERM Standards

Other National Standards

Where to Find More Information on ERM Standards

Notes

Chapter 16: Metadata Governance, Standards, and Strategies

Types of Metadata

Core Metadata Issues

International Metadata Standards and Guidance

National Metadata Standards

Metadata Strategies

Notes

Chapter 17: Long–Term Digital Preservation

Defining Long–Term Digital Preservation

Key Factors in Long–Term Digital Preservation

Threats to Preserving Records

Digital Preservation Standards

PREMIS Preservation Metadata Standard

Recommended Open–Standard Technology–Neutral Formats

Digital Preservation Requirements

Long–Term Digital Preservation Capability Maturity Model®

Scope of the Capability Maturity Model

Digital Preservation Capability Performance Metrics

Digital Preservation Strategies and Techniques

Evolving Marketplace

Looking Forward

Notes

Chapter 18: Storage and Hardware Considerations

The Onslaught of “Big Data”

Basic Types of Computer Storage

Today's E–Records Storage Solutions

Nonerasable Nonrewritable Requirement for Securities Broker–Dealers

Nonalterable Media Helps Meet Regulations in Healthcare and Other Industries

Notes

Part Five: Project and Program Management Issues

Chapter 19: E–Records Project Planning and Program Management Issues

Avoiding Problems

Communication Is Key

Getting an Early Win

Selecting the Right Team Members

Project Charter

Standards in Project Management

Project Management Methodologies

Determining the Best Approach

Moving to an Ongoing Program

Monitoring and Accountability

Continuous Process Improvement

Why Continuous Improvement Is Needed

Notes

Chapter 20: Building the Business Case to Justify an ERM Program

Determine What Will Fly in Your Organization

Strategic Business Drivers for Project Justification

Benefits of Electronic Records Management

Presenting the Business Case

Notes

Chapter 21: Securing Executive Sponsorship

Executive Sponsor Role

Project Manager: Key Tasks

It's the Little Things

Evolving Role of the Executive Sponsor

Notes

Chapter 22: Procurement Governance: The Buying Process

Evaluation and Selection Process: RFI, RFP, or RFQ?

Evaluating Software Providers: Key Criteria

Negotiating Contracts: Ensuring the Decision

More Contract Caveats

How to Pick a Consulting Firm: Evaluation Criteria

Notes

Chapter 23: Best Practices for Electronic Records Management

Detailed ERM Best Practices

Conclusion

Notes

Appendix A: Laws and Major Regulations Related to Records Management

United States

Gramm–Leach–Bliley Act

Healthcare Insurance Portability and Accountability Act of 1996 (HIPAA)

PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001)

Sarbanes–Oxley Act (SOX)

SEC Rule 17A–4

CFR Title 47, Part 42—Telecommunications

CFR Title 21, Part 11—Pharmaceuticals

U.S. Federal Authority on Archives and Records: National Archives and Records Administration (NARA)

U.S. Code of Federal Regulations

Canada*

United Kingdom

Australia

Identifying Records Management Requirements in Other Legislation

Notes

Appendix B: Listing of Technology and Service Providers

Appendix C: Trends in Electronic Medical Records Technology

Diagnostic Support Intelligence

Computerized Physician Order Entry (CPOE) Facilitation

Drug Alerts

Charting Patient Vital Signs and Significant Indicators

Patient Compliance Support

Improved Organization of Clinical Data for Improved Access

Connectivity with Existing Digital Technologies

Improved Workflow for Added Efficiency and Status Tracking

Mobile Technologies More Easily Integrated

Compatibility with Radiology Picture Archiving and Communication Systems (PACS) Networks for Access to Diagnostic Images

Enables Patient Remote Access to Their Medical Records

Interoperability with Multiple Clinicians and Medical Providers to Optimize and Coordinate Patient Care

All Certified EMR Vendors Must Implement the Health Information Exchange Protocols for Interoperability

Electronic Master Patient Index

Public Health Access to Patient Data

Provides Better and Faster Data for Epidemiology Studies and Drug Efficacy

EMR Technology for the 2012 U.S. Olympic Team

HIMSS EMR Adoption Model

Implementation of New ICD–10 Codes to Automate Medical Billing and Manage Costs

Accountable Care Organizations

Notes

Glossary

Notes

About the Author

About the Major Contributors

Index

WILEY CIO SERIES

Founded in 1807, John Wiley & Sons is the oldest independent publishing company in the United States. With offices in North America, Europe, Asia, and Australia, Wiley is globally committed to developing and marketing print and electronic products and services for our customers' professional and personal knowledge and understanding.

The Wiley CIO series provides information, tools, and insights to IT executives and managers.  The products in this series cover a wide range of topics that supply strategic and implementation guidance on the latest technology trends, leadership, and emerging best practices. 

Titles in the Wiley CIO series include:

The Agile Architecture Revolution: How Cloud Computing, REST-Based SOA, and Mobile Computing Are Changing Enterprise IT by Jason Bloomberg

Big Data, Big Analytics: Emerging Business Intelligence and Analytic Trends for Today's Businesses by Michele Chambers, Ambiga Dhiraj, and Michael Minelli

The Chief Information Officer's Body of Knowledge: People, Process, and Technology by Dean Lane

CIO Best Practices: Enabling Strategic Value with Information Technology by Joe Stenzel, Randy Betancourt, Gary Cokins, Alyssa Farrell, Bill Flemming, Michael H. Hugos, Jonathan Hujsak, and Karl D. Schubert

The CIO Playbook: Strategies and Best Practices for IT Leaders to Deliver Value by Nicholas R. Colisto

Enterprise IT Strategy, + Website: An Executive Guide for Generating Optimal ROI from Critical IT Investments by Gregory J. Fell

Executive's Guide to Virtual Worlds: How Avatars Are Transforming Your Business and Your Brand by Lonnie Benson

Innovating for Growth and Value: How CIOs Lead Continuous Transformation in the Modern Enterprise by Hunter Muller

IT Leadership Manual: Roadmap to Becoming a Trusted Business Partner by Alan R. Guibord

Managing Electronic Records: Methods, Best Practices, and Technologies by Robert F. Smallwood

On Top of the Cloud: How CIOs Leverage New Technologies to Drive Change and Build Value Across the Enterprise by Hunter Muller

Straight to the Top: CIO Leadership in a Mobile, Social, and Cloud-based (Second Edition) by Gregory S. Smith

Strategic IT: Best Practices for IT Managers and Executives by Arthur M. Langer

Strategic IT Management: Transforming Business in Turbulent Times by Robert J. Benson

Transforming IT Culture: How to Use Social Intelligence, Human Factors and Collaboration to Create an IT Department That Outperforms by Frank Wander

Unleashing the Power of IT: Bringing People, Business, and Technology Together by Dan Roberts

The U.S. Technology Skills Gap: What Every Technology Executive Must Know to Save America's Future by Gary Beach

Cover image: © alengo/iStockphoto
Cover design: John Wiley & Sons, Inc.

Copyright © 2013 by John Wiley & Sons, Inc. All rights reserved.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.
Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Cataloging-in-Publication Data:

Smallwood, Robert F., 1959-
Managing electronic records : methods, best practices, and technologies / Robert F. Smallwood.
pages cm
Includes bibliographical references and index.
ISBN 978-1-118-21829-7 (cloth); ISBN 978-1-118-28483-4 (ebk); ISBN 978-1-118-28290-8 (ebk); ISBN 978-1-118-28238-0 (ebk)
1. Electronic records — Management. 2. Records —Management. I. Title.
CD974.4.S63 2013
025.04—dc23
2012045105

For my dearly departed brothers:

William Scott Smallwood

David Bruce Smallwood

FOREWORD

This book is timely: There continues to be a strong need for comprehensive resources addressing the diverse issues and challenges of managing electronic records.

This need has grown over the twenty–plus years I have co–chaired the only national conference focusing exclusively on electronic records management (ERM). I am pleased to welcome and applaud Robert Smallwood's comprehensive book on managing electronic records as an excellent, profound information resource.

The need for this book is founded in the “sea change” that the management of electronic records has undergone—and continues to undergo—as society and business have moved full on into the digital age.

Consider just five of the component changes:

1.The historic function has evolved from materials management to risk mitigation.

2. An increasing focus on the broader tenets of information governance (IG).

3.The very nature of what constitutes records has expanded greatly to include metadata, e–mail, messaging, social media, cloud use—and it continues to evolve.

4. The volume of records being created and needing to be managed has grown exponentially.

5. The use of records to resolve legal disputes has expanded from primarily “proving the positive” to “proving the negative.”

Bottom line: The sea change resulting in the digitization of business records has created a whole new world regarding what is managed, why it is managed, how it is managed, and who is responsible for the management process. And increasingly, as the goal of managing records has become more focused on risk mitigation, the sphere of solution buyers has expanded to include project managers and professionals in risk management, compliance, IG, and law.

From all these manifestations of change, Robert Smallwood, in collaboration and consultation with a number of leading practitioners, has come forward with a comprehensive and authoritative resource on the management of electronic records never before available. Robert's book is a pioneering resource with focus and quality. It presents not only a “big picture” perspective of the issues and problems but also quite specific recommendations from an operational perspective—providing insights and assistance not only for students, young professionals, and newly assigned project leaders, but also for seasoned records management, risk, legal, and compliance professionals.

This book is a huge undertaking that few have both the vision to take on and the perseverance to make a reality. It is a much–needed resource that will facilitate education on electronic records management issues and help in achieving the implementation of successful solutions. Bravo!

Robert F. Williams
Cohasset Associates

PREFACE

After more than five years of e-records research, and an intensive year of detailed research, consultation, collaboration, writing, and editing, this book has come to fruition. It represents a truly collaborative effort by a number of experts and highly skilled practitioners in electronic records management (ERM) and the broader information governance (IG) field. I am fortunate to know them: Some of the contributors I have known for decades; and this is a lesson for students and young professionals—that lasting business relationships are a vital resource that can yield career rewards over the long term, but also offer lasting friendships that are a reward in themselves. This is only possible if you immerse yourself in your chosen field and strive for excellence day after day, year after year, and hold respect for your work and the work of your colleagues. No one can know everything, but if you know key people who have specific expertise, you can always find the answers you need. Of course, you will also need to be able to return the favor.

We strove to extensively document our work so that researchers, analysts, practitioners, teachers, and students wishing to delve further into particular topics will have a head start in knowing where to find additional information. This was a difficult and tedious process, which yielded over 600 citations. We tried to distill the massive amount of information into clear, understandable, actionable terms. We also to confirm and document methods, best practices, standards, and technical information from a variety of sources, both public and private, from books, blogs, magazines, interviews, government portals, and consulting work product; and also, to include expertise from around the world to make this book truly a global resource.

Writing it was a challenging series of research and analysis tasks undertaken and represents a collective mountain of effort—and many, many mornings of waking before dawn to study, consult, collaborate, and write. It would have been easier and less stressful to give up, but we pressed on.

The result is the most comprehensive and current resource on the topic of ERM ever produced, which will hopefully afford those relying on this information an easier road as they implement ERM and IG programs.

This book will assist records managers, CIOs, IT managers, compliance and risk managers, and others involved in records management and information governance to make intelligent, informed decisions. For those seeking to implement an information governance program that includes electronic records management, bulk pricing for the book and e–book are available. Please visit: www.electronic–records–management.com.

— Robert F. Smallwood

ACKNOWLEDGMENTS

I would like to sincerely thank my colleagues for their support and generous contribution of their time and expertise, which made this book possible, and improved it greatly:

Many thanks to Lori Ashley, Barb Blackburn, Barclay Blair, Charmaine Brooks, Ken Chasse, Monica Crocker, Charles M. Dollar, Seth Earley, Marc Fresko, Steve Goodfellow, Gordon Hoke, Ulrich Kampffmeyer, John W. Orth, Bud Porter–Roth, Jon Pyke, Paula Lederman, Craig Rhinehart, and Robert F. Williams.

I am truly honored to include their work and owe them a great debt of gratitude.

PART ONE

E–Records Concepts

CHAPTER 1

E–Records Definitions, Business Drivers, and Benefits

First, some basic definitions of core terms used in this text: The International Organization for Standardization (ISO) defines (business) records as “information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”1 It further defines records management as “[the] field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”2

The U.S.–based Association of Records Managers and Administrators (ARMA), defines a record as “evidence of what an organization does. They capture its business activities and transactions, such as contract negotiations, business correspondence, personnel files, and financial statements. . . .”3

Electronic records management (ERM) has moved to the forefront of business issues with the increasing automation of business processes, and the vast growth in the volume of electronic documents and records that organizations create. These factors, coupled with expanded and tightened reporting laws and compliance regulations, have made ERM increasingly essential for most enterprises—especially highly regulated and public ones—over the past decade.

ERM follows generally the same principles as traditional paper–based records management, that is, there are classification and taxonomy needs to group and organize the records; and there are retention and disposition schedules to govern the length of time a record is kept, and its ultimate disposition, whether it is destruction, transfer, or long–term archiving. Yet e–records must be handled differently and they contain more detailed data about their contents and characteristics, known as metadata. (This book discusses these detailed topics in more depth in later chapters.)

E–records are also subject to changes in information technology (IT) that may make them difficult to retrieve and view and therefore render them obsolete. These issues can be addressed through a sound ERM program that includes long–term digital preservation (LTDP) methods and technologies.

ERM is primarily the organization, management, control, monitoring, and auditing of formal business records that exist in electronic form. But automated ERM systems also track paper–based and other physical records. So ERM goes beyond simply managing electronic records; it is the management of electronic records and the electronic management of nonelectronic records (e.g., paper, CD/DVDs, magnetic tape, audio–visual, and other physical records).

E–records management has become much more critical to enterprises with increased compliance legislation and massively increasing volumes of electronic information.

Most electronic records, or “e–records,” originally had an equivalent in paper form, such as memos (now e–mail), accounting documents (e.g., purchase orders, invoices), personnel documents (e.g., job applications, resumes, tax documents), contractual documents, line–of–business documents (e.g., loan applications, insurance claim forms, health records), and required regulatory documents (e.g., material safety data sheets, MSDS). In the past, many of these documents were first archived to microfilm or microform/microfiche, before e–document software began to mature in the 1990s.

Not all documents rise to the level of being declared a formal business record that needs to be retained; that definition depends on the specific regulatory and legal requirements imposed on the organization, and the internal definitions and requirements the organization imposes on itself, through internal information governance (IG) measures and business policies. IG is the policies, processes, and technologies used to manage and control information throughout the enterprise to meet internal business requirements and external legal and compliance demands.

ERM is a component of enterprise content management (ECM), just as document management, web content management, digital asset management, enterprise report management, and several other technology sets. ECM encompasses all an organization's unstructured digital content, (which means it excludes structured data i.e., databases). ECM includes the vast majority—over 90 percent—of an organization's overall information, which must be governed and managed.

ERM extends ECM to provide control and to manage records through their lifecycle—from creation to archiving or destruction. ERM is used to complete the lifecycle management of information, documents, and records.

ERM adds the functionality to complete the management of information and records by applying business rules to manage the maintenance, security, integrity and disposition of records. Both ERM and ECM systems will aid in locating and managing the records and information needed to conduct business efficiently, to comply with legal and regulatory requirements, and effectively destroy (paper) and delete (digital) records that have met their retention policy timeframe requirement, freeing up valuable space, physical and digital, and eliminating records that could be a liability if kept.

E–records management follows the same basic principles as paper–based records management.

E–records management includes the management of electronic and nonelectronic records, like paper and other physical records.

Records Management Business Rationale

Historically, highly regulated industries, such as banking, energy, and pharmaceuticals, have had the greatest need to implement records management programs, due to their compliance and reporting requirements.4 However, over the past decade or so, increased regulation and changes to legal statutes and rules have made records management a business necessity for nearly every enterprise (beyond very small businesses).

Notable industry drivers include:

Increased government oversight and industry regulation. It is a fact that government regulations that require greater reporting and accountability were early business drivers that fueled the implementation of formal records management programs. This is true at the federal and state or provincial level. There are a number of laws and regulations related to records management that have been added in the past 10 to 15 years. In the United States, the Sarbanes–Oxley Act of 2002 (SOX) created and enhanced standards of financial reporting and transparency for the boards and executive management of public corporations and accounting firms. It also addressed auditor independence and corporate governance concerns. SOX imposes fines or imprisonment penalties for noncompliance, and requires that senior officers sign off on the veracity of financial statements. It states clearly that pertinent business records cannot be destroyed during litigation or compliance investigations. Since SOX, other countries, such as Japan, Australia, Germany, France, and India, have adopted stricter “‘SOX–like” governance and financial reporting standards.

Changes in legal procedures and requirements during civil litigation. In 2006, the need to amend the U.S. Federal Rules of Civil Procedure (FRCP) to contain specific rules for handling electronically generated evidence was addressed. The changes included processes and requirements for legal discovery of electronically stored information (ESI) during civil litigation. Today, e–mail is the leading form of evidence requested in civil trials. The changes to the U.S. FRCP had a pervasive impact on American enterprises and required them to gain control over their ESI and implement formal records management and electronic discovery (“e–discovery”) programs to meet new requirements. Although they have been ahead of the U.S. in their development and maturity of records management practices, Canadian, British, and Australian law is closely tracking that of the United States in legal discovery. The U.S. is simply a more litigious society so this is not unexpected.

Information governance awareness. IG, in short, is the set of rules, policies, and business processes used to manage and control the totality of an organization's information. Monitoring technologies are required to enforce and audit IG compliance. Beginning with major legislation like SOX in 2002, and continuing with the massive U.S. FRCP changes in 2006, enterprises have become more “IG aware” and have ramped up efforts to control, manage, and secure their information. A significant component of any IG program is implementing a records management program that specifies the retention periods and disposition (e.g., destruction, transfer, archive) of formal business records. This, for instance, allows enterprises to destroy records once their required retention period (based on external regulations, legal requirements, and internal IG policies) has been met, and allows the enterprise to legally destroy records with no negative impact or lingering liability.

Business continuity concerns. In the face of real disasters, such as the 9/11 terrorist attacks, Hurricane Katrina, and in 2012, Superstorm Sandy, executives now realize that disaster recovery and business resumption is something they must plan and prepare for. Disasters really happen and businesses do fail if they are not well–prepared. The focus is on vital records (more details on this topic in subsequent chapters), which are necessary to resume operations in the event of a disaster, and managing vital records is a part of an overall records management program.

A number of factors provide the business rationale for ERM, including facilitating compliance, supporting information governance (IG), and providing backup capabilities in the event of a disaster.

Why Is Records Management So Challenging?

With these business environment, regulatory, legal, and IG influences and changes comes increased attention to records management as a driver for corporate compliance. For most organizations, a lack of defined policies and the enormous and growing volumes of e-documents (e.g., e–mail messages) make implementing a formal records management program challenging and costly. Some reasons for this include:

Changing and increasing regulations. Just when records and compliance managers have sorted through the compliance requirements of federal regulations, new ones at the state or provincial level are created or tightened down.

Maturing information governance requirements within the organization. As senior managers become increasingly aware of information governance—the rules, policies, and processes that control and manage information—they promulgate more reporting and auditing requirements for the management of formal business records.

Managing multiple retention and disposition schedules. Depending on the type of record, retention requirements vary, and they may vary for the same type of record based on state and federal regulations. Further, internal information governance policies may extend retention periods and may fluctuate with management changes.5

Compliance costs and requirements with limited staff. Records management and compliance departments are notoriously understaffed, since they do not generate revenue. Departments responsible for executing and proving compliance with new and increasing regulatory requirements must do so expediently, often with only skeletal staffs. This leads to expensive outsourcing solutions, or staff increases. The cost of compliance must be balanced with the risk of maintaining a minimum level of compliance.

Changing information delivery platforms. With cloud computing, mobile computing, Web 2.0, social media and other changes to information delivery and storage platforms, records and compliance managers must stay apprised of the latest information technology trends and provide records on multiple platforms – while maintaining the security and integrity of organizational records.

Security concerns. Protecting and preserving corporate records is of paramount importance, yet users must have reasonable access to “official” records to conduct everyday business. “Organizations are struggling to balance the need to provide accessibility to critical corporate information with the need to protect the integrity of corporate records.”6

Dependence on the information technology (IT) department or provider. Since tracking and auditing use of formal business records requires IT, and records and compliance departments are typically understaffed, they must rely on assistance from their IT department or outsourced IT provider—which often do not have the same perspective and priorities as the departments they serve.

User assistance and compliance. Users often “go their own way” with regard to records, ignoring directives from records managers to stop storing “shadow” files of records on their desktop (for their own convenience), and inconsistently following directives to classify records as they are created. Getting users across a range of departments in the enterprise to comply uniformly with records and compliance requirements is a daunting and unending task that requires constant attention and reinforcement.7 But it can be done through methodical steps.

Implementing ERM is challenging because it requires user support and compliance, adherence to changing laws, and support for new information delivery platforms like mobile and cloud computing.

Benefits of Electronic Records Management

There are a number of business drivers and benefits that combine to create a strong case for implementing an enterprise ERM program. Most are tactical, such as cost savings, time savings, and building space savings. But some drivers can be thought of as strategic, in that they proactively give the enterprise an advantage. One example may be the advantages gained in litigation by having more control and ready access to complete business records, which yields more accurate results, and more time for corporate attorneys to develop strategies—while the opposition is wading through reams of information, never knowing if they have found the complete set of records they need. Another example of a strategic benefit is more complete and better information for managers to base decisions upon.

An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefits.

Implementing ERM represents a significant investment. An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefits. The volume of records in organizations has often exceeded the employees' ability to manage them. ERM systems do for the information age what the assembly line did for the industrial age. The cost/benefit justification for ERM is sometimes difficult to determine, although there are real labor and cost savings. Also, many of the benefits are intangible or difficult to calculate, but help to justify the capital investment. There are many ways in which an organization can gain significant business benefits with ERM.

More detail on business benefits is provided in Chapter 20, Building the Business Case, but hard, calculable benefits (when compared to storing paper files) include office space savings, office supplies savings, cutting wasted search time, and reduced office automation costs (e.g., fewer printers, copiers, cutting automated filing cabinets).

In addition, implementing ERM will provide the organization with improved capabilities for enforcing IG over business documents and records, and improved, more complete, and more accurate searches; improved knowledge worker productivity; reduced risk of compliance actions or legal consequences; improved records security; improved ability to demonstrate legally defensible records management practices; and increased working confidence in making searches, which should improve decision–making.

Additional Intangible Benefits

The U.S. Environmental Protection Agency (EPA), a pioneer and leader in e–records implementation in the federal sector, lists some additional benefits8 of implementing ERM:

ERM benefits are both tangible and intangible or difficult to calculate.

Improved professionalism, preserving corporate memory, and support for better decision–making are key intangible benefits of ERM.

1.To Control the Creation and Growth of Records. Despite decades of using various nonpaper storage media, the amount of paper in our offices continues to escalate. An effective records management program addresses both creation control (limits the generation of records or copies not required to operate the business) and records retention (a system for destroying useless records or retiring inactive records), thus stabilizing the growth of records in all formats.

2.To Assimilate New Records Management Technologies. A good records management program provides an organization with the capability to assimilate new technologies and take advantage of their many benefits. Investments in new computer systems don't solve filing problems unless current manual recordkeeping systems are analyzed (and occasionally, overhauled) before automation is applied.

3.To Safeguard Vital Information. Every organization, public or private, needs a comprehensive program for protecting its vital records and information from catastrophe or disaster, because every organization is vulnerable to loss. Operated as part of the overall records management program, vital records programs preserve the integrity and confidentiality of the most important records and safeguard the vital information assets according to a “Plan” to protect the records.

4.To Preserve the Corporate Memory. An organization's files contain its institutional memory, an irreplaceable asset that is often overlooked. Every business day, you create the records that could become background data for future management decisions and planning. These records document the activities of the Agency that future scholars may use to research the workings of the Environmental Protection Agency.

5.To Foster Professionalism in Running the Business. A business office with files askew, stacked on top of file cabinets and in boxes everywhere, creates a poor working environment. The perceptions of customers and the public, and “image” and “morale” of the staff, though hard to quantify in cost–benefit terms, may be among the best reasons to establish a good records management program.9

So there are a variety of tangible and intangible benefits derived from ERM programs, yet the business rationale that fits for your organization depends on its specific needs and business objectives.

CHAPTER SUMMARY: KEY POINTS

According to ISO, a record is “information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”10

Records management is “[the] field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”11

Electronic records management (ERM) includes the management of electronic and nonelectronic records, like paper and other physical records.

ERM has become much more critical to enterprises with increased compliance legislation and massively increasing volumes of electronic information.

ERM follows the same basic principles as paper–based records management.

A number of factors provide the business rationale for ERM, including facilitating compliance, supporting information governance (IG), and providing backup capabilities in the event of a disaster.

Implementing ERM is challenging since it requires user support and compliance, adherence to changing laws, and support for new information delivery platforms like mobile and cloud computing.

ERM benefits are both tangible and intangible or difficult to calculate. Tangible benefits include space savings, office automation and supplies savings, and search time reduction.

Improved professionalism, preserving corporate memory, support for better decision–making, and safeguarding vital records are key intangible benefits of ERM.

Notes

1. International Organization for Standardization, “Information and Documentation—Records Management. Part 1: General,” ISO 15489–1:2001 section 3.15 (Geneva: ISO, 2001).

2. International Organization for Standardization, “Information and Documentation—Records Management. Part 1: General,” ISO 15489–1:2001, section 3.16 (Geneva: ISO, 2011).

3. ARMA.org, “What Is Records Management?” 2009, www.arma.org/pdf/WhatIsRIM.pdf.

4. www.microsoft.com/en–us/download/details.aspx?id=15932, “Records Management with Office SharePoint Server,” Microsoft White Paper, 2007. Used with permission from Microsoft.

5. Ibid.

6. Ibid.

7. “Records Management with Office SharePoint Server.”

8. EPA, “Why Records Management? Ten Business Reasons,” updated March 8, 2012, www.epa.gov/records/what/quest1.htm.

9. Ibid.

10. International Organization for Standardization, “Information and Documentation—Records Management. Part 1: General,” ISO 15489–1:2001, section 3.15 (Geneva: ISO, 2001).

11. International Organization for Standardization, “Information and Documentation—Records Management. Part 1: General,” ISO 15489–1:2001, section 3.16 (Geneva: ISO, 2011).

CHAPTER 2

Information Governance

The Crucial First Step

Information governance (IG) is a sort of “super discipline” that has emerged as a result of new and tightened legislation governing businesses, and the recognition that multiple overlapping disciplines were needed to address today's information management challenges in an increasingly regulated and litigated business environment.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!