VERY URGENT

INFORMATION GOVERNANCE AND RECORDS 151

of documents (e.g., e-mail messages) make implementing a formal RM program chal- lenging and costly. Some reasons for this include:

■ Changing and increasing regulations. Just when records and compliance managers have sorted through the compliance requirements of federal regulations, new ones at the state or provincial level are created or tightened down.

■ Maturing IG requirements within the organization. As senior managers become increasingly aware of IG—the rules, policies, and processes that control and manage information—they promulgate more reporting and auditing require- ments for the management of formal business records.

■ Managing multiple retention and disposition schedules. Depending on the type of record, retention requirements vary, and they may vary for the same type of record based on state and federal regulations. Further, internal information governance policies may extend retention periods and may fl uctuate with management changes.5

■ Compliance costs and requirements with limited staff. RM and compliance depart- ments are notoriously understaffed, since they do not generate revenue. De- partments responsible for executing and proving compliance with new and increasing regulatory requirements must do so expediently, often with only skeletal staffs. This leads to expensive outsourcing solutions or staff increases. The cost of compliance must be balanced with the risk of maintaining a mini- mum level of compliance.

■ Changing information delivery platforms. With cloud computing, mobile com- puting, Web 2.0, social media, and other changes to information delivery and storage platforms, records and compliance managers must stay apprised of the latest IT trends and provide records on multiple platforms all while maintain- ing the security and integrity of organizational records.

■ Security concerns. Protecting and preserving corporate records is of paramount importance, yet users must have reasonable access to offi cial records to conduct everyday business. “Organizations are struggling to balance the need to provide accessibility to critical corporate information with the need to protect the in- tegrity of corporate records.” 6

■ Dependence on the IT department or provider. Since tracking and auditing use of formal business records requires IT, and records and compliance departments typically are understaffed, those departments must rely on assistance from the IT department or outsourced IT provider—which often does not have the same perspective and priorities as the departments they serve.

■ User assistance and compliance. Users often go their own way with regard to records, ignoring directives from records managers to stop storing shadow fi les of records on their desktop (for their own convenience) and inconsistently following directives to classify records as they are created. Getting users across a range of departments in the enterprise to adhere uniformly with records and compliance requirements is a daunting and unending task that requires constant attention and reinforcement. 7

Implementing ERM is challenging because it requires user support and com- pliance, adherence to changing laws, and support for new information deliv- ery platforms, such as mobile and cloud computing.

152 INFORMATION GOVERNANCE

Benefi ts of Electronic Records Management

A number of business drivers and benefi ts combine to create a strong case for imple- menting an enterprise ERM program. Most are tactical, such as cost savings, time savings, and building space savings. But some drivers can be thought of as strategic , in that c they proactively give the enterprise an advantage. One example may be the advantages gained in litigation by having more control and ready access to complete business records, which yields more accurate results and more time for corporate attorneys to develop strategies while the opposition is wading through reams of information, never knowing if it has found the complete set of records it needs. Another example is more complete and better information for managers to base decisions on.

Implementing ERM represents a signifi cant investment. An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefi ts. The volume of records in organizations often exceeds employees’ ability to manage them. ERM systems do for the information age what the assembly line did for the industrial age. The cost/benefi t justifi cation for ERM is sometimes diffi cult to determine, although there are real labor and cost savings. Also, many of the benefi ts are intangible or diffi cult to calculate but help to justify the capital investment. There are many ways in which an organization can gain signifi cant business benefi ts with ERM.

More detail on business benefi ts is provided in Chapter 7 , but hard, calculable benefi ts (when compared to storing paper fi les) include offi ce space savings, offi ce supplies savings, cutting wasted search time, and reduced offi ce automation costs (e.g., fewer printers, copiers, cutting automated fi ling cabinets).

In addition, implementing ERM will provide the organization with:

■ Improved capabilities for enforcing IG over business documents and records ■ Improved, more complete, and more accurate searches ■ Improved knowledge worker productivity ■ Reduced risk of compliance actions or legal consequences ■ Improved records security ■ Improved ability to demonstrate legally defensible RM practices ■ Increased working confi dence in making searches, which should improve deci-

sion making

An investment in ERM is an investment in business process automation and yields document control, document integrity, and security benefi ts.

ERM benefi ts are both tangible and intangible or diffi cult to calculate.

INFORMATION GOVERNANCE AND RECORDS 153

Additional Intangible Benefi ts

The U.S. Environmental Protection Agency (EPA), a pioneer and leader in e-records im- plementation in the federal sector, lists some additional benefi ts of implementing ERM:

1. To control the creation and growth of records. Despite decades of using vari- ous nonpaper storage media, the amount of paper in our offi ces continues to escalate. An effective records management program addresses both cre- ation control (limits the generation of records or copies not required to operate the business) and records retention (a system for destroying useless records or retiring inactive records), thus stabilizing the growth of records in all formats.

2. To assimilate new records management technologies. A good records manage- ment program provides an organization with the capability to assimilate new technologies and take advantage of their many benefi ts. Investments in new computer systems don’t solve fi ling problems unless current manual record-keeping systems are analyzed (and occasionally, overhauled) before automation is applied.

3. To safeguard vital information. Every organization, public or private, needs a comprehensive program for protecting its vital records and information from catastrophe or disaster, because every organization is vulnerable to loss. Operated as part of the overall records management program, vital records programs preserve the integrity and confi dentiality of the most important records and safeguard the vital information assets according to a “plan” to protect the records.

4. To preserve the corporate memory. An organization’s fi les contain its institu- tional memory, an irreplaceable asset that is often overlooked. Every busi- ness day, you create the records that could become background data for future management decisions and planning. These records document the activities of the agency that future scholars may use to research the work- ings of the Environmental Protection Agency.

5. To foster professionalism in running the business. A business offi ce with fi les askew, stacked on top of fi le cabinets and in boxes everywhere, creates a poor working environment. The perceptions of customers and the public, and “image” and “morale” of the staff, though hard to quantify in cost-benefi t terms, may be among the best reasons to establish a good records management program.8

Thus, there are a variety of tangible and intangible benefi ts derived from ERM programs, and the business rationale that fi ts for your organization depends on its specifi c needs and business objectives.

Improved professionalism, preserving corporate memory, and support for bet- ter decision making are key intangible benefi ts of ERM.

154 INFORMATION GOVERNANCE

Inventorying E-Records

According to the U.S. National Archives and Records Administration (NARA), “In records management, an t inventory is a descriptive listing of each record series ory system, together with an indication of location and other pertinent data. It is not a list of each document or each folder but rather of each series or system ”9 (emphasis added).

Conducting an inventory of electronic records is more challenging than perform- ing a physical records inventory, but the purposes are the same: to ferret out RM problems and to use the inventory as the basis for developing the retention schedule. Some of the RM problems that may be uncovered

include inadequate documentation of offi cial actions, improper applications of record-keeping technology, defi cient fi ling systems and maintenance prac- tices, poor management of nonrecord materials, insuffi cient identifi cation of vital records, and inadequate records security practices. When completed, the inventory should include all offi ces, all records, and all nonrecord materials. An inventory that is incomplete or haphazard can only result in an inadequate schedule and loss of control over records. 10

The fi rst step in gaining control over an organization’s records and imple- menting IG measures to control and manage them is to complete an inventory of all groupings of business records, including electronic records, 11 at the system or fi le series level.

The focus of this book is on IG and more granually e-records, and when it comes to e-records, NARA has a specifi c recommendation: Inventory at the computer systems level. This differs from advice given by experts in the past.

The records inventory is the basis for developing a records retention schedule that spells out how long different types of records are to be held and how they will be archived or disposed of at the end of their life cycle. But fi rst you must determine where business records reside, how they are stored, how many exist, and how they are used in the normal course of business.

There are a few things to keep in mind when approaching the e-records invento- rying process:

■ Those who create and work with the records themselves are the best source of information about how the records are used. They are your most critical resource in the inventorying process.

■ RM is something that everyone wants done but no one wants to do (although everyone will have an opinion on how to do it).

■ The people working in business units are touchy about their records. It will take some work to get them to trust a new RM approach. 12

NARA recommends that electronic records are inventoried by information sys- tem, not by record series.

INFORMATION GOVERNANCE AND RECORDS 155

These knowledge workers are your best resource and can be your greatest allies or worst enemies when it comes to gathering accurate inventory data; developing a workable fi le plan; and keeping the records declaration, retention, and disposition process operating effi ciently. A sound RM program will keep the records inventory accurate and up to date.

Generally Accepted Recordkeeping Principles®

See Chapter 3 for more detail on applicable principles in IG. To summarize: It may be useful to use a model or framework to guide your records inventorying efforts. Such frameworks could be the D.I.R.K.S. (Designing and Implementing Recordkeeping Systems) used in Australia or the Generally Accepted Recordkeeping Principles® (or “the Principles”) that originated in the United States at ARMA International. The Principles are a “framework for managing records in a way that supports an organization’s immediate and future regulatory, legal, risk mitigation, environmental, and operational requirements. ” 13

Special attention should be given to creating an accountable, open inventorying process that can demonstrate integrity. The result of the inventory should help the or- ganization adhere to records retention, disposition, availability, protection, and com- pliance aspects of The Principles.

The Generally Accepted Recordkeeping Principles were created with the as- sistance of ARMA International and legal and IT professionals who reviewed and distilled global best practice resources. These included the international records management standard ISO15489–1 from the American National Standards Institute and court case law. The principles were vetted through a public call-for-comment process involving the professional records informa- tion management . . . community. 14

E-Records Inventory Challenges

If your organization has received a legal summons for e-records, and you do not have an accurate inventory, the organization is already in a compromising position: You do not know where the requested records might be, how many copies there might be, or the process and cost of producing them. Inventorying must be done sooner rather than later and proactively rather than reactively.

E-records present challenges beyond those of paper of microfi lmed records due to their (elec- tronic) nature :

1. You cannot see or touch them without searching online, as opposed to simply thumbing through a fi ling cabinet or scrolling through a roll of microfi lm.

What are The Principles? They are guidelines for information management and governance of record creation, organization, security, maintenance, and other activities used to effectively support the recordkeeping of an organization.