Establishing a solid records management program is a challenge for any organization. Just like the planning of a new college campus or the revitalization of an existing city center, it has to be planned carefully from start to finish. All organizations benefit from consistent, thorough, and well-maintained records, but records management is rarely given priority status. Most organizations focus on "the next thing" that will take their business forward, without spending enough time on creating, completing, updating, maintaining, protecting, and even purging or destroying their records at the appropriate times.
Humans are notorious for being motivated when there is a sense of urgency to act. Many of us can identify with the need to diet or eat properly, but we first take action when we realize in a panic that our clothes no longer fit. We study like we should when there is a fear we might not get into the college of our choice, or might have to repeat a class. Unfortunately, few people do what they should do without an external motivation. Regulatory compliance, and the fear of litigation that accompanies it, have provided the necessity for records management to move up the organizational priority list for many businesses. Factors for establishing a successful policy are outlined below, along with software considerations to make implementation easier.
Communicating the Need for A Records Management Policy
The key to a successful records management program is a well thought-out records management policy that is accompanied by consistent records management processes. A clear policy establishes rules that inform staff what to create, manage, purge, and destroy, and helps record managers, as well as the agencies with whose rules they must comply, to know when infringements have occurred.
It is imperative to keep in mind, however, that automation is not a substitute for a policy. If you are still working from paper records, automation will not solve your problems, nor will it improve upon the inherent weaknesses in the policy. The need for compliance is true whether records are stored electronically or are still on paper. A sound policy sets clear expectations for records management, and helps staff to follow procedural expectations consistently.
As stated by Steve Weissman, Senior Analyst and Director of Marketing from Art Plus Technology, "Simply automating your records management program often results in automating the existing chaos. By failing to set up a plan for the creation, management, and purging of data, companies are at risk of simply getting into trouble more quickly. Although managers may aim to prove compliance, their lack of a policy may actually demonstrate expediently that they have not complied. This spells unwanted trouble for those organizations that could have been avoided if they had established a solid policy from the start."
Even the act of creating a policy can help with legislation, in particular Sarbanes-Oxley compliance, because it demonstrates that an organization has made sincere efforts to ensure compliance and implement internal controls. If your organization has not felt the urgency to create and communicate a clear records management policy, the records manager should elevate the importance of compliance and the undesirable consequences of compliance failure. This can serve as a motivating tool to implement a plan from which your company will benefit on multiple levels. The policy will give management the tools they need to effectively oversee one of the most critical assets a company owns: its collective corporate records.
Review: Defining a Record and its Lifecycle
The ISO (International Organization of Standardization) defines records as "information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business". The form of a record can vary from a paper document to an email, voicemail, fax, image, or notes about the documents. Each record should have important information, or metadata, about the record that accompanies it. Who created the record? Where will it be stored? Who is allowed to access it? How long must it be stored? When should the record be purged from the files? When should it be disposed of or destroyed?
During the first and shortest part of the record cycle, an organization is typically concerned with managing an active document and its contents, including who has accessed, viewed, annotated, or otherwise taken action on the material. The remainder of the lifecycle is focused on record storage (records that are temporarily or permanently inactive), controlled access, maintenance, purging, and disposal.
Record Storage: Establishing A Clear Path for Easy Retrieval
The first step in records management is the effective classification of records and a storage system that enables quick, easy, and secure retrieval of information when it is needed. Regardless of whether you employ OCR, ICR, barcodes, or another method of capturing your information, electronic storage of your documents, images, and historical records can make records management easier. However, it only works to its maximum potential if information is classified thoroughly and intelligently.
In a digital world, a clear indexing plan takes into consideration the diverse sets of people and departments that need to locate records, and the terms by which they need to search for them. By taking the time to create a solid record classification or indexing plan, your staff, auditors, and regulatory agencies will be better served, and you can reallocate staff skills to more important tasks than searching for records.
Recently, e-discovery has made it imperative for companies to be able to provide whatever information is relevant to an issue during investigations and other regulatory response projects that require specific data. Legislation that was revised as recently as 2006, in particular the rules of civil procedure, now give courts of law the power to demand data as evidence, regardless of the cost to the companies that are required to provide it. Emails, text files, data stored on PDAs and other devices, backup tapes, databases, videotapes, voice files, and other materials are all subject to these regulations. A comprehensive and efficient records management system with easy retrieval helps companies avoid the crippling problems that can arise from eDiscovery challenges. Companies with technology that enables electronic searching of e-content and compliance with these demands have a significant advantage over those that do not. Those that have implemented an efficient system to enable easy e-discovery, coupled with a clear policy, have an indisputable edge in a court of law.
For the long term, companies should aim to create a corporate file plan, a single hierarchical structure for all corporate records. This lofty objective is difficult to achieve, and can be accomplished more easily if done so gradually. By applying record retention policies at the department level first, the foundation can be laid for enterprise-wide success.
Controlling and Auditing Access: Creating Clear Guidelines
The need to control who views, reads, annotates, and acts upon documents during the active portion of a record's lifecycle was apparent long before regulatory compliance was the buzz. In decades past, organizational hierarchy, trust, and respect provided many of the rules related to who should access materials. In today's world, those standards put organizations at risk if access is not properly controlled and monitored. With HIPAA, Sarbanes Oxley, SEC and other regulations, it is no longer enough to rely on respect and an arms-length handshake.
Easy and effective auditing of the policy is critical. Breaches of security can and do occur, but they can be prevented easily in a digital solution that is configured to control who is authorized to take specific actions. Equally important, the system should be capable of providing thorough audit reports. If certain portions of a form should be accessible to everyone, but specific portions require viewing or annotation restrictions, good document management software programs can address this need. If documents travel through an automated workflow process during the active part of the record lifecycle, reporting tools can provide the information needed to demonstrate compliance with internal policies, as well as external regulations.
Record Maintenance
Once a policy for records management is in place, many of the maintenance challenges are eliminated. By establishing a clear plan for storage, indexing, and access, the numerous actions that surround a record during its lifecycle are easier to manage. If your organization has moved beyond basic digital storage to include automated workflow, there are multiple benefits. Changes to documents or record updates to a policy or application can be configured to launch a routine process automatically, delivering a document with instructions for action, generating customized letters or calls based on data stored within a record, and much more. While the cost savings and increases in efficiency are enough to encourage any savvy records manager to consider this carefully, the reporting tools that help to monitor action and maintain compliance make it an important consideration.
Record Retention: Knowing When to Purge Records from the System
Since most records gradually lose their relevance to a company's current business over time, purging helps to reduce the plethora of irrelevant material through which the staff has to search for pertinent data. Just as the Statute of Limitations defines the maximum period that one can wait before filing a lawsuit, record retention schedules guide the user to eliminate information that may no longer be relevant to a business from a legal point of view. Purging appropriately (as soon as it is logical and permitted by law) keeps business data relevant and accessible, and removes what is no longer needed. Workers are no longer distracted by data that is not pertinent to their businesses. Purging promotes efficiency, while simplifying searches for information.
Vijay Magon, Technical Director for OITUK, Optical Image Technology's partner in the United Kingdom, states, "Timely purging of materials in accordance with retention schedules is a vital part of compliance. Companies need to demonstrate that they have a policy and system in place that results in purging the right materials at the right time. Technology makes it much easier to monitor and enforce these policies, while providing a clear audit trail of access and activity. Without this proof, companies place themselves at considerable and unnecessary risk."
Solutions to Document and Record Management Challenges
There are many components to a complete record management solution. Once a solid policy has been established, there are several powerful tools that can make management of the document and record lifecycle considerably easier. Automated workflow (during the business lifecycle of a document), email management, a hierarchical storage management product (to manage document retention and audits), and Web services are important components of a thorough solution. The role of each component in a records management program is explained below.
The Role of Automated Workflow during the Record Lifecycle
Digital workflow is the key to effectively managing, monitoring, and auditing each of the steps involved in every business process that is related to a document or record. Automated workflow facilitates a record manager's need to monitor document access and processes relating to those documents. If a court order arises, a company may be required to provide access to the records or show who viewed, altered, or forwarded a document or any other action related to it. An automated workflow product with robust reporting tools makes this process faster, easier, and considerably less time consuming and less expensive. Electronic workflow can be configured to demand the level of consistency and thoroughness that a recordkeeping department requires, and robust reporting tools to prove that the system and workers are following the expectations and rules set forth in the policy guidelines.
Leading electronic workflow products on the market today can integrate thoroughly with diverse line-of-business software applications. This maximizes the value of data that is stored in those applications and enables data to be shared appropriately across the enterprise based on the company's pre-set rules. Digital workflow pushes the right documents and data to the correct parties for timely action, dramatically improving efficiency. Updates in the database relating to a policy or application can automatically send an alert for action, or generate an appropriate call or letter. Workflow reporting tools enable all transactions to be monitored and analyzed in formats that suit the business and simplify compliance with auditors. These same tools provide managers with productivity analysis, clear audit trails, and information that enables continual quality improvement in the processes that relate to a company's documents. During the business lifecycle, the value of digital workflow in aiding compliance and assisting organizational efficiency can not be overstated.
A solution provider with automated workflow should have a product with tools to customize workflows to the needs of the business, tracking tools to show where documents are within a process, and reporting and auditing tools to help facilitate compliance. The software should be scalable to grow with your organization, and should integrate with other line of business software to provide maximum benefit from the investment. Organizations with limited IT staff and resources should ask their vendor about the availability of professional services to help them design, configure, and make potential changes the system to fit their changing needs.
Email Management Tools to Promote Efficiency and Compliance
Emails are similar to other corporate records because they hold content relating to a company's business. A large majority of companies' emails have valuable business content, as well as information regarding how decisions were made. Industry statistics suggest that 60 to 70% of corporate communications are housed within emails, and sometimes more.
Effective management of email messages is a critical piece of proper records management, since they often store important corporate information and communications. As Steve Weissman states, "A record is a record, regardless of its source or its form. Whether the information is stored in a voicemail, fax, document, image, or email, there is content, and it is a record. Companies are wise to manage all types of records effectively and thoroughly." Email messages should be stored in the company repository to enable easy searching of their content, including the transmission information in the header and the metadata about the email. Many companies now store their emails in a corporate repository as a step toward compliance. If a court of law requires proof that email messages were sent out or received on a particular topic or in a stated timeframe, the auditors will expect data to prove facts unequivocally. The cost of providing the data an auditor requires may be irrelevant to the governing agency, but disastrous for a business in cases where searching or complying proves to be difficult.
While tracing who forwarded specific emails beyond your company's direct email recipients is an enigmatic challenge, your company needs to be able to prove what was sent out, and to whom, if questions arise. Without a searchable system, the tracking of such data about emails becomes a labor-intensive, time consuming, and expensive process. Establishing clear and consistent rules for autoarchiving of emails promotes greater efficiency and fewer errors, and makes compliance easier.
An email management solution provider should include robust search tools that make true management of this critical information easy. The software should be able to monitor email on multiple servers simultaneously, and run on any platform to allow easy integration with other current and future technologies. The solution should be scalable, to enable it to grow with your company. The inclusion of blacklist and whitelist capabilities helps record managers to facilitate management of incoming emails and provides the added benefit of dramatically improving efficiency.
Hierarchical Storage Management Tools to Automate Retention and Audits
A strong hierarchical storage management product removes the human component to managing a document and information repository. This makes the system more efficient and less prone to errors. Retention schedules can be automated, with built-in alerts when a record needs to be purged. Vital information can be backed up routinely and automatically based on the rules you set in place.
A hierarchical storage management solution addresses the document-centered stipulations set forth in regulations and eliminates the human element in ensuring compliance. It includes retention schedules, audit trails, move and purge requirements, data migration, and various other records management tools. It should allow for automated and regular backups of data within pre-set rules that state the hierarchy of data importance. When paired with other products in an integrated document management suite, your organization will be empowered with a solution that not only addresses regulatory challenges, but also provides the means to increase the control of content, reduce risks, and ensure document integrity.
Web Services to Ensure Interoperability
Recently, Web services have gained increasing significance in records management. Since documents and records concerning those documents often are stored in and processed by diverse line of business applications, interoperability of systems is vital. Web services enable the systems to communicate with each other, ensuring that data stored in different applications can be accessed and centralized for easy reporting and analysis. They enable organizations to tap into multiple technologies within their familiar applications. Data can be extracted from those applications behind the scenes, and as an additional benefit, specific operations can be performed by tying Web services into workflow to push work behind the scenes to those who need it. By configuring the system to automatically extract data or perform whatever is needed behind the scenes, efficiency is dramatically improved. In addition, compliance is made much easier by the ability to pull emails from multiple sources and provide data about the emails that is needed for analysis and audits.
Summary
Records management is a never ending process. It helps to have a clear policy and effective tools that integrate with each other, both within each department that holds records and even across the enterprise. Consider your existing policies before you begin, and rectify weaknesses or inconsistencies so you understand your needs completely before choosing a solution provider.
When evaluating vendors to contribute to a complete records management solution, make sure you also consider a workflow-driven document management solution that will integrate seamlessly and make it easier for you to manage the business lifecycle of your documents while they are still active. Don't wait for an emergency to give you a sense of urgency to establish a strong records management program. With a solid plan, and tools that take advantage of workflow, reporting, storage management, email management, and Web services interoperability, your business should be able to manage records effectively and you should reap tremendous gains in efficiency. More importantly, you should be able to police your records effectively so the real police don't have to.
