The Ten Biggest Issues in Records Management Today

1
The Ten Biggest Issues in Records Management Today

• Presented by
• David O. Stephens, CRM, FAI
• To The St. Louis Chapter
• ARMA International
• September 21, 2006

2
Well discuss these top ten RM issues . . .

• The growing role of RM as a significant issue in
  organizational management
• RMs role in the transition to the management of
  electronic records in the (nearly) paperless
  office
• Sarbanes Oxley and the role of RM in corporate
  governance
• RMs role in regulatory compliance and litigation
  risk reduction
• The impact of September 11th and RMs role in
  enhancing information protection
• Getting to (nearly) perfect in records retention
• The role of electronic records retention in
  improved data life cycle management
• Bringing records management / retention to the
  desktop and the messaging environment
• The significance of the new software solutions
  for electronic records management
• The role of RM in digital preservation

3
Records management Not new, but never more
important!

• Let your Eminence give orders throughout each
  and every province that a building be erected in
  which to store the records . . . so that they may
  remain uncorrupted and may be found quickly by
  those requiring them . . .
• The Emperor Justinian
• Roman Empire, 6th century A.D.

4
Issue 1 - The growing role of RM as a significant
issue in organizational management

• With the recent spate of business scandals, now
  for the first time ever records have become
  pivotal in determining the fate of organizations!
  

5
From benign neglect to a compelling
organizational imperative

• RM requires time and effort to do correctly.
• It requires sustained commitment over time it is
  not something that can be introduced with fanfare
  and then forgotten about.
• The reality is that many organizations avoid RM
  or relegate it to low priority status because
  they think it will cost a lot of money and they
  dont see its ultimate value.
• One recent study characterized the level of
  management recognition accorded RM as benign
  neglect, something senior executives dont
  really want to do they would rather spend their
  time on other priorities.

6
But, today, RM is experiencing an historic
transformation!

• Because of the ten issues well review today, the
  climate for RM has never been more favorable!
• While RM has long been regarded as a mosquito
  relegated to the backwaters of organizational
  management, its now in the midst of an historic
  transformation.

7
Some cogent observations . . .

• This is the first time Ive seen it RM receive
  this much attention. With the CEO aware of the
  risks, records management efforts are getting
  funding.
• Mark Gilbert, Gartner Inc.
• Electronic records management has recently been
  exposed as an organizational imperative.
  Organizations must identify and begin treating
  electronic records with the same rigor as
  paper-based records, and as part of an overall
  organizational records management plan.
• Andrew Warzecha, Meta Group

8
Organizational recordkeeping Now in the middle
of the biggest revolution ever!

• Since the dawn of recorded history, records could
  be seen and touched, read and comprehended by
  sight, without the aid of machines.
• But recently, only several decades ago, things
  began to change.
• With the advent of computers, records began to be
  created, for the first time ever, in non-visible
  formats.
• And this changed everything!
• This seminar is about these changes, and what
  they portend for records managers and the
  organizations for which they work.

9
Electronic records The management challenges are
much greater than for paper!

• Higher strategic value
• Higher customer / client expectations
• Greater technical expertise required
• Much higher rates of growth
• Greater accessibility challenges
• Greater consequences of loss
• Much shorter life expectancy and greater
  preservation challenges
• All of these make RM more important than ever
  before!

10
Issue 2 RMs transition to the management of
electronic records in the (nearly) paperless
office

• Many records managers still cling tenaciously
  and irrationally to the notion that paper will
  be with us forever that the long-awaited but
  hitherto unrealized paperless office is and
  will remain a myth.
• In my humble opinion We are just now witnessing
  the tipping point. 25 years from now, their
  will be very little paper left!

11
The (nearly) all-digital office Not if but
when!!!

• Just because it hasnt happened during the last
  30 years doesnt mean it wont happen during the
  next 30!
• During the last 30 years, electronic records have
  become much more prevalent and prolific, relative
  to their paper counterparts.
• And their importance has skyrocketed while that
  of paper records has gradually declined.

12
A recent book from the UK The most substantive
analysis of this subject

• The introduction of new technologies is
  unlikely, in most environments, to drastically
  reduce or eliminate paper as quickly as is often
  predicted.
• Source The Myth of the Paperless Office, Sellen
  and Harper, MIT Press, 2002.

13
Why do we still have abundant quantities of
paper? Two main reasons . . .

• 1. Ease of production the high ratio of people
  to paper producing machines.
• 2. Behavior patterns of document creators Many
  office workers grew up with paper and still
  rely on it, particularly for extended-term
  recordkeeping

14
But . . . as Bob Dylan said, the times they are
a changin

• The decisive factor in the transition to the
  less-paper office is . . .
• . . . Different behavior patterns on the part of
  the next generation of office workers.
• Our children and grandchildren do not and will
  not use filing cabinets when they take our places
  in the offices of today and tomorrow!!!

15
So, although its early demise has been wrongly
predicted, paper is (eventually) on the way out!

• The de-papering of organizations is a long-term
  trend.
• In this sense, its analogous to building the
  interstate highway system or other major
  infrastructure initiatives of national / global
  significance.
• The technology to do this has been invented
  during the past 30 years and is just now
  beginning to make a significant impact!
• To reiterate In another 25 years, their will be
  very little paper left!

16
Issue 3 Sarbanes Oxley and the role of RM in
corporate governance

• The Sarbanes-Oxley Act of 2002 has perhaps
  greater implications for records management than
  any single piece of federal legislation in
  decades.

17
With SOX on the books, executives can no longer
afford to look the other way about RM!

• Prior to the enactment of this legislation, many
  corporate executives were inclined to regard
  records management as a discretionary endeavor,
  one unrelated to the overall success of the
  business and thus not worthy of serious
  management attention.
• In fact, this law introduces new, compelling
  reasons for CEOs to view records management as an
  essential function, one they must implement and
  fund to the level of proven success.
• Non-compliance with certain provisions of SOX is
  a Federal crime and can result in punishment of
  up to twenty years in prison.

18
RMs role in SOX compliance

• As gatekeepers of corporate recordkeeping, it
  will be they records and information managers
  who ensure that a corporations policy and
  culture matches its legal requirements . . .
• Source Sen. Patrick Leahy, D-Vermont

19
SOX and RM

• The need for this law arose from cooking the
  books overstating earnings and hiding losses.
  
• Thus, SOX requires that a companys financial
  records must be complete, true and accurate,
  accessible, retained in accordance with the law
  and good faith, and fully usable in support of
  any audits, investigations or other regulatory
  requirements.
• Special attention should be devoted to the proper
  management and integrity of the data residing in
  financial and other relevant recordkeeping
  systems.
• This means that the information residing in these
  systems must be managed such that a high degree
  of integrity can be demonstrated.

20
Issue 4 RMs role in regulatory compliance

• During the past several years, a number of new
  regulatory initiatives have occurred in the U.S.
  which are having a significant impact on records
  management.
• In addition to SOX, the other major new mandates
• HIPPA
• Basel II
• SEC Rule 17a-4
• EU data protection
• California privacy laws

21
Issue 4 RMs role in regulatory compliance and
litigation risk reduction

• These initiatives have greatly increased the
  awareness of the need for and benefits of RM on
  the part of organizations and their management.
• When scrutinized by a court, regulator, or the
  wary investing public, anything that is perceived
  as good and reasonable corporate policy and
  behavior can transform a potentially bad
  situation into a non-event and one that is more
  likely to be overlooked as a one-time occurrence.
• In my Legal Myths and Realities and Andersen Case
  Lessons Learned presentations, well discuss
  these issues in detail.

22
RMs role in demonstrating compliance

• RMs goal should be to ensure that the
  organizations recordkeeping systems are being
  managed such that the integrity of their
  information content can meet the tests of
  trustworthiness authenticity, completeness and
  reliability.
• In short full compliance, in letter, spirit and
  good faith!

23
RMs role in mitigating litigation risks

• The presence or absence of records can be either
  favorable or unfavorable . . .
• . . . exculpatory or incriminating.

24
RMs role in mitigating litigation risks

• The best strategy
• Retain only whats needed to operate the company,
  comply with the law, and meet reasonable needs to
  retain history!

25
Issue 5 The impact of Sept. 11th and RMs role
in information protection

• There is a persuasive, even compelling, argument
  that protecting organizational information from
  loss due to disaster whether due to natural,
  technical or human causes is the most important
  aspect of records management.

26
Greater risks / consequences of loss

• Most organizations could lose all their paper
  records and survive.
• No so for computer records!
• A large-scale data loss would likely be
  cataclysmic and irrecoverable!

27
Lessons learned Dont keep vital records in
paper form with no backup!

• One major lesson of Sept. 11th For everything
  vital, have backups at a secure off-site
  location!
• If an organization is vulnerable to a cataclysmic
  disaster of the severity of September 11th, the
  only feasible strategy to protect the records is
  to get them off site.

28
For all vital, mission-critical records, off-site
backup is the way to go!

• Organizations should adopt the long-term goal of
  converting to digital format every paper-based
  recordkeeping system of mission-critical
  importance as soon as resources and priorities
  allow.
• Records managers should survey all such
  applications, and develop a plan for conversion
  from paper to digital format that can be
  implemented over a period of several years.
• This will permit the records to be backed up
  off-site.
• For all mission-critical recordkeeping systems,
  we recommend that organizations give themselves 5
  years to get out of paper.

29
Issue 6 Getting to (nearly) perfect in records
retention

• Sadly, most records retention programs are not
  organized around success.
• Most have no long-term management plan or
  strategy for achieving success.
• So, just like every self-fulfilling prophesy,
  success in retention remains elusive!

30
The goal 80 to 90 perfect!

• Records retention is never perfect!!!
• Some employees will always circumvent whatever
  policy or guidelines are in place.
• But 80 to 90 perfect is a big success!
• By contrast, a moribund retention program is
  probably operating at a 20 to 30 success rate.

31
Getting to (nearly) perfect in enterprise records
retention

• Clear, comprehensive policies and schedules
• Aggressive purge day strategies
• Employee / departmental compliance requirements
  with penalties for non-compliance
• Retention audits by corporate compliance officer

32
Achieving success in enterprise retention means
being successful in five recordkeeping
environments

• 1. Active paper records at departmental
  workstations
• 2. Inactive paper records in storage facilities
• 3. Personal working papers kept in desks,
  credenzas and bookcases
• 4. Data in computer applications managed by IT
• 5. Electronic records in desktops, controlled by
  their creators

33
No more unmanaged storage repositories!

• As a matter of policy, organizations should
  strive to eliminate all unmanaged storage
  repositories!
• The life cycle of all retained records should be
  governed by reasonable retention rules.
• Retention rules must be systematically applied in
  all 5 environments!

34
Getting to perfect in retention

• Organizations should establish a 5-year goal of
  applying retention rules in all 5 recordkeeping
  environments.
• Poorly managed warehouse storage and IT-managed
  system applications will require at least 3
  years.
• The single biggest problem Inadequate strategy
  for modifying employee behavior.

35
The key to success in retention Employee
behavior modification

• As 3 of the 5 recordkeeping environments consist
  of content that is under the direct custody / or
  control of individual employees, success in
  retention depends on practical, workable
  strategies to modify their saving behavior
  patterns.
• The goal to get employees away from
  unrestrained, indefinite patterns of keeping
  records.

36
Four key aspects to modifying employee retention
behavior

• They must be required to review content under
  their personal custody and control.
• This must occur systematically under established
  rules and policies.
• There must be consequences for failure to comply
  with such rules and policies.
• Appropriate documentation must be created and
  maintained to demonstrate compliance.

37
Records Retention or Purge Days The single
most important step in retention compliance

• If an organization doesnt want to do them, dont
  even bother with retention as it wont be
  successful!
• Labor commitment 8 to 16 hours per employee per
  year, exclusive of e-mail.

38
Employee retention compliance documentation

• Employees are required to certify that they are /
  are not in full compliance.
• Exceptions must be documented / justified.
• Some organizations make this a departmental
  (rather than individual employee) responsibility.
• This must be carefully considered such
  documentation would be subject to discovery!

39
Impose penalties for non-compliance

• At the discretion of the supervisor
• Adverse report in personnel file
• Adverse impact on compensation
• Dismissal for willful, repeated violations.

40
Retention compliance audits

• These are most effective when a senior policy
  compliance officer or internal auditor takes the
  lead role and records management plays a
  supporting role.

41
Issue 7 The role of electronic records
retention in improved data life cycle management

• Theres never been a better time than now for
  information lifecycle management, because the
  growth of information propelled by business
  continuity, compliance, and the proliferation of
  unstructured content such as rich media and
  e-mail is far outpacing the growth of IT
  budgets. ILM helps companies around the world
  deal with this growth while lowering the overall
  cost of data ownership.
• Joe Tucci, CEO, EMC

42
Basic questions concerning data life cycle
management

• What happens to computer data as it ages?
• Does the value of data increase or decrease as
  time passes?
• Do storage management requirements change as data
  ages through its life cycle?
• In the world of paper, these are questions that
  records managers have addressed for decades!
• But not in the world of IT, where retention has
  not been widely practiced.

43
ERR Its in the embryonic stage!

• According to one study, 47 of the respondents
  reported that electronic records have not been
  specifically included in their organizations
  retention schedules.
• Another study 81 of the respondents reported
  that rules for automatic purging of data, under
  authority of retention schedules, have not been
  incorporated into their organizations computer
  applications.

44
If getting rid of dead data is such a good idea,
why hasnt it been widely practiced???

• A largely invisible problem no physical /
  visible manifestations.
• In some situations, its cheaper to retain than
  purge.
• For decades, IT had carte blanche to buy all
  the storage they wanted no questions asked!
• No strong advocate among key stakeholder groups.

45
None of the key stakeholders in business
computing strongly advocated ERR, so it didnt
happen!

• IT departments Data retention not a priority
  no methodology or expertise.
• Vendors Driven by customer priorities. Data
  retention not historically an issue. But this is
  changing!
• Data owners Usually content to take whatever
  data they can get.

46
The biggest perceived weakness in the business
case Media capacity and the cost of storage

• With media capacity increasing at 60 per year
  and the cost-per-megabyte declining at 35 per
  year, it is often assumed that there is no viable
  business case for ERR.
• But . . . this view neglects the explosive growth
  of data and increases in the total cost of data
  ownership!

47
The total cost of data ownership

• The total cost of data ownership is unknown or
  poorly understood in most organizations.
• The fundamental problem The total cost of data
  ownership continues to rise, even while media
  costs continue to decline.
• As weve noted, increasing media capacity and
  declining cost per MB leads many IT specialists
  to conclude, erroneously, that there is no viable
  business case for ERR.
• Actually, what is happening is that these two
  trends create a virtually unlimited demand for,
  and consumption of, data storage!

48
The explosive and unprecedented growth in
data storage

• The total cost of managed storage now rivals or
  exceeds the investment in systems and servers,
  and often accounts for 50 or more of total IT
  spending.
• Data storage costs will rise to three-quarters of
  all IT spending over the next few years.
• Source Storage Inc.

49
Issue 8 Bringing RM / retention to the desktop
and the messaging environment

• In most organizations, the desktop is an records
  management basket case generally
  under-managed or mismanaged.
• But this is where most of the work of
  organizations is done!
• Approx. 56 of all digital content resides here.
• To bring better records management to the desktop
  is one of the biggest records management
  challenges today.

50
Email The number one office task!

• E-mail is, arguably, the most significant new
  technology for business communication since the
  advent of the telephone.
• Together with other electronic records created at
  the desktop level, the management of e-mail is
  one of the biggest RM challenges today.

51
A transforming technology It makes the wheels of
business turn

• By some estimates, more than 90 of all business
  documents are created electronically and 60 of
  those are transmitted as e-mail attachments.
• E-mail has literally revolutionized the way
  business is conducted, as well as the way in
  which organizational records are created,
  transmitted, stored, and maintained.
• For most organizations, the messaging environment
  is the primary business platform.
• Thus, this issue is at the top of the RM agenda
  nearly everywhere.

52
The greater part of the organizations knowledge
base

• According to various studies, as much as 75 of
  business-critical information its intellectual
  assets and institutional memory is stored in
  electronic messaging systems.
• In 1999, the figure was just 33.
• In 1996, the volume of e-mail exceeded that of
  postal mail for the first time ever.
• Since then, e-mail usage has exploded.

53
The worst-managed form of records?

• In some environments, the management problems
  associated with e-mail have become so severe that
  some observers wonder about the future viability
  of this communications technology.
• Ray Ozzie, creator of Lotus Notes, observes that
  e-mail has been pushed to the breaking point,
  past the limits of its original, intended
  purpose, thereby resulting in lower and lower
  productivity gains.

54
Under-managed, unmanaged e-mail

• E-mail is frequently left unmanaged in user
  mailboxes, and is subject to random retention and
  disposition by users.
• The e-mail archives of users can easily become
  massive and unwieldy.
• They resist classification schemes, ignore
  structured searches, and frustrate policy-managed
  archiving and retention.

55
In many organizations, e-mail management works
as follows . . .

• Automatic messages are sent to all e-mail users
  telling them to reduce the number of messages in
  their mailboxes, that their mailboxes have
  exceeded size limitations set by the
  administrator, and that they may not be able to
  send or receive new mail until they reduce the
  size and quantity of messages in their mailboxes.
  
• Where this is practiced, there is no effective
  records management process in place.

56
Consider the analogy of the postal mail you
receive at home . . .

• When you go home tonight, youll get your mail
  out of your mailbox.
• There will be bills, magazines, and junk mail.
• Youll discard the junk mail, put the magazines
  on the coffee table or night stand, and put the
  bills in the pending file for payment.
• But you wont put any mail back in the mailbox!
• Well, thats exactly whats happening in the
  digital environment!!!

57
The messaging environment should be restricted to
current communications only!

• Many e-mail users retain hundreds, even
  thousands, of e-mails, in their messaging
  environment. This is not best but worst
  practice!
• A top records management priority is to ensure
  that the messaging system is not morphed from an
  e-post office into an unmanaged archive!

58
Generally, best practice is that the retention of
e-mail must be

• Content driven that e-mail messages that relate
  to an established records series appearing in the
  retention schedules must be retained as per that
  policy
• And that such retention must be outside the
  messaging environment in a designated repository,
  managed under retention rules and policies.

59
Issue 9 The significance of the new software
solutions for ERM

• Today, for the first time ever, the goal of total
  life cycle management, through a retention
  methodology supported by computer software, is
  within reach!
• This is the holy grail of RM!

60
For the first time, large computer companies get
into the RM business

• For decades, records management was perceived as
  tangential to the larger enterprise information
  management agenda because large computer
  companies werent in the records management
  business. But now
• In 2002 IBM acquired Tarian Software and
  announced plans to integrate records management
  capabilities across its entire software
  portfolio.
• In 2003 EMC acquired Documentum and launched an
  Information Lifecycle Management business.
• In 2006, IBM further solidified its position in
  the marketplace by its acquisition of FileNet.
• These and other developments have the potential
  to elevate records management to another level of
  legitimacy as an information management
  initiative of enterprise strategic significance.

61
Software solutions for data retention

• Retention functionality in native applications
• ERMS software
• Integrated EDMS / ERMS software
• Fixed-content archiving solutions
• Database archiving solutions

62
Issue 10 The role of RM in digital preservation

• Our IT department tells me they can support data
  retention requirements up to 5 years with
  certainty. From 5 to 10 years, with a little bit
  of luck. After 10 years, there are no
  guarantees!
• Source Edie Allen, Records Manager (retired)
  Battelle Memorial Labs

63
Why digital preservation?

• If an organization creates a record in electronic
  format in, say, the year 2006, and this record
  will need to be digitally processed and read many
  years later, how, exactly, can this requirement
  be supported in a technology environment in which
  the only constant is rapid change?

64
Digital The most impermanent recordkeeping
medium ever!

• Digital information is only as permanent as the
  hardware and software that gives it
  intelligibility.
• For computer-based records, unless special
  preservation measures are instituted, the outer
  limits of life expectancy can range between 10 to
  20 years and sometimes even as few as 5 years or
  so a period of time consistent with the average
  service life of the hardware and software
  required to read and process the records.
• While this time period is perfectly adequate for
  many electronic records, for many others it is
  not.
• The only way extended-term data retention
  requirements can be satisfied is by a series of
  carefully planned preservation practices which
  must be implemented by IT departments.

65
The larger issue is technology obsolescence, not
media stability!

• There is near-unanimity among all commentators
  that technological obsolescence represents a far
  greater threat to the preservation of electronic
  records than media stability.
• Thus, what is needed is a strategy for
  obsolescence protection the ability to provide
  access to digital content through successive
  generations of new hardware and software.

66
Digital preservation Eight best / recommended
practices

• 1. Records selection
• 2. Storage media selection
• 3. Data migration
• 4. Standardize file formats
• 5. Media recopying
• 6. Metadata management
• 7. Systems documentation
• 8. Media storage and maintenance

67
RMs goal in digital preservation

• Work with IT in a multi-year initiative to put in
  place all that is required to meet the
  organizations requirements for long-term data
  retention
• New policies and procedures
• Adequate budget
• Dedicated expertise
• Systematic implementation