By Priscilla Emery
Ed.'s Note: This article is excerpted from the Records Management Report, published by CMS Watch.
To some, managing records represents one of the most boring and onerous business functions that anyone could possibly undertake within an organization. Of course, most people don’t even understand what records management is -- making it easy to malign an activity that is so misunderstood.
Indeed records management crosses numerous disciplines. Did you know…
- That categorization and indexing are two elements that are critical to the success of a records management program? Sounds a little like knowledge management.
- That vital records preservation is one of the key steps in developing a disaster recovery plan? Sounds like infrastructure management.
- That by ignoring records management policies employees and their companies can potentially end up facing criminal penalties? Sounds like a legal profession.
- What led to Arthur Andersen’s downfall? Shredding — inappropriate shredding — shredding of records that should have been retained according to the policies of both Andersen and Enron.
Despite what people may say, what you don’t know can hurt you and, in the case of records management, what you choose to ignore can cripple you and your organization.
Recent dramatic headlines have made it quite apparent that records management (or the lack thereof) is an essential activity to ascertain and confirm the credibility of many business transactions and government activities. The proliferation of electronic documents (especially e-mails) and the potential litigation exposure that they cause are becoming the bane of legal advisors and records managers in many corporations and government agencies. Microsoft, Texaco and other Fortune 500 companies have taken hits from “runaway” e-mails introduced as evidence in high stakes cases.
But, to records managers e-mail is just another record type in the scheme of things (not a trivial record type but a record type just the same). They know that in fact, “smoking guns” can come in many different guises, including: paper, electronic image files, video tape, voice recordings, etc. It’s all potential evidence and therefore potential deposition fodder. Making sure that all the relevant information is accessible in a timely fashion, should an organization need to defend itself in a lawsuit, is also what records managers are responsible for.
These days a records manager’s job is anything but boring, and in many organizations there aren’t enough of them to handle the increased compliance laws and regulations that have cropped up in recent months.
Not surprisingly, then, many companies are looking at records management software as a way to get a better grip on the increased volume of all kinds of records. Although that approach can help, a basic understanding of what records management is and its concomitant practices are required before even looking at any software product. If you don’t have a records management policy in place along with the appropriate retention and destruction rules for the records, the software will be useless.
What is Records Management?
There are many different definitions of records management but one that I like the best is,
“A professional discipline that is primarily concerned with the management of document-based information systems. The application of systematic and scientific controls to recorded information required in the operation of an organization’s business. The systematic control of all organizational records during the various stages of their life cycle: from their creation or receipt, through their processing, distribution, maintenance and use, to their ultimate disposition. The purpose of records management is to promote economies and efficiencies in recordkeeping, to assure that useless records are systematically destroyed while valuable information is protected and maintained in a manner that facilitates its access and use.”
Some people have the mistaken impression that records management is about hoarding everything that comes across one’s desk in the course of doing business. In some highly regulated industries it may seem that is the case. But in most cases it’s not only making sure that what needs to be kept as a record is retained but also prescribing how long it should be kept, where it should be stored, who has access to it and when it should be destroyed (if ever).
There is even an ISO standard for developing a records management program (ISO 15489). However, even though records retention practices are considered systematic and scientific, deciding what is a record and how long it should be retained is a combination of both prescribed practice and a certain amount of subjectivity depending on the actual documents in question. Just defining what is a record can get somewhat confusing to people.
What is a Record?
According to the Federal Records Act a record is, “recorded information, regardless of medium or characteristics, made or received by an organization that is evidence of its operations and has value requiring its retention for a specific period of time.”
According to the National Archives and Records Administration (NARA) records include,
“… all books, papers, maps, photographs, machine-readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the U. S. Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of the data in them.”
Got it?
This can be confusing for non-governmental organizations that don’t believe that these definitions necessarily apply to them so a more generic definition would be that records are recorded information, regardless of physical form, that are generated or received and used while conducting business, and preserved because of their informational value or as evidence of an organization’s functions, policies, decisions, procedures, operations, mission, programs, projects, and activities.
This is why there is no real cookie-cutter approach to defining a records retention program for every document out there — every company has to look at its own business operations and examine what should be considered a record and then decide what retention rules to apply against them. Again, the government and other industry regulators may help in that decision by defining exactly what they expect to see if they have to do an audit or investigation, but audits and investigations aren’t the only reasons to have a records management program.
There are other ways to determine if an information item should be considered a record or not:
- Does the information document your daily business process?
- Does the information provide input to a mission-critical business decision?
- Does the information provide evidence as to whcy a business decision was made?
- Is the information required for legal, fiscal, audit, or tax purposes?
"Vital Records" contain unique or irreplaceable information and require special protection, such as articles of incorporation, annual reports and shareholder records. These should be defined as an integral part of a disaster recovery plan or operation.
RM Programs, RM Software
Essential elements of a records management program include a records retention policy and a set of procedures where records are classified, retention periods are defined and destruction procedures are prescribed. Classification of records and then maintaining them with the appropriate metadata are necessary so that this information can be retrieved quickly when required.
Record integrity depends on three attributes: content, context, and the structure of the original record. Authenticity is very important to determining if a piece of information is the “true” record of an event or business transaction, which is why the management of electronic records, most especially e-mails, web pages and instant messages, is so problematic. The ability to generate larger volumes of records in a shorter period of time has increased the productivity of many organizations but that productivity gain can be lost if essential records can’t be found during the course of doing business or, in even more critical procedures such as when an audit takes place or a legal discovery of evidence is required. Finding lost records costs money in terms of lost productivity and in more the substantial costs of fines, court costs and lawsuit settlement costs.
Hence the need for records management software that aid in the record repository management activities of many organizations. These products help users:
- manage retention schedules,
- store records in their appropriate classifications along with the prescribed metadata,
- search for records when required,
- destroy records according to prescribed schedules,
- put holds on records so they don’t get destroyed while the company goes through an audit or investigation, and
- track the access of the record over its active and in-active life cycle.
In many cases these systems track not only electronic documents but also other record objects such as paper, boxes and tapes...
Amid all the focus on key records management features such as record declaration and standards certification, one key factor sometimes gets lost in the shuffle. Records management is a core activity within many different business processes within the organization itself. It is in and of itself not meant to be the core application. Just like filing is an adjunct activity to one's work, records management must fit into the core business process in order to be truly effective.
Therefore, technological elegance shouldn't be the focus -- integration with core business processes is more important. Ability to support and integrate with key business applications and be imbedded as an activity within a workflow should become more important evaluation criteria in the long run.
