Managing Electronic Records

Methods, Best Practices, and Technologies

Robert F. Smallwood

• Publisher: Wiley
• Year: 2013
• ISBN:
  9781118282380
• Edition: 1
• Topic: Business
• Subtopic: Information Management
• Index: Business

The ultimate guide to electronic records management, featuring a collaboration of expert practitioners including over 400 cited references documenting today's global trends, standards, and best practices

Nearly all business records created today are electronic, and are increasing in number at breathtaking rates, yet most organizations do not have the policies and technologies in place to effectively organize, search, protect, preserve, and produce these records. Authored by an internationally recognized expert on e-records in collaboration with leading subject matter experts worldwide, this authoritative text addresses the widest range of in-depth e-records topics available in a single volume.

Using guidance from information governance (IG) principles, the book covers methods and best practices for everything from new e-records inventorying techniques and retention schedule development, to taxonomy design, business process improvement, managing vital records, and long term digital preservation. It goes further to include international standards and metadata considerations and then on to proven project planning, system procurement, and implementation methodologies. Managing Electronic Records is filled with current, critical information on e-records management methods, emerging best practices, and key technologies.

• Thoroughly introduces the fundamentals of electronic records management
• Explains the use of ARMA's Generally Accepted Recordkeeping Principles (GARP®)
• Distills e-records best practices for email, social media, and cloud computing
• Reveals the latest techniques for e-records inventorying and retention scheduling
• Covers MS SharePoint governance planning for e-records including policy guidelines
• Demonstrates how to optimally apply business process improvement techniques
• Makes clear how to implement e-document security strategies and technologies
• Fully presents and discusses long term digital preservation strategies and standards

Managing e-records is a critical area, especially for those organizations faced with increasing regulatory compliance requirements, greater litigation demands, and tightened internal governance. Timely and relevant, Managing Electronic Records reveals step-by-step guidance for organizing, managing, protecting, and preserving electronic records.

PART ONE

E–Records Concepts

CHAPTER 1

E–Records Definitions, Business Drivers, and Benefits

First, some basic definitions of core terms used in this text: The International Organization for Standardization (ISO) defines (business) records as “information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”1 It further defines records management as “[the] field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”2

The U.S.–based Association of Records Managers and Administrators (ARMA), defines a record as “evidence of what an organization does. They capture its business activities and transactions, such as contract negotiations, business correspondence, personnel files, and financial statements. . . .”3

Electronic records management (ERM) has moved to the forefront of business issues with the increasing automation of business processes, and the vast growth in the volume of electronic documents and records that organizations create. These factors, coupled with expanded and tightened reporting laws and compliance regulations, have made ERM increasingly essential for most enterprises—especially highly regulated and public ones—over the past decade.

ERM follows generally the same principles as traditional paper–based records management, that is, there are classification and taxonomy needs to group and organize the records; and there are retention and disposition schedules to govern the length of time a record is kept, and its ultimate disposition, whether it is destruction, transfer, or long–term archiving. Yet e–records must be handled differently and they contain more detailed data about their contents and characteristics, known as metadata. (This book discusses these detailed topics in more depth in later chapters.)

E–records are also subject to changes in information technology (IT) that may make them difficult to retrieve and view and therefore render them obsolete. These issues can be addressed through a sound ERM program that includes long–term digital preservation (LTDP) methods and technologies.

ERM is primarily the organization, management, control, monitoring, and auditing of formal business records that exist in electronic form. But automated ERM systems also track paper–based and other physical records. So ERM goes beyond simply managing electronic records; it is the management of electronic records and the electronic management of nonelectronic records (e.g., paper, CD/DVDs, magnetic tape, audio–visual, and other physical records).

---

E–records management has become much more critical to enterprises with increased compliance legislation and massively increasing volumes of electronic information.

---

Most electronic records, or “e–records,” originally had an equivalent in paper form, such as memos (now e–mail), accounting documents (e.g., purchase orders, invoices), personnel documents (e.g., job applications, resumes, tax documents), contractual documents, line–of–business documents (e.g., loan applications, insurance claim forms, health records), and required regulatory documents (e.g., material safety data sheets, MSDS). In the past, many of these documents were first archived to microfilm or microform/microfiche, before e–document software began to mature in the 1990s.

Not all documents rise to the level of being declared a formal business record that needs to be retained; that definition depends on the specific regulatory and legal requirements imposed on the organization, and the internal definitions and requirements the organization imposes on itself, through internal information governance (IG) measures and business policies. IG is the policies, processes, and technologies used to manage and control information throughout the enterprise to meet internal business requirements and external legal and compliance demands.

ERM is a component of enterprise content management (ECM), just as document management, web content management, digital asset management, enterprise report management, and several other technology sets. ECM encompasses all an organization's unstructured digital content, (which means it excludes structured data i.e., databases). ECM includes the vast majority—over 90 percent—of an organization's overall information, which must be governed and managed.

ERM extends ECM to provide control and to manage records through their lifecycle—from creation to archiving or destruction. ERM is used to complete the lifecycle management of information, documents, and records.

ERM adds the functionality to complete the management of information and records by applying business rules to manage the maintenance, security, integrity and disposition of records. Both ERM and ECM systems will aid in locating and managing the records and information needed to conduct business efficiently, to comply with legal and regulatory requirements, and effectively destroy (paper) and delete (digital) records that have met their retention policy timeframe requirement, freeing up valuable space, physical and digital, and eliminating records that could be a liability if kept.

---

E–records management follows the same basic principles as paper–based records management.

---

---

E–records management includes the management of electronic and nonelectronic records, like paper and other physical records.

---

Records Management Business Rationale

Historically, highly regulated industries, such as banking, energy, and pharmaceuticals, have had the greatest need to implement records management programs, due to their compliance and reporting requirements.4 However, over the past decade or so, increased regulation and changes to legal statutes and rules have made records management a business necessity for nearly every enterprise (beyond very small businesses).

Notable industry drivers include:

• Increased government oversight and industry regulation. It is a fact that government regulations that require greater reporting and accountability were early business drivers that fueled the implementation of formal records management programs. This is true at the federal and state or provincial level. There are a number of laws and regulations related to records management that have been added in the past 10 to 15 years. In the United States, the Sarbanes–Oxley Act of 2002 (SOX) created and enhanced standards of financial reporting and transparency for the boards and executive management of public corporations and accounting firms. It also addressed auditor independence and corporate governance concerns. SOX imposes fines or imprisonment penalties for noncompliance, and requires that senior officers sign off on the veracity of financial statements. It states clearly that pertinent business records cannot be destroyed during litigation or compliance investigations. Since SOX, other countries, such as Japan, Australia, Germany, France, and India, have adopted stricter “‘SOX–like” governance and financial reporting standards.
• Changes in legal procedures and requirements during civil litigation. In 2006, the need to amend the U.S. Federal Rules of Civil Procedure (FRCP) to contain specific rules for handling electronically generated evidence was addressed. The changes included processes and requirements for legal discovery of electronically stored information (ESI) during civil litigation. Today, e–mail is the leading form of evidence requested in civil trials. The changes to the U.S. FRCP had a pervasive impact on American enterprises and required them to gain control over their ESI and implement formal records management and electronic discovery (“e–discovery”) programs to meet new requirements. Although they have been ahead of the U.S. in their development and maturity of records management practices, Canadian, British, and Australian law is closely tracking that of the United States in legal discovery. The U.S. is simply a more litigious society so this is not unexpected.
• Information governance awareness. IG, in short, is the set of rules, policies, and business processes used to manage and control the totality of an organization's information. Monitoring technologies are required to enforce and audit IG compliance. Beginning with major legislation like SOX in 2002, and continuing with the massive U.S. FRCP changes in 2006, enterprises have become more “IG aware” and have ramped up efforts to control, manage, and secure their information. A significant component of any IG program is implementing a records management program that specifies the retention periods and disposition (e.g., destruction, transfer, archive) of formal business records. This, for instance, allows enterprises to destroy records once their required retention period (based on external regulations, legal requirements, and internal IG policies) has been met, and allows the enterprise to legally destroy records with no negative impact or lingering liability.
• Business continuity concerns. In the face of real disasters, such as the 9/11 terrorist attacks, Hurricane Katrina, and in 2012, Superstorm Sandy, executives now realize that disaster recovery and business resumption is something they must plan and prepare for. Disasters really happen and businesses do fail if they are not well–prepared. The focus is on vital records (more details on this topic in subsequent chapters), which are necessary to resume operations in the event of a disaster, and managing vital records is a part of an overall records management program.

---

A number of factors provide the business rationale for ERM, including facilitating compliance, supporting information governance (IG), and providing backup capabilities in the event of a disaster.

---

Why Is Records Management So Challenging?

With these business environment, regulatory, leg...