March 14, 2006
Most organizations today have some sort of records retention and destruction (RR&D) program or are considering the development of such a program. For the purpose of this article consider the following definition of a record: “Records are information created, received and maintained by an organization or person in pursuance of legal obligations or in the transaction of business”. Included in this definition would be paper records, electronic documents, transaction data in databases, email messages, telephone voice recordings or any digital form of information relevant to the operation of the organization.
The motivations for addressing records retention issues generally fall into three broad categories: legal and regulatory compliance, reduction of physical storage requirements and the perceived value of records for the organization (such as intellectual property). For most organizations the primary driving force for RR&D considerations is the need to be compliant with laws and regulations imposed by governments and regulators. Experience with various approaches to RR&D programs and various levels of success allow for some basic conclusions or “lessons learned” that may be valuable to organizations considering the development or modification of a program.
Lesson 1. – There is no “magic” all-inclusive list of records to be retained and their required retention periods that we can use as a check list for guiding the development of a RR&D program. Estimates of the number of legal and regulatory requirements that could be considered exceed 10,000. Each organization must develop a list of candidate records for a RR&D program based on their particular legal and regulatory environment, the value of records to the organization, the risks associated with improper destruction of records and the costs of implementing a program.
Lesson 2. – Use project management methods to develop the program. The development and implementation of a RR&D program should be treated as any other enterprise-wide project employing well know principles of project management including management sponsorship, detailed requirements definitions, assigning responsibilities and authorities and a sound work plan. Records for inclusion in the program need to be prioritized, policies for retention and destruction along with compliance monitoring need to be developed. Employees need to be trained on the policies and implementation strategies need to be detailed. To develop a workable and sustainable RR&D program is not a trivial undertaking and needs to be supported at the highest level of management.
Lesson 3. – Automation tools can be a key component to success, compliance and cost containment. The types of tools employed will be dependent on the complexity of the program and the size of the organization. At a minimum, consider a Content Management System (CMS). A CMS is the modern version of a document management system that can deal with all forms of electronic records.
A CMS system can capture records, organize records for easy retrieval, manage document revisions, and notify people of actions to be taken. It is beyond the scope of this article to discuss the various CMS features and options to be considered but the basic advantages of such a system are that they assist humans with the management of records, help us remember to execute time critical events (such as records destruction) and provide management with audits for testing compliance. CMS vendors will certainly list many other advantages but the important point is such systems can be invaluable in implementing a cost-effective program and affordable systems are available for any type and size of organization.
Lesson 4. – Integrate Business Process Management (BPM) efforts with RR&D programs. Experience in implementing (BPM) methods demonstrates that the consideration of the role of records in business processes will help identify important records for retention as we also gain an understanding of opportunities for productivity gains. In addition, a RR&D program may be treated as any other business process and BPM methods can provide an optimum strategy for the program.
In summary, RR&D programs should be considered to be important and integral to the daily operations of an organization but the development of a program is not a trivial process. To ignore the demands for such a program creates unacceptable risks and missed opportunities for business improvements.
Bruce D. Downing is president of Provisory Services, a business process and information systems consulting company. Dr. Downing has more than 30 years of experience as a senior business executive and consultant in the information systems industry providing business development, management and technical support services to a wide variety of industries. His experience includes the analysis of business processes and the integration of IT support systems to meet business requirements. Dr. Downing’s areas of expertise include records/document management, information security, information systems auditing and automation of internal controls for compliance. He can be contacted at [email protected].