by Ian Springsteel

Electronic Records Management: Are You Sure You Want to Save That?

News
Sep 15, 200110 mins
Security

Think you have a good electronic records management strategy? Think again. Sure, you back up your data rigorously. You save everything you can, whether it’s product specs or sales reports, in case the original files are damaged. But such practices, say electronic records experts, can be dangerous. To manage electronic files right, you need to take into account what’s in those files and decide how long to save them.

Few companies have addressed this issue head-on. After all, “records systems” smacks of too much dreary library science to arouse immediate interest. But CIOs are finding two issues that are making them pay attention. First and foremost are lawsuits. The files on servers and backup tapes are a common source of legal angst and expense when they are subpoenaed by plaintiffs’ attorneys. If such files aren’t organized, discovery costs can reach millions of dollars. Second, companies are creating digital documents that need to be saved for many years. Current systems and file formats may not be around then, creating the need for long-term digital file storage. To knock off both concerns at once, forward-looking CIOs are installing electronic records management systems.

Human versions of such systems have been used for years at most companies to track paper documents. Corporate records managers?professional experts in organizing and preserving company documents?help determine what files to keep, for how long, based on both legal requirements and any business need for them. By this plan, usually called a retention schedule, documents get filed according to predetermined categories

Increasingly, CIOs?working with records managers as well as their corporate legal departments?are applying those processes to digital documents, most often as part of a document management or knowledge management system. Using electronic record-keeping software?a type of middleware?CIOs can turn databases of documents into legally defensible records management systems.

See You in Court

Most CIOs get their first exposure to electronic records management at the wrong end of a lawsuit. That’s when Robert Rickert, CIO of KeyCorp, a multistate bank based in Cleveland, usually hears about it. “Electronic records issues come up probably monthly,” says Rickert. KeyCorp holds records on $87 billion in assets from hundreds of thousands of customers, which are both consumers and businesses.

KeyCorp keeps hundreds of thousands of documents on hand to satisfy government regulations that govern those assets. Most records are on paper, stored away in boxes. But the company also has lots of unofficial documents, including correspondence, that it keeps on various LANs that are managed by local offices and departments. Rickert knows that all of that information can be subpoenaed by plaintiffs suing the bank. He doesn’t say how much retrieving the data costs his company, but legal experts note the costs can add up. Every backup tape that a plaintiff suspects contains incriminating data costs about $1,000 to process, says John Jessen, president and CEO of Seattle-based Electronic Evidence Discovery, which helps companies comply with legal discovery orders.

KeyCorp manages the risk through a set of policies that makes every department responsible for destroying its unneeded files and e-mails. “There is a logical process and a reason that a document exists or doesn’t exist,” says Rickert. Still, he knows there’s room for improvement. The current process depends on LAN administrators to deleteing files manually and each department keeping on top of its records deletion responsibilities. There’s no formal process for making sure departments comply with their own standards.

It’s not that companies such as KeyCorp don’t manage data well from an IT perspective. The problem is that their files often aren’t being managed according to their content. Copies of important documents may be kept on PCs or servers long after the official copy has been destroyed. Moreover, important digital files may have little long-term access or version control applied to them, casting doubt on their authenticity and undermining their future credibility as evidence. “The biggest mistake is that IT people often think archiving tape backups and discarding of them at a certain date is records management,” says Julie Gable, principal Gable Consulting, an electronic records advice company in Wyndmoor, Pa.

Without retention schedules imposed on them, IS departments often omit the disposal piece of the puzzle, says Jessen. “IT people tend to want to hold on to information for as long as possible,” he says. One of his clients underwent a legal risk assessment and discovered 50,000 backup tapes of corporate information that had supposedly been destroyed. IT managers had stored the tapes offsite, just in case they were needed. “Had those tapes been subpoenaed, the company was looking at a potential bill of $50 million to sort through them all for relevant information,” Jessen says.

Build Records Management with KM

But records management isn’t all about lawsuits. It can also help CIOs improve their companies’ knowledge management systems by providing a rich framework of information about each document?called meta-data?that can be used for organizing and accessing a KM system. “It’s easy to get off on a legal-exposure tangent, but CIOs who aren’t dealing with this are also missing a huge opportunity to organize and mine the legacy records of the company,” says Richard Barry, principal of Barry Associates, an Arlington, Va., electronic records consultancy.

Electronic records management is a key foundation for the KM system at Washington, D.C.-based World Bank, which finances economic development projects in developing countries. “Many of the documents we create with client countries need to be kept for more than 30 years, and we have over 900,000 documents,” says Mohamed Muhsin, CIO of The World Bank. Shipping documents to employees around the world was slow and expensive. “A 100 percent electronic storage and access system will make retrieval faster and cheaper,” he says.

Some records have been maintained electronically since 1992, when the bank built the first generation of its Integrated Records and Information System (IRIS). The third-generation IRIS, rolled out last year, combines images and data in a database available to World Bank offices and clients worldwide via the Internet. The system was custom-built using a Lotus Notes front end linked with an Oracle database that tracks access and retention information about each document. As the number of documents available on the system has increased, the bank’s total cost of document and records management, including the cost of handling and storage, has declined 20 percent, says Muhsin.

Because the records need to be preserved for decades, Muhsin decided to use Adobe Systems’ PDF file format for storing every document. “At some time in the future when PDF is replaced by another format, at least we will only have one format to worry about,” says Muhsin. Some records management experts are also looking into using XML standards to create an archival file format.

Automating the Process

For most organizations, though, the biggest problem is not keeping documents around but getting rid of them in a timely and efficient manner. Automating the retention and deletion process in an electronic records management system is emerging as a best practice for information management.

Ford Motor Co., which is in the process of rolling out its second-generation Enterprise Document Repository (EDR) infrastructure, is doing just that. Ford’s original repository system, from OpenText, was rolled out companywide in 1996, when Ford started encouraging employees to rely on electronic versions of critical documents, such as marketing plans and engineering reports. Steven Scheerhorn, manager of knowledge workplace infrastructure at Ford’s System Integration Center, says the system saves the company millions of dollars a year in printing and document shipping costs alone.

The new EDR system adds the ability to automate records management. Up to now, employees have had to manually review all their online documents once a year. Getting busy employees to comply with the schedule and destroy documents on time took weeks or months of cajoling. Worse, says Scheerhorn, the owners of information, whose permission is necessary for keeping or destroying a document, might be difficult to track down because of a transfer or retirement.

Automation will eliminate those bureaucratic obstacles. The system will prompt employees who create documents to classify them according to Ford’s existing records retention rules. When it comes time to purge documents, or copy them into a permanent file, the owner is automatically alerted. “This new functionality allows users to specify when a document should be deleted [at the time] it’s created,” explains Elizabeth Adkins, manager of global information management at Ford. If documents are needed in a lawsuit, the new system’s tagging feature allows them to be frozen by the legal department so that they can’t be tampered with. That, plus the ability to simply and quickly locate all the documents on a given subject, helps Ford reduce litigation costs and save time, the two knowledge managers say. They declined to discuss specific cases.

Build or Buy?

Like The World Bank, Ford decided to build its own records management application. The company worked with Documentum rather than adopting an off-the-shelf packages, because it wanted to integrate the records management application with the document repository. Adding this capability took a couple of weeks, Scheerhorn says. “It was very straightforward, and it made sense because of our scale.”

Companies that haven’t already made big investments in document management or KM may be able to use a commercially available electronic records management system (ERMS). Barry says many do a good job at both document management and records management?which wasn’t the case until recently. “It used to be that you needed two components, one for document management and the other for records management,” he explains. “Now, many of the ERMSs do just fine at document management. Companies should satisfy themselves that one system won’t meet their needs before they license two.”

A national standard has emerged for ERMSs, thanks to the Department of Defense (DOD). In response to several court cases against the federal government in the 1990s, the DOD created a ERMS standard Records Management Application (RMA) standard. DOD tests records management software for compliance with the standard and certifies products that pass (for more information about the standard and records management, see DOD’s RMA Certification website at jitc.fhu.disa.mil/recmgt).

One weakness of records management systems, Barry warns, is that they don’t work well with ERP systems, but vendors are working on this problem. Meanwhile, linking your ERP systems to a records management system from scratch is difficult, he says.

CIOs Must Lead

With responsibility for record keeping diffused among different departments, most companies need someone to coordinate electronic records management. CIOs are logical leaders.

“Putting together a good plan for electronic records requires the skill of records managers, IT managers and legal counsel, not just one area,” says Jessen. Unfortunately, there is often a disconnect between a company’s IT group and its records managers. CIOs can ensure that the right specialists work together and understand their combined objective.

That’s how it works at Procter & Gamble. CIO Steve David cosponsors the company’s records governance team, a committee with members from the legal, patent, information security, IT, operations, human resources and internal audit departments. The company is rolling out a combined document management and records management system similar to Ford’s. Jane Connerton, records manager for P&G, says David made sure the system balanced costs and productivity gains.

Knowing where that balance lies, of course, requires understanding of what electronic records management is and the benefits it can offer.