Commentary--Is your company's record-keeping adequate or is it a digital landfill? With new laws and compliance regulations weighing heavily on organizational policies and procedures, many companies are waking up to find out they have lost control of their content. The fact is most organizations are unprepared to address the reality of the growing compliance challenge.
Gone are the days when old files were merely put in a box and hauled over to a warehouse. Many of today’s compliance regulations call for some form of structured electronic recordkeeping. Everything from e-mails to instant messages to voicemails is now carefully maintained by organizations, so they can hand over records and e-mails, when necessary, for a government audit or litigation.
For businesses of all sizes, sucessful records management requires systematically applying a consistent process across an enterprise. This means designing and implementing a procedure that can preserve the integrity and trustworthiness of records across the enterprise.
While saving everything may appear the solution at first glance – this is anything but an effective compliance plan. There are four core elements that, when addressed, enable most organizations to begin to build a foundation that can help them withstand some of the most common compliance pressures.
Manage electronic records across the enterprise
Investing in a retention management-only approach compared to a records
management approach is not the shortcut it appears to be. Simply retaining information across various silos or keeping retention folders created by various users creates new complexity when a record needs to be put on hold.
By treating records management as an automated service across the enterprise and enforcing controls across multiple repositories, records can be centrally managed. This simplifies administration and compliance because information affected by an audit, for example, can be locked down regardless of the repository or application in which it is stored.
If no formal electronic records management strategy exists, start by taking an inventory of records, how old they are, what format they are in, and what policies, events or regulations determine how long they must be maintained. Be sure to note computing systems and location, software products and versions, including method or tools used for encryption, business purpose of the information stored, as well as how the data is stored and how often it is backed up. Look carefully at the volume of data being retained and examine any native capabilities for search as well as the data formats.
After conducting an inventory, reduce the volume of electronically stored information. This may not only reduce storage and data management costs, it could also shrink your organization’s exposure. Also, keep in mind that retention requirements are often event driven, such as the settlement of a claim, or payoff of a mortgage. Therefore, one size does not necessarily fit all when it comes to retaining records. Take into account events that might drive the need to delete records earlier or later.
Rather than relying on the risky business of trusting individual users to ensure records are managed properly, having software in place to ensure electronic information is captured and managed in accordance with policies will not only help the organization achieve compliance, but also sustain it over time.
Manage e-mail and keep as part of the business process
When it comes to the challenge of retaining growing volumes of information, e-mail is often top of mind. It is frequently the first thing organizations must fork over during regulatory investigations and civil discovery. Establishing a searchable e-mail archive is an important place to start. It is also important to create e-mail management policies to safely reduce the storage of older e-mails.
One of the first places to start is by archiving e-mail and associated buried content, such as attachments, for both mailbox management and storage management. This ensures that each e-mail is managed as a record to ensure compliance. Likewise, e-mail management should stay within context of the original business process.
Ensure effective electronic discovery
Electronic discovery is more than just searching; it is a process that defines what documents are needed, how they are handled, collected, reviewed and eventually packaged to be presented to external or opposing counsel. Electronic discovery also ensures that important evidence, content or records can be produced efficiently, and provides proof of compliance with policies and processes. It is not a one-time act and requests for information can be expected to continue to increase whether from regulators, courts, government, or public interest groups.
The good news is that there are multiple business benefits of electronic discovery. When managed in context of an enterprise content management system, it helps reduce the problems associated with scattered information silos, multiple copies of information, as well as poor indexing of files. Getting unstructured content like e-mails, proposals, contracts, call-center records and collaborative documents under control can be made even easier by adding metadata and creating taxonomies to categorize and manage this information while implementing the electronic discovery process.
Once search tools and electronic discovery protocols are in place, it is a good idea to test your system periodically against a variety of sources. For example, how long does it take to search and report results on 20 named individuals in your e-mail system regarding one matter over a period of three years? Don’t forget to conduct this benchmark across not only current systems but retired systems and archive systems as well.
Create a unified foundation for governance, risk and compliance
Enterprise content management software can serve as the foundation for helping achieve compliance but it can also be useful for governance and risk concerns as well. By establishing operational policies, processes and controls and automating most all records management and retention tasks while putting controls in place, organizations can cost effectively manage risk and more easily produce evidence and records proving the organization has adhered to its policies and processes.
Creating such a compliance framework can be easily achieved by effectively integrating records management, enterprise content management and business process management. This provides the added benefit of allowing one platform to address many overlapping regulations and compliance, risk and corporate governance initiatives. It is also a more cost-effective approach than using several independent solutions that do not work together, enabling the implementation and licensing costs to be spread across the entire enterprise. An enterprise content management-based approach can also deliver repeatable processes that have the flexibility to accommodate a variety of discovery and regulatory requests now and in the future.
Finally, records management may seem like a daunting task at the outset, but with a framework and repeatable processes in place, most companies find there is a positive return on investment for their business.
biography
Craig Rhinehart is the director of ECM Compliance and Discovery Product Marketing for IBM. He came to IBM through the 2006 acquisition of FileNet, where he served as vice president of Compliance Markets and Products.
