Records Management: Not as Easy as It Looks

Often on the advice of legal counsel, more organizations are evaluating enterprise records management to comply with the revised e-discovery laws or support compliance. Despite the urgency of this mandate, the reality is that it can take years to implement true, enterprisewide records management.

Even among Global 1000 companies with the financial and legal resources to fund such initiatives, analysts estimate that only a fraction has an enterprisewide strategy for managing records. Some of the barriers to enterprise-level records management solutions include:

• Difficulty in identifying all of an organization's records and their sources;
• Complexity of creating and approving a file plan, a process that often requires outside consulting services; and
• Training and change management for end users

Most organizations simply cannot afford to delay risk mitigation initiatives. The identifiable cost of purchasing software licenses that go unused is negligible when compared to the potential cost of failing to produce discovery- or compliance-related documents. Without having potential records in a managed environment, the cost of discovery itself will be higher, it is much more difficult to impose even basic policies for preserving documents and the possibility of an expensive legal finding is much higher.

Frustrated by delays, some business units begin to look for departmental records solutions, but in the long run this can actually increase the cost, complexity and risks. These disparate solutions become yet another silo of information that must be searched and may not adhere to the established corporate standards for naming conventions, classifications and taxonomies

Most Records Originate as Documents
A sizable percentage of records start out as documents (using the loose definition of the term to include just about everything else an organization collects) that were part of some initial transactions. They become de facto records when they are evidence of a transaction instead of driving it. For instance, an incoming invoice is a document that ensures vendors get paid. If that invoice is in a managed environment, it may serve as a record that established controls were followed during a Sarbanes-Oxley audit, even if it isn't part of a formal records management application.

An enterprisewide content management strategy can provide the groundwork for defining records in the long term, in addition to delivering productivity, customer service and cost savings in the near term. Controlling content in a managed environment provides managers with an accurate inventory of information assets. Simply the ability to search all content using metadata is a significant milestone in the ability to respond to e-discovery requests and audits. Understanding what exists, who uses it and how it is used is instrumental in developing an effective file plan.

Like records management, effective content management must be scalable enough to meet the targeted needs of the entire enterprise to be practical from a cost and usability standpoint. One large Ohio county calculated the cost of an enterprise solution and found that it was one-third of the cost of deploying multiple point solutions, based solely on software and services.

Federated search—the ability of a third-party solution to access documents in other repositories and file shares—is not likely to provide the same benefits as a consolidated managed environment. Not only are there few success stories to point to, the full functionality of the content management solution will not be available. The level of IT complexity will be increased, creating delays that solution was intended to eliminate. Generally, federated search vendors tout packaged connectors, which would require competing vendors to work cooperatively. Any such claim should be validated by asking what vendors and software versions the packaged connector has been certified for.

Effective content management can impose retention policies, one of the inherent risk-mitigation capabilities of records management. Automated retention ensures that documents are readily accessible to auditors for as long as they need to be, but not long enough to become potential liabilities. Retention policies can be based on when content entered the system or a qualifying event such as separation of employment.

Once in a secure repository, files can proactively be audited to ensure that a managed folder, such as an employee file, has all required documents. On a larger scale, a report can be run against an entire content repository, ensuring, for example, that every purchase order has a valid authorization for expenditure (AFE).

In an e-discovery or compliance investigation, the integrity of documents will be questioned. Unlike physical filing cabinets that are difficult to prevent access to, electronic document management prevents and monitors access. Audit trails are maintained to indicate not only who saw a document and what they did with it. If used in conjunction with automated workflow, it is even possible to demonstrate that the appropriate business rules were followed.

Breaking Down the Barriers
Once a file plan and policies are established, records management functionality native to the content management application can be incorporated into the solution. Ideally, this will happen in conjunction with physical records management, automated workflow actions to reduce end user tasks and industry expertise to ensure the solution meets the needs of the business unit and/or process.

Having the documents in a managed system with appropriate metadata and correlation to related records facilitates deployment of the records management solution and eliminates the need to move records to another repository. A phased approach allows organizations to avoid paying for records management licenses before they're ready to use them. Spreading costs across multiple buying cycles may also help eliminate any potential barriers to entry caused by budget restrictions. The learning curve for end users and IT is also reduced because neither group will have to learn a new application.

Enterprise records management is the ultimate goal, but most organizations can't afford to be at risk in the meantime. Content management can ease the transition and increase control quickly by

• Identifying and consolidating all potential records and the relationships between them;
• Reducing the complexity of creating a file plan by classifying all documents; and
• Minimizing the need for extensive change management and training for users.