Records and information management (RIM) is a key impact area of information governance (IG)—so much so that in the records management (RM) space, IG is often thought of as synonymous with or a simple superset of RM. But IG is much more than that. We will delve into the details of RM here—a sort of crash course on how to identify and inventory records, conduct the necessary legal research, develop retention and disposition schedules, and more. Also, we identify the relationship and impact of IG on the RM function in an organization in this chapter.

The International Organization for Standardization (ISO) defines (business) records as “information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”¹ It further defines RM as “[the] field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”²

RIM extends beyond RM (although the terms are often used interchangeably) to include information—that is, information such as e-mail, electronic documents, and reports. For this reason, RIM professionals must expand their reach and responsibilities to include policies for retention and disposition of all legally discoverable forms of information, RIM professionals today generally know that “everything is discoverable” and that includes e-mail, voicemail, social media posts, mobile data and documents held on portable devices, cloud storage and applications, and other enterprise data and information.

Electronic records management (ERM) has moved to the forefront of business issues with the increasing automation of business processes and the vast growth in the volume of electronic information that organizations create. These factors, coupled with expanded and tightened reporting laws and compliance regulations—most especially the EU General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA)—have made ERM essential for most enterprises, especially highly regulated and public ones.

ERM follows generally the same principles as traditional paper-based records management: There are classification and taxonomy needs to group and organize the records; and there are retention and disposition schedules to govern the length of time a record is kept and its ultimate disposition, which is usually destruction but can also include transfer (e.g., U.S. federal agency records sent to the national Archives and Records Administration for archiving and safekeeping) or long-term archiving. Yet e-records must be handled differently, and they contain more detailed data about their contents and characteristics, known as metadata. (For more detail on these topics see Appendix A.)

E-records are also subject to changes in information technology (IT) like file formats and protocols that may make them difficult to retrieve and view and therefore render them obsolete. These issues can be addressed through a sound ERM program that includes long-term digital preservation (LTDP) methods and technologies for digital records needed to be maintained 10 years or more.

ERM is primarily the organization, management, control, monitoring, and auditing of formal business records that exist in electronic form. But automated ERM systems also track paper-based and other physical records. So ERM goes beyond simply managing electronic records; it is the management of electronic records and the electronic management of nonelectronic records (e.g. paper, CD/DVDs, magnetic tape, audio-visual, and other physical records).

Most electronic records, or e-records, originally had an equivalent in paper form, such as memos (now e-mail), accounting documents (e.g. purchase orders, invoices), personnel documents (e.g. job applications, resumes, tax documents), contractual documents, line-of-business documents (e.g. loan applications, insurance claim forms, health records), and required regulatory documents (e.g. material safety data sheets). Before e-document and e-record software began to mature in the 1990s, many of these documents were first archived to microfilm or microform/microfiche.

Not all documents rise to the level of being declared a formal business record that needs to be retained; that definition depends on the specific regulatory and legal requirements imposed on the organization and the internal definitions and requirements the organization imposes on itself, through internal IG measures and business policies. IG is control of information to meet legal, regulatory, business and risk demands. In short, IG is security, control, and optimization of information.

ERM is a component of enterprise content management (ECM), just as document management, Web content management, digital asset management, enterprise report management, workflow, and several other technology sets are components. ECM encompasses all an organization's unstructured digital content, which means it excludes structured data (i.e. databases). ECM includes the vast majority—typically 80 to 90%—of an organization's overall information that must be governed and managed. Structured information held in databases makes up the remainder; however, due to its structured and consistent nature it is more easily managed.

ERM extends ECM to provide control and to manage records through their life cycle—from creation to destruction. ERM is used to complete the life cycle management of information, documents, and records.

ERM adds the functionality to complete the management of information and records by applying business rules to manage the maintenance, preservation, and disposition of records. Both ERM and ECM systems aid in locating and managing the records and information needed to conduct business efficiently, to comply with legal and regulatory requirements, and to effectively destroy (paper) and delete (digital) records that have met their retention policy time frame requirement, freeing up valuable physical and digital space and eliminating records that could be a liability if kept.

In the last few years, the term content services has been used to supplant and expand the definition of ECM, mostly to include cloud-based platforms that offer Software-as-a-Service tools to manage content. This renaming effort has been led by Gartner, and many see it as a necessary recharacterization of a market that has evolved.

Records Management Business Rationale

Historically, highly regulated industries, such as banking, energy, and pharmaceuticals, have had the greatest need to implement RM programs, due to their compliance and reporting requirements. However, over the past decade or so, increased regulation and changes to legal statutes and rules have made RM a business necessity for nearly every enterprise (beyond very small businesses).

Notable industry drivers fueling the growth of RM programs include:

• Increased government oversight and industry regulation. Government regulations that require enhanced reporting and accountability were early business drivers that fueled the implementation of formal RM programs. This is true at the federal and state or provincial level. In the United States, the Sarbanes-Oxley Act of 2002 (SOX) created and enhanced standards of financial reporting and transparency for the boards and executive management of public corporations and accounting firms. It also addressed auditor independence and corporate governance concerns. SOX imposes fines or imprisonment penalties for noncompliance and requires that senior officers sign off on the veracity of financial statements. It states clearly that pertinent business records cannot be destroyed during litigation or compliance investigations. Since SOX was enacted, Japan, Australia, Germany, France, and India also have adopted stricter “SOX-like” governance and financial reporting standards. Newer legislation, such as the EU GDPR, and global privacy concerns have further driven the need for updated and expanded RM programs. This has given the RM profession a boost in visibility and energy.
• Changes in legal procedures and requirements during civil litigation. In 2006, the need to amend the US Federal Rules of Civil Procedure (FRCP) to contain specific rules for handling electronically generated evidence was addressed. The changes included processes and requirements for legal discovery of electronically stored information (ESI) during civil litigation. Today, e-mail is the leading form of evidence requested in civil trials. The changes to the US FRCP in 2006 and its update in 2015 had a pervasive impact on American enterprises and required them to gain control over their ESI and implement formal RM and electronic discovery (e-discovery) programs to meet new requirements. Although they have generally been ahead of the United States in their development and maturity of RM practices, Canadian, British, and Australian law is closely tracking that of the United States in legal discovery. The United States is a more litigious society, so this is not unexpected.
• IG awareness. IG, in sum, is the set of rules, policies, and business processes used to manage and control the totality of an organization's information. Monitoring technologies are required to enforce and audit IG compliance. Beginning with SOX in 2002 and continuing with the massive US FRCP changes in 2006 and 2015, along with the introduction of the far-reaching GDPR legislation, enterprises have been forced to become more IG aware and have spurred ramped up efforts to control, manage, and secure their information. A significant component of any IG program is implementing an RM program that specifies the retention periods and disposition (e.g. destruction, transfer, archive) of formal business records. This program, for instance, allows enterprises to destroy records once their required retention period (based on external regulations, legal requirements, and internal IG policies) has been met and allows them to legally destroy records with no negative impact or lingering liability. This practice, if consistently implemented, allows for the elimination of information that has low value to make room for new information that has higher business value.
• Business continuity concerns. In the face of real disasters, such as the 9/11 terrorist attacks, Hurricane Katrina, and Superstorm Sandy, executives now realize that disaster recovery and business resumption is something they must plan and prepare for. Disasters really happen, and businesses that are not well prepared really go under. The focus is on vital records, which are those most mission-critical records that are needed to resume operations in the event of a disaster, and managing those records is part of an overall RM program.

Why Is Records Management So Challenging?

With these changes in the business environment and in regulatory, legal, and IG influences comes increased attention to RM as a driver for corporate compliance. For most organizations, a lack of defined policies and the enormous and growing volumes of documents (e.g. e-mail messages) make implementing a formal RM program challenging and costly. Some reasons for this include:

• Changing and increasing regulations. Just when records and compliance managers have sorted through the compliance requirements of federal regulations, new ones at the state or provincial level are created or tightened down, and even those from other countries, such as GDPR, have had an impact.
• Maturing IG requirements within the organization. As senior managers become increasingly aware of the value of IG programs—the rules, policies, and processes that control and manage information—they promulgate more reporting and auditing requirements for the management of formal business records.
• Managing multiple retention and disposition schedules. Depending on the type of record, retention requirements vary, and they may vary for the same type of record based on state and federal regulations. Further, internal IG policies may extend retention periods and may fluctuate with management changes.³
• Compliance costs and requirements with limited staff. RM and compliance departments are notoriously understaffed, since they do not generate revenue. Departments responsible for executing and proving compliance with new and increasing regulatory requirements must do so expediently, often with only skeletal staffs. This leads to expensive outsourcing solutions or staff increases. The cost of compliance must be balanced with the risk of maintaining a minimum level of compliance.
• Changing information delivery platforms. With cloud computing, mobile computing, Web 2.0, social media, and other changes to information delivery and storage platforms, records and compliance managers must stay apprised of the latest IT trends and provide records on multiple platforms all while maintaining the security and integrity of organizational records.
• Security concerns. Protecting and preserving corporate records is of paramount importance, yet users must have reasonable access to official records to conduct everyday business. “Organizations are struggling to balance the need to provide accessibility to critical corporate information with the need to protect the integrity of corporate records.”⁴
• Dependence on the IT department or provider. Since tracking and auditing use of formal business records requires IT, and records and compliance departments typically are understaffed, those departments must rely on assistance from the IT department or outsourced IT provider—which often does not have the same perspective and priorities as the departments they serve.
• User assistance and compliance. Users often go their own way with regard to records, ignoring directives from records managers to stop storing shadow files of records on their desktop (for their own convenience) and inconsistently following directives to classify records as they are created. Getting users across a range of departments in the enterprise to adhere uniformly with records and compliance requirements is a daunting and unending task that requires constant attention and reinforcement. Increasingly, the solution is to automate the task of classification as much as possible using file analysis tools, often enabled with artificial intelligence (AI).

Benefits of Electronic Records Management

A number of business drivers and benefits combine to create a strong case for implementing an enterprise ERM program. Most are tactical, such as cost savings, time savings, and building space savings. But some drivers can be thought of as strategic, in that they proactively give the enterprise an advantage. One example may be the advantages gained in litigation by having more control and ready access to complete business records. This yields more accurate results and more time for corporate attorneys to develop strategies while the opposition is placing blunt legal holds on entire job functions and wading through reams of information, never knowing if it has found the complete set of records it needs. Another example is more complete and better information for managers to base decisions on. Further, applying the principles of infonomics may help organizations find new value or even to monetize information.

Implementing ERM represents a significant investment. An investment in ERM is an investment in business process automation and yields document control, document integrity/trustworthiness, and security benefits. The volume of records in organizations often exceeds employees’ ability to manage them. ERM systems do for the information age what the assembly line did for the industrial age. The cost/benefit justification for ERM is sometimes difficult to determine, although there are real labor and cost savings. Also, many of the benefits are intangible or difficult to calculate but help to justify the capital investment. There are many ways in which an organization can gain significant business benefits with ERM.

More detail on business benefits is provided in Chapter 7, but hard, calculable benefits (when compared to storing paper files) include office space savings, office supplies savings, cutting wasted search time, and reduced office automation costs (e.g. fewer printers, copiers, and automated filing cabinets).

In addition, implementing ERM will provide the organization with:

• Improved capabilities for enforcing IG policy over business documents and records.
• Increased working confidence in making searches, which should improve decision making.
• Improved knowledge worker productivity.
• Reduced risk of compliance actions or legal consequences.
• Improved records security.
• Improved ability to demonstrate legally defensible RM practices.
• More professional work environment.

Additional Intangible Benefits

The US Environmental Protection Agency (EPA), a pioneer and leader in e-records implementation in the federal sector, lists some additional benefits of implementing ERM:

1. To control the creation and growth of records. Despite decades of using various nonpaper storage media, the amount of paper in our offices continues to escalate. An effective records management program addresses both creation control (limits the generation of records or copies not required to operate the business) and records retention (a system for destroying useless records or retiring inactive records), thus stabilizing the growth of records in all formats.
2. To assimilate new records management technologies. A good records management program provides an organization with the capability to assimilate new technologies and take advantage of their many benefits. Investments in new computer systems don't solve filing problems unless current manual recordkeeping systems are analyzed (and occasionally, overhauled) before automation is applied.
3. To safeguard vital information. Every organization, public or private, needs a comprehensive program for protecting its vital records and information from catastrophe or disaster, because every organization is vulnerable to loss. Operated as part of the overall records management program, vital records programs preserve the integrity and confidentiality of the most important records and safeguard the vital information assets according to a “plan” to protect the records.
4. To preserve the corporate memory. An organization's files contain its institutional memory, an irreplaceable asset that is often overlooked. Every business day, you create the records that could become background data for future management decisions and planning. These records document the activities of the agency that future scholars may use to research the workings of the Environmental Protection Agency.
5. To foster professionalism in running the business. A business office with files askew, stacked on top of file cabinets and in boxes everywhere, creates a poor working environment. The perceptions of customers and the public, and “image” and “morale” of the staff, though hard to quantify in cost-benefit terms, may be among the best reasons to establish a good records management program.⁵

Thus, there are a variety of tangible and intangible benefits derived from ERM programs, and the business rationale that fits for your organization depends on its specific needs and business objectives.

Inventorying E-Records

According to the US National Archives and Records Administration (NARA), “In records management, an inventory is a descriptive listing of each record series or system, together with an indication of location and other pertinent data. It is not a list of each document or each folder but rather of each series or system”⁶ (emphasis added).

Conducting an inventory of electronic records is more challenging than performing a physical records inventory, but the purposes are the same: to ferret out RM problems and to use the inventory as the basis for developing the retention schedule. Some of the RM problems that may be uncovered

include inadequate documentation of official actions, improper applications of recordkeeping technology, deficient filing systems and maintenance practices, poor management of nonrecord materials, insufficient identification of vital records, and inadequate records security practices. When completed, the inventory should include all offices, all records, and all nonrecord materials. An inventory that is incomplete or haphazard can only result in an inadequate schedule and loss of control over records.⁷

The first step in gaining control over an organization's records and implementing IG measures to control and manage them is to complete an inventory of all groupings of business records, including electronic records,⁸ at the system or file series level.

The focus of this book is on e-records, and when it comes to e-records, NARA has a specific recommendation: inventory at the computer systems level. This differs from advice given by experts in the past.

The records inventory is the basis for developing a records retention schedule that spells out how long different types of records are to be held and how they will be archived or disposed of at the end of their life cycle. But first you must determine where business records reside, how they are stored, how many exist, and how they are used in the normal course of business.

There are a few things to keep in mind when approaching the e-records inventorying process:

• Those who create and work with the records themselves are the best source of information about how the records are used. They are your most critical resource in the inventorying process.
• RM is something that everyone wants done but no one wants to do (although everyone will have an opinion on how to do it).
• The people working in business units are touchy about their records. It will take some work to get them to trust a new RM approach.⁹

These knowledge workers are your best resource and can be your greatest allies or worst enemies when it comes to gathering accurate inventory data; developing a workable file plan; and keeping the records declaration, retention, and disposition process operating efficiently. A sound RM program will keep the records inventory accurate and up to date.

RM Intersection with Data Privacy Management

By Teresa Schoch

The tsunamic rise in electronic information and increasing complexity in information management¹⁰ has resulted in newly created or redefined roles tasked with creating order out of chaos. Information professionals attempt to control their domains in roles described as content management, knowledge management, e-discovery, data management, data security, records management, privacy management, and IG. Due to an increased focus on privacy rights in the EU, as well as in individual US states, potential enforcement actions have had an alarming impact on all of these roles, often causing intraorganizational conflict as enforced silos inhibit compliance with expanding and complex privacy laws.

Other than prohibitively expensive e-discovery disasters or unexpected regulatory audits leading to fines, in the past, there has been no real accountability in the United States as to how an organization maintains, organizes, creates, and/or disposes of its information. However, data breaches of private information, as well as the hacking of business and trade secrets, have become commonplace. ¹¹ Corporations have scrambled to determine the what, where, when, and ownership of information that has been compromised, often racing against the clock to notify law enforcement and impacted individuals in time to avoid financial damages. C-level executives have lost their jobs over their company's mishandling of breaches.¹² A court allowed a class action by credit card holders against Neiman Marcus,¹³ and the FTC acted against Wyndham Resorts for failure to protect the data of its customers.¹⁴ The potential for fines imposed by the FTC or state attorney generals based on state data-breach laws, damages in private lawsuits, or the untimely loss of highly placed executives increases the potential costs of a future breach. In addition, as reflected in the Neiman Marcus case, damage to a company's reputation due to the glaring scrutiny of its inadequate IG program serves to motivate others to remedy inadequate IG frameworks.¹⁵

Meanwhile, the EU has the right to fine US organizations collecting data on EU residents up to 20 million euros, or 4% of global sales, for the mishandling of personal data pursuant to the GDPR, which became effective on May 25, 2018. Records management is at the core of information management, since it is the gatekeeper to all information of ongoing value to the organization (a record is defined as information that has business value or meets regulatory or litigation requirements); it is even more obvious in privacy management now that private data being maintained is required to be held for a specified time in a specified manner. Personal data must be capable of easy access and any data maintained on a protected individual must be accurate. In addition, when private data no longer has business value, the risk of maintaining it becomes prohibitive and it must be deleted in a manner that ensures continued privacy protection. As records managers assess their own domains, they realize that many of the obligations created by new privacy laws can only be met if they understand the new laws’ effects on how they manage personal data pursuant to laws that impact their organization. Some erroneously assumed that privacy managers/attorneys/directors would expand their roles by learning the RIM world and addressing the changes required by privacy laws, but instead, they refer the details of maintaining privacy-related records to their records staff. While their willingness to delegate the legal duties of access, scheduling, deletion, and reliability of personal data is laudable, it creates new dynamics and an increased level of responsibility within the RIM framework that might not be thoroughly understood by the organization.

Since the GDPR has taken effect, many corporate attorneys have instructed the RIM staff to reassess records retention schedules based on the GDPR. Overworked professionals from all domains have developed plans to meet compliance requirements, often attempting to make the law fit into how they have always handled their duties in the past. As an example, the RIM “big bucket” approach, utilized to create records retention schedules for global records containing personal data of EU residents, could lead to fines in the millions. When an EU country requires employment records’ retention of 30 years, while another country requires disposal of the same record types three months after termination of employment, a default to a 30-year schedule for all EU employment-related data is simply an unsound practice. Likewise, deletion of all EU employment data three months after employment termination would leave an organization open to an inability to meet the legal obligations of other jurisdictions, and to the inability to defend the organization in the event of litigation. In this instance, each country needs to be addressed individually. If there is a legitimate basis for maintaining personal data (e.g. potential litigation relating to employment), the data can be maintained under GDPR solely for that purpose, even if there is a privacy-related requirement of a shorter retention period for that specific data. In these “conflict of laws” situations, the data maintained for the interim retention period based on legitimate business interests requires heightened security as well as restricted access. Retention schedules relating to records containing personal data have their own rules, often involving a conflict of laws, that require a new data-scheduling framework within the RIM environment.

In the RIM domain, managing information that contains personal data is an example where less is more. Less information makes it easier and faster to retrieve relevant information (in this case, personal data), costs less to maintain, and limits liability to those whose information is deleted as soon as it no longer has business value. Until recently, the decision to “keep it all” was based on an assessment of return on investment that considered the risks worth taking compared to the cost of ensuring compliance through the creation of a long-term IG roadmap. The lack of calculated routine disposition was defended as a strategic decision to maintain data for marketing or business planning using increasingly sophisticated analytical software.

However, attempting to meet GDPR requirements while maintaining large data pools or warehouses of information that have not been identified, much less classified (the unknown unknown), creates an extremely difficult environment for compliance. For companies that do business with European residents, enforcing defensible disposition has become a critical mission. While scheduling records disposition has become more complex under GDPR, meeting a defensibility standard relating to disposition has become easier.

Generally Accepted Recordkeeping Principles®

It may be useful to use a model or framework to guide your records inventorying efforts. Such frameworks could be the DIRKS (Designing and Implementing Recordkeeping Systems) used in Australia or the Generally Accepted Recordkeeping Principles® (or “the Principles”) that originated in the United States at ARMA International. The Principles are a “framework for managing records in a way that supports an organization's immediate and future regulatory, legal, risk mitigation, environmental, and operational requirements.”¹⁶ More detail can be found in Chapter 3.

Special attention should be given to creating an accountable, open inventorying process that can demonstrate integrity. The result of the inventory should help the organization adhere to records retention, disposition, availability, protection, and compliance aspects of the Principles.

The Generally Accepted Recordkeeping Principles were created with the assistance of ARMA International and legal and IT professionals who reviewed and distilled global best practice resources. These included the international records management standard ISO15489–1 from the American National Standards Institute and court case law. The principles were vetted through a public call-for-comment process involving the professional records information management … community.¹⁷

E-Records Inventory Challenges

If your organization has received a legal summons for e-records, and you do not have an accurate inventory, the organization is already in a compromising position: You do not know where the requested records might be, how many copies there might be, or the process and cost of producing them. Inventorying must be done sooner rather than later and proactively rather than reactively.

E-records present challenges beyond those of paper or microfilmed records due to their (electronic) nature:

1. You cannot see or touch them without searching online, as opposed to simply thumbing through a filing cabinet or scrolling through a roll of microfilm.
2. They are not sitting in a central file room but rather may be scattered about on servers, shared network drives, or on storage attached to mainframe or minicomputers.
3. They have metadata attached to them that may distinguish very similar-looking records.
4. Additional “shadow” copies of the e-records may exist, and it is difficult to determine the true or original copy.¹⁸

Records Inventory Purposes

The completed records inventory contributes toward the pursuit of an organization's IG objectives in a number of ways: It supports the ownership, management, and control of records; helps to organize and prepare for the discovery process in litigation; reduces exposure to business risk; and provides the foundation for a disaster recovery/business continuity plan.

Completing the records inventory offers at least eight additional benefits:

1. It identifies records ownership and sharing relationships, both internal and external.
2. It determines which records are physical, electronic, or a combination of both.
3. It provides the basis for retention and disposition schedule development.
4. It improves compliance capabilities.
5. It supports training objectives for those handling records.
6. It identifies vital and sensitive records needing added security and backup measures.
7. It assesses the state of records storage, its quality and appropriateness.
8. It supports the release of information for Freedom of Information Act (FOIA), Data Protection Act, and other mandated information release requirements for governmental agencies.¹⁹

With respect to e-records, the purpose of the records inventory should include the following objectives:

• Provide a survey of the existing electronic records situation.
• Locate and describe the organization's electronic record holdings.
• Identify obsolete electronic records.
• Determine storage needs for active and inactive electronic records.
• Identify vital and archival electronic records, indicating need for their ongoing care.
• Raise awareness within the organization of the importance of electronic records management.
• Lead to electronic recordkeeping improvements that increase efficiency.
• Lead to the development of a needs assessment for future actions.
• Provide the foundation of a written records management plan with a determination of priorities and stages of actions, assuring the continuing improvement of records management practices.²⁰

Records Inventorying Steps

NARA's guidance on how to approach a records inventory applies to both physical and e-records.

The steps in the records inventory process are:

1. Define the inventory's goals. While the main goal is gathering information for scheduling purposes, other goals may include preparing for conversion to other media, or identifying particular records management problems.
2. Define the scope of the inventory; it should include all records and other materials.
3. Obtain top management's support, preferably in the form of a directive, and keep management and staff informed at every stage of the inventory.
4. Decide on the information to be collected (the elements of the inventory). Materials should be located, described, and evaluated in terms of use.
5. Prepare an inventory form, or use an existing one.
6. Decide who will conduct the inventory, and train them properly.
7. Learn where the agency's [or business’] files are located, both physically and organizationally.
8. Conduct the inventory.
9. Verify and analyze the results.²¹

Appraising the Value of Records

Part of the process of determining the retention and disposition schedule of records is to appraise their value. Records can have value in different ways, which affects retention decisions.

Records appraisal is an analysis of all records within an agency [or business] to determine their administrative, fiscal, historical, legal, or other archival value. The purpose of this process is to determine for how long, in what format, and under what conditions a record series ought to be preserved. Records appraisal is based upon the information contained in the records inventory. Records series shall be either preserved permanently or disposed of when no longer required for the current operations of an agency or department, depending upon:

• Historical value or the usefulness of the records for historical research, including records that show an agency [or business] origin, administrative development, and present organizational structure.
• Administrative value or the usefulness of the records for carrying on [a business or] an agency's current and future work, and to document the development and operation of that agency over time.
• Regulatory and statutory [value to meet] requirements.
• Legal value or the usefulness of the records to document and define legally enforceable rights or obligations of [business owners, shareholders, or a] government and/or citizens.
• Fiscal value or the usefulness of the records to the administration of [a business or] an agency's current financial obligations, and to document the development and operation of that agency over time.
• Other archival value as determined by the State [or corporate] Archivist.²⁴ (Emphasis added.)

Ensuring Adoption and Compliance of RM Policy

The inventorying process in not a one-shot deal: It is useful only if the records inventory is kept up to date, so it should be reviewed, at least annually. A process should be put in place so that business unit or agency heads notify the RM head/lead if a new file series or system has been put in place and new records collections are created. There are emerging approaches that utilize file/content analytics tools to automate this process.

Following are some tips to help ensure that a records management program achieves its goals:

1. Records management is everyone's role. The volume and diversity of business records, from e-mails to reports to tweets, means that the person who creates or receives a record is in the best [position] to classify it. Everyone in the organization needs to adopt the records management program.
2. Don't micro-classify. Having hundreds, or possibly thousands, of records classification categories may seem like a logical way to organize the multitude of different records in a company. However, the average information worker, whose available resources are already under pressure, does not want to spend any more time than necessary classifying records. Having a few broad classifications makes the decision process simpler and faster.
3. Talk the talk from the top on down. A culture of compliance starts at the top. Businesses should establish a senior-level steering committee comprised of executives from legal, compliance, and information technology (IT). A committee like this signals the company's commitment to compliant records management and ensures enterprise adoption.
4. Walk the walk, consistently. For compliance to become second nature, it needs to be clearly communicated to everyone in the organization, and policies and procedures must be accessible. Training should be rigorous and easily available, and organizations may consider rewarding compliance through financial incentives, promotions and corporate-wide recognition.
5. Measure the measurable. The ability to measure adherence to policy and adoption of procedures should be included in core business operations and audits. Conduct a compliance assessment, including a gap analysis, at least once a year, and prepare an action plan to close any identified holes.

The growth of information challenges a company's ability to use and store its records in a compliant and cost-effective manner. Contrary to current practices, the solution is not to hire more vendors or to adopt multiple technologies. The key to compliance is consistency, with a unified enterprise-wide approach for managing all records, regardless of their format or location.

Therefore a steady and consistent IG approach that includes controls, audits, and clear communication is key to maintaining an accurate and current records inventory.

Sample Information Asset Survey Questions²⁸

1. Information Asset Description
   1. 1.1 Name: A descriptive and meaningful label for the asset
   2. 1.2 Description: What is the information asset and what it is used for
2. Ownership: This section covers the “stewardship” of the information asset, including the key roles and responsibilities of the owner and manager, together with any other stakeholders likely to be affected by the quality and availability of the asset.
   1. 2.1 Owner has overall accountability for access, use, and management of the asset
   2. 2.2 Manager: Hands-on manager responsible for day-to-day operations and administration. Expected to be familiar with the details of the asset content, structure and usage, and so likely to be quick to detect evidence of breach, tampering/corruption, and so on
   3. 2.3 Creator: Source of the information; a person, application system, or external source
   4. 2.4 Stakeholders/customers: Other stakeholders affected by the use, management, integrity, or availability of the asset
3. Dates
   1. 3.1 Creation date: Date on which the asset was created (if involving a fixed lifecycle)
   2. 3.2 Last review date: Date on which the asset was last reviewed for completeness and accuracy
   3. 3.3 Date closed: Date on which the asset was closed/completed/removed from production use
4. Confidentiality
   1. 4.1 Confidentiality: Indicates the confidentiality classification of the information based on the Confidentiality of Information policy, which is distinct from the Risk/Impact Criticality rating in section 7 below.)
   2. 4.2 Data Privacy and Protection: Indicates whether the asset contains or relates to Personally Identifiable Information (PII) and potential relevance to Data Protection or Data Privacy regulations and legal risk—especially the EU General Data Protection Regulation (GDPR).
5. Retention
   1. 5.1 Retention period: Retention category (if useful—but avoid duplication and inconsistency)
   2. 5.2 System of Record: Name of the record system used to store the asset (or a subset of related business records)
6. Access and Use
   1. 6.1 Applications and Interfaces: List of applications and interfaces authorized to access the information asset, together with the corresponding access rights
   2. 6.2 User groups: List of user groups authorized to access the asset, together with the corresponding access rights
   3. 6.3 Metadata: List of any metadata needed to access or describe the context of the asset
7. Risk/Impact of problems/issues
   1. 7.1 Confidentiality: Impact if the asset is accessed or disclosed without authorization
   2. 7.2 Integrity: Impact if the information is corrupted, tampered with, or otherwise suffers a loss of integrity
   3. 7.3 Availability: Impact if the information is lost or unavailable?
   4. 7.4 Criticality: The overall criticality rating is the product of the combined scores of the above confidentiality, integrity, and availability ratings.

Of note: To truly have an IAR that stays up-to-date on a daily basis, file analysis software must be implemented on the back end to monitor and update the status of information assets.

General Principles of a Retention Scheduling

A series of basic principles common to all retention schedules, include:²⁹

• The retention schedule must include all records.
• Records scheduling includes all records, regardless of media or location.³⁰
• All legal and regulatory requirements for records must be reflected in the records scheduling process. For public entities, retention scheduling fosters and enables the agency to comply with information requests (e.g. FOIA in the United States, Freedom of Information Act 2000 in the United Kingdom, Freedom of Information and Protection of Privacy Act and the Health Information Act in Canada, and Freedom of Information Amendment [Reform] Act 2010 in Australia).
• Records scheduling is a “proactive” planning process, where schedules are set in place and standardized in advance.
• Periodic review of the retention schedule must take place when significant legislation, technology acquisitions, or other changes are being considered; but in any case, this should be at least annually or biannually.
• Records scheduling is a continuous process that needs updating and amending, based on legal, technology, or business changes over time.
• Classification and records scheduling are inextricably linked.
• File series with similar characteristics or value should be assigned consistent and appropriate retention periods.
• Records of historical value must be preserved.
• Records retention periods should reflect the business needs of users, the value of the records, and any legal or compliance requirements. The best way to make these determinations are with a team that includes cross-functional representatives from RM, legal, risk, compliance, IT, and business unit representatives, headed by an executive sponsor.
• RM resource use is optimized, and costs are minimized by keeping records a minimum amount of time under a planned and controlled set of processes.
• Records must be retained in a repository (file room or software system) where the record is protected (e.g. made read-only and monitored with an audit trail), so that the integrity of the record is maintained in a manner that meets all evidence and legal admissibility standards if or when litigation is encountered.
• Senior management must approve of and sign off on the retention schedule and will be legally accountable for compliance with the schedule.
• Senior management must be able to readily review retention schedules, policy documentation, and audit information to ensure users are in compliance with the retention schedule.
• Complete documentation of scheduling requirements and activities must take place so that future users and archivists can view and track changes to the retention schedule.³¹

Developing a Records Retention Schedule

A records retention schedule defines the length of time that records are to be kept and considers legal, regulatory, operational, and historical requirements.³² The retention schedule also includes direction as to how the length of time is calculated (i.e. the event or trigger that starts the clock [e.g. two years from completion of contract]). Legal research and opinions are required, along with consultation with owners and users of the records. Users typically overestimate the time they need to keep records, as they confuse the legal requirements with their own personal wishes. Some hard questioning has to take place, since having these records or copies of records lying around the organization on hard drives, thumb drives, or in file cabinets may create liabilities for the organization.

Disposition typically means destruction of a file series once it has met its lifecycle retention requirements. However, it can mean not just destruction but also archiving, or transfer and a change in ownership and responsibility for the records (such as is often done in the US federal government when records are transferred to NARA). The processes of archiving and preserving are an example where records may be handed over to a historical recordkeeping unit. At this time, the records may be sampled and only selective parts of the group of records may be retained.

Why Are Retention Schedules Needed?

A retention schedule allows for uniformity in the retention and disposition process, regardless of the media or location of the records. Further, it tracks, enforces, and audits the retention and disposition of records while optimizing the amount of records kept to legal minimums, which saves on capital and labor costs and reduces liability (by discarding unneeded records that carry legal risk).³⁴ The Generally Accepted Recordkeeping Principles state the critical importance of having a retention schedule (see the section “Generally Accepted Recordkeeping Principles” in Chapter 3 for more details) and provides guidelines for open collaboration in developing one. In the public sector, holding records that have passed their legally required retention period also can have negative ramifications and liabilities in meeting information service requests made during litigation, compliance actions, or, for example, under the US FOIA, or similar acts in other countries.

Information Included on Retention Schedules

A retention schedule consists of these components:

• Title of the record series
• Descriptions of the records series
• Office responsible for the retention of the record (default is usually the office of origin)
• Disposal decision—destroy, transfer to the archives, or, in exceptional circumstances, reconsider at a later (specified) date
• Timing of disposal—a minimum period for which the records should be retained in the office or in an off-site store before disposal action is undertaken
• Event that triggers the disposal action
• Dates on which the schedule was agreed, signed, or modified
• Legal citations or a link to a citation that reference the retention requirements of that group of records

A sample of a simple records retention schedule is shown in Figure 9.4.

What Records Do You Have to Schedule? Inventory and Classification

Inventory and classification are prerequisites for compiling a retention schedule. Before starting work, develop an information map or data map that shows where information is created, where it resides, and the path it takes. What records are created, who uses them, and how is their disposition handled? Questions like these will provide key insights in the development of the retention schedule.³⁶ Confirm that the information map covers all the uses of the records by all parts of the organization, including use for accountability, audit, and reference purposes.

In the absence of a formal information map, at a minimum you must compile a list of all the different types of records in each business area. This list should include information about who created them and what they are used for (or record provenance), which parts of the organization have used them subsequently and for what purpose (its usage), and the actual content.

In the absence of any existing documentation or records inventory, you will need to conduct a records inventory or survey to find out what records the business unit (or organization) holds. Tools are available to scan e-records folders to expedite the inventory process. A retention schedule developed in this way will have a shorter serviceable life than one based on an information map because it will be based on existing structures rather than functions and will remain usable only as long as the organizational structure remains unchanged.

Once a records inventory or survey is complete, building a records retention schedule begins with classification of records.³⁷

This basic classification can be grouped into three areas:

1. Business functions and activities
2. Records series
3. Document types

Business functions are basic business units such as accounting, legal, human resources, and purchasing. (See Appendix A, Information Organization and Classification: Taxonomies and Metadata for details on the process of developing classifications.) It basically answers this question: What were you doing when you created the record?

Business activities are the tasks performed to accomplish the business function. Several activities may be associated with each function.

A records series (or file series) is a group or unit of identical or related records that are normally used and filed as a unit and that can be evaluated as a unit or business function for scheduling purposes.

A document type is a term used by many software systems to refer to a grouping of related records. When the records are all created by similar processes, then the document type is equivalent to the business functions or activities mentioned previously. However, “document type” often refers to the format of the record (e.g. presentation, meeting minutes). In this case, there is not enough information to determine a retention period, because it is ambiguous regarding what type of work was being done when that document was created. Retention schedules require that record series be defined by business function and activity, not by record format or display type.

Rationale for Records Groupings

Records are grouped together for fundamental reasons to improve information organization and access. These reasons include:

• Grouping by “similar theme” for improved completeness
• Improving information search speed and completeness
• Increasing organizational knowledge and memory by providing the “context” within which individual documents were grouped
• Clearly identifying who the record owner or creator is and assigning and tracking responsibility for a group of records
• Grouping records with the same retention requirements for consistent application of disposition processes to records

Records Series Identification and Classification

After completing a records inventory including characterizing descriptive information about the records such as their contents, use, file size, and projected growth volumes, you will need to interview staff in those target areas you are working with to determine more information about the specific organizational structure, its business functions, services, programs, and plans.³⁸

In the course of business, there are several different types of records series. There are case records, for example, which are characterized as having a beginning and an end but are added to over time. Case records generally have titles that include names, dates, numbers, or places. These titles do not provide insight into the nature of the function of the record series. Examples of case records include personnel files, mortgage loan folders, contract and amendment/addendum records, accident reports, insurance claims, and other records that accumulate and expand over time. Although the contents of case files may be similar, you should break out each type of case record under a unique title.

Subject records (also referred to as topic or function records) “contain information relating to specific or general topics and that are arranged according to their informational content or by the function/activity/transaction they pertain to.”³⁹ These types of records accumulate information on a particular topic or function to be added to the organization's memory and make it easier for knowledge workers to find information based on subject matter, topics, or business functions. Records such as those on the progression of relevant laws and statutes, policies, standard operating procedures, and education and training have long-term reference value and should be kept until they are no longer relevant or are displaced by more current and relevant records. In a record retention schedule, the trigger event often is defined as superseded or obsolete. Records of this type that relate to “routine operations of a [project], program or service” do not have as much enduring value and should be scheduled to be kept for a shorter period.

Retention of E-Mail Records

Are e-mail messages records? This question has been debated for years. The short answer is no, not all e-mail messages constitute a record. But how do you determine whether certain messages are a business record or not? The general answer is that a record documents a transaction or business-related event that may have legal ramifications or historic value. Most important are business activities that may relate to compliance requirements or those that could possibly come into dispute in litigation. Particular consideration should be given to financial transactions of any type.

Certainly evidence that required that governance oversight or compliance activities have been completed needs to be documented and become a business record. Also, business transactions, where there is an exchange of money or the equivalent in goods or services, are also business records. Today, these transactions are often documented by a quick e-mail. And, of course, any contracts (and any progressively developed or edited versions) that are exchanged through e-mail become business records.

The form or format of a potential record is irrelevant in determining whether it should be classified as a business record. For instance, if a meeting of the board of directors is recorded by a digital video recorder and saved to DVD, it constitutes a record. If photographs are taken of a groundbreaking ceremony for a new manufacturing plant, the photos are records too. If the company's founders tape-recorded a message to future generations of management on reel-to-reel tape, it is a record also, since it has historical value. But most records are going to be in the form of paper, microfilm, or an electronic document.

Here are three guidelines for determining whether an e-mail message should be considered a business record:

1. The e-mail documents a transaction or the progress toward an ultimate transaction where anything of value is exchanged between two or more parties. All parts or characteristics of the transaction, including who (the parties to it), what, when, how much, and the composition of its components are parts of the transaction. Often seemingly minor parts of a transaction are found buried within an e-mail message. One example would be a last-minute discount offered by a supplier based on an order being placed or delivery being made within a specified time frame.
2. The e-mail documents or provides support of a business activity occurring that pertains to internal corporate governance policies or compliance to externally mandated regulations.
3. The e-mail message documents other business activities that may possibly be disputed in the future, whether it ultimately involves litigation or not. (Most business disputes actually are resolved without litigation, provided that proof of your organization's position can be shown.) For instance, your supplier may dispute the discount you take that was offered in an e-mail message and, once you forward the e-mail thread to the supplier, it acquiesces.

Managing e-mail business records is challenging, even for technology professionals. According to an AIIM and ARMA survey, fully two-thirds of records managers doubt that their IT departments really understand the concept of electronic records life cycle management. That is despite the fact that 70% of companies rely on IT professionals alone to manage their electronic records.

Although the significance of e-mail in civil litigation cannot be overstated (it is the leading piece of evidence requested at civil trials today), one-third of IT managers state that they would be incapable of locating and retrieving e-mails that are more than one year old, according to Osterman Research.⁴⁰

How Long Should You Keep Old E-Mails?

There are different schools of thought on e-mail retention periods and retention schedules. The retention and deletion of your electronic business records may be governed by laws or regulations. Unless your organization's e-mail and ESI records are governed by law or regulations, your organization is free to determine the retention periods and deletion schedules that are most appropriate for your organization.⁴¹ If your organization's e-mail retention periods are not specified by law or regulation, consider keeping them for at least as long as you retain paper records. Many software providers provide automated software that allows e-mail messages to be moved to controlled repositories as they are declared to be records.

Destructive Retention of E-Mail

A destructive retention program is an approach to e-mail archiving where e-mail messages are retained for a limited time (say, 90 days), followed by the permanent manual or automatic deletion of the messages from the organization network, so long as there is no litigation hold or the e-mail has not been declared a record.

E-mail retention periods can vary from 90 days to as long as seven years:

• Osterman Research reports that almost one-quarter of companies delete e-mail after three months.
• Heavily regulated industries, including energy, technology, communications, and real estate, favor archiving for one year or more, according to Fulbright and Jaworski research.⁴²

The most common e-mail retention period traditionally has been seven years; however, some organizations are taking a hard-line approach and stating that e-mails will be kept for only 90 days or six months, unless it is declared as a record, classified, and identified with a classification/retention category, and tagged or moved to a repository where the integrity of the record is protected (i.e. the record cannot be altered and an audit trail on the history of the record's usage is maintained).

Legal Requirements and Compliance Research

Legal requirements trump all others. The retention period for a particular records series must meet minimum retention requirements as mandated by law. Business needs and other considerations are secondary. So, legal research is required before determining retention periods. Legally required retention periods must be researched for each jurisdiction (state, country) in which the business operates, so that it complies with all applicable laws.

In order to locate the regulations and citations relating to retention of records, there are two basic approaches. The first approach is to use a records retention citation service, which publishes in electronic form all of the retention-related citations. These services usually are bought on a subscription basis, as citations are updated on an annual or more frequent basis as legislation and regulations change.

Figure 9.5 is an excerpt from a Canadian records retention database product called FILELAW®. In this case, the act, citation, and retention periods are clearly identified.

Another approach is to search the laws and regulations directly using online or print resources. Records retention requirements for corporations operating in the United States may be found in the Code of Federal Regulations (CFR), the annual edition of which

is the codification of the general and permanent rules published in the Federal Register by the departments and agencies of the federal government. It is divided into 50 titles that represent broad areas subject to federal regulation. The 50 subject matter titles contain one or more individual volumes, which are updated once each calendar year, on a staggered basis. The annual update cycle is as follows: titles 1 to 16 are revised as of January 1; titles 17 to 27 are revised as of April 1; titles 28 to 41 are revised as of July 1, and titles 42 to 50 are revised as of October 1. Each title is divided into chapters, which usually bear the name of the issuing agency. Each chapter is further subdivided into parts that cover specific regulatory areas. Large parts may be subdivided into subparts. All parts are organized in sections, and most citations to the CFR refer to material at the section level.⁴⁴

There is an up-to-date version that is not yet a part of the official CFR but is updated daily, the Electronic Code of Federal Regulations (e-CFR). “It is not an official legal edition of the CFR. The e-CFR is an editorial compilation of CFR material and Federal Register amendments produced by the National Archives and Records Administration's Office of the Federal Register (OFR) and the Government Printing Office.”⁴⁵

Event-Based Retention Scheduling for Disposition of E-Records

Event-based disposition is kicked off with the passage of an event, such as hiring or firing an employee, the end of a project, or the initiation of a lawsuit.

Event-based disposition can have an associated retention schedule, and the clock starts running once the event occurs. The required retention period begins only after the triggering event occurs. The length of the retention period may be regulated by law, or it may be determined by IG guidelines set internally by the organization. So, when an employee is terminated, and personnel files are destroyed after (say) five years, the retention schedule entry would be “Termination + 5 years.”

One other definition of event-based disposition comes from the US e-records standard, Department of Defense 5015.2, which states that a disposition instruction in which a record is eligible for the specified disposition (transfer or destroy) upon or immediately after the specified event occurs. No retention period is applied and there is no fixed waiting period, as with “timed” or combination “timed-event” dispositions. Example: “Destroy when no longer needed for current operations.”⁴⁶

Some hardware vendors provide solutions that assist in executing event-based disposition with assistance from firmware (fixed instructions on a microchip). The firmware-assisted solution should be considered if your RM or IG team aims to perform a complete and thorough retention solution analysis. These hardware-based solutions can potentially streamline the event-based disposition process.⁴⁷

Triggering events may be record-related, “such as supersession or obsolescence.” This is common to a policy statement. For example, if a group of policies are to be destroyed five years after superseded or obsolete, the old policy would be held for five years after the new policy has been created.

Sounds simple. But in an attempt to meet retention requirements, organizations handle event-based triggers in different ways, ways that often are problematic. For instance, the trigger events often are not captured electronically and fed directly into the retention scheduling software or records repository to start the clock running, or the event itself is not well documented in the retention schedule so it is not consistently being applied and tracked. In other cases, the organization simply does not have the ERM functionality it needs to manage event-based triggers.

This causes many organizations to simply overretain and keep the records indefinitely, or until disk storage is full, which means that those records are retained for an incorrect—and indefensible—time. The period is either too long or possibly too short, but it always is always inconsistent. And inconsistent means legally indefensible.

The only prudent and defensible approach is to implement the proper IG policies to manage and control the implementation of event-based disposition.

Prerequisites for Event-Based Disposition

Three key prerequisite tasks must be completed before event-based disposition can be implemented:

1. Clarify trigger events. Not all of the events that can trigger the beginning of a retention period are as clear as the date an employee is terminated. For instance, “contract completion date” could be the day a vendor finishes work, when a final invoice is rendered, when the invoice is paid, or some other period, such as 30 days following the payment of the final invoice. These definitions, depending on the record series in question, may be regulated by law or governed by IG policies.

   What is needed is an agreement as to what the definition is, so that the retention period will be uniform among the record series in question, providing a defensible policy.

   To gain this agreement on these blurry areas, the RM lead/manager or team will need to work with the relevant business unit representatives, IT, compliance, risk management, and any other stakeholders.

   The event triggers must be clear and agreed on so that they may kick off a retention period and disposition process.

   In a number of cases, the answer to these questions will rely on trigger points, such as one year after completion or four months after the board of directors’ meeting. It is important to choose a trigger point that you can implement. For example, there is no point in saying that records should be kept until an individual dies, if you have no reliable way of knowing the person is alive. Instead, choose a trigger point based on the information you have about the individual; in this case, the 100th birthday might be a suitable trigger point.

2. Automated capture of agreed-on trigger events must be performed and sent to the ERM. It is easy to know an employee's termination date—most human resources management systems or payroll systems can supply it—but other types of events are not so easily captured and may require some customization in order that this information is fed into an ERM. The metadata about the event must be seamlessly entered into the ERM so that it may launch the beginning of the retention period. If systems external to the ERM need to be interfaced, a common locater (e.g. contract number) can link the two.
3. The ERM systems must have complete retention and disposition capabilities. In order for the retention to start properly and run to final disposition, this tracking capability must be an inherent feature of the software. (In some cases, organizations may use specialized retention and disposition software that can perform this task minimally without complete ERM functionality, but it falls short of the type of richness that a robust ERM system provides. What is needed is the ability to include the details or retention rules beyond simple date calculations (i.e. to store descriptive data or scope notes and records series code in addition to retention requirements, which are automatically associated with the retention rule, and to have a records hold-and-release capability). If destruction is the final disposition, then the system must be able to perform a deletion of the record (so long as there is no preservation or legal hold) with no traces that can allow reconstruction of it, and this process must be verifiable.

   To accomplish clarity and agreement on event-based triggers requires close consultation and collaboration among RM staff, business units, IT, legal, compliance, risk management, and other stakeholders, as relevant.

Final Disposition and Closure Criteria

After completing the records values analysis and legislative and legal research, you must determine the closure criteria and final disposition (e.g., destroy, transfer, archive) for each records series. To minimize costs and litigation risk, retention periods should be kept as short as possible while meeting all applicable regulatory, legal, and business requirements.⁴⁸

Retaining Transitory Records

Transitory documents usually do not rise to the level of becoming a record; they are temporary and are useful only in the short term, such as direct mail or e-mail advertising (brochures, price lists, etc.), draft documents (although not all are transitory, and some may need longer retention periods, such as draft contracts) and work in progress, duplicates, external publications (e.g. magazines, journals, newspapers, etc.), and temporary notices (e.g. company picnic, holiday party, or football pool). You must consider transitory records in your master records retention schedule.

Implementation of the Retention Schedule and Disposal of Records

Automated programs that interpret these retention periods are the best way to ensure that records are disposed of at the correct time and that an audit trail of the disposition is maintained.

Ongoing Maintenance of the Retention Schedule

Records series are not static; they change, are added to, and are amended. New record functions emerge, based on changes in business, acquisitions, and divestitures. So it is necessary for organizations to review and update—at least annually—their records retention schedule.

In addition, retention requirements change as legislation changes, lawsuits are filed, and the organization refines and improves its IG policies. Development of a records retention schedule is not a one-time project; it requires attention, maintenance, and updating on a regular schedule, and using a controlled change process.

Audit to Manage Compliance with the Retention Schedule

Once your organization establishes records retention schedules for business units, or a master retention schedule, there must be IG policies in place to audit and ensure that policies are being followed. This is a key requirement of maintaining a legally defensible retention schedule that will hold up to legal challenges.