Planning for Records Management
Definitions abound, and in that spirit we submit yet another: records management is the systematic control of all organizational records during the various stages of their life cycle—from their creation or receipt, through their processing, distribution, maintenance, and use, to their ultimate disposition. The purpose of records management is to promote economic and efficient record-keeping. This assures that useless records are systematically destroyed, while valuable information is protected and maintained in a manner that facilitates its access and use as well as ensuring legal and regulatory compliance.
The basic element of a records management system is the record. A record is a document or other item in an organization that requires retention for a period of time. Records management is the process by which organizations:
Identify the types of information that should be considered records
Determine how live documents will be managed while in use, and how they should be collected once declared to be records
Define disposition rules which determine in what manner and for how long each record type should be retained to meet legal, business, or regulatory requirements
Perform tasks such as records disposition, or locating and holding records related to external events such as lawsuits
Implement technological solutions and business processes to help ensure that the organization complies with its records management obligations in a cost-effective and productive way
Some of the properties common to a records management system are
Documenting the organization’s information environment by describing and categorizing content that may become records, documenting source locations, and describing the content workflow into the records management application
File plans describe where each type of record in the enterprise should be retained, as well as its policies, retention, disposition, and responsible managing party
Compliance requirements document that defines the methods used to guarantee participation of the organization’s employees as well as the rules that the organization’s IT systems must follow to ensure compliance
Methods for collecting records that are no longer active from collaboration document libraries, file servers, and e-mail systems
Methods for capturing the metadata and audit histories of records
Methods for auditing active records
Processes for holding records for events like litigation and audits
System reporting and monitoring of records to ensure that they are being filed properly
Planning overview
Planning for the records management process is extremely important and typically involves team members from across the organization. The steps are
1. | Identify roles. The roles may include the following:
|
2. | Develop a file plan. It is important to review and document file usage to determine which documents and other items may become records. After you have analyzed your organizational content and determined retention schedules, fill in the rest of the file plan. File plans differ from organization to organization, but in general they describe the kinds of items the enterprise acknowledges to be records, indicate where they are stored, describe their retention periods, and provide other information such as who is responsible for managing them and what broader category of records they belong to. |
3. | Develop retention periods. For each record type, determine when it will no longer be active, how long it should be retained past the active date, and how it should be disposed of. |
4. | Determine the scope of your retention policy. Policies can be applied at a site collection level or at an individual document library. If your policy will be widely used, implement it at the site collection and then apply it to your retention document libraries. |
5. | Design the records management repository. MOSS 2007 includes a Records Repository site template, which is designed for records management. Using your file plan, design the site’s content types, libraries, policies, and its record series. |
6. | Develop workflows and methods to move content into the Records Repository. In MOSS 2007 you can create custom workflows to move content into your Records Repositories. There are also APIs that allow you to integrate MOSS 2007 Records Management functionality with other applications. |
7. | Plan e-mail integration. For organizations that are already planning to move to Exchange Server 2007 along with Office Outlook 2007, there are features designed to facilitate the flow of e-mail into the Records Repository, using specialized folders and commands. If you are using Exchange Server 2007 as your e-mail server, you can plan how to classify e-mail and move it to the Records Repository quite easily. Many third-party vendors are developing integration with SharePoint that will provide hooks for other e-mail systems. Additionally, it is possible to customize your own integration with SharePoint. |
8. | Plan for compliance reporting and documentation. If an organization becomes involved in a records-related legal dispute or is forced by a government agency to prove compliance, it is important to have the system and processes well documented. |
Creating file plans and policies
A file plan lists the records in the organization and describes how they are organized and maintained; this is critical to a successful records management program. The file plan:
Documents your activities
Identifies records
Helps to retrieve records quickly
Provides retention and disposition instructions when records are no longer needed
Documents responsibilities for managing the various types of records
Defining a record
The determination of which active documents may be declared as records often requires the collaboration of lawyers, records managers, content managers, and compliance officers. Records management is not only the domain of highly regulated industries. There are now broad accounting and tax laws, such as the Sarbanes-Oxley Act, which records managers need to be aware of.
Some suggestions to assist you with the identification of records are
1. | Identify the legal obligations and business needs of the enterprise. |
2. | Analyze active document usage across the organization. |
3. | Create a list of active document types that should become records. For example:
|
Next, categorize the records. Often, records in the same category will have the same retention periods.
| Record Type | Record Category | Description |
|---|---|---|
| 401K, insurance, and stock option plans | Employee Benefit Description | Employee benefits |
| Subcontractor and employment agreements, statements of work | Legal Agreements | Legal agreements between the organization and individuals, companies, and government agencies |
| Press releases, articles | Press Releases | Statements released to the press |
Documenting the file plan
After determining which documents to classify as records and creating a set of record categories, complete the file plan by defining retention periods for each record category, indicating how to dispose of records when their retention periods have expired, and supplying other information such as the primary records manager for each record type and media in which the record is stored.
Note
The example in Table 12.2 is provided only as a sample and is not intended to provide legal guidance. Please work with your extended team to document the proper file plan information and disposition durations.
| Records | Description | Media | Record Category | Retention | Disposition | Contact |
|---|---|---|---|---|---|---|
| Insurance plan | Blue Cross/Blue Shield health care plan | Scanned PDF image | Employee Benefit Plans | (x) years | Archive | Roger Recordski |
| Subcontractor agreements | Company agreements with subcontractors | Legal Agreements | (x) years | Destroy | Linda Legaleagle | |
| Press releases | Public press announcements | Electronic documents | Press Releases | (x) years | Destroy | Paula Presston |
| Stock option plan | Employee stock option plan | Employee Benefit Plans | (x) years | None | Stanley Stockton |
Defining your policies
Policies determine the rules that apply to your records. They determine how long your content is retained and the labeling, auditing, expiration, and barcoding actions for your content. You can create policies at both the site collection level and the individual document library level. You will need to create a policy for each combination of retention and disposition in your file plan. You may also need to create additional policies if the options for the policy differ between file plans.
For each policy, you will need to define the following items:
Name and Description: Define a distinct policy name and administrative description so that users can understand the size and scope of the policy.
Policy Statement: The policy statement is presented to users when they open items that are managed by the policy. This allows you to inform users of the necessary record management circumstances for managed items.
Retention Period: This is the period that the item will be managed by the records management site. You can calculate this period based on any date field that you define for the record, or the default date fields of create date or modified date. You should have already defined this period in your file management plan.
Disposition: This defines the action that the records management site will perform when the retention period has elapsed. The options are to delete the record, delete the record and all the associated submission data, or submit the record to a workflow that you have defined. For example, you can create an archive workflow that moves the record to an archive location when the retention period elapses.
Cross-Ref
See Chapter 8 for information about implementing workflows.
Labels: If you enable labels for your policy, they are included when the document is printed. This feature allows you to ensure that important information is attached to your managed items. The label can be formatted as appropriate and include document properties that are calculated at the time of the printing, such as {Date}.
Auditing: Auditing allows you to track when managed items are viewed, opened, edited, checked in/out, moved, or deleted.
Barcodes: The records management process can assign barcodes so that you can track your physical records.
Scope: Is this policy a local document library policy or should it be defined at the site collection level?
Determining how records are moved to the repository
There are three methods available for moving files to the records repository site. Based on your file plan, you will choose the appropriate method for moving your records. The methods for moving records are
User Action: After you have a records repository site, the site collection administrator can configure the connection to the records repository. This enables a pull-down option on the edit menu for every item in the site collection so that users can choose to send it to the records repository. This action sends a copy to the records repository and leaves an active record in the original location that can continue to be used or deleted as appropriate for the purpose.
Managed E-mail Folders: If you are using Exchange Server 2007, the e-mail administrator can configure a management policy for folders so that when messages are moved into those folders, a copy of the message is sent to the records repository site.
Custom method: You can write a custom method that will move records to the records repository using the SharePoint object model. This method could be kicked off by a custom SharePoint workflow that walks a document through its entire lifecycle. For example, if you have a contract, the workflow may flow through drafting the contract, finalizing the contract, obtaining control approval, and when complete, send the contract to the records repository.