RECORDS MANAGEMENT RISK KEY

PERFORMANCE INDICATORS (KPIS)

WHAT IS RECORDS MANAGEMENT?
Technology has greatly expanded the methods of creating, editing, maintaining, transmitting and retrieving
records. From creation to disposition, records in electronic recordkeeping systems may now utilize a variety of
media. An example of an electronic recordkeeping system is one in which a personal computer generates the
original records, which are subsequently stored on a secondary electronic resource. While paper copies of the
electronic records may be printed for distribution, the original records are transferred electronically.

After a specified period, the inactive records are transferred to condensed electronic long-term storage and the
original media upon which the records were stored may be erased and reused. Other electronic records may be
created, manipulated, maintained and disposed of on the computer without ever being produced in hard copy.

Paper forms traditionally have been the primary medium for conducting business transactions, in both private and
public environments. With the explosive growth of internet-based transactions for commercial and retail business,
the electronic form is becoming the primary user interface – the visual record – when transacting electronic
commerce. As such, the graphics and text of the forms, as well as the information that is entered into the forms,
comprise the "record" of transacted business. Records of electronic transactions will have an important role as
evidence in legal disputes and regulatory audits.

With the rapid advancement in business systems, practices and procedures must be established to guide public
and private entities through the potential minefield of electronic records management issues. What the courts
require and auditors expect – therefore what commercial and public entities should be striving for – are systems
and processes that are accurate and reliable and, as such, are viewed as trustworthy in the management of their
electronic transaction records.

Managing records and documents refers to the process of controlling electronic or hardcopy documents
throughout their life cycle – from inception through permanent retention or destruction. The activities in this
process ensure the availability of documents to people who need them, while at the same time, protecting them
from access by people who don't. The activities also ensure a company's compliance with regulations affecting its
documents and reduce the legal exposure documents present when they are held past their useful life. In the
business world, this process is usually referred to as document management. Although some use the terms
"document" and "record" interchangeably, "record" historically has referred to a paper document.

The Difference Between “Electronic Document Management” and “Electronic Record

Management”

Electronic Document Management (EDM) Electronic Record Management (ERM)

Document management software addresses the The primary purpose of record management is to
common organizational problem of the inability to manage the risk and cost created by a given
retrieve and manage electronically generated organization’s information. Forms, invoices, orders
information efficiently. It facilitates the needs of and correspondence letters can be classified as
multiple users who work on a single document. records. For example, once a document is a record, it
is no longer managed by the creator but by the
organization.

Strengths: Strengths:
• Documents, technical manuals, • Identify collections of electronic records so they
engineering/architectural drawings, aperture cards, can be managed effectively.
x-rays, blueprints, or microfiche are organized onto
• Locate collections of electronic records within a
a compact disk (CD), digital versatile disk (DVD) or
managed environment, so they can be physically
other storage devices.
accessed and organized and intellectually
• Documents are tracked and controlled. controlled.
• Document locations are properly tracked in order to • Relate electronic records to departmental functions
destroy documents appropriately.

1
1 Source: [Link]
 Electronic Document Management (EDM) Electronic Record Management (ERM)

and business systems architecture.

• Information is retrieved faster and more effectively
with paper systems. • Audit existing electronic records for compliance
with the corporate electronic records policy.
• Accountability is greater.
• Assist with the planning of an appraisal strategy.

There are several factors within organizations that contribute to a sound electronic records management program.
As electronic information is created, organizational entities are responsible for the problems and solutions that
coincide with the creation. These include central IT functions responsible for “mainframe” operations, office
systems organizations responsible for distributed computing, electronic document management systems (EDMS)
and enterprise network services.

There are functional managers responsible for specific systems and development applications. Additionally, there
are department-level users where shared networks are in place, so information can be controlled at that level.
Finally, there are individual end users that have information specifically residing in their personal computers.
Archivists and records managers are also key players, as they have responsibilities regarding the appraisal and
preservation of organizational records, accessibility of organizational records and ultimately the disposition of
those records.

The points of view on information, processing and its life cycle differ between information technologists, archivists
and record managers. The professional careers of most IT managers developed before the advent of personal
computers. Thus, they tend to hold to the traditional model of information processing classified as input,
processing and output.

Archivists and records managers view the life cycle of a document chronologically: creation, use, appraisal,
preservation and disposal. While IT specialists concentrate on the creation and use of electronic documents or
information, archivists and records managers concentrate on preservation and disposal.

Life Cycle Management

The life cycle model can also be used to evaluate business processes and the formal and informal arrangements
for maintaining records. Finally, the life cycle model illustrated below can play an important role in opening the
dialogue between IT, record specialists and managers, as well as defining role issues.
• Creation and Identification: To create a new document, record or file and provide unique identifying
information.
• Appraisal: To determine the ultimate disposition of documentary material and schedule it for future destruction
or archival retention, typically in terms of years after creation based on an assessment of the value of the
document to the organization.
• Control and Use: To store and retrieve information for use by its creator and others with authorized access
rights or to convey information to others as part of administrative or secondary use.
• Disposition: To destroy information according to the schedule determined at the appraisal stage or to transfer
it to an archival repository. This may also include reappraisal and the imposition of restrictions on access in
order to protect personal privacy or confidentiality.

Records Management Systems (RMS) Capabilities

Record management incorporates capabilities to preserve the security, authenticity, integrity and permanent
preservation of documents. The archival function within record management is concerned with “identifying,
safeguarding and preserving archival records and ensuring that these are accessible and understandable.” A
sophisticated electronic RMS will, therefore, include not only functions necessary for document management but
also features supporting these longer-term perspectives. These include the association of contextual and
structural data within a document, construction and management of audit trails, document version control, support

2
2 Source: [Link]
for disposition scheduling, and maintenance of the relationships between records in files, file series and the
corporate filing plan. Overall, an RMS should provide the following system capabilities:
• Capture records that have been created as documents directly from a user application or by a deliberate
action, which enters a previously created document in the RMS.
• Capture records profile metadata directly from the desktop and other relevant user applications as far as
possible and ensure that captured metadata is indissolubly linked to the record itself.
• Capture and store profile information about nonelectronic records, such as paper files, including location and
access information.
• Hold (potential) records in a queue for review before “registering” them in the records management system.
• Accommodate the drafting process without creating a record by allowing versions of a document to be created
without automatically creating a new record on each occasion.
• Capture a record as a result of document transfer from a different application or document storage system or
through a scanning process.
• Capture all parts of a record, which may be in different formats, and maintain the link between the parts without
compromising record integrity.
• Offer an import/export function, which allows for the bulk loading of all types of records as a batch process,
capturing as much metadata as can be supplied from the source and flagging those records, which require
manual intervention before final integration into the system.
• Capture and store electronic records regardless of format. These types of electronic records include text
documents, spreadsheets, graphical images, presentation software products and email messages, together
with all attachments.

In addition, each system should have the ability to perform the following functions:
• Ensure that a record, once “registered” in the system, cannot be changed or altered in any way except by the
creation of a new version, including the application of sensitivity editing.
• Ensure that all relevant original characteristics, attributes and metadata are retained in the creation of a new
version and ensure that all versions are linked together for retrieval and display purposes.
• Identify a document owner and apply allowed restrictions, which an owner can impose upon record
manipulation.
• Offer check-in and checkout features for records and groups of records so that access and version control can
be audited.
• Identify primary record copies and distinguish them from any other copies.
• Maintain an audit trail of actions carried out on a record. The details can be set by an organizational policy.
• Provide any other facilities necessary for maintaining the integrity of the record.
• Provide facilities for maintaining the record in its original format, or an equivalent format, which maintains all
aspects of the record that are inherent in the original format.
• Provide functions necessary for maintaining the authenticity of the record.
• Display all elements of the record together as a consistent unit on retrieval.
• Manage records and groups of records according to the requirements of security markings and provide
facilities for monitoring access.
• Control visibility of and access to records and groups of records in relation to user group categories and
classifications.
• Define active, semiactive and inactive periods.
• Enable the integration of various search facilities without compromising the integrity of the records.

Which Records Should Be Included?

3
3 Source: [Link]
All electronic records that the department holds should be included in the inventory of record collections. The
following records are among the most critical to be accounted for by an organization:
• Record collections, even if they have not been previously of interest to the record officer in paper or electronic
form
• Electronic records that are normally printed on paper and held in a paper recordkeeping system
• Records that are held in a separate electronic recordkeeping system
• Source records that have been copied to a separate electronic recordkeeping system

The term “record collection” is used to indicate a grouping of records with similar characteristics that can be
managed together as a whole. The management of a record collection includes making decisions for the group on
filing or indexing, scheduling and selection, and on requirements for migration and preservation. Record
collections can take various physical forms. A fundamental goal of establishing electronic records management is
to ensure that they are held within a managed electronic environment and are subject to appropriate controls, and
where this is not the case, that every effort is made to bring them within one. A managed electronic records
environment exists when records can be organized and indexed (by whatever mechanism) for management and
retrieval in logical groups that reflect the context of creation and use.

BUSINESS RISKS RELATED TO RECORDS MANAGEMENT

Because of the technological characteristics of electronic records and the complexity of their use, thoughtful
application of sound records management principles needs to be given to their creation, maintenance and final
disposition.

Risks Related to Technology

• No distinction is made between record and nonrecord information.
• Lack of effectiveness occurs when creating and maintaining true record systems.
• Once an electronic record has been created, its survival as a proper record becomes subject to a series of
“threats” associated with the nature of the new technology itself.
• Lack of necessary authenticity occurs.
• Lack of information within a government agency about its electronic systems and their relationship to the
agency's other records occurs, usually compounded by a complete lack of proper documentation.
• Electronic records are unstable and require active management during their lifetime to ensure their survival.
• Problems of hardware and software incompatibility may make records inaccessible.
• Constant and increasingly frequent technological advances in software and hardware design give rise to
incompatibility.

Risks Related to Uncontrolled Environments

• Uncontrolled accumulation of records, documents and data
• Inadvertent destruction of records, documents and data
• Unauthorized tampering with records and documents
• Lack or absence of systems documentation and associated metadata
• System paralysis, or at the very least, hindrance in accessing information
• Additional costs associated with the purchase of additional storage
• Increased risk of wholesale, unsystematic and possibly illegal destruction
• Public embarrassment due to loss of valuable business and archival records
• Increased risk of security breaches

4
4 Source: [Link]
• Unauthorized alteration or deletion of records (loss of evidence)
• Unnecessary delays in or breakdowns in the business process
• Lack of public accountability

Risks Related to Record Management and the Courts

• Spoliation or intentional alteration or destruction of a document may occur.
• The upgraded system cannot read legacy information, which may be needed in the future for legal purposes.
• Records may not be accurate if expected to be used as evidence in the courts.
• Data may have been tampered with.
• Audit procedures and email policies may not be in place.
• Email may not be kept in an electronic form.

MANAGEMENT BEST PRACTICES AND PERFORMANCE MEASURES

The success of an enterprise will be driven by how efficiently it coordinates the differences in speed from the front
end to the back end, on a 24/7 basis, while giving as much visibility and variability to the customer as possible.
The principal issues for the management of electronic records are the same as those for the management of any
record. They include, for example, the creation of authentic records, tracking of records and disposal
arrangements. However, how these issues are addressed in the electronic environment vary.

Companies that seek to maximize the benefits and minimize the risks presented by their documents take a
proactive approach to document management. To have an effective electronic records management program, the
agency records management analyst and/or manager – in cooperation with administrative, professional, technical
and clerical staff – should take the following steps:

Create a Record Classification Scheme

A record classification scheme helps a company organize its records within a logical framework so they can be
more easily and efficiently managed. Records managed according to a classification scheme are more accessible
and less likely to be lost, making it easier for employees to find and share information.

Creating a record classification scheme begins with defining the records to be managed. Engineering drawings,
email and voicemail messages, and webpages are a few examples of formats that may be defined as records.
Once the records have been defined, they are categorized. Each category contains records that share common
features. For example, one category may consist of a company's payroll records. Decisions can then be made
about a category, eliminating the need to consider each record individually. Finally, all records are cataloged
using a classification index. To be effective, the index must be uniformly applied to all of a company's records and
flexible enough to accommodate the varying requirements of the organization's departments and workgroups.

5
5 Source: [Link]
Organize Records in an Efficient, Enterprisewide System
A company's records are a valuable asset. They enable a company to demonstrate regulatory compliance during
government investigations or audits. They contain information and knowledge which, when applied, result in a
stronger, more competitive organization. Organizing records in an efficient, enterprisewide system makes them
easier to manage for optimum value.

A record management system should be structured to meet the information needs of the people. With that goal in
mind, a company with a mature records management process solicits input from a variety of personnel before
designing its system. The result is a system that makes documents available quickly to people who need them
and protects them from access by people who don't. To ensure that employees feel comfortable using the system,
high-performing companies always make training a priority.

Many companies use electronic record management software to organize their records in an efficient,
enterprisewide system. However, companies that choose not to use record management software enterprisewide
can benefit by selectively using the software to automate repetitive paper-intensive processes. Automated
processes are faster and less prone to human error. They also simplify the measurement of activity levels,
detection of bottlenecks and other information useful to a business process manager.

Establish Record Management Policies and Procedures

Record management policies and procedures should have executive management support. An objective set of
instructions are provided by the procedures, clearly defining what is expected of involved parties to eliminate
confusion and ensure integrity and efficient operations.

Companies that have a mature records management process formalize their record management policies and
procedures in a comprehensive written document. Ideally, policies and procedures are contained in a record
management manual that also clarifies the system(s), methods and technologies to be used for cost-effective and
practical day-to-day record management within the company. To be effective, procedures are updated regularly to
accommodate changes in technology, organizational structure or regulatory environment. The manual should be
distributed to employees at all levels of the organization.

Comply With All Regulations Affecting the Company's Records

High-performing companies comply with all regulations affecting their records. Penalties for noncompliance can
range in severity from fines to the conviction for a criminal offense to the forfeiture of valuable rights and
privileges. For example, some courts have denied debtors discharge in bankruptcy because the debtor's records
were inadequate, while others ruled that failure to keep required records justified forfeiture of rights under a
commercial contract.

An annual review of the state, national and international regulations affecting a company's records reveals
whether its record management program complies with the law. To ensure that they keep abreast of changes in
the regulatory environment, companies with a mature records management process assign responsibility for
regulatory compliance to one individual.

Most regulations affecting a company's records are intended to fulfill a greater purpose, such as prohibiting
employment discrimination. In the U.S., the bulk of laws govern some aspect of record creation, retention or
storage and are enforced by federal regulatory agencies. Employee, accounting and tax records are the most
heavily regulated. Additionally, industry-specific regulations affect many companies, with those in highly regulated
industries bearing the greatest burden. An annual review of the code of federal regulations helps companies keep
abreast of changes in federal regulations affecting their records.

Regulations designed to ensure the authenticity of electronic records have appeared recently in the U.S. and
abroad, spurred by the growing use of electronic technologies. Without proper controls, electronic records are
easily altered. Regulations that apply specifically to electronic records impose controls on the systems and
practices used to create and maintain the records. Companies that adhere to these regulations increase the
probability that their electronic records will be accepted as authentic and legally admissible during litigation or
government investigation.

6
6 Source: [Link]
Adhere to a Record Retention and Destruction Schedule
A company's records can be used as evidence against it during litigation or government investigation. High-
performing companies minimize that risk by following a comprehensive record retention and destruction schedule.
The schedule is determined by weighing a document's business value against the legal risk that it represents to
define the record’s retention period. State, national and international record retention laws applicable to specific
categories of records form the foundation of the schedule, but a well-designed schedule goes beyond that which
is required by law to include all company records.

Record categories with very brief retention periods may require only one storage medium over their life cycle. The
majority of records migrate from active storage to archival storage to permanent storage or destruction during
their retention periods. Selecting the appropriate mix of storage media for the document life cycle optimizes a
company's storage resources.

Unless a record has been designated for permanent retention, it is destroyed at the end of its retention period.
The systematic destruction of records, done in accordance with approved destruction procedures, reduces a
company's legal exposure, controls the growth of electronic records and increases the efficiency of computing
resources. However, there are several conditions under which record destruction should be suspended. Once a
company is notified that it is a party to the litigation, a government investigation or an audit, it has a legal duty to
preserve evidence germane to that litigation or investigation. Suspending record destruction under these
circumstances lessens the likelihood that civil or criminal penalties will be imposed for improper destruction of
records.

QUESTIONS TO CONSIDER
• How are documents/records collected?
• How are documents/records indexed?
• How are documents/records accessed?
• How are documents/records stored?
• How are documents/records maintained?
• How are documents/records disposed of?
• Are the documents/records legible?
• Are the documents/records protected from damage?
• Are controlled documents identified as such?
• Are all obsolete/controlled documents removed from use?
• Are all needed documents/records generated?
• Are the documents/records complete?
• Are the documents/records adequate?
• Do the documents/records exist?
• Do the documents/records show a process being followed?
• Do all documents in use have the same revision as the master list shows?
• What documents/records are generated by what document?
• Where is the master index of all controlled documents kept?
• Has the organization established and maintained documented procedures to control documents?
• Is this master list up to date?
• Is the process determining if a document should be controlled accurate?

7
7 Source: [Link]