The number of ways to store data has increased dramatically over the past few decades. While this increase in options provides the user with greater flexibility, it also brings challenges and complexity. Forty or 50 years ago, storage options were limited to paper or microfilm. Storage and retrieval in those tangible forms are straightforward and volume is relatively small. With the advent of computers, data was suddenly stored in non-tangible forms on mainframes and mini-computers. In these cases, however, 20 to 30 years ago, user access was tightly controlled and storage was expensive, resulting in low volumes of highly structured data. More recently, though, and continuing today at an ever-quickening pace, users can - and do - use paper, microfilm, mainframes, servers, PCs, flash drives, email, content management systems, transactional systems, instant messaging technology, social networking media outlets, wikis, blogs, Web 2.0, and the cloud (public or private) to store information. The variety of storage options, the ease with which end users can store their data in multiple locations, and the instant transmissions available via the Internet and mobile devices result in a complex tangle of information that requires new tools and methods to control.
Lawyers, records managers, CIOs and others involved in the day-to-day management of information in the modern world understand very well that the frenetic pace at which information technology evolves presents new challenges every day. Fortunately, well-established and effective records and information management principles are being adapted to help meet these challenges. Additionally, these contemporary adaptations of traditional records management practices are flexible enough to accommodate new technological developments.
Historic Approaches To Records Management
Historically, records and information management professionals relied on two basic methods for identifying and managing an organization's records and information. Those two methods were:
1. records inventory1based on output of business processes, and
2. refresh the records retention schedule 2on a periodic basis (i.e., every few years).
In a world in which business was conducted at a slower pace and paper was the primary medium for documenting business transactions, these traditional approaches were effective. In that world, records managers reviewed the paper outputs of business processes to identify the types of information managed by the organization. Records managers could afford to perform a comprehensive inventory of all the organization's records because paper was tangible and the volume of information was considerably lower than it is today.
Likewise, in the past, when dealing with a smaller volume of records, records managers could afford to refresh the retention schedule on a regular but relatively infrequent basis. The smaller volume of records, coupled with the slower pace of business and a less frenetic pace of mergers and acquisitions, ensured that an organization's information types and associated retention periods did not change as often as they do today.
In the modern world, business processes are completed and documented at a rapid pace (with or without human intervention). A traditional records inventory, based on a review of the information products generated by those business processes, is impractical and does not yield viable results. Likewise, in the modern world, with constant technological change; frequent mergers, acquisitions and divestitures; ever-present litigation concerns; and rapidly evolving regulatory guidance, a time-based refresh of retention periods does not synchronize the records-management program with the needs of the business.
Modern Approaches To Records Management
In order to keep pace with information technology changes, the records and information management profession continues to evolve (albeit at a slower pace than technology). The evolution of the profession includes the modernization of many of the traditional approaches to records management, including:
1. a shift from product-centric to process-centric information management,3
2. an evolution of the records inventory to address the proliferation of electronic information, and
3. a shift from time-based retention schedule refresh to event-driven retention schedule refresh.
Process-centric information management shifts the focus of information management within an organization from managing information at the end of the process to managing information throughout business processes. This modern approach incorporates elements of business process management, as the initial step of this methodology is to review business processes with the actual resources performing those processes. The review identifies the information used or generated by the process and identifies how that information could be managed to enhance/facilitate business processes. Likewise, the retention period for information types within the organization can be more closely tied to the operational needs of the organization when individuals in the organization provide direct feedback on their job functions. This modern approach also addresses the issue of implementing records management within your organization, as it embeds information management into business processes, avoiding the addition of extra tasks (i.e., filing electronic documents into a content management system) to an individual's workload.
Two modern approaches have evolved from the traditional records inventory. Those approaches are enterprise information mapping (EIM) 4and backfile characterization . Enterprise information mapping takes the basic concept of identifying information types and applies it to an organization's electronic information systems. EIM uses a risk-based approach to assess the management controls in place for enterprise information systems and applications containing structured electronic data. The initial step of the methodology is a high-level assessment of the organization's information systems, asking questions such as "What types of information are stored in the system?", "How often is the data in the system accessed?", or "Has the system been involved in litigation?" Once a high-level understanding of all of the organization's information systems is attained, a detailed survey of high-risk systems (based upon organization-specific risk factors) is performed to more fully understand those high-value systems. Finally, the output of the EIM methodology consists of high-level profiles of all of the organization's systems, detailed profiles of high-value systems, and a graphical depiction of the organization's systems, including interfaces among systems.
The backfile characterization 5methodology is also an evolution of the records inventory concept. Specifically, the backfile characterization identifies and characterizes information repositories containing legacy information across the enterprise and provides recommendations for reducing the current volume and inhibiting future growth . The backfile characterization addresses the modern issue of the build-up of information repositories that contain unmanaged legacy data. The initial step of the backfile characterization is an assessment of all information repositories (regardless of media) within an organization that contain legacy data. The identification of repositories of legacy data feeds into an analysis of the repositories. The analysis consists of a risk-based system for making decisions on how to deal with the repository (e.g., apply an age-based cutoff for destroying information, apply the longest retention period of all information types found in the repository to the entire repository). The output of the backfile characterization is a set of disposition recommendations for all information repositories that incorporate the organization's specific risk factors.
Finally, the event-based retention schedule refresh methodology is the modern version of the traditional retention schedule refresh. Event-based retention schedule refresh addresses aligning retention policies with changes in business processes, resulting from divestitures, acquisitions, changes in regulatory environment, and the ongoing shift from paper to electronic information. In other words, an acquisition often results in new information types in the organization, as new business processes are integrated into the organization. Likewise, the introduction of a new technology (i.e., social networking) within the organization results in new avenues for the exchange of information. Event-based retention schedule refresh uses these business occurrences as triggers to refresh the appropriate sections of the organization's records management program. The refresh consists of identifying new, modified, or obsolete information types within the records management program, using the process-centric approach discussed earlier, with the goal of streamlining the retention schedules to meet the needs of the business. The refresh also consists of identifying any new regulations or changes in existing regulations that may affect the amount of time information must be maintained by the organization. The event-based retention refresh methodology reduces the amount of effort expended to synchronize the records management program with the needs of the evolving organization.
Remaining Vigilant
The modern approaches discussed above represent adaptations of traditional records and information management concepts and methodologies. The power of these adaptations lies in their ability to evolve along with the pace of business and technological change. Enterprise information mapping and backfile characterization are methodologies that can be adapted to identify and manage information stored in the cloud, or in Web 2.0 applications, or in whatever the next cutting-edge technology lies just beyond the horizon. These methodologies do require vigilance to be effective, however. It's a given that information will grow within your organization and new information technologies will be introduced. Keeping pace with those changes requires a commitment to utilizing methodologies such as event-based retention refresh or process-centric records management on a rolling basis to ensure that information is properly managed within your organization. 1 A records inventory is a process by which an organization's information is identified and classified to facilitate the management of the information (i.e., through the use of a records retention schedule).
2 The records retention schedule is defined as a plan for the management of records, listing records by type and indicating how long they should be kept; the purpose is to provide continuing authority to dispose of or transfer records to historical archives.
3 For more information, read "The New Business Of Managing Information - A Process-Centric Approach," The Metropolitan Corporate Counsel, September 2009.
4 For more information, read "'GPS' For Your Organization: The Art And Science Of The Enterprise Information Map," The Metropolitan Corporate Counsel, January 2009.
5 For more information, read "Case Study: Meeting Compliance Requirements through a Comprehensive Records Management Program Parts 1-4," Expert and Legal Management Insights, Q1-Q4 2009 (available upon request from Duff & Phelps, LLC (http://www.duffandphelps.com).
Published June 2, 2010.
