The Foundation for Sound Records Management
ERM Community Wiki
Records retention schedules are the basis for records management (RM). Along with the records inventory, records retention forms the foundation on which the rest of the records management edifice can be constructed. In the March/April issue, we discussed why RM strategy is successful only if it is supported by a well-executed technology implementation. In this article, we cover records retention including the planning, research, implementation, and maintenance of retention schedules.
The need for a records retention schedule goes beyond ensuring that records are retained and disposed of in compliance with applicable laws and regulations and that the processes meet business and operational requirements. A records retention schedule also acts as an organization’s safe harbor during litigation. Organizations that have implemented a documented retention schedule can demonstrate a good faith effort when disposing of records. This refers not only to paper records but also electronic and other media records such as evidence collected by defense or law enforcement agencies. Anything and everything that is defined by the organization to be a record, irrespective of type, format, or media, should have a corresponding mapping to the retention schedule.
While records retention sounds reasonably straightforward, it will take most organizations a considerable amount of time to do it right. Among the major tasks: devising the right structure, determining the right number of “buckets,” legal and business retention research, associating the records series and ironing out a multitude of details related to retention schedules.
All these issues are part of the retention schedule puzzle and will affect the success of the RM project. A records retention schedule that is either too high-level or too detailed will present problems during implementation and when the RM platform is in place. How to find the right balance? We offer advice on some of the key questions organizations will face as they put in place an enterprise record retention schedule.
Step 1: Which Theory? A Word on Buckets
There are several theories around records retention, including the big bucket theory and the little bucket theory. The big bucket theory refers to organizing records into larger groups and applying retention requirements at the larger group level. The little bucket theory refers to applying retention to very specific groups of records (also called detailed schedule retention). Typically, organizations that are highly regulated implement a fairly detailed retention schedule. We believe in the “right” bucket theory—organizations need to evaluate their specific legal, regulatory, and compliance environments and THEN determine the appropriate record series and record-type groups.
In addition to the size of the buckets, organizations should also consider the type of buckets (departmental, functional, etc.). These days most organizations choose to implement a functional retention schedule that provides better management than just a straightforward organizational or departmental schedule.
When determining which theory to follow, it is imperative to work with inside counsel, regulators, audit, and compliance functions (and outside counsel where available) to ensure that the categorization of records is at a level that is consistent with the organization’s current and future needs.
Step 2: Researching Retention Schedules
How should I conduct my retention research? The cliché answer is, “It depends.” However, this is not to be taken lightly nor can one assume that the legal department has this responsibility (though they can provide significant input). Records managers must get all involved groups to sign off on the retention schedule (business, compliance, regulatory, stakeholders, and/or internal and external counsel). This ensures that each involved party understands the schedule and it resolves any issues regarding retention periods or the classification scheme.
Some organizations may have a previous schedule to manage paper or file rooms. This presents another challenge for the RM team. The new schedule needs to incorporate and baseline (assuming the applicable laws are still relevant) the existing schedule and augment it with the rest of records in the organization. This becomes a non-trivial task as some records still must conform to the old paper-focused schedule. On top of that, bringing in new categories for electronic and other media records will be challenging. Record managers should thus take a holistic view of the records within the company, focus on a comprehensive file plan, and then determine how to incorporate any previous retention schedules into the master. The key to properly integrating disparate schedules is to focus on the new but reference the old.
Conducting retention research can be a fairly complex process, especially for companies that have several sub-organizations. Many organizations hire a consulting company or law firm to help them create a retention program. However, an organization can’t just pass this responsibility on to a consultant. Representatives of the organization MUST remain closely involved with the process and understand all the intricacies of developing and researching the retention schedules. It is hardly any progress to have a great retention schedule, but have no one in the organization who fully understands it.
There are various retention management tools in the marketplace and organizations need to carefully evaluate which vendors and technologies make most sense to them. The tool landscape runs the gamut—from those that focus on managing inventories and retention schedules to those that focus on holds to those that just support legal retention research to those that focus on business-rules-driven categorization. Companies should evaluate the skill sets, time, and resources available in-house before going out and buying a product. Also a cost-benefit assessment of the tools needs to be performed in conjunction with the specific needs of the records management program.
Step 3: Addressing Legal Requirements
This is an area where the 80/20 rule comes into play. Typically, 80 percent of an organization’s records have business retention requirements; 20 percent will have legal retention requirements. With the exception of certain highly regulated industries, most organizations will find that many of their business records may not have specific legal retention requirements, requiring them to determine what makes business sense from a records retention standpoint.
The key to good legal retention research is a collaborative partnership among the in-house counsel, records management, and business compliance teams. This requires the right representatives participating in the effort. For organizations conducting legal retention research in-house, it is essential to have a good idea of the applicable laws and jurisdiction under which the organization operates. While legal counsel will do much of the leg work, do not expect legal counsel to have a final finished product in a week’s time. Frequently, legal counsel may not be prepared to quickly provide the detailed research and analysis this effort requires. In such cases, it falls to the records managers and appropriate members of the implementation team to coordinate with legal, come up with a game plan, and provide management attention and skilled resources to determine the proper retention periods. It is important to appreciate that legal may not have a detailed understanding of all of business and operational type records—thus involvement from the business during the legal retention research is required.
Step 4: Addressing Business Retention Issues
Determining business retention requirements can be relatively straightforward if the business units have sufficient background into various aspects of records retention around operational, financial, and compliance. In some organizations business departments have their own internal legal counsel who may be able to help with the retention periods—regardless, get the right set of business unit personnel and stakeholders to participate in business retention decisions. The participants need to not only have the depth and breadth of the particular business they represent, but also a good appreciation of the relevant regulatory, legal, and operational requirements.
Generally, business managers are relatively unaware of the records retention periods and tend to frequently use either the IND (indefinite) or AIL+2 as their business retention period. Here AIL refers to “After I Leave the company.” Puns aside, records managers need to be prepared to play the role of an investigator and ask pointed questions on when, why, and how they referenced records from the past. A series of questions the RM team might ask: When was the last time you used the deal file report? How often have you had to go back and pull up this record? What caused this request to retrieve the record? How did you retrieve the record? Were there any supporting records that had to be retrieved as well? What happened after the record was retrieved? What types of records did you have to search/discover/retrieve in the past? Were any records found to be missing or not easily locatable? What was the legal, business, or monetary impact of the missing records? To assist businesses with the retention effort, the RM team may consider using industry-standard retention schedules that can be procured from retention vendors and/or law firms as a baseline. It may be helpful also to peruse the Web for retention schedules posted by several governmental agencies and other organizations. This will help to get a perspective on the retention periods for record series that may be similar to your organization.
Step 5: Determining the Overall Retention Period
Once business and legal retention issues have been decided, the total retention period can be determined. Typically, the higher retention period (either legal or business) trumps. However, it is important to keep both the legal and business requirements in mind when deciding the final retention periods. At this juncture going back to legal counsel and to the business to resolve any discrepancies will help further solidify the retention schedule.
Step 6: Putting in Place Retention Schedule Governance
The retention schedule must be reviewed and, as appropriate, be approved by stakeholders from legal, compliance, business units, and IT. This goes a long way in making sure that everyone buys into how the schedule is laid out, what the different levels are, how it is organized, etc. Retention schedules are living, breathing documents that need to be reviewed, maintained, and tweaked as both the organization and laws change. So, don’t assume the process is over once a file plan has been developed and the associated retention periods determined. An ongoing process to maintain, review, and update should be in place to ensure that the file plan and associated retention schedules are kept up-to-date.
The RM team must institute an initiative to collaborate with counsel to implement a change management process to periodically amend the retention schedule and to research the impact of new laws and regulations on existing retention periods and/or retention categories. After the schedule has been changed, an analysis of the retention changes to existing business processes, procedures, and/or systems is required. This will enable an understanding of the level of effort required to implement the retention schedule change.
Step 7: Implementing the Pilot Retention Schedule
Ensuring that everyone within the organization follows the categorization, retention, and disposition process may even be more daunting than putting together the retention schedule. We are sure some readers have seen or heard of great retention schedules, perfect in every respect, literally gathering dust because managers and business users simply didn’t understand the schedule or were not willing to put in the effort required to implement it properly. It is therefore important to put in place a plan that considers the end users’ viewpoint and allows them time to adapt to the new RM processes.
After the retention schedule has been sufficiently developed, it may be worthwhile to conduct a pilot of the retention schedule in a select business unit. There may be resistance to a pilot. After all, the retention schedule is the document that lays down the law so why bother piloting and getting feedback? However, a pilot project can provide helpful early feedback on the retention schedule from the people who are actually going to use it. Users may suggest changes in the file plan, the folder/sub-folder structure, names of categories, and even new business retention periods based on actual use. There is a big difference between drawing up a schedule on a conference room white board and incorporating that same schedule in real life. Like any other project, the key to successfully implementing retention schedules is to validate the requirements and let the process run in a controlled environment to evaluate how well it is doing against the requirements. This allows the retention schedule to be fine-tuned and adjusted.
By conducting the pilot, the RM team also gets a sense of how usable and acceptable the schedules are. While these may be considered “soft factors,” proper implementation will not happen unless users have bought into what needs to be done and why.
Step 8: The Retention Schedule in Operation OK, how do we implement it through the organization? The old adage of “crawl, walk, and run” comes to mind. Retention schedules simply cannot be implemented overnight. Implementing the retention schedule should follow a phased or step-by-step approach. Subsets of records or sub-business units should be identified as candidates for a phased implementation approach.
For starters, employees won’t know what to do and systems won’t be ready for RM and everyone will be at a loss on how to “manage” RM. Therefore, sufficient training and process changes to enable employees to understand and adapt to the new “records-enabled” business processes are required. This is an area that cannot be emphasized enough and it behooves the RM team to do whatever is necessary to ensure that RM is reflected and adapted as part of the normal course of business. A RM program cannot and will not succeed until the employee actually creating/ updating the record follows the proper RM steps.
Once business processes and procedures have been updated, the question arises as to how to apply retention to records that cannot be migrated over to the new RM system. So what to do with records that are not in the repository? Given time and money (lots of it), it is conceivable that one could migrate all of the legacy records to the electronic record repository. Unless there is a clear business case and value, it may not be worthwhile to propose such an effort. The RM team should evaluate migrating such records on a case-by-case basis, perhaps using a prioritization model. The key is to validate the migration effort against the business value provided.
Organizations may thus wish to consider adopting a risk-based view for legacy records. Determine what constitutes the biggest risk to the organization, identify the associated legacy records, and focus on securing those records. If time and money permit, move on to the next set of riskiest records. Organizations may also make a blanket policy statement, such as everything that is not in the records repository in three years will be considered a non-record. This gives department heads some time to figure out the steps needed to secure their records. Some organizations have chosen not to migrate any of their legacy records. However, their focus is not just on managing records in the records repository, they also manage legacy records through a combination of manual processes and procedures. While this may be perceived as risky, if done right, it actually may be a reasonable solution. The other issue is of applying retention schedules to structured records. More often than not, these systems do not support the application of retention, let alone record disposition. Once again the cost factor is simply too high to make large-scale changes to existing code and/or infrastructure. This leaves a key vulnerability within the RM program. Sometimes legacy structured systems contain critical records that absolutely need to be managed but no one dares touch the codebase for fear of creating “gotchas” and affecting the core system.
The good news is that structured systems can be updated, and records managers should work with IT and others in the business to determine if adding RM feature sets to these systems is feasible. When applying retention to structured systems, focus on the inputs and outputs of the system. In some cases, the outputs will be the most likely candidates for retention consideration, in other cases both inputs and outputs will be candidates. Structured systems are handled in a variety of ways in different organizations and records managers need to talk with their systems, data, and business and legal teams to determine an optimal retention strategy.
Another approach to applying retention to a structured system may be to consider the entire system as a “record” and apply a single retention period. This makes it somewhat manageable in the sense that periodic reports can be run at the end of the retention period and records can be disposed of through manual and/or automated means. Industry vendors that provide capabilities to manage retention for structured systems are an option, but it is important to first ensure the business case for procuring, installing, and configuring a third-party system to manage structured records. Undertaking such a task may turn out to be a complex exercise, especially for a homegrown structure. Sometimes the integration aspects of these systems may require more time and effort than anticipated.
Part of putting the retention schedule into operation is determining how records will be disposed of at the end of the retention period. Depending on the type and media of the record, various disposition methods would need to be put in place. The disposition method needs to comply with stated industry standards and specific benchmarks.
Step 9: Plan for Change
Rarely is the first retention schedule an organization develops is the one that goes into production—it is an iterative process. The standardized retention schedule, by its very nature, will occur in stages and morph over time. The file plan too will change as additional information becomes available, the organization changes, new product lines are created, mergers/acquisitions occur, or executives realize that something important was forgotten.
However, remember the “keep it simple” paradigm. Retention schedules that are overly complicated and incredibly detailed may look great on paper, but others in the organization frequently have a tough time adopting and following them. As a result, the RM team must ensure that the chosen retention schedules are both legally defensible and practical. Achieving this balance is the only way to be successful.
Conclusion
Developing and implementing a retention schedule is the cornerstone of the records management program. The key is to ensure alignment with the legal group during the development of the schedule and, once developed, to obtain approvals and buy-in from concerned stakeholders. Using an iterative and a crawl-walk- run approach to implementation ensures any bumps will be worked out. From the end-users’ standpoint, retention schedules need to be precise and yet simple enough to be assimilated easily into business processes. A well-deliberated approach to retention, balancing both the risk and cost of doing so, will go a long way in making the program successful. Achieving these balances is a challenging task, but with the right thought and planning, a workable retention schedule can be crafted and can help pave the way for the success of the entire RM program.
Nishan DeSilva is the global director of RM program at Watson Wyatt Worldwide. Watson Wyatt is a trusted business partner to the world’s leading organizations on people and financial issues. He is an experienced RM expert with more than 15 years of business and technology leadership in a variety of financial services verticals and is a certified electronic records management master (ERMM). Ganesh Vednere is a senior RM consultant working for a Global financial services firm and is experienced in implementing enterprise-wide content and RM programs. He has over 10 years of industry experience in various business and technology areas.
Adapted from an article by Nishan DeSilva and Ganesh Vednere. The article, The Foundation for Sound Records Management, originally appeared in the May/June 2008 issue of AIIM E-DOC Magazine. http://www.aiim.org/ResourceCenter/Archive/Article.aspx?ID=34790
