GRC: An Introduction To Records Management

By David Roe (@druadh20) May 25, 2010

4 comments

Recent events — particularly in the financial services sector — have increased the pressure on enterprise records management practitioners, as more and more companies face regulatory audits or litigation-related discovery requests. The idea of document management is easy for most people to understand. Records management, on the other hand, presents some conceptual challenges. Here's a primer.

Only recently, the U.S. Library of Congress added to the records management confusion by announcing that that they will be archiving all the tweets tweeted since Twitter’s 2006 creation. So, one might ask does this imply that tweets are business records?

Federal Records And ISO

Apparently not. In the US, the Federal Records Act provides the basis for all records-related decisions. It defines a record as,

…recorded information, regardless of medium or characteristics, made or received by an organization that is evidence of its operations and has value requiring its retention for a specific period of time.”

Internationally, the International Standardization Organization (ISO) defines records as:

… information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business.”

From these two definitions we can draw three important things. A record :

Provides evidence of an organization’s activities
Can be in any medium
Is information created in respect of legal obligations

Records Management And DoD 5015.2

Amongst vendors, the de facto standard used by both the public and private sectors for the provision of an adequate records management systems (RMS) is the Department of Defence’s 5015.2 standard.

It outlines the minimum requirements of RMSs before they can be used by the DoD and other federal agencies and outlines what functions they must have. Included among desired features are:

Capture and scanning management
File plan management
Retention and disposition management
Access and library management
Storage management
Email management

Combined, these applications manage different aspects of electronic and physical records and come with search capabilities to locate records stored across enterprises.

The DoD 5051.2 standard acts as the starting point for the European standards (MoReq) in records management which, like the DoD standards, outline requirements of a RMS.

Record Management Considerations

So if a record is an evidential record of an enterprise's activities what do you need to take into account before deploying a RMS?

While the role of records as an evidential resource outlining enterprise activities rarely changes, the way in which different enterprises choose to deal with them is different from company to company.

This is why it is necessary to be clear as to what needs to be achieved. Areas that need to be identified include:

Record management roles:
Records managers, compliance officers and IT personnel to deploy and monitor systems, content managers to identify where records will be kept.
Enterprise content:
Assessment of all existing and future content and determining what content is likely to become records.
Outline file plan:
Clear list of content that can be considered records and identify where they will be stored, retention periods, person responsible for them.
Retention schedules:
Whether the record is still in use, when its lifecycle has come to an end and how to dispose of them
Records management design:
Based on your file plan, design libraries, content types, policies, and storage locations
Compliance:
As records are a key component of compliance, it is important to ensure that the records can be found and accessed easily.

Electronic Records and Physical Records

The increasing number of regulatory demands from different federal and international organizations means that enterprises now have to consider the relationship between physical records and electronic records and how best to manage both.