Effective Records Management for Today s Business Environments

Transcription

1 RECORDS MANAGEMENT DOCUMENT IMAGING WHITE PAPER Effective Records Management for Today s Business Environments CONTENTS Executive Overview Business Drivers for Records Management Implications of Regulatory and Compliance Mandates The Value Chain in Information Lifecycles Changing Office Technologies Organizational Best Practices How Canon Business Process Services Improves Business Performance

2 Executive Overview Successful enterprises have come to rely on information as a major internal asset to be leveraged to improve business results or, in some cases, as a lucrative product to sell. There is increasing public scrutiny regarding the need for corporate leaders to assure that business information in the form of records can be trusted, audited, retained and produced, when required. The importance of properly managing business records is revealed in news sources almost daily, including the consequences of the failure of some organizations to retain records for mandated time periods (Arthur Andersen) and the discovery in some cases of reputation damaging s (Microsoft and many others). Unfortunately, litigation is a frequently used tactic to resolve disputes between individuals and organizations. Governmental investigations are routinely initiated when audits yield findings of non-compliance with expected business practices or activities. In both of these scenarios, there is an immediate focus on how well management supported the proper retention and timely production of records, in both paper and electronic formats. There is a fiduciary responsibility to assure that employees perform job functions as delineated by defensible policy, procedure and management directives. Executive-level attention to records management strategies, policies, procedures and technology systems now is the expected practice in well-run organizations. Executive signatures required on financial statements by the Sarbanes- Oxley Act (SOX) make it critical to manage enterprise information and evidentiary records in a well-documented and consistent manner. Each organization s value chain and information workflows must have supporting records management activities and auditable business processes that clearly document the status of activities. This includes what is known and when each responsible associate knew it. A carefully developed records management strategy and rigorously enforced enterprise-wide information management policies are the keys to achieving excellence in management and, in turn, promoting customer, investor, regulator, employee and public confidence in an organization s activities, products, and services. 2

3 Business Drivers for Records Management Today s complex business environments generate numerous challenges for both management and employees. Fast-paced changes in office technologies, changing government mandates and global competition create both obstacles and opportunities. However, a common aspect of all business environments is the constant demand for on-time access to data, information and documentation. Business records are needed for operational guidance, reporting to auditors, documentation of intellectual capital and evidence in litigation, as well as a variety of other tactical and strategic drivers. To meet these needs, records must be locatable and retrievable quickly and accurately. Otherwise, lost productivity, damaged public relations and adverse financial impacts may result. Of equal importance is the current transition of most enterprises from sifting through piles of paper to managing gigabytes of data. This shift creates a mandate for every enterprise to similarly evolve the ways they control and manage processes that generate or utilize records. Information is one of the most vital strategic and operational assets of organizations. Organizations depend on information to make critical strategic decisions, protect contractual rights, support innovation, develop products, deliver services, drive marketing, process transactions, serve customers, and generate revenue. This essential information is contained in business documents or records that need to be effectively managed. Senior executives are ultimately are responsible for the prudent stewardship of corporate assets. Yet many companies today lack effective policies and procedures to control, manage, retrieve and preserve critical corporate records and other business documents. Consequently, they risk severe penalties and loss of corporate reputation for noncompliance with records-related regulations and legal statutes while their employees waste valuable time searching for information when it is needed. They keep some records too long spending too much for storage while simultaneously they often failing to protect other mission-critical information from loss or destruction. Because operational effectiveness is a concern for shareholders, customers, and Boards of Directors, it is incumbent on C-level officers to be fully aware of their current corporate records requirements, policies, procedures and known gaps relative to established industry best practices. Effective enterprise strategies must be in place to assure that information assets are managed in strict compliance with a broad, continually evolving spectrum of regulations and standards. Increasingly complex business environments make this challenge more and more difficult to meet. Records management expertise is outside the realm of most business managers and is not a core competency for most organizations. Therefore, companies wishing to minimize the risks associated with non-compliance are increasingly turning to thirdparty solution providers with records management subject-matter expertise and hands-on operational best-practices knowledge. Without such external professional assistance, organizations must bear the direct cost of internal development including acquiring the required expertise, conducting appropriate 3

4 research and navigating learning curves for the development of records management programs and solutions. The business risks associated with poorly managed information resources are substantial and increasing. Unfortunately, when information management issues are covered by the news media, it is often in a highly negative context. For example, when Arthur Andersen was implicated in the accounting irregularities related to Enron, the headlines did not report that Arthur Andersen had the foresight to have a records retention schedule and records management program. The headlines did, however, extensively cover the use of shredders and allegations of intentional spoliation of evidence. When public records used by state governments that must be made available to the public cannot be located, allegations of misconduct may quickly arise. And when small sets of s mysteriously disappear in any organization, there can be an assumption of spoliation (destruction of evidence) that someone has tampered with the system and has intentionally deleted potentially incriminating evidence. Information management typically is one of the largest overhead burdens of an organization. The creation of correspondence, reports, brochures, forms Information is one of the most vital strategic and operational assets of organizations. Organizations depend on information to make critical strategic decisions, support innovation and generate revenue. This essential information is contained in business documents or records. and graphic materials can be highly expensive due to both the cost of materials and labor. Now that much of this information flow must occur within computer systems and networks, the incremental cost of performing daily tasks continues to grow. At the same time it becomes critical to have well-run information systems that support an organization s business goals. Should an organization s loss of information become publicly disclosed, the financial impact in lost customers and public confidence can be immense. These dangers are especially true for financial services, insurance and data management businesses where customer loyalty often correlates to perceived organizational trustworthiness and reliability. The electronic information glut that affects organizations makes it increasingly difficult to establish what information is sufficiently valuable for long-term retention. For this reason, it is challenging to differentiate data, files, and documents that should be discarded early in the information lifecycle from official records. Information is often created on a 4

5 personal computer, printed to paper locally, saved to offline disks, and sent through networks to many recipients. These proliferating copies of records create difficulty in establishing the identity, accuracy and authenticity of records that require retention for long-term preservation. Many individuals find themselves in the unenviable position of not knowing which copy of their documents should be preserved as records material. Should they preserve the paper copy or the numerous versions of electronic files? This situation is rapidly getting worse as office files continue to multiply each year. As illustrated in Fig. 1, Barclay T. Blair, author of Information Nation, analyzed the results from an IDC Digital Universe study and established that, while the amount of digital data will expand significantly over the next 10 years, the number of files containing that data will grow 50% faster and the number of items requiring Information Governance, i.e. records management, will grow 100 fold in the same time frame. Obviously the hold on to everything approach to records management can t exist in the near future, particularly since the actual significant value of information usually lasts only a few years. Most records, once filed into filing cabinets or disk drives, seldom are referred to again after their initial usage. But this expanding amount of information puts increased demands on efficiency of retrieval. Many office workers, especially those new on the job, or temporary workers, waste hours daily, simply looking for information that could readily be Information Governance is the emerging term for the high-level, strategic management of information assets. The term suggests a cohesive vision that ties together all of an enterprise s activities that harness information to drive better business results. Records management will continue to be the key tactical tool within Information Governance that manages risk, assures accountability and simultaneously improves access to and protection of vital business information Data will grow 44x in next decade But, the number of files we manage will grow 50% faster And, data requiring information governance will grow 100xl 90% of all these files will require IG by 2020 Source: IDC 2010 Digital Universe Study Fig. 1 5

6 available had it been filed using an organization-wide standardized filing plan. Mislabelled or misfiled information imposes initial labor search costs and subsequent resource costs in the event it must be re-created or re-generated. The potential financial losses due to misplaced evidentiary material, hard-to access corporate records or lost research data related to product development can surge to millions of dollars. Document management expenses are a major component of corporate operating expenses. Companies spend approximately 10% of revenue on document management, production and distribution. (IDC End User Research) Knowledge workers (the economy s highest-paid workers) spend an estimated 20% of their day looking for information in documents; yet, about 50% of the time, they are unable to find the data they need. (IDC Study, January 2005) For reasons such as the above, many organizations have decided to create formally defined records management programs that are staffed with skilled professionals working to gain control of the information glut that threatens to obstruct business workflows. Organizations are beginning to assign more records management responsibilities to employees. However, assuring enterprise-wide proper management of information and records is simply beyond the job description and workplace experience of most employees. Employees dedicated to line-of-business activities need to be spending time accomplishing functionally important tasks, rather than wrestling with long-term corporate records retention issues. In fact, the local, state, and federal government agency investigative research required to professionally establish records retention periods for certain classes of corporate records is far beyond the capabilities of the average office worker. Records retention research requires specialized insights and educational background. Creating a records filing and indexing system that can be used across an organization to assure that both paper and electronic records can be retrieved is also a task that only well-trained records management professionals should undertake. Setting strategies, developing policies, implementing procedures, deploying support tools and then delivering the training programs to educate employees about the importance of retaining records and the tools available to them requires well- trained professionals with subjectmatter expertise. Effective records management can reduce the cost of doing business by effectively managing information resources in a number of ways: Ensure compliance with regulations and legal statutes, thereby avoiding costly fines and penalties to which executives may be liable, as well as damage to corporate reputations; Limit financial risk from pre-trial discovery in government investigations and civil litigation; Streamline storage requirements for both electronic and paper documents; Reduce time and effort required to reconstruct mission-critical information in the event of a disaster or other loss Reduce labor costs to control, manage, preserve and access information. 6

7 Implications of Regulatory and Compliance Mandates Today s news headlines about records and recordkeeping systems often are uncomplimentary regarding organizations roles in records destruction. A classic case is that of Arthur Andersen employees shredding documents in an attempt to reduce the records available subsequent to discovering court proceedings were in progress. The losses suffered by many organizations due to improper attention to accounting irregularities and other executive misdeeds have focused both public and governmental attention on the needs for excellence in recordkeeping. This heightened news media focus and resulting public attention means that organizations and their leading executives must introduce unimpeachable records management programs with consistently well-implemented policies and procedures. Although many firms have been in the news with respect to inappropriate records-related actions, none is more visible than the case of Arthur Andersen. In November 2001, the U.S. Securities and Exchange Commission (SEC) delivered a subpoena to Arthur Anderson requesting records about the public accounting work performed for Enron. Subsequently in January, Arthur Andersen revealed that it had destroyed a number of documents related to the Enron audits. In March 2002, Arthur Andersen was charged with obstruction of justice for inappropriate records destruction, and the company was subsequently convicted in June Within less than one year, many of Arthur Andersen s clients withdrew their business. A $9 billion company with a long history of professional credibility was effectively destroyed simply because of court decisions that it had not followed its own records management policy. A major outcome of this action has been increased public scrutiny of accounting practices, records management practices, and executive responsibility in general. For firms that have demonstrably supported and enforced existing records management programs, this level of visibility and management practices review does not pose a problem. However, companies that have failed to invest any significant resources to ensure official records are created and managed with the requisite attention and priority, risk serious consequences should records become suspect during audits, regulatory review or legal actions. The most impactful factor increasing the consequences has been the legislative and regulatory responses to the high-profile cases discussed above and other similar events. The Sarbanes-Oxley Act of 2002 brought new focus on the issue of records accountability and proper records control during auditable business processes. The law requires that the CEOs and CFOs personally attest to and certify many records used in reporting financial status. Among other things, the Act creates guidelines for the establishment of audit committees, requires that documents relevant to possible government investigations be appropriately retained, and specifies that audit work papers be retained for seven years. Stiff criminal penalties are provided for executives in non-compliance, including that CEOs and CFOs making a false approval of company financial status po- 7

8 tentially be fined up to $1 million and/or be sentenced to prison for up to 10 years. If the false representations are deemed to be willful and intentional, the fine may reach $5 million and the prison sentence could reach 20 years. These admonitions apply to anyone who knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes false entries in records or documents. Another area of growing concern for corporations is the stringent attention paid by courts to the preservation of records when the prospect of litigation arises. Just as Sarbanes- Oxley legislation addresses the destruction of records, spoliation of evidence is of similar importance to courts expecting to see high-quality fully disclosed documentation. Spoliation is the destruction or alteration of evidence by actively destroying information or simply failing to preserve it. When records are destroyed at a defendant s site or while under management control, the courts generally will find in favor of the plaintiffs even when ill intent on the part of the defendant may not be present. Courts have awarded fines and sanctions against organizations that failed to preserve records on magnetic tapes, optical disks, or older computer systems when the data could not be read or used. In addition, the costs of electronic records discovery are often paid by the defendant, creating significant incentive to settle cases quickly. Influence by regulatory agencies in the recordkeeping processes of business is growing. There is increasing need to assure records creation and retrieval occurs accurately and quickly, with proper supervision. Some examples of the scope and complexity of the regulations include: The Securities and Exchange Act of 1934, Rule a-4 prescribes non-rewriteable, non-erasable media for recording some electronic records; The National Association of Securities Dealers Rule 3010 directs that organizations oversee the com munications of authorized repre sentatives with the public, including Chief Executives must personally attest in annual filings to the rigorousness and accuracy of the financial controls in place in their organizations, including determining that financial records are properly supported by quality recordkeeping processes. KEY ISSUES + Records management processes must assure that financial transactions are accurately conducted and assets are accurately assessed + Testing of internal controls to assess the accuracy of financial records must be a formally reviewed process + Inter-organizational collaboration between IT, Finance, and Legal Counsel must support the implementation of Records Management policies and procedures + Executive management must both support and lead these efforts Table 1 SARBANES-OXLEY ACT SECTION 404 RECORDS MANAGEMENT IMPLICATIONS FOR PUBLIC COMPANIES 8

9 assurance that employees comply with policies. To assure compliance t here can be expectations of monitor ing s received internally or sent externally, as well as the ability to se lect for separate treatment s that may have legal implications and; SEC regulations require that organizations provide comprehen sive electronic records retention and search capabilities that ensure the latest two years of records are readily accessible. The losses suffered by many organizations due to improper attention to accounting irregularities have focused attention on the need for excellence in recordkeeping. It is important to note that while in prior years corporate management expressed concerns over the impact of increased legislation and regulation, a survey conducted by the SEC published in 2010, The Economic Effects of SOX Section 404 Compliance: A Corporate Insider Perspective, indicated that the general result was a positive impact on corporate governance with over 80% of companies ascribing one or more direct benefits arising from the increased regulation. Litigation electronic discovery (ediscovery) costs resulting from the need to produce s and other electronic records can be significant and push defendants into out-of-court settlements. For instance, most organizations today know that their systems are out of control with respect to the volume of s transmitted and the capacity of their servers to store the records in a wellorganized manner for retrieval. This is simply an IT systems performance issue and organizational inconvenience until a court decides that: 1) this performance failure has been known for some time; and 2) management s failure to address it means that critical to resolving legal disputes has been lost. Courts may decide to award damages to plaintiffs simply because the defendant has made it impossible to accurately assess the validity of their own defense or courts may decide that recordkeeping activities affect the quality of the records produced for legal purposes. In January of 2010, United States District Court Judge Shira A. Scheindlin, presiding in the influential Southern District of New York, issued an important new decision in the area of records management, specifically ediscovery. In the Pension Comm. of University of Montreal Pension Plan v. Bank of Am. Secs., LLC, decision, she stated that certain actions not in accordance with established best practices would result in a finding of gross negligence with respect to executing discovery obligations. The specific actions cited - items such as failure to issue a written litigation hold, failure to identify all of the key players and to ensure that their electronic and paper records are preserved, failure to cease 9

10 the deletion of or to preserve the records of former employees that are in a party s possession and failure to preserve backup tapes when they are the sole source of relevant information - are important not only as expected practices of a well-implemented records management program but as representatives of the best practices that Judge Scheindlin established six years earlier in her landmark decision Zubulake v. UBS Warburg. In fact the 2010 decision was subtitled Zubulake Revisited: Six Years Later because the decision indicated that six years after they were written into case law, any further short fallings in properly executing established best practices such as these constituted negligence. In the original Zubulake vs. UBS Warburg case, the plaintiff ( Zubulake ) filed suit against UBS, her former employer, alleging gender discrimination and retaliation. This matter came before the court after Zubulake s motion to compel UBS to produce messages that existed only on backup tapes and other archived media. Judge Scheindlin issued five groundbreaking opinions in the case. The Zubulake decisions, including the final one issued in 2004, provided lawyers with new best practices related to the legal and technical aspects of electronic discovery. Zubulake greatly increased the scope of a party s duty to preserve and produce electronic records and imposed sanctions for spoliation. In Pension Comm. of Univer. of Montreal Pension Plan v. Bank of Am. Secs., LLC, Judge Scheindlin reiterates the importance of maintaining practices in compliance with case law as well as statutory regulations summing it up in the introduction: By now, it should be abundantly clear that the duty to preserve means what it says and that a failure to preserve records - paper or electronic - and to search in the right places for those records, will inevitably result in the spoliation of evidence. 10

11 The Value Chain in Information Lifecycles All information has a lifecycle that begins with creation and ends with a final disposition of information to an archive or destruction. Information can typically exist in either paper or electronic format and technology innovations continually bring about new forms such as web pages, investor briefing videos and corporate presence on social media. Increasingly, most information is created on computer systems as electronic files or data. After creation, digital computer files can be printed, transmitted to other users by , and/or made accessible by posting on Internet web sites or other means. Eventually, digital information must be stored for future retrieval or may simply be deleted. During the various phases of the information lifecycle, some of this information becomes sufficiently valuable to be considered record material and other information simply remains in general document or data format for eventual disposal. This distinction of becoming a record for preservation is critical to the concept of records management, in that all defined records series should have a mandated retention period, whereas non-record materials should be discarded soon after their initial use, often within one year of creation. For this reason, when an organization establishes a value chain for products and services, the important records that add value to the creation or management of those products and services should be identified early and should be managed throughout their entire lifecycle. Documents or data that do not need to be retained will clutter up disk drives or desktops and can be eliminated as soon as is practical in the lifecycle of the information by quickly moving it toward destruction or deletion. A typical document workflow in an organization might occur as seen in Fig. 2. It is common for organizations such as financial, insurance, and manufacturing firms to produce both paper and electronic records materials during project or transaction workflows. In many cases, records may initially be produced on computers and then merged with data gleaned from paper documents. The paper-based records would be filed in re- 11

12 PROJECT TASKS PRODUCE PAPER AND ELECTRONIC DOCUMENTS PAPER Business Development Work Initiation Product Design Design Refinement Product Engineering Product Manufacturing Promotional Documents and Work Authorization Design, Development, and Working Documents Project Closeout Records ELECTRONIC Fig. 2 RECORDS PRESERVATION PLANNING Native file formats Conversion to TIFF or PDF/A Does your organization have a data migration strategy for records? Copying to archival media CD/DVD Periodic, scheduled migration to new archival media Years 1-3 Years 4-7 Years 8-10 Years Fig. 3 12

13 cords centers, and eventually scanned or simply stored as paper off-site. It is obvious that not all organizations are properly staffed and equipped to perform records tracking in an integrated manner for both paper and electronic files across multiple departments and locations for the prescribed time frames. Similarly, many organizations are not staffed or trained to capture and manage the records generated from complex business processes if the documents must be scanned into images for multi-user access from many different jobsites. In these cases, it may be more cost-effective to contract for outside assistance with these integration issues so that internal personnel can focus their attention on the organization s line of business, delegating records management services to more highly skilled, trained specialists. Contemporary concerns about technology obsolescence and digital preservation are the source of another information lifecycle issue. All computer systems run on hardware and software platforms that begin to become obsolete from the moment they are installed and configured. Further, hardware systems such as tape, magnetic disk and CD/DVD drives degrade over time; as a result, the information recorded with those devices is in danger of becoming inaccessible. As office desktop computer software versions change yearly, the various data formats being created may not be re-usable in the future depending on the backward compatibility of each vendor s software offering. For this reason, many organizations are creating digital document preservation strategies that include a migration of electronic records over time from the original native file formats to more permanent file formats, such as PDF (and the newly emerging archival standard PDF/A) or TIFF, to archival media such as CD-ROMs, and eventually to printing and preservation on acid-free archival-quality paper media. Without a sound data migration strategy, (see Fig. 3) organizations may, in the future, try to retrieve electronic files that are not readable on the thencontemporary computer equipment. This will greatly impact organizational success in addressing records retrieval needs and could negatively impact the overall success of the organization in the marketplace. Defining the information lifecycle within the operating framework of business processes and value chain is vital to the identification of critical records needing long-term retention. Each business process that generates revenue must have the critical records for that process defined in a Records Retention Schedule, retention periods assigned, and applicable policies and procedures developed to address them. In addition, appropriately trained personnel must be assigned to assure that those records are captured and preserved, or the loss to the organization may be substantial, financially or in public perception. In contrast, well-managed organizations with highly skilled personnel assuring that recordkeeping systems are properly managed will enhance the marketplace reputation and viability of an organization and its management. 13