RECORDS MANAGEMENT AND THE DEVELOPMENT OF AUTOMATED INFORMATION SYSTEMS

Transcription

1 RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--TITLE PAGE RECORDS MANAGEMENT AND THE DEVELOPMENT OF AUTOMATED INFORMATION SYSTEMS AUGUST 1991 RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--FOREWORD FOREWORD This pamphlet was prepared by the U.S. General Services Administration (GSA) with the assistance of a multiagency task group. Its purpose is to help agencies improve their systems development practices and to fulfill their records management requirements. These goals can be achieved through more effective use of records management staff and expertise. This pamphlet presents the concept of the systems development life cycle and points out the importance of records management to each phase of the life cycle. The pamphlet is intended for Federal executives responsible for managing information resources, and for systems development and records management personnel who need to know more about each other's discipline. Special thanks are due the following individuals who helped in the preparation of this document: Katherine Coram National Archives and Record Administration Rose Marie Cummins Department of the Interior Elijah Kelly, Jr. Department of State Theodora Kunec Department of the Treasury Nina K. Regan National Aeronautics and Space Administration Mary Ann Wallace Department of Energy Lisa K. Westerback Department of Commerce B. Walter MacDermid General Services Administration We welcome your comments about this document. Please contact the Policy and Regulations Division at or FTS with your questions or suggestions. THOMAS J. BUCKHOLTZ Commissioner Information Resources Management Service U. S. General Services Administration RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--TABLE OF CONTENTS TABLE OF CONTENTS Introduction The Value of Records Phase One: Identifying Needs Phase Two: Defining Requirements Phase Three: Designing the System Phase Four: Acquiring the System Phase Five: Developing the Software Phase Six: Installing and Testing the System Phase Seven: Operating the System Phase Eight: Retiring the System Summary Appendix: Legal Authorities and Records as Evidence RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--INTRODUCTION INTRODUCTION Effective management today depends upon the adequacy and relevance of information obtained from automated information systems (AIS). Because much of the information used by Federal managers for decisionmaking is based on recorded facts, effective AIS development and records management are mutually supporting functions. This pamphlet fosters this mutual support by pointing out the value of using the record managers' essential knowledge and experience in AIS development. Their continuing participation will both improve the quality of information used in decisionmaking and ensure that program managers fulfill the statutory requirements for documentation. As of July 1, 1990, Federal agencies are required to establish procedures whereby records management officials participate in developing new agency systems and in revising existing systems. Federal agencies are required by law to preserve records that adequately document their policies, decisions, procedures, and essential transactions. The documentation should contain sufficient information to protect the legal and financial

2 rights of the Government and of persons directly affected by its activities. The National Archives and Records Administration (NARA) guides and assists agencies with respect to adequate and proper documentation. It also authorizes the disposition of records after specified retention periods. The General Services Administration (GSA) is charged with assisting Federal agencies in developing cost effective records management programs. Both agencies conduct research in records management science and periodically review the agencies' records management practices. The Freedom of Information Act (FOIA), subject to certain exceptions, requires agencies to honor requests from the public for information on agency rules, opinions, orders, records and proceedings. The Privacy Act of 1974 imposes strict limitations on the agencies' authority to disclose information maintained on individuals without their prior written consent. RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--SYSTEMS DEVELOPMENT LIFE CYCLE SYSTEMS DEVELOPMENT LIFE CYCLE An agency's AIS affects records management by capturing, creating, processing, disseminating, and storing information. Effective and efficient AIS and records management are interdependent. Agencies generally use a systems development methodology to obtain high quality systems that are accurate, efficient, secure, and reliable. These methodologies, a part of information resources management (IRM), consist of a life cycle with sequential phases. First, information processing requirements are identified, studied, and translated into a system design. Next, the system is built, tested, installed, and used. Eventually, this system is retired and typically replaced. Experience shows that a life cycle methodology, properly followed and with management approvals at critical junctures, has the best chance of producing an effective AIS that meets the agency's needs timely and within budget. A key factor in the life cycle method is involvement by staff knowledgeable in all of an agency's information requirements. This reduces the likelihood that the system acquired will omit any important functions. Staff with records management experience and knowledge ensure that an AIS will effectively and efficiently fulfill records management functions. This pamphlet discusses the "how" and "when" the records managers' knowledge becomes profitable to the development of an agency's AIS. The Value of Records Because Government decisions are primarily based on recorded information, records are essential. They support immediate administrative, legal, and fiscal needs, and ensure accountability and continuity of operation. Records preserve the rights and interests of both the Government and the public. They also enable the public to monitor the Government's actions. Recordkeeping is far more complex today than in the past. Technological advances in data capture, storage, and dissemination provide countless ways for meeting information requirements. Agencies must choose the best way for each particular application. These choices are made systematically during the phases of the development life cycle. These phases and their relevance to records management are discussed below. Phase One: Identifying Needs Management perceives a need for either a new AIS or a major enhancement to an existing system in order to fulfill the agency's mission. The agency determines the feasibility of an automated solution, compares and costs alternative approaches, and proceeds with the selected approach. During this phase, records managers need to perform a general survey of the types of information to be captured, developed, maintained and disseminated by the new AIS. This survey gives management an early assessment of the likely impacts the new AIS will have on records management and on agency compliance with the requirements of FOIA and the Privacy Act. If the AIS will have significant impact on records management, such as a complete restructuring of reporting requirements, the agency's senior management should be informed.

3 Phase Two: Defining Requirements In phase two, a systems development team is in place and consists of program and records managers, users knowledgeable about the functions to be automated, and computer specialists trained in AIS development. The team prescribes the proposed system's functional requirements in detail. Ideally, this will include identifying all sources of information for input to the system and defining the required records to accomplish and document activities supported by the AIS. Existing records as well as any new records created by the system should be identified. The systems development team identifies and consults with the program managers having custodial responsibility for each record series (footnote). The team addresses particular processing, storage, and security requirements along with FOIA and Privacy Act issues. It also prescribes suitable safeguards and controls. Records managers work with program managers to recommend disposition criteria for each series and to obtain NARA concurrences. NARA-approved disposition authorities are documented in the agency's records schedule. These analyses identify any vital records and those with important legal significance. Vital records comprise two categories. "Emergency operating records" are those vital to the essential functions of the Federal government for the duration of a declared emergency. They must be available for use by emergency operating centers. This requirement has implications later in the AIS design because analysts must take into account the need to have electronic records compatible with the automated data processing equipment (ADPE) at the emergency operating centers. "Rights and interest records" are those essential to preservation of the legal rights and interests of individual citizens and the Government. These include social security, payroll, retirement and insurance records. They require protection but not necessarily accessibility at the emergency operating centers. Some types of records are frequently desired as legal evidence. Factors affecting the use of records as evidence are discussed in the appendix. Footnote: A record "series" consists of file units or documents arranged according to a filing system or kept together because they relate to a particular subject or function; result from the same activity; document a specific transaction; take a particular form; or have some relationship arising out of their creation, receipt, or use During this phase, the records managers ask the following types of questions: o What is the system's purpose? Does it serve different purposes for different users? Do the different purposes reflect different needs for retaining data? o What inputs are needed and how long should the inputs be retained? Are they needed for legal or audit purposes or for the vital records program? o How long must the information be kept on-line? Are on-line retention requirements reflected in design parameters for the mass storage? o If the agency no longer needs data on-line, does it need to retain it off-line? If so, for how long? o How can requirements for retaining and disposing of data be integrated with the system design and operations? Can such techniques as regular update and backup operations, or creation of history files or subset files, be used for this purpose? o What will be done with computer-generated output reports, whether on paper, computer output microfilm (COM), compact disc (CD), or other electronic media? o Are multiple copies of the data needed? If so, in what media? In what locations? Do all of the media need to be kept for the same period of time? How will the integrity and authority of the data be ensured? o Are any outputs widely distributed and, if so, has an analysis of alternative means of distribution been performed? o Is the information subject to the provisions of the Privacy Act? How does the Act's requirements for maintenance of timely, complete, relevant, and accurate information affect the agency's estimate of how long data should be kept? (When records subject to the Privacy Act are involved, retention and disposal policies must be determined and included in a Federal Register notice published when the system is established.) o Is the information in the system part of the agency's vital records program? If so, what provisions must be made to ensure availability of the information during emergencies? o Which media must be given special care to ensure data preservation for long-term operational needs or for archival purposes? Phase Three: Designing the System Functional requirements are translated into specifications for ADPE, software, input media, output media, storage media, access control measures, and other features. Software developers use these

4 specifications to build the system. Records managers, with their expertise in forms design and knowledge of paperwork reduction goals, can help lay out computer input screens and hard copy forms to ensure the capture of essential information. Knowledge of micrographics, imaging, photographic reproduction, facsimile transmission, document scanning, multipart forms, and paper bursting and decollation technologies contribute to a successful AIS. Records managers ensure that the design specifications reflect all records management requirements. Omitting important features during this phase may require an expensive system revision later. In general, it is more costly to retrofit a control or a feature into an operational system than to include it in the initial design. The growth of both intraoffice and inter-office local area networks (LANs), with their electronic mail capabilities, poses questions about the adequacy of documentation. This is because electronic memoranda often communicate findings and decisions. The application of sound copy and mail management practices can ensure that electronic memoranda are permanently preserved when necessary and that electronic routing directories are efficient. Records managers assist program management in selecting storage media and in budgeting for costs associated with printing forms, mailing, storage, and testing and certification. Where applicable, this analysis assesses the likely impact on the agency's information collection budget as prescribed by the Office of Management and Budget. Phase Four: Acquiring the System Phase four consists of acquiring the necessary ADPE and applications software. Records managers should collaborate with the contracting and ADP staffs on resolving pertinent and emerging records management issues throughout the acquisition process. In particular, they review solicitation documents to ensure adequate provision for information and records management requirements. Phase Five: Developing the Software In this phase, applications software results from writing computer programs. Phase five may overlap with phase four in the development of applications software. Much of the work in this phase is done by computer specialists who write, install, and test software programs; and technical writers who prepare user manuals and operator run books. Plans are made for user training. Records managers help technical writers by preparing policy and procedure statements for handling, securing, and accessing system-maintained records. They also conduct training in records management procedures. Phase Six: Installing and Testing the System Phase six entails installing and testing the system to ensure that it meets requirements and provides reliable processing of official agency transactions and information. An installation often requires a onetime loading of the new system's database with data reflecting correct status information and transaction history as of a given cutover date. Computer specialists determine the best loading technique, which may involve a specially prepared electronic file obtained from the retiring system, or perhaps, manually coded hardcopy sheets. Frequently, a combination of both techniques is used. The records used to load the empty database are generally no longer needed by program management once the system is operational. Records managers advise on quality control procedures for ensuring an accurate loading, and on the disposition of coding sheets and their value as an audit trail. During the installation phase, IRM managers often develop or refine software change control procedures for use when the AIS becomes operational. Change control is important because evolving agency requirements necessitate system changes. Without an orderly and controlled process accompanied by adequate testing, erroneous logic can be introduced into the system. This could cause incorrect processing, corrupted data, and poor decisionmaking. While IRM managers and auditors typically approve change control procedures based upon concerns of day-to-day system's operation and integrity, records managers evaluate change control procedures as they affect the adequacy of documentation and the preservation of records. Before accepting the AIS as operational and certifying its integrity and accuracy, program management conducts a rigorous acceptance test that simulates live conditions and processing volumes. This test verifies processing accuracy and satisfactory performance. Records

5 managers assist by incorporating specific tests of records management requirements and by confirming acceptable test results. Phase Seven: Operating the System Soon after a system is operational, the program management and/or the internal auditing function usually perform a post-implementation review to ascertain whether the system works as intended and whether the projected savings and other benefits are being attained. The review should include records management aspects. Program managers are responsible for monitoring the system's on-going performance. Sustained satisfactory performance requires the reliability and durability of electronic storage media such as magnetic tape reels and cartridges, and removable disks and diskettes (floppy disks). Used for both onsite and offsite backup storage of important data files, these items require special handling to prevent the loss of information. The ability to read these backup media frequently is not determined until attempting system recovery and restoration, which could be months or years after the backup creation. To guard against problems with these backup media, the regulations require agencies to read annually a statistical sample of all reels and disks containing either permanent or unscheduled information. These tests help to identify any loss of data and to discover its causes. Media with ten or more errors shall be replaced and, when possible, lost data restored. Records managers provide useful assistance by monitoring compliance with retention policies, and in designing and executing the annual statistical test of the electronic media. Phase Eight: Retiring the System At some point the agency's role and requirements may change to such an extent that the AIS is no longer required and should be retired and replaced. Special planning is required for retiring a system to ensure adequate preservation of records, along with the means to read them. Records managers help identify all records to be preserved and advise on NARA's requirements for archival storage media. RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--SUMMARY SUMMARY Effective AIS are developed methodically to ensure success. This sequential method consists of life cycle phases, each of which can profitably use the knowledge of records managers. Involvement by records managers will improve system effectiveness and serve to ensure that program managers meet their statutory requirements for documenting government actions. These benefits, in turn, will foster better government by facilitating informed decisionmaking and allowing the public to monitor its actions. Suggestions for further reading on this and related topics may be found in the appendix. KEY ALT-I TI VIEW IMAGE PHASES OF A LIFE CYCLE RECORDS MANAGEMENT AND THE DEVELOPMENT OF AIS RECORDS MGMT. AND THE DEVL. OF AIS--APPENDIX APPENDIX: LEGAL AUTHORITIES AND RECORDS AS EVIDENCE The Authorities The two laws primarily governing Federal records management are the Federal Records Act of 1950, as amended, and the Paperwork Reduction Act, as codified at chapters 21, 29,31, and 33 of title 44 of the United States Code (U.S.C.). establishes the basis for records management programs in Federal agencies. It also states the records management oversight responsibilities of both the National Archives and Records Administration (NARA) and the General Services Administration (GSA). The Paperwork Reduction Act (44 U.S.C et seq.) makes records management part of a broader program of Federal information resources management. NARA and GSA issue separate regulations to provide

6 guidance for implementing agency responsibilities under these laws (see 36 Code of Federal Regulations (CFR) Ch. XII; and 41 CFR Ch. 201, respectively). GSA's records management regulations are part of its Federal Information Resources Management Regulation (FIRMR). Records as Evidence Records have evidential value in enforcing contracts involving an interest in land or a guaranty of another's debt, or contracts that are incapable of being performed within one year. Such contracts generally cannot be enforced by a writing signed by the party against whom enforcement is sought. The Uniform Commercial Code (2-201) extends this requirement to contracts for the sale of goods whose value exceeds $500. In AIS planning, system designers should consider the need for records to evidence contracts when determining their storage media and format. Because routine business records have generally been created subject to methods enhancing their reliability, they have become admissible as evidence. This doctrine has been codified into The Uniformed Business Records as Evidence Act, which has been adopted by some states. Systems designers should plan for adequate systems controls in the form of edits, batch totals, check digits, and access restrictions to ensure that system maintained records can qualify as admissible evidence, if required. The best evidence rule requires, if accessible, the production of the highest degree of proof possible, given the nature of the case. Thus, the original document, due to its authenticity, is preferred over a copy, and the latter is generally not admissible unless the absence of the original can be satisfactorily explained. System designers planning to microfilm records should ensure that disposition policies for original hardcopy documents are stated clearly and rigorously complied with to ensure that the microfilm can qualify as the best susceptible proof. In the Federal court, microphotographs, are admissible as evidence to the same extent as the original documents (44 U.S.C. 3312). SUGGESTIONS FOR FURTHER READING General Services Administration, Information Resources Management Service, ELECTRONIC RECORDKEEPING. Washington, DC: U.S. Government Printing Office IAC/IRM Executive Board, Special Task Group on Electronic Recordkeeping. FINAL REPORT. Washington, DC National Archives and Records Administration, Office of Records Administration. MANAGING ELECTRONIC RECORDS. Washington, DC National Archives and Records Administration, Office of Records Administration. THE MANAGEMENT OF ELECTRONIC RECORDS IN THE 1990'S: A REPORT ON THE CONFERENCE HELD JUNE 21-23, 1989, EASTON, MD. Washington, DC President's Council on Management and Improvement, and the President's Commission on Integrity and Efficiency. MODEL FRAMEWORK FOR MANAGEMENT CONTROL OVER AUTOMATED INFORMATION SYSTEMS. Washington, DC: U.S. Government Printing Office U.S. Congress, Office of Technology Assessment. ELECTRONIC RECORD SYSTEMS AND INDIVIDUAL PRIVACY. OTA-CIT-296. Washington, DC: U.S. Government Printing Office