Records & Information Management Policy

Transcription

1 2014 Records & Information Management Policy VerQu

2 CONTENTS Document Control... 2 Purpose... 3 Scope... 3 Organizational Placement... 3 Roles and Responsibilities... 3 Corporate Records Manager... 3 Record Management Governance Board... 3 Legal Department... 4 Information Technology (IT) Department... 4 Company Departments... 4 Records Management Coordinators... 5 Company Personnel... 5 Records Retention, Storage and Destruction... 6 Records Retention Schedule... 6 Storage... 6 Destruction Hold Orders... 6 Destruction... 6 Electronic Recordkeeping... 7 Training... 7 Program Audits... 7 Policy Maintenance... 7 Page 1 of 7

3 DOCUMENT CONTROL Document Details Title VerQu Records & Information Management Policy File Name VerQu_RIM_Policy.docx Prepared By VerQu Version 1.1 Status General Distribution Version Date Summary of Changes Author 1.0 3/12/2013 Document Creation Frank Perrone 1.1 1/15/2014 Formatting edits, updated content Frank Perrone Page 2 of 7

4 PURPOSE SCOPE The purpose of this Records Management Policy is to establish policy for the retention, storage and destruction of all <COMPANY NAME> ("Company") business records, regardless of media or format (including electronic and hardcopy), to satisfy legal, regulatory, business and operational requirements. This Policy also establishes the organizational governance and placement of records management responsibilities within the Company. In addition, this Policy provides guidelines for Company departments in defining their internal records procedures and thereby serves as a framework for establishing consistent and accountable corporate recordkeeping practices. This Policy and subsequent policies and procedures adopted under the Records Management Program apply to: Any and all records created or received in conjunction with the operations of the Company, regardless of media or format. All physical locations where records are maintained, including corporate offices, call centers, and distribution centers of the Company and its United States affiliates and subsidiaries, as well as off-site storage facilities. All personnel (including employees and on-site contractors), who create, receive, manage, or use Company records. This Policy replaces all previous records management policies, procedures and guidelines of Company departments. In the future, all records management policies and procedures must be issued by the Legal department as described in this Policy. ORGANIZATIONAL PLACEMENT The Company's Records Management Program resides in the Legal department. ROLES AND RESPONSIBILITIES CORPORATE RECORDS MANAGER The Corporate Records Manager resides in the Legal department and is responsible for: Developing and issuing records management policies and procedures for review and approval by the Records Management Governance Board. Educating and training personnel on records management policies and procedures. Working with the Records Management Governance Board and executive management to effectively manage the Records Management Program. RECORD MANAGEMENT GOVERNANCE BOARD The Records Management Governance Board has oversight over the Records Management Program once it is implemented. The Governance Board is responsible for: Page 3 of 7

5 Approving amendments to the Records Management Program including, but not limited to, the Records Retention Schedule. Reviewing the Records Management Program and other relevant policies and procedures, as needed, to address changes in business organization; business processes: recordkeeping systems; and legal, regulatory, and operational requirements. Providing guidance to the Records Management Program on records management initiatives and activities. LEGAL DEPARTMENT The Legal department is responsible for: Authorizing suspension of the routine destruction of records by issuing records destruction holds needed to support ongoing audits, litigation, government investigation and other events. Authorizing the release of destruction holds. Notifying the Records Management Governance Board of significant changes in the corporate organization and/or changes in laws or regulations that necessitate a review of the Company's records management policies and procedures and the Records Retention Schedule. INFORMATION TECHNOLOGY (IT) DEPARTMENT IT - is responsible for: Assessing current system capabilities to comply with records management policies and procedures. Evaluating any new business applications, software, or upgrades to technology for the ability to support compliance with the Records Management Program. Developing, issuing, and implementing secure delete/destruction procedures for electronic records. Coordinating with the Legal department to monitor compliance with the Records Management Program for electronic records. Reviewing and monitoring any media conversions to enable electronic records being converted or reformatted to be managed in compliance with the Records Management Program. Developing and implementing plans for the long-term preservation and accessibility of electronic records per the Records Management Program. Assisting with the application and removal of destruction holds on electronic records. COMPANY DEPARTMENTS Company departments establish and maintain record keeping systems that comply with legal, regulatory, business and operational requirements, including those requirements established under the Records Management Program. The department head is accountable for ensuring that records management policies and procedures are implemented at all levels of his or her Page 4 of 7

6 department. Company departments are responsible for: Implementing records management policies and procedures at all levels of the department, including employees, temporary employees, and on-site contractors. Identifying and informing the Records Management Governance Board about business requirements for records. Overseeing the destruction of records in accordance with procedures established under the Records Management Program. Applying destruction holds on department records as directed. Informing personnel about records management policies and procedures. Ensuring that personnel participate in required records management training (in coordination with the Legal department). RECORDS MANAGEMENT COORDINATORS Each department must appoint one or more Records Management Coordinators. Records Management Coordinators are responsible for: Implementing relevant records management policies and procedures within their department. Assisting other personnel within their department with specific tasks associated with records management policies and procedures. Properly indexing, classifying and packing for shipment all records to be transferred to off-site storage. Coordinating departmental access to off-site records storage and associated activities. Obtaining and maintaining records management forms and supplies, if any. Acting as a liaison to the Legal department. COMPANY PERSONNEL Company personnel are responsible for the appropriate management and storage of their business records and for preparation of their materials for off-site storage. Specific responsibilities include: Creating, receiving, and managing records as part of their daily work according to established policies and procedures. Evaluating records to determine their appropriate classification and storage. Packing and preparing cartons for off-site storage per departmental protocol, with the assistance of the department's Records Management Coordinator. Page 5 of 7

7 Destroying records according to established records management policies and procedures. RECORDS RETENTION, STORAGE AND DESTRUCTION RECORDS RETENTION SCHEDULE STORAGE The Records Retention Schedule identifies what records are being managed and defines how long they need to be retained, based upon legal, regulatory, business and operational requirements. Departments must consult with the Legal department about any variations from the Records Retention Schedule. All such variations must be approved by the Records Management Governance Board. The Records Retention Schedule that has been approved by the Records Management Governance Board is the only retention schedule authorized for Company use. Records must be stored to ensure their protection, usability, and integrity for as long as they are required to be retained under the Records Retention Schedule or destruction hold orders (see below). Appropriate storage systems environments, handling procedures, media, and the physical and intellectual safeguarding of records must be considered in achieving compliant record keeping and in the implementation of the Records Management Program. Records must remain on Company premises or in Company approved storage locations, as determined by the applicable Company department in conjunction with the Legal department. DESTRUCTION HOLD ORDERS The destruction of records may be suspended under special circumstances, including litigation, government investigation, audits, or other actions that require the retention of records otherwise eligible for destruction. The duty to preserve and protect records during or in anticipation of litigation, government investigation, or audit supersedes the scheduled retention and destruction of records. All records, including hardcopy records, records and other electronic records, are potentially discoverable in litigation or in government investigations, regardless of storage medium or physical location. The Legal department is the only department with the authority to issue or release a "destruction hold" order that suspends the destruction requirements for records. The Legal department maintains a record of all destruction hold orders, both active and superseded. Destroying, discarding, withholding, or altering records pertinent to a legal, governmental investigation, or audit action is a crime. Persons found guilty of such actions may be subject to disciplinary actions, including dismissal. DESTRUCTION Official records that have met the Records Retention Schedule requirements, and that are not subject to any destruction hold orders, are eligible for destruction. Under no circumstance may duplicates or draft documents be retained longer than the corresponding official records. When records are approved for destruction, all copies in the Page 6 of 7

8 possession of personnel also must be destroyed. This includes copies in all media and formats, such as photocopies, microfilm copies, and electronic files stored on removable media, hard disks, file servers, magnetic tape, or other storage devices, subject to the limitations of specific software applications. Premature destruction of official records is expressly prohibited. Destruction of confidential official records should be carried out in accordance with the appropriate confidential destruction procedures. ELECTRONIC RECORDKEEPING TRAINING Like hardcopy records, electronic records, including and other electronic business communications that meet the definition of official records, must be retained, stored and destroyed according to the provisions of the Records Management Program. Also like hardcopy records, electronic records that do not meet the definition of official records should be retained only as long as actively needed and in no case longer than the official record. The Legal department is responsible for the creation, implementation, and administration of the records management training program. The objective of this training is to notify all personnel of the existence, scope, purpose, and importance of the Company's Records Management Program. The training program should include, but not be limited to, the following topics: Records Retention Policy Records Management Procedures Records Retention Schedule PROGRAM AUDITS The Records Management Program is audited every three years for compliance with the policies and procedures in effect at the time of the audit. The Director of Internal Audit is authorized to conduct these audits and report on Program compliance to the appropriate Company officials, including the Records Management Governance Board. POLICY MAINTENANCE From time to time, changes may need to be made to the Records Management Program to account for changes in legal, regulatory, business or operational requirements for records management and retention. The Legal department is responsible for notifying the Records Management Governance Board of any amendments that should be made to the Records Management Program to account for such changes. All departments are responsible for notifying the Legal department of any changes regarding the management and retention of records that fall within their purview. The Records Management Governance Board is responsible for approving any necessary amendments to the Records Management Program. The Governance Board also is responsible for reviewing the Records Retention Schedule for appropriate fit to the organization after any significant organizational change (acquisition, divestiture, or creation of new business lines) but no less frequently than every five years. In addition, the Governance Board is responsible for having the retention time periods reviewed through legal and regulatory research after any significant regulatory changes but no less frequently than every five years. Page 7 of 7