Risk & Compliance Chutes and Ladders

Transcription

1 Archiving and Records Management can help you meet them Optimized business Processes mean better Response times to Customer inquiries Compliance is Golden! CONGRATULATIONS! Corporate Governance means you create your own corporate compliance requirements Uh-oh the SeptaCycle Foundation is suing you for taking their idea. Detect bad behavior w/supervision CommonStore helps you to reduce investment for additional hardware Uh-oh each one of your people is generating 4 megabytes of every day your system performance is all over the floor Pre & Post Supervision of Find records whenever the need arises. Retain Records as a key corporate asset for years Single-Instance Storage reduces your DASD footprint Reduce in-house expense of legal IT Experts Monitor employee compliance Use visualization techniques to show relationships among people based on evidence btw- CommonStore for SAP can improve your SAP system performance Archiving is designed to reduce data on high performance disk devices You need to search through 3 years of on the 5-Wheel Bike project Search makes Legal Discovery a snap! El Searcho, El Findo! Risk & Compliance Chutes and Ladders Records Management allows you to store as a corporate record Archiving & Discovery for Lotus Domino & Exchange You have a Lotus Domino or MS Exchange infrastructure in place Start Welcome to Risk & Compliance 1

2 Compliance in an on demand environment IBM Software Group, Information Management Software It's not knowing what you don't know about retention that will get you and your corporation in trouble Tom Reding, CRM, Executive Consultant: Risk, Governance, & Compliance Solutions 2007 IBM Corporation

3 Compliance in an on demand environment IBM Software Group, Information Management Software Tom Reding, CRM Executive Consultant: Risk, Governance and Compliance Solutions 27 years as a client in multiple highly regulated industries, twice on the witness stand, four times deposed Industry-wide recognition as an author, presenter and contributor to industry standards and guidelines SME for info integration, content/document management, e-records management, and litigation support issues Corporations can not demonstrate compliance without Records Management 2007 IBM Corporation

4 Proposed Agenda Issues / Concerns / Questions Why don t we hear more about success stories? The Dichotomy: Opposing views Trends in Highly Regulated Industries regarding Retention? Strategic Inter-relationship between e-evidence Discovery & Retention Retention: When, Where, Who, How, Why Records Management enabled Retention Ensuring Consistency in Compliance & Records Management Enterprise-wide (including structured data records) Retention = Archiving and Records Management Retention Best Practices What to look for in Retention Solution Provider Q&A / Next Steps 4

5 Issues / Concerns / Questions Who is concerned about retention and why? Maintain in native format or standard format: Pros and Cons? Architecture: Manage within Server, ECM, Optimized Repository? Employ WORM / WORM-like Storage Media: Best Practice or Nightmare? Migration of Media and / or Data Format: What needs be considered? Preservation and Protection of Metadata: An issue of integrity Beyond Retention: The balance of enterprise (federated records mgmt) Convenience copies: Should we care? Retention Management vs. Records Management? Single Instance Store: s, Attachments, Both? Discovery: What are the Facts and Options? 5

6 Why don t we hear more about success stories? Corporate reluctance to draw attention to themselves Evolutionary process, not convenience they have arrived A first or early phase deployment, desire to wait until more mature 6

7 Value Proposition for Records Management The courts will view the following as BAD = 1.NOT having a Records Management Program 2.NOT having a consistent deployed Records Management Program Single Enterprise Search / e-evidence Discovery (records & non-records) Consistency in the declaration and classification Consistency in ability to declare non-records as records Centralized application & release of Hold Orders Centralized disposition authority for the enterprise 7

8 Management vs. Retention Dichotomy Legal mandates, regulatory requirements, and good business practices dictate retention; while Corporate policy requires deletion of large in-boxes and files after a specified length of time or reaching space limits. 8

9 Are you one of those in the Board Room or middle management? 9

10 Examples of What NOT to do Compliance Hall of Shame Bernie Ebbers Former CEO of WorldCom Now Serving 25 Years Luke Duffy Formerly of Bank of Australia Now Serving Time, Took Down CEO Ken Lay Former CEO of Enron Facing 175 Years Gale Norton Secretary of the Interior Held in Contempt of Court Morgan Stanley Fined $1.45 Billion Stock Price Down CEO Removed Liu Jinbao Former CEO of Bank of China Now on Death Row 10

11 Compliance in an on demand environment IBM Software Group, Information Management Software 2007 IBM Corporation

12 Effective Records Management is the Goal for MOST Corporate Legal Departments. 12

13 What are the Implications? More audit and court fines, out-of-court settlements, etc. regarding than another other document type. Implications of Unified Communication: Retention of those Communications , Instant Messaging (IM), fax, v-mail, Snail Mail,??? (what s next) What is your corporations Legal Position? Keep everything destroy nothing Keep nothing destroy everything All is created equal Regulatory Drivers: FRCP, SOX, HIPAA (health care), SEC 17a-4 (financial services), various whistle blowing, harassment, Ensure timely and complete disposition / expungement of ALL copies Ensure privacy and record security policy 13

14 Retention: When, Where, Who, How, Why? When: at point of creation, To or first cc Addressee Where: incoming and outing communications When sending, at workstation by sender, When receiving, journaling, server, inbox Who: automated, Administrator, End-user (journaling / server) How: when journaling (automated), upon receipt at server (automated), upon opening (end-user), upon saving (end-user) Why: to ensure responsibility, integrity, trustworthiness, completeness, authenticity Redaction: When, Where, Who, How, Why Encryption: When, Where, Who, How, Why 14

15 Age Of Electronic Discovery Discovery shifting from paper to electronic information Electronic records growing exponentially Information increasingly exists only in electronic form and in many locations Storage is getting cheaper Lack of court guidance, Lack of corporate awareness. New Federal rules took effect December 1,

16 Most Corporations Unready for New Federal Rules of Civil Procedure on Electronic Evidence 16

17 New FRCP: How Does This Impact You? Your Organization faces a >95% chance of litigation in 2007 You MUST know where your documents live You MUST keep relevant documents with metadata FULL Records Management is INEVITABLE You MUST be able to search for and present documents intact regardless of location Evidence Discovery Legal Search Redact Review Present 17

18 Summary of Rule Change / Clarification An assessment of the organization s information policies and procedures to ensure that the right records and information can be located, preserved and produced for discovery when necessary. The creation of an effective Legal Hold policy to stop the destruction of records and information due to routine business processes or other reasons. A process for disseminating a clear and effective Legal Hold notice to inform employees and others of their responsibility to preserve certain records / information for litigation. Assessment of the organization s IT infrastructure to ensure it can effectively support the Legal Hold process and preserve all necessary records and data compilations without hindering business processes. Points of contact across the organization s business units that possess a thorough knowledge of their areas records and information, as well as what form those records are in and where they are located. 18

19 Summary of Rule Change / Clarification (continued) Within 30 days of filing a discovery order opposition counsels must meet to decide how to handle electronic evidence discovery. Firms must agree on what records are shared and in what format. Gartner Analyst John Bace said, companies will need to act immediately to avoid the potential for sanctions and "negative inferences" in court battles; organizations should quickly take steps to develop records retention policies and content management procedures to help protect the organization in case records are lost. 19

20 Business Problems & Pains Administrator: My users are complaining about poor response time I need to keep adding more and more disk storage because of the explosive growth in volume and large attachments. Backups and restores take too long. It s a challenge to keep control of our system CIO: I think it s ridiculous that we have so much redundant information being stored in our system. People send the same and attachments to multiple people and we store the same information multiple times The business units are all over me about the restrictions we impose to keep mail box sizes down Line of Business Executive: My employees don t have the time to think about which s should be saved and which should be destroyed. We need a standard policy There are a lot of s that are customer service related that we never see or know about because we are not included in the distribution. It would be great if we could do a search on a repository for specific words, terms or names to see all the s our customers are sending Compliance Officer: If we are not NASD\SEC or Sarbanes-Oxley compliant, we could be liable for sizable fines I must be able to show that our management process prevents s from being altered Chief Legal Counsel: We have a lot of legal exposure because some s are on desktop PC s or backup tapes that should be destroyed while there are other s that we need to keep that we cannot find. Our chances of winning favorable judgments in litigation are reduced when we cannot show that we have a usual and customary process for managing and other records. It is a slow & expensive process to search s that are on backup tape. 20

21 Discovery Facts A 2004 survey of 840 U.S. companies co-sponsored by the epolicy Institute found 21% had their employee and instant messaging subpoenaed, up from 14% in a 2003 survey. The trend extends beyond U.S. borders, too. The Singapore High Court allowed presentations of s as evidence in a legal dispute. According to Gartner Research, most major corporations are dealing with an average of 86 lawsuits at any given time at a typical cost of between $1.2 and $1.4 million per suit before any judgments or settlements are made. According to Osterman Research, nearly three out of four enterprises have faced a requirement during the past three years to search through backup tapes to recover old s in response to a request from the legal department, human resources department or some other entity within the enterprise. The average messaging user sends and receives nearly 25,000 s annually. The use of continues to increase at a breakneck pace, which will inevitably attract even more discovery requests. Discovery is expensive. Many legal discovery requests must be fulfilled within just 72 hours. Without the proper tools and policies, a single legal discovery of your can cost from $150,000 to more than $250,000 per legal matter. Gartner says the average cost of a single e-discovery case for a major corporation is $1.5 million. 21

22 Traditional e-discovery of Retrieving from tape back-ups involves: Retrieval from un-indexed tapes, usually off-site; Restoring and searching for information on each tape, which may cost $2,000 - $5,000 per tape; Search based on context and content extremely costly and time consuming; No guarantee that the requested records are even recoverable. 22

23 The Process of e-discovery involves: 1. Evidence Collection Identifying relevant repositories, storage medium, etc. De-duping (removing duplicate messages & attachments) Identifying relevant and responsive messages & attachments (via metadata and/or full text searching) Identifying with critical IT staff are going to be pulled off their normal duties to devote to this immediate endeavor 2. Evidence Processing Extracting metadata from the s & attachments Ensure the integrity and inalterability of the metadata is maintained throughout the restoration process 3. Evidence Review Design, development, and establish a hosting location for the evidence review database to support the discovery process 4. Evidence Production Creating output of messages & attachments deemed to be responsive to the discovery request (commonly native file format so as to maintain header information many times called for during litigation) 23

24 Retention = Archiving and Records Management Architecture for Retention Solutions: Pros & Cons Manage within Server: Pros: Manage where maintained, one copy Cons: Effect on server performance ECM: Pros: Leverage existing investment, manage all unstructured content within a single repository, ability to leverage retention / records management technology available internally Cons: May lack ability to maximized for retention and discovery Optimized Repository: Pros: Self describing, ability to leverage retention / records management technology when / if available Cons: Ensure completeness of enterprise-wide discovery of any and all information dealing with, unless federation is employed Retention Management vs. Records Management: Retention Management: Default retention, all is considered equal Records Management: Ability to apply granular retention policy to based on the content 24

25 Retention Management and Records Management Both are Important Records Management 1. Control of official Records Documents that need the full recordkeeping process/control 2. Formal Declaration of Business Record Policies/Procedures must be in place. Everyone must be engaged! 3. Full Formal Records Control Formal control by a professional RM practitioner, and formal structured process. Enforced recordkeeping oversight 4. File plan and retention schedule Formal, managed, approved retention periods and their assignment 5. Records-based Access Control/Security Access based on corporate-wide security/information management model 6. Destroy according to retention plan Only Records Practitioner or designate can destroy records Destroy according to retention schedule only Retention Management 1. Control of non-records Documents that do not need formal records control, Or Records that have yet to come under formal records control, Or Records with no assigned retention rule 2. No Records Declaration Ad-hoc assignment of retention periods and destruction dates. 3. Informal non-records control No professional practitioner, informal unstructured process Recordkeeping oversight not enforced 4. Ad-Hoc Retention period, destruction date, legal holds Not necessarily according to a file plan or retention schedule 5. Ad-Hoc access Control/Security Access based on immediate business need 6. Destroy based on business needs Any designated person can delete Delete when no longer needed 25

26 Search for within Archiving Solutions vs. Records Management Legal Hold Functionality Functionality Ability to apply and release a hold order to Ability to apply and release multiple hold orders on the same during the same time period (disposition will not occur until ALL holds have been removed) Search x x Records Mgmt x x Ability to apply and release multiple hold orders on the same at the same time (in a single process) Any authorized user has the ability to apply and release hold orders on Ability to apply and release multiple hold orders across all known data / record types (desktop documents, transactional documents, structured, unstructured data, physical records, etc.) Extensive and searchable hold order audit trail capability on (who applied / released what and when) Extensive and searchable hold order audit trail capability on all known data / record types (who applied / released what and when) Extensive audit trail capability on usage (view, print, copy, repurpose, declared, disposition, lifecycle transition, etc.) Extensive audit trail capability for all known data / record type usage (view, print, copy, repurpose, lifecycle transition, etc.) x x x x x x x x Full functional records management capability for all known data / record types including (formal retention, disposition, lifecycle transition, security policy, etc.) and US Government certified x 26

27 Discovery In A Compliance Framework A suite of tools that allow you to quickly discover, review and produce documents, regardless of storage location, in a legally compliant way. Imaging Management File System Management Locate documents wherever they exist Manage responsive documents across multiple cases Enforce Duty to Preserve and legal holds Records Management Electronic Discovery Prove Compliance 27

28 Discovery and Production are Equally Important Discovery is the ability to find and access information Locate relevant information on demand Across all content silos and storage mediums Irrespective of records or non-records Production is the ability to bring it all together for submission In a timely manner These elements are just as critical as the retention and records management policies and processes 28

29 Best Practices Start small, but high profile, pick an advocate Define and agree upon success criteria Measure the success criteria Minimize impact on end-users - automate, automate, automate Minimize impact on corporate culture change Priority should be on the business process, not: Software, Media, or Data format Use WORM / WORM-like technology ONLY when / where required to Whiteboard your file plan prior to designing in the policy engine (similar to a database) 29

30 Next Steps Set expectations, define pilot & measure deliverables, don t over commit Know your Regulatory Requirement & Business Drives Know your allies and their drivers ECM vs. dedicated Repository? e-discovery Solution? Secure at Storage Layer or with an Records Management Policy Engine? 30

31 What to look for in Discovery & Records Management Solution Provider Deliver the appropriate mix of technologies required to meet your requirements Efficiently integrate the various technologies into a seamless solution Incorporate strong knowledge of the specific industry requirements into the required solution Integrate the overall solution into our customer s internal framework of policies and processes that reflect the requirements you have defined 31

32 What to look for in Retention Solution Provider Completeness of Solution (capture, supervision, discovery, storage, migration, retention, holds) Track record for successful deployments Platform independence Scalability, Performance, Throughput Support for Storage Solutions including CAS Compression & Format Hierarchal Storage Management in the solution Support, Maintenance, Strategy 32

33 Archiving & Search All s are captured by archiving solution. / IM System The Search application should have export feature to copy selected s from the repository for litigation or other reasons Archiving Archiving Solution Solution Search Upon ingestion s should be given a default retention rule Content Management Content Repository Management / Repository The Search allows for the search and retrieval of s across multiple mailboxes based on attributes and / or full text. 33

34 Archiving, Search & Records Management / IM System Hold Orders should be placed on s from the within the Search application. Archiving Solution Search Upon ingestion s should be given a default retention rule Content Management / Repository Records Management Solution The records disposition process will utilize the the Content Management solution workflow for the deletion process. s outside of the default retention are declared as records. 34

35 Full Enterprise-wide or Federated Records Management / IM System Archiving Solution Search The solution is designed for growth to meet all potential future Records Management requirements. Content Management / Repository Other Content Systems File Systems Enterprise Content Integration Solution Records Management Solution 35

36 Predictions made three years ago Archiving Solutions and Data Warehouses Insurance Underwriters impact on Records Management Information Assets and Information as a Liability Challenge what we generate and keep and why Fast forward to today 36

37 How Many Times Do You Want to Pay for that Information that is NOT required? 1. Generation 2. Management (retain, preserve, and protect) 3. Search and Retrieve (audit, litigation / discovery) 4. Fines / Penalty / Settlement 37

38 Questions & Answers Compliance in an on demand environment IBM Software Group, Information Management Software Risk mitigation can NOT be realized, nor good corporate governance, and compliance achieved without records management. In the end, all that matters, is our integrity IBM Corporation