Electronic Records Management: Software Evaluation Decision Guide SELECTING A SOFTWARE PROVIDER AND IMPLEMENTING SUCCESSFULLY A MANAGEMENT DECISION GUIDE AUTONOMY CA EMC H-P HYLAND INFOLINX IBM INI INTEGRO INTERWOVEN/AUTONOMY IRON MOUNTAIN LASERFICHE OMNIRIM OPEN TEXT ORACLE THIS REPORT IS A CRITICAL GUIDE FOR RECORDS MANAGERS, IT MANAGERS, RISK MANAGERS, LITIGATORS AND IN-HOUSE COUNSEL, INFORMATION ARCHITECTS, DATA CENTER MANAGERS, INFORMATION SECURITY MANAGERS, AND COMPLIANCE MANAGERS RESPONSIBLE FOR IMPLEMENTING ELECTRONIC RECORDS MANAGEMENT (ERM) CAPABILITIES IN THEIR ENTERPRISE.
Who we are IMERGE Consulting is North America's largest and most experienced team of experts in the fields of enterprise content management (ECM) and business process optimization. IMERGE is also a leading provider of education courses in electronic records management (ERM), electronic document capture and e-discovery. IMERGE has offices in major cities including Boston, San Francisco, Toronto, Chicago, Houston, Los Angeles, Minneapolis, Seattle, New Orleans and Washington, DC. What we have achieved Our track record speaks for itself: We have completed more successful projects, published more articles and given more expert presentations than any other enterprise content management consulting firm in the world. We are proud that our organizations include some of the world s best and largest public and private organizations. Learn more about us at imergeconsult.com or contact an IMERGE professional today to discuss putting our expertise to work for you. About the Author Robert Smallwood, MBA, Master of Information Technology, Laureate of Information Technology is a founding Partner of IMERGE Consulting and has been recognized as one of the industry s 25 Most Influential People and Top 3 Independent Consultants by KM World magazine. Some of his past client organizations include Bank of America, AT&T, Xerox and IBM. He has published more than 100 articles and given more than 50 conference presentations on document and content management, specializing in email management and ediscovery expertise since 2003, although he worked in the legal vertical market for Wang Labs in the 1980s-90s. He is the author of the book, Taming the Email Tiger. 1
Disclaimer The references provided in this book should not be considered as legal advice, and is only provided as a resource and starting reference point for further foundation to your organization s own research. All cited references should be verified and updated with your own legal counsel and findings as applicable. Contents Overview...4 Why Records Management?...4 Managing Electronic Records Lags Behind Physical Records...5 Key Records Management Challenges...6 Electronic Records Management:...7 Electronic Records Management Standards...8 Ten Key Functional Requirements for E-Records Software... 10 E-records Software Market Overview... 11 Evaluating E-Records Software Providers: 10 Key Criteria... 11 The Evaluation and Selection Process: RFI, RFP or RFQ?... 16 Negotiating Contracts: Assuring and Ensuring Your Decision... 19 More Contract Caveats... 21 Five Key Trends to Focus on In Evaluating Records Management Alternatives... 22 E-Records Marketplace Quick Analysis... 23 Major Players in the E-Records Market... 24 Autonomy... 24 CA... 31 EMC... 32 H-P... 34 Hyland... 36 Infolinx... 37 IBM... 38 2
INI... 43 Integro... 45 Interwoven/Autonomy... 45 Iron Mountain... 46 Laserfiche... 47 OmniRIM... 48 Open Text... 48 Oracle... 50 Complementary E-Records Software... 51 Records Management and MS SharePoint... 53 Legal and Litigation Considerations: E-Discovery... 58 E-discovery Marketplace M & A Activity... 61 Consulting Firm Evaluation Criteria: How to Pick a Firm... 61 Additional Resources... 64 3
Overview Records Management underpins many key business activities by ensuring that business information is efficiently documented, tracked, controlled, maintained and disposed of. Records management ensures that an organization knows what information it has, is confident of its accuracy, and that it is discoverable in court and quickly accessible. Records Management ensures that controlled information is only accessible to those with the right of access and that it is duly retained according to corporate and legislative rules after which it is appropriately disposed of. Many organizations are swamped with unstructured electronic information which is neither properly filed nor securely managed though to appropriate disposal. This huge information asset, 80% of which is held in unstructured form, is often locked inside end-users' desktops and departmental file systems, embedded in collaboration and email systems, and integrated into business processes, creating a significant challenge for information governance and the mitigation of risk. 1 Why Records Management? Traditionally, records management solutions have been a mainstay of highly regulated industries that have significant government compliance and reporting considerations. However, recent changes in legal statutes and requirements have significantly broadened the need for records management solutions for every enterprise. 2 Notable industry drivers include: Changes in government and industry regulations. Industry and government regulations have been early drivers for records management adoption. Due to compliance regulations and legal risks (for example, SOX, SEC 17-a/b, DOD 5015.2, MoReq, ISO, and HIPAA) organizations need retention and disposition 1 http://www.meridio.com/products/records-management/index.htm Sept. 2009 2 Records Management and Office SharePoint Server Microsoft White Paper, 2007 4
policies, and failure to comply with these policies can result in fines or imprisonment. Legal ediscovery. U.S. Federal Rules of Civil Procedure will have an impact on companies across the board as they realize the need to implement records management to address new electronic discovery requirements. This ruling may be the most significant to affect records management adoption since the U.S. Sarbanes- Oxley Act. With these regulatory and legal changes comes increased attention to records management as a driver for corporate compliance. For most organizations, a lack of management solution seem daunting and cost-prohibitive. Managing Electronic Records Lags Behind Physical Records Electronic records are twice as likely to be unmanaged compared to paper records, according to industry researcher AIIM, with 26% of organizations admitting that no records management disciplines are applied to the majority of their electronic records. 3 AIIM also found that only 56% of organizations have a procedure for placing a freeze on electronic records in the event of pending litigation, compared to 71% for paper records. In addition, IT staff rather than records management staff are expected to carry out records management processes on electronic documents and emails. Based on over 700 responses, the AIIM research report entitled Electronic Records Management - still playing catch-up with paper shows that the volume of paper records is 3 http://www.publictechnology.net, Sept. 29, 2009 5
still increasing in over half of organizations, but in 21% it is finally showing signs of going down. Meanwhile, 70% of respondents report that the volume of electronic records is increasing rapidly, with none reporting a decrease. Over half of the respondents now scan newly received paper items and file them electronically. On the other hand, as well as directly filing incoming paper documents, 40% admit that they print newly generated electronic documents and emails for the purpose of filing them as paper records. AIIM found that over a third of organizations, if challenged, would not be confident that their electronic records had not been changed, deleted or inappropriately accessed. For organizations over 5,000 employees it rises to 43%. These companies would be at a major disadvantage in any legal action defending or prosecuting. The survey found that 13% of organizations are already using dedicated e-discovery tools with a further 22% planning to do so. Forty percent use functions within their ECM (Enterprise Content Management) or ERM (Electronic Records Management) systems for e- discovery, and 11% have invested in Enterprise Search to help with this. The survey was taken by 768 individual members of the AIIM community between July 30th and August 18th 2009, using a Web-based tool. Invitations to take the survey were sent via e-mail to a selection of the 65,000 community members. Key Records Management Challenges Difficulty applying retention policies to content. Organizations are struggling to apply retention policies to a wide range of content types in order to comply with regulations and business policies. High costs of complying with new laws and regulations. New laws and regulations are forcing organizations to quickly implement records management 6
solutions, and the burden of funding these initiatives can be high. Most companies are struggling to find a cost-effective solution for addressing new compliance requirements and minimizing corporate risk. Difficulty providing access to controlled records. While protecting the integrity of enterprise records is critical, it is not reasonable to expect that all corporate records are made inaccessible. The needs to continue standard business practices are sometimes at odds with the need to protect work product. Organizations are struggling to balance the need to provide accessibility to critical corporate information with the need to protect the integrity of corporate records. Heavy reliance on IT. Complying with and reporting on the records management process has traditionally placed a large burden on IT to perform administrative tasks. Poor user adoption of records management solutions. Many companies have experienced difficulty getting a wide range of users to adopt records management solutions across the enterprise. Electronic Records Management: Background and Introduction Electronic Records Management Definition and Positioning The International Standards Organization - ISO 15489 Information and Documentation Records Management, defines a record as Information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business. 7
Electronic records management (ERM) is the management of electronic records AND the electronic management of non-electronic records, e.g. paper, files, folders, boxes, CD/DVDs, tapes, audio-visual, and other physical records. Electronic records management is a component of enterprise content management. (ECM). ECM encompasses ALL an organization s digital content including email and attachments, word processing documents, spreadsheets, presentations, electronic forms, scanned images and other electronic documents, website and Intranet content, e-reports, electronic records and other digital assets. ECM consists of a variety of software applications and technologies designed to capture, manage, store, and provide electronic content to users. ECM is used to complete the lifecycle management of information, documents, and records. ERM extends ECM to provide control and to manage records through their lifecycle from creation to destruction. ECM and business process management (BPM), which is the automation of work steps in business processes, will add increased functionality to further improve and enhance the efficiencies in the day to day work environment. Efficiencies are gained primarily in labor savings and reduced errors. ERM adds the functionality to complete the management of information and records by applying business rules to manage the maintenance, preservation, and disposition of records. Both systems will aid in locating and managing the records and information needed to conduct business efficiently, to comply with legal and regulatory requirements, and effectively destroy (paper) and delete (digital) records which have exceeded their retention policy, freeing up valuable space, (physical and digital) and eliminating records that could be a liability if kept. Electronic Records Management Standards The National Archives and Records Administration (NARA) has endorsed the U.S. Department of Defense 5015.2 standard as an adequate and appropriate basis for 8
addressing the basic challenges of managing records in the automated environment that increasingly characterizes the creation and use of records. Records Management vendors can be certified as compliant with the DoD 5015.2 standard after verification from the Joint Interoperability Test Command (JITC) which builds test case procedures, writes detailed and summary final reports on 5015.2-certified products, and performs on-site inspection of software. In the U.K., the National Archives has published two sets of functional requirements to promote the development of the electronic records management software market (1999 and 2002). It ran a program to evaluate products against the 2002 requirements. While these requirements were initially formulated in collaboration with central government, they have been embraced by many parts of the wider public sector in the UK and in other parts of the world. The European Commission and the DLM Forum issued the standard MoReq Model Requirements for Electronic Records and Document Management in 2001 as a result of the IDA program of the European Commission. The update of the MoReq standard (MoReq2) was completed in early 2008.1 For more information on MoReq2, or to register your interest in providing input throughout the MoReq2 development phase, please visit www.moreq2.eu. The Public Records Office of Victoria (PROV) located in Melbourne, Australia published the Victorian Electronic Records Strategy (VERS) which includes a standard for the preservation, long-term storage and access to permanent electronic records. The VERS standard has been adopted by all Victorian Government departments. A digital archive has been established by PROV to enable the general public to access permanent records.2 Guidance on the management of electronic records can be found on the many websites of National and State Archives,3 and from the leading U.S. trade association for records managers, Association of Records Managers and Administrators (www.arma.org), the National Archives and Records Administration (NARA at www.archives.gov) or certain vertical market industry groups, such as the American Health Information Managers Association (at AHIMA.org) which is the leading trade association for healthcare records managers. 9