Records Management: The Digital Dilemma

by Debra Haverson

Enron, Coca-Cola, Union Bank of Switzerland, the Rose Law Firm — what do these organizations have in common? All have been accused of destroying official documents and some have faced severe consequences. Yet paper documents are only the tip of the records management challenge.

According to Robert F. Williams, president of records management consulting firm Cohasset Associates, Chicago, electronic records are much more difficult to manage than paper records.

"The challenge really starts with the question, 'What is a record?' " Williams explains. An electronic record may contain information that comes together from more than one system in more than one place, plus it has metadata (information about creation and access) associated with it. "So we have a whole new set of paradigms."

Many records managers are frustrated to discover accidentally deleted records, while others see expensive email servers full of obsolete or legally incriminating messages like the ones that plagued Microsoft and that may yet add to the troubles of Enron and Arthur Andersen.

The full story behind the records management challenge includes a complex mixture of legislative history, market forces, business practices and technology trends. Beryl Snyder, information management policy and standards coordinator at Chevron-Texaco, San Ramon, CA, advises users to "understand it's going to take a long time" to figure out the best course for your company.

Assess Business and Technology Issues

Many companies have management policies in place for paper records, but they may have a false sense of confidence that their computer systems reliably capture records such as email.

"The IT community has been focused on producing documents faster, prettier and cheaper," says Williams of Cohasset. "That does not take into account the life cycle management responsibilities that are associated with records."

Williams calls for "a new mindset" on assessing compliance and legal risks. Yet there are few specifics to point to due to a lack of legal precedents. "Case law is fact-specific; statutory law is policy-specific," Williams says. "We're evolving quite rapidly in the policy-specific area, but it will take a decade or more before we get a meaningful body of case law."

In the meantime, corporate lawyers may err on the side of wanting to keep too much content. No one is sure just when it's prudent to keep, for example, metadata or audit logs of who accessed an email through a link to a document repository. From a business point of view only, Williams says he's not certain that keeping so much information makes sense. "That's where case law is going to come in," he adds.

Unfortunately, companies have to make business decisions about electronic records retention now in anticipation of what future case law might dictate.

Case law will involve all types of content. According to Mark Gilbert, research director, content management community at Gartner, Stamford, CT, the business world has begun to use the term "rollback" in relation to Web sites.

"What's surprising is that Web sites have so much publicly available information on them, but it's very rare that companies can recreate the Web site they had even three to four months ago," says Gilbert. "People need to start viewing their Web sites as something that may end up in a records management system."

Some Web content management system providers are adding ways to maintain site records. For example, Stellent (formerly IntraNet Solutions), Eden Prairie, MN, now integrates its content management software with the Foremost records management system, from Arlington, VA-based TrueArc. This integration can take site snapshots and manage them as records.

Site records management may extend beyond just the content available on a particular date. According to Rich Medina, a principal analyst at Chicago-based Doculabs, legal and regulatory mandates may call for customers to be able to replay the experience they had during a Web transaction. A few vendors can help companies meet this requirement, including document management vendor Tower Technology of Boston. Tower markets an application called WebCapture that records the sequence of screens encountered during an online transaction. An email confirmation can be sent that will allow the customer to click and view the securely stored replay. (Note: Tower Technology should not be confused with Tower Software, Reston, VA, a well-known records management application vendor.)

What's a Record?

Companies must determine what content needs to become a corporate record with an established retention schedule. This decision demands an assessment of long-term business and regulatory needs as well as potential legal risks. This self-evaluation must include core business systems including ERP and accounting; email systems such as Microsoft Exchange; report and output management tools; e-commerce solutions that enable dynamic Web sites with online forms and transactions; and collaboration tools such as project extranets and online conferencing.

Once critical content is identified, companies should assess the records management features of their existing technologies, including document management systems and content management systems. Don't operate under the erroneous assumption that all these systems "keep records."

"The critical processes of records management were [often missing] in document management software," says Mary White-Dollman, the corporate records management director at Houston-based Conoco. "There was no classification function, no systematic retention management according to business rules, no way to suspend destruction and preserve e-records if required and no way to actually delete records and indexes at end of life cycle as required."

More of this type of functionality is coming to document and content management in 2002. For example, Open Text of Waterloo, Ontario, purchased the records management company PS Software and customized its IRIMS product to be a module in the Livelink collaborative knowledge management system. Documentum, IBM and Interwoven are among the other content management vendors (in addition to Stellent) that have addressed records management needs.

Adding Records Management To Other Applications

Bruce Miller believes in bringing records management functionality to existing applications. As an original founder of Provenance (now TrueArc), Miller says he spent 10 years trying to convince users that records management wasn't "a minor administrative function." Miller left TrueArc in 1999 and started Tarian Software, a Fairfax, VA-based company that takes an integrated approach.

"Our engine has no user interface," says Miller describing the Tarian e-Records Engine. "It's meant to be embedded directly inside another piece of software."

Miller cites the frustrations he witnessed as companies struggled to integrate records management products with document management systems. They had to deal with overlapping layers of features and "repeating repositories." Miller claims Tarian's integrated approach is easier, cleaner and more user-friendly than conventional records management products.

So far, Tarian has sold this concept to Lotus and IBM, among others. Behind the scenes, Tarian's records management engine can set up the file plan for a classification and retention schedule and set up triggers that automatically save content as records. Depending on how the engine is embedded, users may be provided with options to classify documents manually.

Other vendors also recognize the desirability of built-in records management features. Sally Plows, records management product specialist at Open Text, says customers asked for tighter integration of electronic records management within its Livelink product. One key objective, she says, is to make this function "transparent so that users aren't very aware that it's going on." An organization creates a folder hierarchy in which users place documents, including emails, and the records management systems apply the classification and retention schedules established by the corporate records manager.

Tackle the Email Beast

Nothing seems to present a more daunting task than email records management. "There is lots of talk about [email] solutions, but so far most have been targeted at specific industries like brokerages and are not viable for larger organizations," says White-Dollmann of Conoco.

TrueArc specifically addresses email content with ArcIQ, an auto-classification engine within its TrueArc for Microsoft Exchange product.

"We have a large corporate customer that estimated that up to 70 percent of its email doesn't need to be stored for more than six months, but 30 percent does need to be kept as official records," says Russell Stalters, president of TrueArc. "If you have a way to distinguish that 30 percent and get rid of the 70 percent, then 70 percent of your long-term storage costs can be eliminated. For a 30,000-employee company, that can be a significant [cost savings]."

ArcIQ inserts many automatic records management steps into the usual email system. For example, when an individual saves an email, a prompt appears with a yes/no choice asking if the user would like to make this a corporate record. In some cases, this "opt out" could be eliminated if the company determines that certain documents (for example, a broker's correspondence with a customer) must always be retained to comply with a regulatory, legal or business need. Retention rules could also be triggered automatically by actions such as publishing content to an application like Microsoft SharePoint Portal Server.

Email can become an area of conflict between IT and records management watchdogs. IT worries about storage capacity and network capacity and may see emails with a URL pointing to a central repository as an efficient solution. Records management personnel are concerned not only with content but also with whether the company needs the associated metadata.

"A lot of organizations, from a policy perspective, would like to know who opened up the email and have that file [with metadata] as a record — even though the content may be identical to what was sent out on a distribution list," says Tim Shinkle, TrueArc's chief technology officer. These two different records, he adds, may also have different retention schedules.

Take It Slow

Trying to please everyone is a tough task, but that's the goal of many records management vendors and corporate initiatives. Gaining the cooperation of end users is crucial, something too often neglected in first-generation efforts. Early deployments also failed because they didn't have tight integration with email servers, ERP systems and document management systems. Some vendors have overcome these problems, but analysts caution managers not to rush into the implementation stage. The best strategy is to establish a comprehensive plan for records management and then test and ensure the success with one small-scale project at a time.

Beryl Snyder of ChevronTexaco is an outspoken proponent of the take-it-slow approach. After three years of study and planning (with some delays as merger requirements took priority last year), her company is moving slowly but surely toward developing an enterprisewide records management strategy.

"People know records management has to happen, but it is not the piece that will be the front end with users," says Snyder. "And companies are not going to staff up to have [records managers] behind the scenes doing it for them. There's got to be some magic to this, but we don't know what it is yet."

Snyder says the time spent reducing departmental compartmentalization and working with end users to identify common challenges will build a team approach and an overarching vision of how to manage electronic records. ChevronTexaco's approach must make information in the SAP, FileNet imaging and Documentum applications and data warehouses more accessible — either through an SAP-proposed solution or a Plumtree portal. The petroleum giant's records management functions will be handled by TrueArc's Foremost system and email management software.

Snyder says there is the dilemma of how to make it easy for users but not take away their control over the information they have created. Content authors want, need and deserve to be involved in the transition from document to corporate record, she says.

"There's a huge culture change for our company in trying to put controls on something that was formerly discretionary," Snyder explains. "Now a trend is that employees have become so burdened by all this information that they thought they could manage themselves that we're starting to see some willingness to turn it over."

Snyder says her company has a "100 MB club" of email users who receive a notification when their Microsoft Outlook mailbox contains more than 100 MBs of messages. A likely possibility for the upcoming records management implementation is to have an easy, unobtrusive way for users to move documents into TrueArc based on email retention guidelines Snyder developed. The company would build in rules about what to delete from email. For example, one rule might assume that any email the users still have not moved to the records management repository one year after creation can be deleted. Alternatively, the rule could provide notification to someone that these documents should be deleted and ask for manual confirmation to do so.

Plan for Success

Williams of Cohasset cautions that the answer doesn't lie in giving users complete ownership of corporate records. Records managers, with their independence and neutrality, bring a higher level of accuracy and reliability to the process, he says.

"Senior management needs to take a value-based approach," he says, committing both IT and records management people and resources to the process. "It's a multidimensional problem that requires a team solution."

Companies also need to invest in enterprisewide solutions, says Valerie King-Bailey, vice-president of global marketing at Qumas, a Florham Park, NJ-based provider of compliance management technology. "In order to be truly successful, it needs to be deployed throughout the company," she says. To get past internal politics and predispositions to limited technologies, she asserts that an edict has to be issued by "C-suite" executives such as the CEO or the CTO.

Finally, analysts and records managers agree that companies can't bring users in too early. Vendors, integrators and records managers are still coping with new technologies and facing new problems. Rather than letting your company become a guinea pig, prove systems offline in small-scale tests. If early attempts to implement a massive system fail, then the records management team may lose the faith and cooperation of end users. Worse yet, they might lose resources and management support.

Debra Haverson (hercster@bcpl.net) is a freelance writer based in Baltimore.

Records Basics

Mary White-Dollmann, corporate records management director at Conoco, defines records management as, "The systematic control of all records from their creation, or receipt, through all their processing distribution, organization, storage and retrieval to their ultimate disposition." She says the functions of records management software are records registration (capture), retention calculation, disposition control, deletion and suspension of deletion to support litigation. The software is used to control significant business records in any media including engineering, legal (contracts), HR, medical and financial records. Some of these features may sound like document management functions. But White-Dollmann draws clear distinctions between the disciplines of document management and records management, as the graphics below illustrate.

Enron & Records Management Ethics

Retention and destruction both have a place in content life cycle management, but in the wake of recent headlines regarding massive document shredding at Enron and its accounting firm, Arthur Andersen, you might wonder how far these companies strayed from accepted records management practices. Could such policies sanction the destruction of records that might later be viewed as incriminating evidence? For answers, we turned to Charles Dollar, senior consultant at Cohasset Associates, Chicago, and author of more than 20 publications and reports on records management, including the book "Authentic Electronic Records: Strategies for Long-Term Access" (Cohasset Associates, 1999).

Transform: If a company such as Enron was knowingly deceiving investors and regulators, would you expect that company to be diligent about records management?

Dollar: You don't really expect people who are cooking the books to knowingly or completely document what they do. But the fact is that, absent any other means of preserving memory of events, transactions and who's supposed to do what, creating records is the natural process of doing business, whether it's legal or illegal.

Transform: If Enron executives had assiduously enforced records management principles, is it possible that they would have destroyed damning evidence as a matter of policy?

Dollar: There's a great deal we don't know about the internal operations of Enron. I've read that there was a records retention schedule in place, at least at Arthur Andersen. Based on that schedule, it might have been entirely appropriate to destroy some records. For example, records with a three-year retention period should be destroyed after three years. But if the company had reason to believe that some of this material might be required in a regulatory hearing or litigation, then case law suggests that even though the retention period had expired, the documents still should not have been destroyed. If there is a court-issued "hold order," a company absolutely may not destroy documents.

Prudential Life Insurance got into a lot of difficulty four years ago on this very point. The company received a class action suit and a court order saying, "do not destroy any records." Somehow this message was not adequately communicated to all the right people at Prudential, and records continued to be destroyed. A senior executive was fired, and the company was required by the court to put in place a records management program that cost millions of dollars.

Transform: What is the basic, underlying motive for companies to practice conscientious records management?

Dollar: One motive is risk management, to comply with regulatory and legal requirements. Some regulators require that documents be kept for seven years. There are instances, such as with contracts, where a statute of limitations mandates that records be kept for a certain period of time. It's useful to retain records in anticipation of potential litigation; if your company is accused of misusing funds, and you have records that document that the allegations are false, you can prevail in the court of public opinion. Finally, you keep records simply in order to continue to do business — to protect the intellectual property of the company itself and preserve a history of what it has done. - PL