Downloadable Course Contents If you d like a copy of the course audio, click to download a PDF version of it.

Transcription

1 What is RIM Legal Disclaimer This course is for general information and educational purposes only. It is not intended to serve as legal advice and the contents should not be relied upon in any specific factual situation. Links At times a word or phrase may appear in blue type. Click these items to download a document or to visit an external site in a new window. Additionally, roll your mouse over words that are in red type to receive more information. Audio The contents of each screen are presented in audio. If you d like to mute the audio, click the icon that is highlighted below. To hear the audio, simply click the same icon again. Downloadable Course Contents If you d like a copy of the course audio, click to download a PDF version of it. Outline Section 1: The Business Case for a Strong RIM Program Section 2: Key Components of a RIM Program Section 3: Standards and Best Practices Section 4: RIM Tools and Technologies Course Learning Objectives Upon completing this course, you will be able to: 1. Explain why a strong RIM program is essential to an organization s success 2. Identify the components of a successful RIM program 3. Identify key standards and regulations that apply to RIM 4. List the tools and technologies that are commonly used in a successful RIM program Course Introduction When you tell people what you do for a living, how do they react? Many records managers face stereotyping and other misperceptions as they progress in their careers, from, So, you re-shelve files all day? to, You ll be out of a job soon, since everyone is going paperless. In reality, records management is a dynamic field with emerging responsibilities in a world that s increasingly dependent on technology. 1

2 This course gives you a brief overview of records management. Throughout the material you will find links to other courses and resources that take you deeper into each subject. What is a Record? Records are recorded information, regardless of medium or characteristics, made or received by an organization in pursuance of legal obligations or in the transaction of business. They are business assets that support an organization s mission, operations, and activities. They have value and add to the intrinsic worth of an organization. Records come in many forms, including a receipt, a customer order, a contract, policies and procedures, personnel files, s, and more. Successful records management programs assist organizations in the rapid, accurate retrieval of information to enhance decision-making processes, provide proof of financial and legal transactions, and capture an organization s growth, change, and milestones. What is RIM? Records and information management (RIM) is the field responsible for efficiently and systematically controlling records. RIM s accountability begins with record creation or receipt and continues through maintenance, use, and disposition. It includes processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records. Formal RIM programs are primarily concerned with the following aspects of information management: Organizing active records for retrieval when needed Ensuring compliance with recordkeeping laws and regulations Determining how long to keep recorded information (known as retention and disposition) Protecting vital records and incorporating their protection into disaster recovery and risk management plans Managing inactive records Purpose of This Course ARMA s Essentials of RIM certificate focuses on the many facets of records management. What Is RIM? is an overview of the importance of a strong RIM program, including a good program s key components, standards and best practices, and the tools and technologies available to records managers. You ve chosen a demanding and interesting field. Let s take a closer look. 2

3 Section 1: The Business Case for a Strong RIM Program Section 1 Learning Objectives Upon completing this section, you will be able to: 1. State why RIM programs are typically created 2. Describe why good records management is important to an organization 3. Explain how The Principles and the Information Governance Maturity Model are beneficial in establishing or evaluating a RIM program 4. Describe the roles of upper management, legal, and IT in establishing a successful RIM program Introduction A solid records management program is a collaborative effort among all employees within an organization. As with most initiatives, support from upper management reinforces in employees minds the critical role that solid recordkeeping practices play in an organization s achievement. IT likely will be your closest collaborator, and legal will help you ensure your recordkeeping practices are compliant and defensible. But your program s success depends on every employee s efforts. Establishing a RIM Program A records manager s clients are generally employees who need information to do their jobs. The challenge is making those records readily available in a systematic manner that is both user friendly and legally defensible. In How to Successfully Implement an E-Records Management Program, Mimi Dione and Adele Carboni state that Records management (RM) programs are typically created for one of four reasons the last two being the most common. Management embraces RM principles because it wants to manage its records better The organization recognizes that proper RM will give it an advantage over its competitors The organization is unable to locate important records and wants to improve its ability to do so A litigation hold or investigation prompts the organization to focus on RM Benefits of Solid Recordkeeping It s your role as a records manager to ensure that your organization or business unit is maintaining adequate records. An often-unheralded benefit of a strong RIM program is that identified weaknesses in records can reflect weaknesses in processes and procedures. 3

4 For example, imagine that a library has a written policy stating that accounts with fines older than 30 days will be turned over to a collections agency. Under this same written policy it s stated that children under age 18 are exempt from being turned over to a collections agency that their parents will be held liable instead. However, a RIM audit unearths children s accounts that were turned over to a collections agency without notifying the parents. Correcting the records and improving recordkeeping practices usually corrects the larger problems. Protecting Vital Records Another obvious benefit of a solid RIM program is the protection of vital records, those records that are fundamental to the functioning of an organization and necessary to continue operations without delay under abnormal conditions. In organizations with shoddy recordkeeping, vital records are lost, accidentally destroyed, or at least compromised. We will look at the logistics of protecting vital records in the next section. For more on vital records, see ARMA International s Vital Records and Business Continuity online course. The Principles An enterprise-wide approach is important for consistent records management practices, but if your organization doesn t have an established RIM program, it s hard to know where to start. ARMA s Generally Accepted Recordkeeping Principles can guide: CEO s in determining how to protect their organizations in the use of information assets Legislators in crafting legislation meant to hold organizations accountable Records management professionals in designing comprehensive and effective records management programs We ll talk more about The Principles in Section 3. Information Governance Maturity Model ARMA International s Information Governance Maturity Model helps organizations evaluate their recordkeeping programs and practices by: Identifying gaps between the current practices and the desirable level of maturity for each principle Assessing the risks to the organization, based on the biggest gaps Determining whether additional information and analysis are necessary Developing priorities and assigning accountability for further development of the program The maturity model is an important tool for getting your RIM program up to par. 4

5 Keys to Success Executive-level participation is key to a RIM program s success. Upper management s involvement provides a budget and resources, lends credibility to the importance of solid records management, and enforces required training and practices. Because RIM is interdisciplinary, records managers must collaborate with colleagues organization-wide, at all levels, to understand their business needs, what takes place within their business units, what records are necessary to conduct business activities, and how the organizational culture is reflected. You don t need to be an expert on everything, but you must know enough to be able to ask the right questions and provide proper RIM guidance. It s important to communicate across the organization the idea that information is an asset, just like people, buildings, and finances. Collaborate With IT Most IT employees have little or no exposure to records management principles, so they are often unaware of the requirements related to the records in the systems under their care. Collaborate closely with IT to be sure the organization purchases technologically compatible records management tools. For example, accessibility to electronic records with long-term retention requirements may require that software and hardware be maintained beyond their operational life. Without proper planning and communication, the IT team may be unaware of these requirements. Get IT s input on such issues as RIM software, electronic document management systems (EDMS), electronic records management systems (ERMS), electronic document imaging, cloud computing, document classification and taxonomy solutions, and more. Involve Legal It s also important to collaborate with legal when establishing a RIM program. Legal will: Confirm that RIM practices, policies, and procedures meet the organization s legal needs and comply fully with all applicable laws and regulations Identify and advise business units and employees about records that are or may be required for actual or potential litigation or government investigations Issue written directives that formally suspend destruction of specific records and remove such suspensions when appropriate Provide written legal opinions, interpretations, and clarifications, as appropriate, about the organization s records management plans, strategies, policies, procedures, and retention schedules Legal and Regulatory Support Compliance with legislation and regulations is an important RIM function. By staying on top of legal recordkeeping requirements, records managers can save their companies from huge penalties and public relations nightmares. 5

6 In the United States, laws require federal, state, and local governments to implement records management programs. Title 44, Sections 3101 through 3107, of the United States Code mandate records management programs in federal government agencies. No comparable mandates apply to non-governmental organizations, though regulations within each industry govern the documentation of quality-control measures, testing, safety practices, financial transactions, and more. Litigation Support A well-managed RIM program prepares an organization not only for government investigations but also for potential litigation. If records are compliant, your organization won t face a public relations nightmare as staff scramble to cover their bases with pieced-together information. A good RIM program has proper retention and disposition practices, and documents are easy to find. This means that if a legal hold is placed on an organization s records, and discovery comes into play, a records manager knows exactly where the required records are located. For more on this topic, see ARMA International s Records Management and the Law course. Privacy and Security Privacy and security of records have always been a concern for RIM professionals. But as more organizations move to electronic recordkeeping, this concern is even greater. While every precaution might be in place to protect physical records, protecting an electronic record whether it s on a desktop, smart phone, laptop, in transit to the cloud, or on some other device can be an even bigger challenge. For more on this subject, see ARMA International s Privacy and Security in RIM course. 6

7 Section 2: Key Components of a RIM Program Section 2 Learning Objectives Upon completing this section, you will be able to: 1. State why RIM programs are typically created 2. Describe why good records management is important to an organization 3. Explain how The Principles and the Information Governance Maturity Model are beneficial in establishing or evaluating a RIM program 4. Describe the roles of upper management, legal, and IT in establishing a successful RIM program Introduction Depending on your organization s structure, records management may report to any number of information-related business units. The most important aspect of the reporting relationship is that the RIM program has management s support. RIM s job is to protect records, active or inactive, important or vital. To do this, records managers must establish risk management and vital records programs. Even with these programs in place, a disaster can occur. Therefore, another aspect of records management is business continuity planning. We will look at all of these topics and more in this section. Introduction Historically, records management has reported to a variety of departments within an organization. However, with the increased attention on litigation, compliance, and the use of technology, the strongest reporting relationships are usually in legal, information technology, and compliance. Wherever the RIM program reports, it s important for RIM personnel to collaborate with all departments and especially with other information management-related departments. Support for RIM The most important factor in placing the RIM program within the organization s structure is the amount of support the RIM function can obtain from all levels of management regardless of the reporting structure. To determine the most effective reporting relationship, consider the following: Who can help ensure compliance with RIM requirements? Which department will give the most positive visibility and will represent and champion the issues of the RIM program at the executive level? Who will ensure the deployment and enforcement of the RIM program enterprise-wide? Who controls the budget and will ensure the RIM program gets the required resources? 7

8 Records Management Authority Formal records management is principally concerned with five aspects of information management: Ensuring compliance with all relevant recordkeeping laws and regulations Organizing active records for retrieval when needed Establishing a retention and disposition schedule for records Managing inactive records Protecting vital records Each of these five aspects applies to paper and non-paper records, and all have significant impact on an organization s mission, business processes, operations, and activities. Establishing a RIM Program To accomplish organization-wide recordkeeping consistency, RIM needs authority from the top down: A records manager with senior status and then accountability at all levels. When establishing a RIM program or reinvigorating an ineffective one, typically a records manager drafts a policy statement or directive for top management s review and approval. In addition to specifying the RIM program s authority, the policy statement must address the program s relationship with and provide guidelines regarding information management for individual departments that create, maintain, and use records. Does your RIM policy provide the records management department authority for all aspects of records management? Are departmental responsibilities clearly articulated? Writing a Records Management Policy A records management policy statement should include: A description of the need for the effective management of records A statement establishing the scope of the program A list of the benefits of a records management program A list of the objectives of the program The appointment of the records manager as manager of the program A directive mandating that departments cooperate with the records manager to ensure program implementation and compliance Retention and Disposition A retention schedule is a comprehensive list of records series, indicating for each the length of time it is to be maintained and its disposition. The retention schedule constitutes an organization s official policy for information retention and disposal. How does a retention schedule help business? Retention schedules: Ensure compliance with records retention laws and regulations 8

9 Minimize the organization s exposure to legal risks that may be associated with document retention and disposal Control the growth of the organization s records Reduce the costs of recordkeeping Legal Holds A legal hold trumps the retention schedule and interrupts the length of time affected records are retained until the hold is lifted. The legal hold process is initiated when there s a potential internal or external threat or when there s a subpoena, discovery request, or court order. Compliance As mentioned in Section 1, various laws and regulations address how long certain types of records must be retained, required storage conditions, media formats, retrieval requirements, and disclosure restrictions. As one of its key responsibilities, a formal records management program must identify legal and regulatory requirements that bear upon the creation, storage, retrieval, and retention of records and implement policies and procedures to ensure compliance with them. Auditing Part of managing records, active or inactive, is readying them for an audit. To keep your organization audit-ready, you must ensure that all recordkeeping is legally defensible. That means being able to prove that your organization is following its internal standards and practices and that it is complying with regulatory or oversight bodies. To keep your RIM program audit-ready, use ISO as an audit tool. The standard places heavy emphasis on policies, procedures, and practices designed to ensure that adequate records are created, captured, and managed properly. We look more deeply at this and other standards in Section 3. Risk Management Risk management involves identification, analysis, control, minimization, or elimination of unacceptable business risks. In records management, ARMA International has identified four types of risk: Administrative threats related to the RIM program itself Records Control risks associated with classification, retention, storage, and disposition Regulatory risks of not complying with the regulations that apply to your organization, as well as the best practices suggested by the relevant regulatory bodies Technology risks associated with unauthorized access 9

10 Components of Risk Management Programs Organizations must make their own decisions on how to manage identified risks, as must records management. The five most common choices for managing risk are: 1. Avoid it. Pursue another action, unless you simply cannot avoid the risk. 2. Transfer it. Outsourcing the risk falls in this category, but in highly regulated industries you might still be accountable for compliance. Use a service-level agreement and monitor the provider for compliance. Keep in mind that this adds costs that must be offset against the cost of accepting the risk or avoiding it. 3. Reduce its likelihood. Focus on the risk s sources to reduce the probability that the risk will occur. 4. Reduce its impact. Use corrective controls to reduce the impact of a risked event once it has occurred. Insurance policies, for example, reduce the impact of a fire. However, not everything is insurable, and there is added cost. 5. Accept it. If the probability of the risk s occurrence is low, or when the cost of mitigating the risk is too high, you might choose to accept the risk. Vital Records As mentioned in Section 1, vital records are those records that if inadequate or lost could bring operations to a halt or lead to serious legal and compliance issues. Important records are replaceable, at moderate cost, but their loss wouldn t jeopardize the organization s mission. Vital records are irreplaceable. Protecting vital records is the primary reason records management is involved with risk management. Vital Records Program Components Whether they are for physical or electronic records, vital records programs follow the same basic structure. Senior management assigns RIM authority to protect vital records, and then the records manager must perform the following tasks. Roll your mouse over each item for more information. Identify vital records. Interview those who handle records in each business unit and help them distinguish between vital and important records. Inventory vital records. Collect additional information about the vital records record title, record series, location, and such in order to decide how best to structure the vital records program. Assess the business value of vital records. Examine the impact the organization would face if it were to lose its mission-critical records. Assess threats/risks to vital records. Take into account the technical and mechanical hazards, human activities and threats, and natural threats and hazards that pose a risk to vital records. Determine how to protect vital records. Consider routine dispersal or designed dispersal; use protective storage with fire-resistant and environmentally controlled equipment and vaults; collaborate with IT to design procedures to protect electronic records. Train employees. Conduct training sessions to educate managers and employees about vital records and how to handle them. 10

11 Disaster Recovery Planning You can t realistically prepare your organization for every possible situation, but for business to continue after a catastrophe, a disaster recovery plan sometimes called a business continuity plan must be in place. The recovery plan s success is dependent on how well vital records are managed before a disaster occurs. Review the plan, modify it, and test it to improve your response during and after an actual disaster. In Emergency Management for Records and Information Management Programs, Jones and Keyes describe five basic steps to disaster recovery for records. Roll your mouse over each item for more information. 1. Assess the damage. Look at the overall impact and determine recovery priorities based on your vital records priorities. 2. Stabilize the situation. Once you re sure everyone is safe, begin removing and relocating damaged materials. 3. Begin salvage operations. How you salvage records will depend on the type of disaster and the types of records that are affected. For example, you might freeze documents that receive direct water damage, remove soot and smoke deposits from records damaged in a fire, and clean and microfilm salvageable pest-damaged paper records. 4. Begin restoration procedures. After salvaging the records, you should clean, repair, or replace damaged file housing, retrieval equipment, and computers. 5. Resume operations. Help employees get back to business. Conduct an after-action review to improve the disaster plan or to apply immediate corrective action. Importance of RIM Training The reality of human nature is that people don t do something unless there is a benefit in their doing it or a consequence if they don t. As we ve stated, for a RIM program to succeed organization-wide, upper management must recognize the importance of, buy into, and support records management s efforts. Upper management s acknowledgement that without solid RIM practices the organization would fail must pervade the corporate culture and philosophy, so all employees treat records as the assets they truly are. What s in it for the employees if they manage records properly? A more productive workplace where everyone can locate information easily and make decisions based on complete information, free of culpability and the disciplinary action that might accompany it. What s in it for the organization? Lower costs, higher productivity, improved morale, regulatory and legal compliance, increased profits, and more. RIM s Role in Training Beyond sharing the cultural and philosophical importance of good RIM practices, records managers must provide detailed training for specific roles, tasks, and processes. In some cases, this means meeting with a business unit s supervisor to explain how to handle the unit s records, and the supervisor will then conduct staff training. In other cases, you might have to provide 11

12 detailed, hands-on instruction, going into the specifics of how to include screen shots or fill out specific checklists to keep records in order. The best training is often actual simulations or demonstrations, down to the mouse-click level. Evaluate your audience to determine the level of training needed, based on their job function, skills, and overall interaction with the records. You want records to be well kept, and you want to ensure that employees receive the training they need to meet their records management responsibilities. Those employees with more records responsibilities will need more detailed training. 12

13 Section 3: Standards and Best Practices Section 3 Learning Objectives Upon completing this section, you will be able to: 1. Explain why standards are important in records management 2. List the American National Standards Institute s four requirements for setting standards Identify some of the worldwide standard-setting organizations, RIM associations, and RIM organizations 3. Describe the value of ISO :2001 (E) and ISO Explain what The Principles are and why they are important 5. Describe how the Information Governance Maturity Model can be used to establish and audit RIM programs Introduction Complying with standards is a must when establishing a records management program. Without standards, there is no benchmark against which to measure performance. ARMA International s collaborative relationship with the American National Standards Institute (ANSI) has established records management standards, as has the International Organization for Standardization (ISO). Professional RIM associations and organizations promote these standards as part of sound records management concepts and methods. ARMA International s Generally Accepted Recordkeeping Principles and the Information Government Maturity Model are key in establishing best practices in records management. Benefits of Standards A standard is a published specification for a product, service, or activity. A balanced consensus group of industry professionals vets standards, which are then approved by a recognized standard-setting organization. By defining performance expectations for products, services, and activities, standards provide useful guidance for records management initiatives. Standards: Serve as benchmarks or instructional tools Lend credibility to the RIM discipline Enhance user confidence and product acceptance Simplify procedural design Ensure procedural consistency Promote efficiency and cost savings 13

14 National Standard-Setting Organizations Standard-setting organizations in a single country establish national standards. In the United States, ARMA International develops ANSI standards that are critical in shaping sound records management programs. ANSI has four requirements that guide the process to ensure that ANSI-approved standards are developed professionally and with integrity: 1. Openness: Requires that participation shall be open to all U.S. national interested parties who are directly and materially affected by the activity in question. 2. Balance: Requires a fair distribution of interest groups within the task forces developing the standards. This prevents any single interest category from dominating the resulting standard in its own interests. 3. Consensus: Ensures that substantial agreement has been reached by directly and materially affected interest categories. This signifies concurrence of more than a simple majority but does not require unanimous agreement. 4. Due process: Allows for public review and comment on each ANSI standard and provides an appeals process. International Standard-Setting Organizations International standards are developed through the collaborative efforts of representatives from national standard-setting organizations. The most important for records management is ISO. ISO partners with ANSI and other standard-setting bodies from around the world. ISO s Records Management Committee has developed some of the most-cited RIM standards. American National Standards Institute (ANSI) Standards Council of Canada (SCC) Canadian Standards Association (CSA) British Standards Institution (BSI) Association Francaise de Normalisation (AFNOR) Deutsches Institut fur Normung (DIN) Japan Industrial Standards Committee (JISC) Standards Australia RIM Associations and Organizations Below are links to the websites professional associations related to RIM. As you visit these sites, note the objectives of each association, their membership requirements and codes of ethics, the types of activities they sponsor, and their publishing programs Click each organization to learn more about it. ARMA International AIIM Institute of Certified Records Managers (ICRM) Information and Records Management Society (Great Britain) International Records Management Trust 14

15 Nuclear Information and Records Management Association (NIRMA) Key RIM Standards With all of the organizations we ve mentioned, you can imagine how many standards are available worldwide. This page addresses a few of the key standards. ISO :2001(E) establishes records management as a global management discipline. It sets a common foundation for RIM principles and outcomes, regardless of the location of a company s business units, which makes it of special interest to multi-national organizations. ISO provides a framework for the use, creation, and management of RIM metadata, which complies with the requirements of ISO ISO doesn t define a mandatory set of metadata; instead the standard assesses some existing metadata sets and their suitability for ISO compliance, and addresses their ability to support business and records management processes. ARMA International develops records management standards and best practices for ANSI s approval and publication. ARMA International offers more than 20 standards and best practices for a variety of records management disciplines. AIIM develops and promotes high quality enterprise content management (ECM) standards, recommended practices, technical reports, and industry specifications to support interoperability, interchangeability, and the global enterprise (from their web site). Government agencies and certain industry organizations also publish information management standards. The U.S. government, for example, adopted the Federal Information Processing Standards. Key International RIM Standards Again, there are many, but here are key international standards from the European Union and Canada. MoReq2 is a Model Requirements Specification for the Management of Electronic Records in the European Union. It defines generic requirements for an electronic records management system, or ERMS. MoReq2, published in 2008, builds on MoReq, which was published in It is intended for use throughout the European Union, but it can be applied elsewhere. Government of Canada Records Management Metadata Standard declares and defines the semantics of a core set of metadata elements necessary to ensure the authenticity, reliability, integrity and usability of records as espoused by ISO International Standard and ISO Technical Specification A companion document, the Government of Canada Records Management Application Profile (GC RMAP) provides business rules for the use of each element and the relationships among elements. Canadian government agencies have also developed standards, which are listed at the website of the Information Management Resource Centre. You can purchase standards from the organizations that issue them or from other providers, such as Techstreet and Information Handling Services. These companies maintain large, searchable databases of national and international standards. 15

16 The Principles We touched on the Generally Accepted Recordkeeping Principles in Section 1, but let s look more in depth at the principles as part of our discussion of standards and best practices. ARMA International recognized a need for a single source that would serve as the basis for ensuring integrity, transparency, and accountability in recordkeeping. That source is The Principles. To develop The Principles, ARMA International brought together RIM experts to review and distill information from global best practices, including ISO, ANSI, and U.S. federal court case law. ARMA International published these eight principles to foster general awareness of recordkeeping standards and principles and to help organizations develop records systems that comply with them. For more information on each principle, see the ARMA International website. The Maturity Model As outlined in Section 1, the Information Governance Maturity Model helps an organization conduct a preliminary evaluation of its recordkeeping programs and practices. When you first apply the model to your organization you may find that your organization is at differing levels of maturity for the eight principles. This is not unusual. The maturity model helps you make an initial evaluation. To be most effective, a more in-depth analysis of organizational policies and practices may be necessary. Summary of The Principles Impact Not only are The Principles useful in establishing company-wide best practices, but being able to show that your organization is compliant with them could help in litigation, as it would show due diligence. The Principles are still a young professional code, and as with other professional codes specialists will supplement it over time with white papers, learned commentary, audit tools, and legal opinion. If you are new to The Principles, see the Introduction to The Generally Accepted Recordkeeping Principles online course for further information. If you are already familiar with them and want to learn more, see Applying The Principles to Achieve Organizational Excellence, an ARMA International online course. 16

17 Section 4: RIM Tools and Technology Section 4 Learning Objectives Upon completing this section, you will be able to: 1. Explain the challenge of managing electronic records and the steps involved in establishing an electronic records management (ERM) program 2. Define electronic document management system (EDMS) and electronic records management system (ERMS) 3. Explain what metadata is and why it is important 4. Describe some of the software programs available for ERM 5. Define micrographics, microforms, microimages, microfilm, microfiche, and computer-output microfilm 6. Describe how active physical records are stored and filed 7. Describe how inactive physical records are stored 8. Explain the challenge of managing records on portable devices Introduction In this section, we will touch on the difficulties of identifying and managing electronic records, including how to establish an electronic records management system. We will also talk about some of the RIM software available to help put your organization s records in order, and the technology of micrographics and its role in records management. Finally, we ll consider how to manage physical records and portable devices. Challenge of Electronic Records Electronic records those that contain machine-readable as opposed to just human-readable information provide a unique recordkeeping challenge. Any file created on an organization-owned device is the organization s property, including , voic , and PDA and smart phone content. Identifying which of these files represent records that must be categorized and retained takes time, as does reviewing these records in an electronic format. You must know what systems the records are stored in, where the data is stored, and who in the organization creates the records. Collaboration for ERM A solid ERM program is a collaborative effort among RIM and IT staff, with input from senior management, legal, and other business units. ERM must be well planned, and it must align with RIM s policies and procedures. There are eight essentials for an effective ERM program. Identify the different electronic records the organization uses 17

18 Interview stakeholders to better understand how records are created, accessed, and retained within their environment Identify all systems used to create, capture, duplicate, access, share, and destroy electronic records Understand how IT s strategic planning impacts systems for future conversion and migration of electronic records Assess how electronic messaging is used to conduct the organization s business and develop appropriate policies that govern electronic messaging and a plan to audit for compliance Know the laws and regulations that impact electronic records Update your retention policies and procedures to include all electronic records Identify potential areas of risk associated with electronic records inside and outside the organization EDMS/ERMS The biggest challenge most RIM programs face regarding ERM is implementing or refining a system. An EDMS consists of hardware, software, policies, and processes to automate the preparation, organization, search and retrieval, access and security controls, and tracking and distribution of electronic documents. An ERMS consists of hardware, software, policies, and processes to automate the preparation, organization, tracking, and distribution of records, regardless of media. ERMS software includes RIMrelated functions, including retention scheduling and disposition. EDMS/ERMS and Metadata Metadata describes, explains, locates, or otherwise makes it easier to retrieve, use, or manage an information resource. Metadata specifically tracks creation of and alterations to an electronic record. It is generated automatically by the system on which the record is created and/or manually by the records users. It should only contain as much information as is useful to retrieve and report on data in the future. An important aspect of managing electronic records is ensuring that metadata is consistent. Poorly created metadata can lead to unintentional loss of information that can have costly consequences. Records managers can help departments avoid such loss. RIM Software As electronic records become more prevalent, more records management software is hitting the market. On the next few screens are examples of the types of software that are out there. Capture and Storage Software Several companies offer software that enables you to index and preserve s and enforce policies for regulatory compliance. content is fully indexed and backed up to enable quick retrieval of any 18

19 message in an organization s central and secure archive. The software also protects from data loss and helps meet e-discovery demands. Legal Hold Management Software Legal hold software is intended to help organizations comply with the Federal Rules of Civil Procedure, which require them to preserve potentially relevant information when litigation can be anticipated. E- discovery workflow management software streamlines legal governance, risk, and compliance management processes. Software allows RIM and legal teams to efficiently identify groups of similar content, locate potentially new custodians, and uncover hidden risks. HRIS Software Human resources information system software is a software or online solution for the data entry, tracking, and information needs of the human resources, payroll, management, and accounting functions within a business. Medical Records Management Software Electronic medical records/electronic health records (EMR/EHR) are the new way of doing business in most doctors offices, and there is plenty of software out there to manage them. There s also software to streamline billing and insurance. Micrographics Micrographics is an imaging technology that uses microforms or photographic media containing microimages, such as microfilm or microfiche. Microforms are created from paper documents filmed with a special image-reducing camera or from computer-processed information that is written directly to the microform. Computer-output microfilm (COM) prints computer-generated information directly onto microfilm, usually microfiche. Benefits of Micrographics Because micrographics technology is not necessarily dependent on software and the basic concepts underlying it will remain the same, micrographics have a competitive advantage over computer technologies like electronic document imaging. For this reason, micrographics applications are frequently recommended for long-term retention or permanent preservation of records. For more on micrographics, see the ARMA International Micrographics course. Storage of Active Physical Records We ve talked a bit about electronic records, but what about physical records those records that are tangible in form, like paper or microfilm? For managing active records, you will need a records storage system and a well-thought-out filing system. Active records are stored in one of three systems : centralized, decentralized, or a combination 19

20 of the two. Centralized: Houses all active records in one location within the organization. Decentralized: Records related to a particular business process, operation, or activity are scattered in multiple locations, and employees maintain the records related to their part of the process. Combination: Provides a central file area for files that are used by several business units, but allows records unique to a department s function to be maintained in their decentralized file area. Advantages of Centralized Storing Centralized storing has these advantages: It allows configuration for economical high-density paper record storage. It uses administrative personnel effectively. Only designated employees service the records. It provides a single, complete file of recorded information on a specific transaction, project, or business decision. It facilitates implementation of uniform file arrangements and consistent recordkeeping procedures. Disadvantages of Centralized Storing Centralized storing has these disadvantages: It can be hard to find a location near all authorized users. It allows withholding of records from the file room, compromising the integrity and completeness of the central file. It allows duplication of convenience copies that compromise the integrity of the records retention policies. It gives the appearance that files are missing if they re not on the shelf and if employees don t follow checkout procedures. Pros and Cons of Decentralized Storing Decentralized storing gives managers immediate access to records, and it helps them retain control over the information. From a RIM standpoint, however, the decentralized system makes it difficult or impossible to locate and access records if a team member is unavailable. Further, it impedes routine records handling processes since records are dispersed among multiple employees. It s also difficult to ensure that all documents related to a particular topic or issue are located because employees arrange their files differently. And, decentralized storing usually means that untrained employees are responsible for routine records handling procedures that would be assigned to administrative personnel in a centralized system. 20

21 Filing Active Physical Records The point of a good filing system is that users can find what they need quickly, regardless of a record s format. A good system also ensures the integrity of recordkeeping practices and allows for the easy identification and preservation of, or purging of, records. The right filing system produces tangible positive results, like: Quick filing and retrieval and fewer misfiles mean higher employee efficiency and productivity Uniform file classification preserves the set order of records and establishes common titles, which imposes order and logic upon the organization s records Less likelihood of litigation losses resulting from lost documents Less likelihood of lost records leading to unfavorable audit findings and penalties Better protection of vital records Expandability and flexibility of system to meet organization s needs Standardization of RIM procedures There are many filing systems available, each with its own advantages. Storage of Inactive Physical Records Preservation of inactive records involves records centers and archives management. A records center is a centralized area for housing and servicing inactive or semi-active records pending their disposition. It can be in a space within the organization or in an independent building, or a portion of a building, depending on the organization s needs. The records center provides protection, security, and retrievability. Archives are facilities that house public and private organizational records that RIM has selected for long-term retention and preservation. Portable Devices Portable devices laptops, smart phones, flash drives, and the like are commonplace and their use is increasing. Work-related records created on portable devices are the organization s property and are discoverable, meaning they can be subpoenaed in litigation. RIM has the daunting task of managing these records, just as they manage other electronic records. Portable devices are convenient, but they are a huge security risk. Laptops are stolen, flash drives are misplaced, and data is lost or compromised as a result. The most comprehensive way to handle the issues that come with portable devices is to govern their use in the organization s policies and procedures. Some organizations go so far as to ban the use of certain devices. 21