2011 Canadian Institute - Records Retention - The Indispensable Nitty Gritty of Retention Policy.pdf

April 3, 2012 ARMA Toronto Chapter

The Indispensable Nitty Gritty of Retention Policy Implementation:

The Operational Side

Event:Canadian Institute – Records Retention Intensive Course

Toronto, Ontario, Canada

April, 2012

Presented by;Keith Atteck

ARMA Toronto Chapter – Member of the Year 2011


Agenda

The essential components that should be included in your operational program documents:

• Developing business rules to guide:

All employees - who are creating and capturing documents

“Records Managers” involved in the records management process

The integration of the records management system into other programs

The IT Department - who deploy and support the tools

Take-Aways: Participants will be shown examples of operational guidelines and documents


Disclaimer

The views expressed in this presentation are those of the author.


The essential components that should be included in

your operational policy documents


Global RIM Program

Change Management

Response to Organizational

Change

Response to Technology Change

RM Support for Technology

Selection and Implementation

Enterprise Content Management

(ECM) Business Rules and

Configuration Management

Imaging Program Management

Requests for Physical Records

ManagementPhysical Records

Management

Shipping, Receiving and Storage Management

Records Centre Operations

Management


New RIM Program: Framework

Framework

Comprehensive documentation

Fundamentals of Records Management

Technology agnostic

Applied to all Tools and Systems

RIM Policy

RIM Program Manual

Cla

ssific

atio

n

Ret

ention

Met

adat

a

Sec

urity

Vital

Rec

ord

s

Ele

ctro

nic

Mes

sages

Legal

Hold

Imag

ing

Tec

hnolo

gy

Chan

ge

Org

aniz

atio

n C

han

ge

Guides and Procedures


RIM: Need to set the Vision early

Ecosystem of InformationWorking in one environment where all records are;

Created or Captured – once,

Collaborated Globally – version controlled, and

Managed – as records.

Being Confident that;

You can find the original record – every time,

You know who worked on it – who used it, and

You know what it was used for – related to activity.

Know that:

One never has to search any other system,

One can leverage the collective wisdom and knowledge of the organization, and

Everyone’s efforts will not be lost or misplaced.

Presenter

Presentation Notes

This ensures that the records are the relevant records by eliminating other possible sources.


RIM: What are your Guiding Principles?

SINGLE authoritative source of information

All documents will be filed electronically

Into one system as a normal course of business

Everyone depends on the system

Manage only ONE COPY

File once – use many times - in many ways

All transacted records made from the document management system

FIRST point of contact principle

The person who is first point of contact with documentation is responsible for determining and ensuring that documentation is appropriately filed

Presenter

Presentation Notes

This reduces the need for deduplication

http://www.google.ca/imgres?imgurl=http://andyiskandar.com/wp-content/uploads/2009/02/keystone_arch.jpg&imgrefurl=http://andyiskandar.com/5/fiction-test-post/&usg=__FZnwyzPzuxoSNZKcRWT2ppkilNc=&h=140&w=160&sz=14&hl=en&start=7&zoom=1&tbnid=_5i6WHsjfVFCsM:&tbnh=86&tbnw=98&prev=/images%3Fq%3Dkey%2Bstone%2Bof%2Bthe%2Barch%26hl%3Den%26sa%3DG%26gbv%3D2%26tbs%3Disch:1&itbs=1


RIM Program Manual: A Guide to Records and Information Management

Introduction: (Employees)

Why Manage Records and Information?

RIM Fundamentals

Roles and Responsibilities

Tools and Resources



Part 1: Managing Records and Information (Employees)

Records Life Cycle

Create or Capture

Classify and Collaborate

Commit, Store and Retrieve

Retain and Dispose

Controlled Security and Access



Part 2: Managing the Program (Employees)

RIM Program Roles and Responsibilities

Maintaining the Classification Scheme

Building and Maintaining the Retention Schedule

RIM Program Documentation

Managing Vital Records

Maintaining the Records Metadata Element Set

Ensuring Knowledge of and Compliance With Program

Principles and Guidelines

Auditing and Quality Assurance



Part 3: Managing Responses to Events (RIM Manager & Support Team)

Organizational Change

Technology Change

Legal Holds and Other Preservation Orders

Records Clean-up Days



Part 4: Using and Managing Supporting Tools (RIM Manager & Support Team)

Process Tools

Technology Tools



Glossary of Terms


Archives

Introduction

This addresses the identification, acquisition, arrangement, description, preservation, use, and promotion of the Company's archival records.

The archival records of an organization are those that are of continuing value because they document the Company's history, organization, structure, and functions. Archival records serve as the Company's long-term memory by providing for: continuity, evidence of continuing rights and obligations, access to past experience, expertise and knowledge, and an historical perspective. An organization's archives also serve a broader value in that they constitute a part of the cultural heritage of society.

Scope and Definitions

This policy applies to all records created or received by the Company in the course of its business that are identified as archival in the Records Retention Schedule and in the process of archival appraisal.

Archival records potentially include selected records in all Company departments and at all plants and facilities, the records of any organizations that are controlled by the Company, and Company records in the custody of third parties contracted by the Company.

Archival records may be in any media format (e.g. paper, electronic, audio, microform, video, etc.), and include any related metadata.


Imaging

The following factors are necessary for the establishment of a credible image management system:

Written authority from senior management to establish the image management program;

Documentation that stipulates the image management program is an integral part of the companies ordinary course of business;

Written authority to dispose of source records/data within a reasonable period of time following the image capture;

Complete and accurate documentation of the system’s processes and procedures;

A quality assurance process and supporting documentation to ensure the integrity of image capture;

An appropriate storage mechanism and contingency plan that ensures access to the images for the total retention period required under the Retention Schedules; and

Conformity with industry accepted standards as they relate to the technology.


Access Control Model

It is essential that an organisation have formal guidelines regulating who is permitted access to its records and information, and under what circumstances.

The Company recognizes the importance of restricting access to records to protect:

personal information and privacy,

professional confidentiality,

security of property (physical, financial and intellectual), and

legal and other professional privileges.

Equally important are legally enforceable rights of access embodied in corporate governance, freedom of information, privacy protection, and archival and legal process law.

At the same time, practices must be designed so as not to restrict access to the records and information employees need to do their jobs.


Electronic Messaging

Electronic messaging records will be managed throughout their life cycles according to the requirements of the Records and Information Management Program (RIM Program), which will exercise control over the classification, retention, storage, retrieval, protection, preservation and final disposition of all electronic messaging records, as required by this standards document and by related procedures and guidelines.

Employees will not store or transfer Company electronic messaging records outside of company-approved electronic messaging or record keeping systems, or to unauthorized storage repositories.

To ensure that electronic messaging records are properly managed, adequately described and readily accessible, they must be classified and declared in the Company’s electronic document management system (EDMS), or electronic records management system (ERMS).

Where employees, contractors, or other parties do not have ready access to the Company’s EDMS or ERMS, electronic messaging records must be forwarded or copied to an authorized user of the EDMS or ERMS to be classified and declared. It is ultimately the responsibility of the author to ensure that the record is appropriately filed.

Note: A printed message record is considered to be a duplicate or information copy, and is to be disposed of when no longer required.


Knowledge Management

Knowledge Management, is a business process that supports the management of an organization’s intellectual assets.

There are two types of Knowledge:

• Explicit knowledge – is public and documented knowledge; structured, fixed content, externalized, and conscious.

• Implicit knowledge – is that which is not directly expressed; that is, where the meaning is inferred from the context and, therefore, relies on existing knowledge.

In an EDMS knowledge is captured explicitly in the information contained in documents as artifacts, but also in the way the information was used -information in context - a form of capture of implicit knowledge.

Knowledge Management, to be effective, recognizes that an artifact’s greatest information value develops as a result of its relationship with other artifacts, and application of the combined result in a different context.

It is important to emphasize the relationship between sources ofinformation and knowledge, and to ensure that participants in the knowledge management process (knowledge managers, consumers and contributors) are able to move fluidly across these relationships.


RIM Feeds Enterprise Content Management (ECM)

http://www.aiim.org/


RIM: Compliance Auditing

General - Benefits of Auditing

Test the degree of integrity of systems and procedures

Understanding degree and extent of compliance

Identifying gaps in procedures and training

Local - Due Diligence Reviews

Conduct regular reviews of all record classifications & metadata

Identify change issues of employees and management

Identifies changes in the business environment

Global - Quality Assurance Reviews

Critical for demonstrating integrity of systems, tools and procedures

Management knows if the systems, tools and procedures are working

Important for Litigation support – Safe Harbour


RIM: Addresses Evidence Risk

Canada Evidence Act

“31.1 Any person seeking to admit an electronic document as evidence has the burden of

proving its authenticity by evidence capable of supporting a finding that the electronic

document is that which it is purported to be.”

“31.2 (1) The best evidence rule in respect of an electronic document is satisfied

• (a) on proof of the integrity of the electronic documents system by

or in which the electronic document was recorded or stored; or

• (b) if an evidentiary presumption established under section 31.4 applies.”

“31.5 For the purpose of determining under any rule of law whether an electronic document

is admissible, evidence may be presented in respect of any standard, procedure,

usage or practice concerning the manner in which electronic documents are to be recorded

or stored, having regard to the type of business, enterprise or endeavour that used,

recorded or stored the electronic document and the nature and purpose of the electronic

document.”

Source: Department of Justice - http://laws.justice.gc.ca/eng/StatutesByTitle/C.html

Application ofbest evidencerule —electronicdocuments

Authenticationof electronicdocuments

Standards maybe considered


RIM: Evidence Best Practice

Canada

CAN/CGSB 72.34-2005 - Electronic Records as Documentary Evidence

“5.2.1 Those who wish to present an electronic record as evidence in legal proceedings shall be able to prove

a) authenticity of the record;

b) integrity of the Records Management System that a record was recorded or stored in; and

c) that it is "a record made in the usual and ordinary course of business" or that it is otherwise exempt from the legal rule barring hearsay evidence.”

Source: CGSB - http://www.tpsgc-pwgsc.gc.ca/ongc/home/index-e.html

Presenter

Presentation Notes

The Canadian General Standards Board (CGSB) is a federal government organization that offers client-centred, comprehensive standards development and conformity assessment services in support of the economic, regulatory, procurement, health, safety and environmental interests of our stakeholders — government, industry and consumers. Helps with the use of safe harbour provisions in the evidence act.


RIM: ISO15489 Best PracticeISO15489-1:2001 – Information and documentation – Records management

Applies to records, in all formats, created or received by any public or private organization in the conduct of its activities, or any individual with a duty to create and maintain records.

Supports:

• Electronic Records Management (ERM) & Physical Records

• ISO9001 – Quality Management Systems

• ISO14001 – Environmental Management Systems

Sets principles of Records & Information Management practice

• Organization institute comprehensive program

• Characteristics, Authenticity, and Integrity of a record

• Based on Functional Classification

Design and implementation of record systems

• Integrity of the system

• Compliance to legal and regulatory environment

• Documenting records transactions

Source: ISO http://www.iso.org/iso/catalogue_detail?csnumber=31908

Presenter

Presentation Notes

Helps with safe harbour provisions in the evidence act. Helps define the key aspects of your RIM Program.


RIM: Best Practice GARP

Information Governance with Generally Accepted Recordkeeping Principles (GARP)8 Principles

AccountabilityIntegrityProtection ComplianceAvailabilityRetentionDispositionTransparency

GARP Capability Maturity Model

Source: ARMA http://www.arma.org/garp/index.cfm

GARP Maturity Level Colour Status

1Sub-standard RED

2In Development ORANGE

3Essential AMBER

4 Proactive BLUE

5Transformational GREEN

Presenter

Presentation Notes

Measuring your maturity is part of defending your safe harbour position.

http://www.linkedin.com/groups?home=&gid=40713&trk=anet_ug_hm


RIM: Integrate to Other Programs

Safety or Sustainability have become the culture of most organizations

It is the first item addressed in meetings

It is measured and reported on

RIM Practice must become the culture of our business, a part of day-to-day work

Supporting safety or sustainability

Measured and reported on


Keep the goal in mind


Risk Vs. Rewards for BusinessRisk – The Blind

Lack of Governance - ad hocIT is in charge??????Don’t know what are recordsDon’t know the custodiansInability to auditNumber of uncontrolled information types and sourcesVolume of duplicationLack of information category structureToo much technologyCan’t find anything easilyPoor basis for business decisionsNo idea what is really happeningECM deployments tend to failEtc.

Rewards – Clear VisionGood governance & transparencyRIM Manager is in chargeCan identify a record and a copyCan identify record authors, custodians and usersAuditable - demonstrates due diligenceControlled record types and sourcesAvoids uncontrolled repositoriesReduced volume – original recordsGlobal search categories – relevancyIntegration of Knowledge ManagementCan find everything quickly and efficiently – better decisionsControlled technology evolutionReduced stress to the organization and its personnelECM has a solid foundation and can succeedEtc.

ROI – Risk of Incarceration (reduced) ROI – Risk of Incarceration (reduced)

Which version do you want to

present in court?

Presenter

Presentation Notes

What is the Value of a RIM Framework in business? Cost reduction Linked to the "value chain” Risk reduction Insurance - Ensuring conformance to legal requirements and protecting the organization in case of litigation Key indicators--outputs and impacts--even if they can't quantify them, in three areas: Performance improvements - in key business processes Makes an Impact - Make a distinctive impact to the communities it touches and does its work with ... unadulterated excellence." Stands the test of time - Achieve lasting endurance: delivers exceptional results over a long period of time


Who do you hire?

When you have a financial or accounting problem, who do you turn to, or hire?

When you have a technology or computing problem, who do you turn to, or hire?

When you need legal advice or have a legal problem, who do you turn to, or hire?

When you have an records or information management problem, who do you turn to, or hire?


Hire a RIM Professional

RIM Professionals are trained to develop and manage records and information

“RIM professionals can offer a safe harbor of sorts….

RIM professionals understand how information and records support the business and interact with employees on a day-to-day basis on the creation, development, issuance, and management of business records.

RIM professionals understand the key legal and IT issues and must collaborate effectively with staff in those departments to ensure the implementation and management of a solid, documented, and explainable records management program.

When a RIM program is in effect and adhered to as it is written – and the organization can show proof of compliance with the program – the organization’s attorneys are in a much better position to defend its ediscovery processes and the information it did – or didn’t produce.”

Resources:

American Records Management Association (ARMA)

• http://www.arma.org/

• Chapters in Canada

http://www.arma.org/


Lessons Learned

Collect stories about records and information failuresHave a clear vision of what is required and how it will workConnect the business case and practice to operationsSenior management sponsorship hard to get and keepGet the best experts to advise on program developmentDevelop a complete eco-system for informationPick the easy targets, the others will see the resultsIn-house IT technical support is criticalBut watch out for IT practices and initiatives that conflict with RIMThe training program will make or break the deploymentDevelop and integrate auditing of the programNetwork, tell your story, be involvedPlant seeds


Questions ?????

Contact:

Keith Atteck C.Tech. ERMm

ARMA Toronto Chapter

[email protected]

Date post:	14-Nov-2014
Category:	Business
Upload:	keith-atteck
View:	263 times
Download:	0 times