QuickCounsel
Successful Records Management Programs
Introduction
A compliant records management program is necessary for organizations to proactively and progressively manage all data, media and information. As the number of laws and risks related to governing records management continues to increase, it becomes even more paramount that organizations follow best practices for proper records management. Organizations need to demonstrate “good faith” intentions to follow these best practices consistently and accurately.
Back to top
Characteristics of Successful Programs
An organization with a solid foundation of proven successful records management practices will:
- Preserve the right information for the correct length of time
- Meet legal requirements faster and more cost effectively
- Control and manage records management storage and destruction fees
- Demonstrate proven practices of good faith through consistent implementation
- Archive vital information for business continuity and disaster recovery
- Provide information in a timely and efficient manner regardless of urgency of request
- Use technology to manage and improve the records management program
- Integrate policies and procedures throughout organization
- Establish ownership and accountability of the records management program
- Arrange for continuous training and communication throughout the organization
- Project an image of good faith, responsiveness and consistency
- Review, audit and improve program continuously
These features must all exist as part of a compliant records management program. Independently, each represents a good practice; as a unit, they serve as a solid foundation of best practices for records management.
Back to top
Where Do You Start?
The early creation of an executive steering committee comprised of senior management across all departments is instrumental to the success and implementation of your organization’s compliant records management program. By creating an active steering committee, your organization will be positioned to proactively address the changing business climate and the ever-increasing regulatory controls for records and information management.
It is best to include senior level executives from Legal, IT, Records Management, Risk/Audit, Finance, HR and any other departments your organization has that generate records. As this committee will approve all policies and procedures that are developed, it is essential that all areas are represented to provide their point of view on operational requirements prior to approval of policies and procedures. This collaborative effort leads to better adherence to policies and procedures and ensures there are no barriers to acceptance.
Steering committees should meet regularly with decisions communicated via the records management program’s communication vehicle, such as a newsletter. They are often chaired by the General Counsel, which has shown to lead to more mature, effective programs.
Best practices for building or improving a records management program suggest an organization should begin with an assessment of their program’s current state. This helps to set the organization around the as-is state and determine areas of risk. There are resources that provide this service for a fee. Iron Mountain provides this service as an incremental value of doing business with Iron Mountain.
Back to top
Best Practices
Once your executive steering committee members have been identified, we would suggest they fully understand the five “best practice” areas:
-
Policies and Procedures: Do your people know who, what and how?
An organization’s records management program should be supported by policies and procedures that address each component of the records management program in accordance with operational and legal requirements.
Your organization will need to do legal research in order to determine applicable laws, as they may be federal, state, or industry imposed. Upon gaining an understanding of the legal requirements, your organization should consider your operational requirements (e.g. do you need to keep something longer than the law requires because your business needs to refer to it?).
-
Retention: What do you keep and for how long?
A sound and legally compliant records retention policy, including a records retention schedule, is the foundation of a good records management program. A records retention schedule is a document that an organization uses to ensure that records are kept only as long as legally and operationally required, and that obsolete records are disposed of in a systematic and controlled manner. Retention schedules should be refreshed every 18 months or less.
Records retention schedules organize records by classes in order to facilitate the application of retention dates. Organizations should manage the number of record classes they have in order to make the retention schedule useful in day-to-day application. It is also considered a best practice to make this schedule available to employees in a centralized location vs. via email or on paper. This will make sure everyone is working off the same version.
-
Index and Access: Can you find what you need?
The success of a records management program hinges on the ability to retrieve information quickly and accurately, thus reducing risks and costs associated with litigation and discovery. Getting the information needed to the right people at the right time will enable them to efficiently do their jobs.
-
Disposal: Are you closing the loop?
Often overlooked, records disposal is a vital element of your records management program. Timely, consistent disposal “closes the loop” of compliance while also reducing storage costs and legal exposure.
-
Audit and Accountability: Can you prove your commitment?
The benefits of a major investment in a records management program will be short-lived if mechanisms – such as senior-level sponsorship – are not in place to ensure there is accountability for records management throughout the organization. When done the right way, records management is integrated with your internal audit process with the results and remediation plans reviewed by your steering committee.
Back to top
Conclusion
Managing legal risk inherently requires a lawyer to find and present information and records that are accessible, authoritative and reliable. But managing legal risk also involves the proper and ethical disposition of obsolete and outdated records that, when they persist, can create significant, adverse economic consequences. These are the essential functions for which records management programs exist. When records management functions are performed poorly or not at all, the legal standing of a company can be dramatically and violently altered.
Back to top
Additional Resources
ACC Resources
Sponsor Resources
Back to top
Have an idea for a quick counsel or interested in writing one?
| The information in this QuickCounsel should not be construed as legal advice or legal opinion on specific facts and should not be considered representative of the views of its authors, its sponsors, and/or the ACC. This QuickCounsel is not intended as a definitive statement on the subject addressed. Rather, it is intended to serve as a tool providing practical advice and references for the busy in-house practitioner and other readers. |
Back to top
Published August 22, 2010
