A Practical Approach To Enterprise Records Management

In the past five years, corporate executives have become painfully aware of the need for "compliance." Sarbanes-Oxley, HIPAA, and industry-specific mandates have elevated recordkeeping and record retention to C-level attention. In the wake of financial scandals has come legislation spelling out in detail what was only implicit before: that electronic information in any form, including email and even instant messaging, may have to be logged, saved, indexed for search and retrieval, and securely retained for a specific number of years, just like paper records. In the US, Sarbanes-Oxley, SEC Rule 17a, NASD 3010 and 3110, and various other mandates today not only formalize broad new record-keeping requirements, but stiffen civil and criminal penalties for non-compliance. And it's the CEOs, not the records managers, who are being held accountable.

An even bigger worry, at least in the general counsel's mind, is the ever-present threat of litigation, in which the ability to find and produce on demand all related documents for discovery means the difference between winning and losing millions. Often the records in question are ordinary interoffice memos and customer correspondence – typically in the form of email. The staggering cost of producing these records, not to mention the organizations' own surprise at the incriminating evidence they might contain or the severe consequences when they are unlawfully destroyed, has elevated records management onto the executive radar screen.

Thus today executives understand that records management is serious business, but may not realize the breadth of its impact across the enterprise or the diversity of requirements that it imposes. In some cases, they mistakenly assume that their disaster recovery system, email archive, or document management repository – systems designed for other purposes – are meeting their enterprise records management needs. At the other extreme, they may fail to realize that the DoD 5015.2-compliant records management application they implemented in the legal department is overkill for most of the records they need to manage across the enterprise, leading to user resistance and ultimately failure to achieve the desired objective.