Less paper, more security: electronic storage doesn't mean more secure files - 2003 Technology & Business Resource Guide: Document Management

California CPA, May, 2003 by Susan Bradley

In 4000 BC, Alexander of Egypt attempted to start a business called "Papyrusless Office." His business folded in less than a year, as the Egyptians just didn't understand the concept. Later, Apollo of Greece tried to sell people on the idea of "Parchmentless Office." It also failed miserably, given that no one could invent a replacement for parchment.

But in 2003, we finally have the right combination of technology, hardware, know-how and software for firms to fully implement a "paperless office" should they choose to do so. So, what are some of the things you need to think about when going paperless? Just the technology, right? Wrong.

EVERYONE IN AGREEMENT

It seems paperless office implementations are more challenging and stressful than any other technology implementation that I've monitored lately. Why? Because many times the system implemented hinders the workflow rather than helps the process. Also contributing to the problem is that organizations don't always solicit input from those people who will use the new system.

Bob Hillery, a security instructor for the SANS Institute in Maryland, says that when you are implementing a security system in an organization, you must find your "go-to" people--those people whom others go to for information on how to perform their tasks.

I would argue these same people should be called upon when implementing a paperless system. This helps to create buy-in from everyone in your organization. Without acceptance, the system likely won't work.

Cedars-Sinai Medical Center turned off its computerized physician order system in January partly due to the lack of partnerships between physicians and firm leaders.

Because paperless is technology, be prepared to roll out your paperless system in parts to allow users to get accustomed to and learn the new way of doing things. Devote some time to assembling and presenting how-to manuals. Test your presentation and documentation ahead of time with employees who aren't involved in the process to make sure instructions and processes are clear.

LOCKDOWN

Next, consider legal issues and retention policies. What documents do we need to scan and "lock" as permanent records? What documents are considered our work paper product that we can annotate? What security do we have to ensure that our documents will remain as they were scanned and cannot be altered?

The same security steps you perform on your paper documents--ranging from locking up highly critical paper in a fireproof safe to having a regular written retention policy--also are vital for your paperless documents. In addition, technology-related security measures should be implemented.

When you set up your computerized systems, perform a risk analysis of your network. Keeping in mind that the greatest security threats are from those computer users inside your network who can weaken your security systems in the actions that they perform.

Many security experts recommend firewall and antivirus software on all computers that are connected--whether physically or virtually--to your network. Thus, consider that when you use remote connectivity to your network, you have just extended the security perimeter of your firm to your house.

MAKING COPIES

Backup and redundancies should be considered, both for your network storage and your scanning equipment. Consider the robustness of your scanner. Is it a better deal to lease a large copier style scanner that will scan many pages per minute versus buying a smaller desktop scanning unit?

Your unit should be able to handle different sizes and types of paper. Accounting documents may not originate on letter-sized paper, thus the scanner you select should be tested with the paper you expect to use. If possible, test the equipment to ensure that your expectations are met.

Also, obtain information about their support policies and procedures. Is it like a typical copier agreement, where maintenance is charged on a per sheet basis and the repair person comes to you? Or must you make arrangements for off-site maintenance, which will increase your down time when the machines break down? Determining the amount of down time that is acceptable for you is important.

Don't merely look at the price of the object when you're shopping around--examine the entire financial transaction, which will allow you to make the best decision regarding your electronic document needs.

When it comes down to it, none of us will have a "paperless" office. We will, however, constantly strive for a less paper environment.

Susan Bradley, CPA, CITP, MCP, GSEC is a partner with Tamiyasu, Smith, Horn Braun in Fresno. You can reach her at sbradley@tshb.com.