corporate records conundrum, The

Information Management Journal, May/Jun 2003 by Caughell, Tracy

Capturing e-mail in corporate records requires the right approach to technology, but solving the problem sets the stage for future challenges

Everyone loves the convenience of e-mail, but e-mail is striking fear into the hearts of many in the world of records management. It is ironic that a technology so effective and easy-to-use could induce such concern. But the fact is, it has become a monster that many are not quite sure how to tame.

E-mail offers a wonderfully easy way to communicate - tap out a quick note, attach a few documents, if needed, hit "send," and away it goes. No telephone tag or garbled cellular calls. E-mail has taken the world by storm, from companies to governments to individuals; it has been embraced as a means of both business communication and casual conversation. And therein lies the downside: e-mail's volume and pervasive use, its mix of business and casual communication, and its dual status as a document and a conversation introduces tremendous risks for organizations. Information contained in an e-mail can haunt an organization for years and provide damning evidence that may result in expensive fines and settlements. Companies from Wall Street's biggest brokerage houses to Microsoft have learned that lesson recently.

The concern over more effective management of e-mail is not new. It is an issue that many organizations have known needs to be addressed in time. But the sudden fall of Enron triggered a chain of corporate scandals that reverberated through the business world and suddenly brought the issue of e-mail to the forefront for records managers. Tough new government regulations, such as the Sarbanes-Oxley Act of 2002, have been passed in response to this seemingly endless stream of accounting and corporate scandals. While these regulations do not address e-mail management directly, they have certainly put the focus on better recordkeeping and accountability. As a result, these laws are fueling a tremendous sense of urgency in many organizations to reduce the risks of e-mail and manage it more effectively as corporate records.

As organizations wrestle with e-mail, other technologies used to communicate - some mature and some just beginning to evolve into new uses - will present similar challenges. The tough new regulatory environment businesses are operating in today has implications for these technologies. Suddenly, the e-mail monster has a few cousins: voicemail and multimedia technology. These technologies have the same risks as e-mail and as they become more integrated with other systems in the enterprise, the pressure will grow to capture this important content for records management. Thus, businesses need a technology solution that allows them to evolve records management capabilities to meet these new demands.

Policy Before Technology

To address the records management challenge e-mail presents, it has become increasingly clear that a policy framework within an organization must drive the technology solution. Organizations must define how they want to approach the problem, based on their risks and regulatory requirements, and what types of message content they want to capture. A careful assessment of these issues is the foundation for an effective records management solution. This may seem like common sense, but it is a huge challenge for most organizations. Knowing what critical e-mail or other communications to capture is difficult and complex.

One of the biggest issues with e-mail is that e-mail repositories were never designed for centralized retention to serve a broader corporate purpose. Organizations maintain mountains of e-mail without a central repository. E-mails come in to an organization by the thousands and reside in individual mailboxes with no consistent organization. In addition, the volume of e-mail in most organizations is overwhelming, with the vast majority of messages having little or no value for records management. In order to capture and retain what is really important in the universe of e-mail across an enterprise, organizations have to take the difficult step of defining the types of e-mail content that warrant retention.

Some organizations decide this is too difficult a challenge. Instead, they take a spolicy short cut, a "scorched-earth" approach of sorts, deciding that all messages should be purged after a set amount of time. While this approach is simple, it is not an adequate solution given the current regulatory environment. It almost guarantees that important e-mails that should be retained will be deleted.

Other organizations take a different approach and decide to keep everything. One option is to back up all e-mail to tape, storing it in case it is ever needed. The other, more ambitious approach is to retain and treat all e-mail as corporate records. This approach is more effective, but it also means there is no discretion in capturing e-mail, so retention and disposition rules get applied to e-mail that, under normal circumstances, would never be considered important corporate records.