Records Management & Compliance: Making the Connection

Information Management Journal, May/Jun 2004 by Kahn, Randolph A

E-Records Management: Ubiquitous and Flawed

Paper records get mismanaged, altered, and destroyed. However, underlying much of the concern around records management is the exponential growth of, universal reliance on, and commonplace mismanagement of electronic records. According to "How Much Information," a global study released last year by the University of California at Berkeley, in 2002, 800 megabytes of new information was created for each person on earth - with 92 percent of it stored on magnetic media, primarily hard drives. An IDC report, "Worldwide E-mail Usage Forecast, 2002-2006: Know What's Coming Your Way," predicted that the number of e-mail messages sent per day will grow from 31 billion in 2002 to 60 billion by 2006.

The importance of these gargantuan numbers is not the mere volume but rather the fact that such technologies are now used to transact real business.

As the sidebar chart indicates, most companies use such technologies as e-mail to conduct important business activities. Yet e-records continue to be mismanaged by companies and governments alike.

The U.S. federal government conducted a 2002 study, "Information Management: Challenges in Managing and Preserving Electronic Records," to assess how well it was managing its own electronic records. The study concluded that there were major flaws in its ability to properly retain and manage electronic records: "Records management guidance is inadequate in the current technological environment of decentralized systems creating large volumes of complex electronic records." A 2002 U.S. General Accounting Office Report on information security at the Federal Deposit Insurance Corp. (FDIC) found a similar lack of controls that exposed critical information to "inadvertent or deliberate misuse, fraudulent use, and unauthorized alteration or destruction, which may occur without detection."

The recipe for disaster appears already to be on every organization's plate, whether large or small, public or private. Most organizations - even the most sophisticated institutions - have a vast and growing volume of electronic records, and much of it is increasing in importance as electronic documents replace their paper counterparts as business evidence.

In a recent court case, Flour Daniel v. Murphy Oil USA Inc., a litigant was reminded about how seemingly innocuous records management failures can create big headaches. Because one of the parties did not have a written policy regarding e-mail retention and because the company failed to follow its own disaster recovery backup tape recycling schedule, it was confronted with the prospect of reviewing 19.7 million e-mail messages at a projected cost of $6.2 million. What was a simple problem that could have been easily and inexpensively addressed earlier became a large, expensive problem in the context of the lawsuit.

Records Management: A Department of One?

Contrary to the popular armed forces advertising campaign touting the success of an "Army of One," a successful records management program requires much more than what any one person can deliver. Sensitive to the post-Enron/Arthur Andersen environment, a Fortune 500 company wanted to audit its records program to ensure it had implemented the essential elements of a viable records management program. The records manager was confident that everything had been done to protect the company. The entire records management program staff consisted of an "Army of One" in a sea of tens of thousands of other employees. While some records management program components were fully developed, only one part of one division out of seven divisions - had even partially followed a retention schedule. In fact, the requirement to develop and follow retention rules was wholly voluntary. Also, the records manager's purview excluded managing e-records, a function left to the information technology (IT) staff to deal with - or not.