Records Management & Compliance: Making the Connection

Information Management Journal, May/Jun 2004 by Kahn, Randolph A

Ongoing communication and training is critical - like records management, communication and training are a process, not a project. All new employees would benefit from records awareness training. Some institutions now have annual training for various types of records-related activities. For example, employees who want continued access to e-mail may be required to go though an annual refresher training course. Companies taking a more proactive approach to management do so with the belief that it is more productive and less expensive to make training an ongoing activity.

Could the result have been different at Andersen if the company had been able to demonstrate that Duncan knew of and was trained on the company's legal-hold policy? Creating, communicating, and training on the policy might have allowed Andersen to place blame for the destruction on the lone-wolf employee. The company could have argued (perhaps successfully) that the individual was exclusively at fault because he alone disregarded company policy that he knew did not countenance the destruction of anything needed for a formal proceeding and that he did so in an apparent attempt to cover up his personal wrong-doing. Andersen, however, was not able to deflect responsibility and is effectively out of the accounting business.

5 Auditing and Monitoring

The only way a sizable organization can systematically learn about problems with its records management program is by auditing past acts or monitoring current conduct. Learning about problems in the process is essential for IMC, whether it is through audits by employees or technological monitoring for offending activities. However, once problems are unearthed, they must be addressed.

In the Murphy Oil lawsuit, for example, if the party that failed to follow its 45-day disaster recovery backup tape recycling schedule learned that its technology department was not following its own policy and corrected the problem before the lawsuit, it would not have been confronted with a multimillion dollar expense for a fishing expedition into the pool of backed-up messages.

6 Consistent Enforcement

IMC can be effective only if a company consistently applies and enforces its own directives. If a records management policy states that the retention rules apply to all records regardless of media, then all electronic records - no matter where they are located - should be subject to the same rules. Yet so many companies routinely limit mailbox sizes, making it all but impossible to manage e-mail records. Worse, many companies purge the contents of the e-mail system without regard to contents after a few weeks, even though statistics show e-mail is how business gets done and the e-mail system is full of business records. Someone must be responsible for applying and consistently enforcing the records management rules with respect to records in voice mail, PDAs, laptop computers, discussion databases, and instant messaging.

The IT department must be advised that "innocently" destroying electronic records by recycling the storage media when it runs out of storage space violates the company's retention rules. Not long ago, a company was forced to pay a monetary penalty for failing to preserve records in the context of a lawsuit. Upon closer evaluation of the destruction of evidence claim, it appeared that retention rules were not applied to e-records. The IT department made up its own rules for retention based on what the system owner decided was necessary. When they ran out of space, he or she simply destroyed otherwise needed evidence.