From the Mouths of CIOs

Information Management Journal, Sep/Oct 2004 by Swartz, Nikki

Organizations can meet the biggest challenges facing them today by getting their records management and IT professionals to work together and develop solutions

In the current environment, organizations large and small are struggling to deal with massive amounts of e-mail, convert years of paper records to electronic formats, and meet compliance and regulatory mandates such as the U.S. Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HIPAA), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Organizations are storing records in multiple media formats - but paper records are increasingly yielding to electronic records because almost everything created today is electronic. Handling and managing electronic records is one of the biggest - if not the biggest - challenges facing organizations today. In a recent study commissioned by ARMA International and conducted by Forrester Consulting, the clear message from business and IT was that electronic records management (ERM) is considered a technology issue that falls under the purview of IT in most organizations.

ARMA's research revealed:

* Records and information management (RIM) professionals are losing their influence in records management as ERM emerges.

* Business and IT perceive few challenges to ERM, other than organizational priorities and budget; unlike business and IT, RIM professionals see many challenges surrounding RIM.

* Business and IT do not fully understand what ERM is; nor do they understand ERM's role in compliance regulations and legislation.

According to Connie Moore, vice president of Forrester's Information Delivery Research Group, RIM will gradually shift from administration to IT, compliance, and legal. "We think this will give RIM professionals more clout because they have knowledge that's very important in moving the organization into ERM. But some RIM professionals who don't move with this shift are going to get left out ... they've got to understand how things are changing" and that most of the changes are inevitable.

ERM is being driven by many different factors, including corporate policies, regulations, technology, archiving needs, best practices, legal, discovery, and audit concerns. In order to successfully implement and effectively maintain an ERM program, as well as meet pervasive compliance and regulatory demands, RIM must be part of a multi-disciplinary team that includes IT, legal, and compliance staff.

There is a great need within organizations for RIM and IT, especially, to work more closely together than ever before. RIM and IT professionals both possess critical knowledge that must be shared. For example, IT and business need RIM assistance in developing methods and metadata for identifying, preserving, classifying, and handling critical records. This is complicated by the fact that, in many organizations, records and IT professionals do not enjoy an effective working relationship and may not even be on the same page when it comes to ERM, archiving, or compliance regulations and legislation.

The Information Management Journal recently spoke to three chief information officers (CIOs) who are in different stages of employing and handling electronic records. The discussions centered on working with records and IT professionals to handle, manage, and maintain their organization's electronic records as well as deal with compliance concerns. Although the situations are different, these CIOs share the same challenges that are confronting most organizations today.

1. How would you describe your organization's general approach to handling electronic messages and records (including e-mail and instant messages)?

Rick Bauer, CIO of The Hill School, a boarding school in Pennsylvania, and Chair of the Storage Networking Industry Association (SNIA) End User Council: Only after a long period of discussion are we waking up to the reality that organizationally, we need a strategy to capture, archive, and manage our electronic communications. What had in the past been ad hoc personal or departmental archiving and management has to give way to a more systematic and effective means of ensuring that this vital information is saved. While legal exposure and regulatory compliance matters drive academia far less than other organizations, it is nevertheless critical that all organizations have some strategy for understanding and managing the ever-increasing volume of digital communications that take place within their respective domains.

John DeVouassoux, CIO, Blackwell Sanders Peper Martin law firm in Kansas City, Missouri: [We have] quite a well-defined policy for dealing with electronic records. The key thing we're trying to accomplish is to be able to regroup all the documents or information in retrievable space. They are grouped essentially by client and/or by matter, and there is a retention schedule attached to that.