Business Continuity Relies on Records

Today, Dec 2004 by Rossell, Gary

They're Called "Vital" for a Reason

In today's environment of compliance and oversight, corporations are placing a greater emphasis on business continuity planning, records management, emergency services, and risk mitigation. Although vital records have roots in all of these disciplines to varying degrees, they are essential to the business continuity efforts in all corporations.

Records managers are challenged today with the responsibility of building and maintaining business continuity plans to recover corporate business functions. Technology disaster recovery plans usually rely on vital electronic record (backups) located at an offsite secured location. Business unit recovery plans may identify vital recovery documents but rarely identify protection methods and plans for vital records essential for the recovery of a business process. The presence of vital records in all business continuity planning efforts makes it essential to identify who is responsible for vital record protection, how they are protected, how they are recovered, how they are made available at the recovery location.

The challenges include assessing the current status of corporate vital records, planning to address vital records in realistic phases, educating management on the necessity of planning, determining which records are vital, establishing a plan to protect vital records and maintaining a vital record program.

Vital Records contain information critical to the continuation or survival of an organization during or immediately following a crisis. The records contain information required to protect assets, stockholders, service customers, collect debts, enforce contracts and agreements, borrow money, document corporate compliance, ensure continuity of business operations, and defend against liability lawsuits. They can be paper, electronic images used in workflow systems, images used for storage and retrieval processes, database records, e-mail with attachments, voice mail, instant messages, or any other official record documenting company business.

The records storage firm, Iron Mountain, offers a four-pronged practical approach to effective vital records planning for business continuity.

1. Assess Current Vital Record Program

Key to the success of the effort is assignment of responsibility for the vital record program to one individual. The business continuity or records manager are likely candidates due to their involvement with records programs or business continuity planning. The program success depends on a clear definition of responsibilities between records management, business continuity, risk management, and emergency preparedness.

A current program assessment identifies other vital record or business function risk assessment programs that exist within the organization and if the material is usable for the vital records program. Typical review areas may include:

* Records management- may have vital record classes identified.

* Business continuity- may have critically assigned to business functions from a Business Impact Analysis (BIA).

* Risk management- may rate company business function loss.

* Emergency preparedness- may specify an order to re-establish company business functions.

If current programs are non-existent, suspend the vital records assessment and complete a BIA of the company business functions. The BIA produces a recovery priority rating (critically) that is a key factor used to align business function recovery priority with vital records during the assessment of vital record risk.

2. Define Corporate Vital Records

The definition of a corporate vital records program is a four-step process with two steps to identify vital records and two steps to implement the program.

* Conduct surveys of business functions to document business function records and collect information to identify and assess vital records.

* Assess vital records probability of loss or damage (risk analysis), impact of loss or damage (risk assessment), and business continuity recovery critically.

* Establish a plan to protect and reconstruct vital records.

* Establish an ongoing process to update and maintain the vital records program.

Survey Business Functions

Business functions are surveyed to document the records a business function creates and uses. The surveys are best accomplished as a one-on-one interview process, with the completion and submission of a survey form in advance of the interview. This approach effectively resolves participant's questions and ensures all records are identified during the survey.

Identify Vital Records

Vital records are identified using from three to six vital record rating factors pertinent to your industry.

Examples of multiple rating factors are:

Rating Factors (Used To)

* Borrow Money

* Document Workflow Process

* Defend Against Lawsuits

* Service Customers

* Collect Debts

* Document Corporate Compliance

* Protect Patient Records

You can use any number of risk ratings but simple ratings like high, mid, and low seem to work best. Use of pre-defined criteria is highly recommended to simplify the rating process for the survey participants.