Electronic media as compliance challenge

For decades, records managers toiled in relative obscurity, developing methods and processes to archive and retrieve the tons of paper their businesses spewed forth. Presently, as an e-discovery law addresses the proliferation of electronic media in everyday business, the importance of document management is gaining boardroom attention. Fortunately, new tools exist to manage data – both electronic and paper – and to mitigate associated risks.

The December 2006 amendments to the Federal Rules of Civil Procedure expanded discovery rules to include electronically stored data. With the rules, ‘informal’ electronic communications such as emails, instant messages (IM) and voice mails took on a new formality as ‘discoverable’ information in civil lawsuits. 

That, combined with Sarbanes-Oxley imposed criminal penalties for document destruction and/or alteration, is elevating the art and science of records management from dusty archives to boards’ radar screens. Some say it’s the best thing that’s ever happened to the profession. 

‘Now when companies go to federal court they have to look at this whole aspect of electronically stored information,’ says Kevin Joerling, manager of RIM (records and information management) content and standards at ARMA International, a not-for-profit organization serving records and information management professionals. ‘Sanctions can be levied against your organization for not handling email and other electronic information properly.’

‘There are pretty tightly controlled ways in which data can be stored in a traditional IT-based system,’ continues Gurpreet Dhillon, professor of information systems at Virginia Commonwealth University. ‘But these controls got a little loose with respect to emails and IM. Increasingly, we are going to see very clear-cut policies for the storage and archival of these messages because they can be presented in a court of law.’

Bettina Tweardy Riveros, associate general counsel and director of product development at Corporation Service Company (CSC), which offers legal support services and electronic document management solutions, says the new rules ‘provide a framework for parties in litigation to produce electronically stored information.’ The linkage between the rules and records management is key. ‘If you are on notice of litigation or reasonably anticipate litigation, you must halt destruction of all relevant documents,’ she says. ‘That is a very heavy burden and case law has indicated that the penalties for failure to halt destruction of documents can be disastrous to companies.’ Furthermore, a company’s inability to put a hold on document destruction could present the appearance that the business has destroyed documents in order to adversely affect a proceeding.

Driving down costs

By minimizing the amount of information that companies need to review and produce, records management also helps reduce litigation costs. According to Riveros, ‘There is a huge cost component for failure to have a good records management program.’ Companies lacking robust records management programs could be faced with huge volumes of electronically stored information – data and documents – plus hard copy documents that they will have to pay outside counsel to review for relevance and privilege, or produce unreviewed to the other party. 

‘The key to records management is that it provides the foundation for compliance in this new electronic era,’ adds Riveros.

Joerling concurs: ‘What we’re talking about here is information; companies need to know what they have and how to go back and find it,’ he says. ‘Companies are starting to find out that properly managing information is really, really important.’ Consequently, the records management function is beginning to move over from its traditional reporting relationship in administration to the compliance function. ‘Today we’re seeing more and more companies have their records management function actually report up through the compliance area, the legal area and the corporate secretary area,’ says Joerling.

New methods emerge from the old

Wherever they report, records managers are well prepared to meet the latest data compliance mandates. They’ve already built a strong foundation – records classification and retention scheduling systems originally designed to manage paper documents. Now they can apply these time-tested principles to managing electronic information. 

For years, optical character recognition (OCR) facilitated the scanning of hard copy documents into computer readable and searchable text. Today vendors and consulting firms supporting the records and information management industry are designing more tools and techniques to assist in the storage and retrieval of data.

‘The organizations we talk to need lots of ways to manage their documents, email and other information,’ says Traci Caughell, the director of product management at Open Text, which provides enterprise content management software and solutions. ‘Finding what they need and when they need it has become a huge risk and a productivity drain.’

Flexibility and compatibility

Caughell’s clients are looking for tools that are easy to use and compatible with the systems they already have in place. They don’t want to change the way they work or have to learn a lot of new processes.

In the past, records management vendors tended to be ‘point solutions’ focusing more on the needs of individual departments. However, Caughell says today’s global companies require centralized records management solutions capable of applying consistent rules to extract and store information from various systems and locations. Consequently, search technology needs to be flexible and robust enough to cover all types of content. Furthermore, clients are requiring ‘customized templates’ that enable various users within the company to access their data conveniently and to drill down for detail, if needed.

Even board material has entered the records management arena – and the electronic age. Tools enable corporate secretaries not only to disseminate information to boards but also to provide a strong audit trail of material submitted for board review and, in some cases, to capture board consent votes and administer questionnaires.

‘In the legal area, you probably have the most demanding needs for records retention and proper management of those records,’ comments Marc Daniels, chief operating officer of Diligent Board Member Services. At the same time, Daniels says the practices of emailing some documents and PDFs, and faxing or mailing other information to board members has become ‘problematic’ because companies circulate material and revisions in so many ways. 

To help resolve this situation, Daniel’s company enables clients to prepare, approve, disseminate and archive board books electronically. These virtual board books ‘have the visual appearance of the traditional hardcopy board book – complete with tabs, cover sheets and indexes – but they are totally electronic.’ Security provisions enable providers of information to have access only to the sections under their responsibility. Similarly, while all board members can access the main book, they can only view material related to the committees on which they serve. 

Following your own rules

In addition to electronic data delivery and storage, another emerging trend in records management is program enforcement. ‘You can have the greatest records management program in the world but if nobody follows it, then you haven’t done yourself any favors,’ says Caughell.

There is a lot of interest in the structures that support the system. ‘Companies are now starting to take a more serious approach,’ adds Joerling.  They’re saying, ‘Not only do we have good sound records management policies and procedures in place, but we’re going to start doing periodic auditing to make sure all of our employees are, in fact, abiding by these rules and destroying documents when they should be destroyed and keeping [documents] for as long as they should be kept.’

‘I am seeing more and more policies that actually make each employee responsible for managing records,’ he says. ‘It’s not just the IT department or the legal department that’s responsible for managing all this stuff.’