To be sure, there is room for ERM technology to improve. Joseph Steffan, director of technology compliance at Lehman Brothers, is a proponent of E-mail archiving tools, but he notes that on some systems, one search can still take an entire day. "Performance has been a big issue," he says. "We are pressing vendors very hard to achieve order-of-magnitude improvements."
Finding Your Way
Despite the imperfect technology, many experts advise companies to explore ERM now rather than wait, particularly if the nature of their businesses makes a legal or regulatory matter likely. To approach such a project efficiently, keep the following things in mind:
For starters, the job is best handled by a multi-disciplinary team. Legal services, compliance, records management, lines of business, and IT all need to be represented. The first task is to determine a retention policy stipulating what to keep and for how long. "An organization needs to understand confidently what its retention policy is going to be," says Steffan. "That mixes legal obligations and operational preferences."
Regulations will sometimes dictate policy. HIPAA, for instance, requires health-care providers to keep all customer information for six years. But coming up with retention rules in gray areas is much harder. You don't want to trash something that could help you in court one day, but saving everything devours expensive storage space and requires more time to search through. Too much information can also be a liability in court, making the matter of what to save and for how long a particularly vexing one.
A lot depends on the company's risk profile. "The first question we ask clients is, 'Do you believe that saving documents increases or decreases your liability?' " says Mark Diamond, president and chief executive of compliance and data consultancy Contoural Inc. "It is a linchpin issue."
Air conditioning and heating supplier York International Corp. uses different approaches for different types of records. Documents generated by standard business processes, such as an employee request for a new PC, are automatically routed to storage using EMC Documentum software. But E-mail retention may vary based on employee roles. For example, all senior-management E-mail is automatically saved, but other employees must actively file E-mail in official records folders to archive it. If no action is taken, the E-mail will eventually be deleted. "The legal department's point is that too much E-mail is a bad thing," explains Timothy Fives, manager of global content solutions for York. "We'd rather err on the side of not having enough data than keeping things in perpetuity, which generally comes back to bite companies."
One challenge for ERM is whether decisions about what constitutes a record can be automated. At specialty-materials maker Rohm and Haas Co., for example, an archiving system will leave it to end users to decide what does and does not get saved. "Historically, end users have always made those decisions," says Jim Coulson, principal and senior consultant at the Records Improvement Institute, a consulting firm that is helping Rohm and Haas design its program. "They are the subject-matter experts. There is no autoclassification tool on the horizon that will classify these things more accurately than the end user."
No matter what approach is taken, training and enforcement are critical. In a courtroom, it is better to have had a bad policy enforced consistently than a great policy enforced inconsistently. "If litigators find you are not following your policy, they will exploit that," says Diamond.
Internal marketing is also an important part of the process. Rohm and Haas enlisted consultants at CRA Inc. to create a long-term communications plan for its program, which will eventually cover many kinds of documents. Employees receive consistent messages telling them how the new system will save them time and inconvenience. "Communication is everything, because more than anything this is a cultural and behavioral change for the corporation," says Sandra Hostetter, program manager for electronic content management and retention. The proverbial "tone at the top" matters as well. Given that improper records management can directly affect the livelihoods of C-level executives, senior leaders have plenty of motivation to encourage strict adherence to new ERM policies.
ERM at a Glance
Electronic records management (ERM) solutions involve a number of components. Depending on the size of the company and the scope of the project, deployment can cost anywhere from $10,000 to $3 million. Mark Diamond, president and chief executive of compliance and data consultancy Contoural, breaks down the offerings as follows:
Retrieval Software
This is the brain of the ERM system. It is responsible for autoarchiving functions and keeps track of where records are, who owns them, who has access to them, and when they should be destroyed. Systems are available for structured data (from EMC, OuterBay, Princeton Softech, and others, priced from $150,000 to $250,000 per application, such as an ERP system), semistructured data (Veritas, EMC (including Documentum and Legato), Zantaz, AXS-One, iLumin, IBM, and others, priced from $25 to $75 per mailbox per year), and unstructured data (Kazeon, Arkivio, and others, priced from $150,000 to $250,000 per major data center). Structured data typically resides in a database; unstructured data is found in spreadsheets, Word documents, or PowerPoint presentations; and semistructured data refers to E-mail and instant messages.
Reader Comments» Post a comment