Alfresco 3 Records Management: Comply with regulations and secure your organization's records with Alfresco Records Management

Records Management systems that use software to automate the management of records are called Electronic Records Management (ERM) systems. This book discusses Alfresco, which is an example of an ERM system. ERM systems are not limited to managing only electronic records; non-electronic records can also be tracked with ERM systems.

Records Management is an important support tool that enables organizations to comply with legal requirements. One of the most compelling reasons for adopting a Records Management system is to be able to produce evidence relative to litigation brought against an organization in a timely manner. Electronic Records Management can do just that. It can be used to quickly search and find the evidence that can help to either prove or disprove compliance with regulations or to supply information relevant to e-discovery requests.

Unfortunately, almost all companies will need to defend themselves against lawsuits at some point in time. It may seem hard to factor potential litigation into the Return on Investment (ROI) calculation for Records Management when there is no immediate litigation pending, but it is usually too late to implement a Records Management system once faced with a lawsuit.

Litigation can be extremely expensive. The average cost for defending a lawsuit in the United States exceeds $1.5 million per case and more than a quarter of that cost is IT-related. In 2009, 22 percent of all companies and 36 percent of companies valued at more than $1 billion had more than 20 lawsuits brought against them with only 27 percent of companies having no lawsuits.

Records Management is a powerful tool for providing accountability and transparency. Records contain the historical details and reasoning behind why certain policies and decisions were made. Records can prove that an organization acted responsibly and with good intent (or not).

But for records to be accepted, they must be trustworthy and believable. They must be accurate and complete. They must be verifiable. Good Records Management systems, practices, and processes are the vital elements that can ensure that records are trustworthy.

But while accountability is something that is often spoken of relative to state and federal governments, accountability is a concept that is not limited to just governments. Governments are accountable to their citizens. Non-government organizations are accountable to their members, their employees, their customers, their communities, and their environments.

Accountability mandates that organizations keep accurate records that can later be reviewed, accessed, and analyzed by individuals inside the organization, and sometimes external to it.

At the heart of Records Management is the idea that records are retained and preserved to ensure that information is available for continued use and reuse. The required retention time for records varies widely. While the majority of records typically have only short-term value and are ultimately destroyed, most organizations also have a category of records, often representing a fairly large fraction of their total number, that need to be retained and preserved for long-term financial, historical, or cultural reasons. This category of records often needs special consideration to ensure that records will remain usable for long periods of time.

Electronic Records Management offers clear benefits over paper-based record systems. The process automation capabilities of ERM make the capturing and ingestion of record data fast and efficient. ERM records can be searched and we can retrieve orders of magnitude more quickly than with paper systems, and backups or copies of the electronic data can be made easily so that data can be safely stored in off-site locations. Because of these benefits, organizations are increasingly abandoning paper and turning towards the digital storage of their information.

While ERM can offer impressive benefits in terms of efficiencies and cost savings, digital assets themselves can be quite fragile, if not properly maintained. Two main areas of concern about preservation of digital assets are the long-term viability of the storage media and the data formats used to store the records.

Magnetic and Optical storage devices are surprisingly short-lived. Both types of media are subject to bit rot, the process where bits become corrupted because they lose their magnetic orientation, or the disk material itself breaks down. Hard drives, for example, have only a three to six-year lifespan expectancy. Magnetic tapes are expected to last ten to twenty years, and the lifespan of CD-ROMs and DVD-ROMs is in the range of 10 to 100 years.

Properly maintained, despite being extremely fragile, some paper has been able to last for thousands of years, and no doubt with the right amount of scientific research, proper attention, and careful handling, the lifespan of digital media could be extended to go beyond the current expected lengths. Both paper and disks tend to do better in cool, dark environments with low humidity. But it should be a given that the lifespan of storage devices will be relatively short.

As ERM systems have centralized storage, storage media degradation for ERM systems isn't really an issue. Because all data is stored centrally, rather than needing to examine and treat the storage media of each asset as a special case, the storage and management of all records can be treated holistically.

However, Records Management systems aren't static. As time passes, ERM systems will obviously evolve. Records Management systems will be upgraded, hopefully on a regular basis, and data and records will be migrated to newer storage hardware and improved ERM software. Data migrations performed in support of regular maintenance and upgrades won't always be trivial, but with careful planning, the work involved to migrate records to new software and hardware should be straightforward.

So from a data preservation level, the worry is not so great that records stored in actively maintained and regularly backed-up Records Management systems would somehow be lost because of degradation of storage media. The real worry is whether the format that digital assets are stored in can continue to be readable.

Data file formats change very rapidly. With some software products, every new release may involve changes to the format in which the data is stored. Without the proper software reader to read a digital asset, the stored data becomes, in effect, useless. A common solution to reduce the size of this problem is to limit or convert the formats of data being stored to a small set of stable core data types. This is an important problem to be aware of when designing and planning for a Records Management systems that requires long-term record preservation. This is one topic that we'll expand on in greater detail in Chapter 4 relative to the Content Model, file content, and data types.

Keeping records for a period past the necessary retention period results in inefficiencies. Storing expired documents simply takes up space and clogs up the Records Management system.

When records are kept longer than needed, those outdated records can be unnecessarily considered during the discovery process. When performing e-discovery key-word searches, outdated documents can be returned as possible search candidate matches, even though they are no longer relevant.

For example, consider an e-discovery request made to the chemical company DuPont. To respond to the request, the company found that it was necessary to review 75 million pages of text over a period of three years. At the end of the e-discovery, they realized that more than half of the documents they examined were outdated and past their retention period. If Records Management guidelines had been applied prior to the discovery, outdated documents would have been properly disposed of, and the discovery process could have been performed much more efficiently. That could have saved DuPont $12 million.

In this example, greater efficiency could have been achieved by eliminating obsolete records, thus minimizing the volumes of data examined during e-discovery. Eliminating obsolete records also reduces the legal risks that could result from obsolete content that may have been in those records.

Having a Records Management system in place prior to an e-discovery request can be an insurance policy that could ultimately save you many times over the cost of the system itself.

Records Management is about being prepared, being prepared for the unexpected. No one can see the future, but disasters do happen, and unfortunately, on an all too regular basis.

On the morning of September 11, 2001, terrorists crashed airliners into each of the Twin Towers of the World Trade Center in New York City. The death toll that day was nearly 3000 people. The destruction was in the billions of dollars and the event seriously impacted the economy in New York City and affected the psyche of nearly every citizen in the United States. Lives and businesses were disrupted and changed.

One business directly affected by this disaster is the law firm of Sidley Austin Brown & Wood LLP (SAB&W), which occupied the fifth fourth to the fifty ninth floors of the North Tower. While 600 SAB&W employees worked in the Trade Center offices, the firm suffered only a single death that day. Unfortunately all physical assets at the location were lost.

Luckily SAB&W was prepared. The firm had a solid disaster recovery plan and within hours after the disaster, the plan was in full effect. By making use of vital records maintained offsite that included information about floor plans, personnel locations, procedures, clients, and vendors, the firm was able to spring into action. The vital records that they had access to included important insurance records. From these records, they were quickly able to determine that their total loss would be fully covered by their insurance and they were also able to quickly start the processing of their insurance payout.

Based on personnel records, an intensive search was immediately initiated to locate all employees from that location. A new office space of similar size was leased at another location in New York City hours after the event. Computers, networking equipment, and furniture were purchased.

Backup tapes kept in Chicago of e-mails and other data from the New York office were identified. Within three days, e-mail and voice mail were fully restored. On the fourth day, the document management system was available again and temporary office space was being set up. Somewhat unbelievably, within only one week, SAB&W was back up and running and in reasonable operational shape.

Unfortunately, most stories of disaster can't boast of such quick and successful recoveries. Consider what happened at Embry-Riddle Aeronautical University near Daytona Beach, Florida in late December, 2006. Four Christmas day tornadoes struck the area. With winds as strong as 159 mph, mobile homes were destroyed and apartment buildings in the area had their roofs torn off. Some of the worst damage from the tornadoes occurred at Embry-Riddle. The storm tossed one of the Embry-Riddle airplanes into the school's main administration building, Spruance Hall. The maintenance hangar, 50 of their 65 airplanes, and Spruance Hall were all destroyed. Total damage totaled $60 million.

Embry-Riddle's Spruance Hall housed the financial aid, the bursar, the president, and general administration offices. The day after the tornado, paper documents literally covered the campus grounds around the area. But in this case, unlike SAB&W, Embry-Riddle was not adequately prepared. They had no disaster or business continuity plan. The mentality had been that disasters are something remote and can never happen to us. But, unfortunately, when disasters do happen and you are not prepared, the results can be devastating.

Hurricane Katrina is another disaster that caught many unprepared with significantly worse consequences than that of Embry-Riddle. Katrina hit the Gulf Coast area in late August 2005 with torrential rains and flooding that caused widespread and serious damage. Katrina is considered to be one of the most catastrophic natural disasters in all of U.S. history. Damage was reported in Texas, Louisiana, Mississippi, and Alabama. Homes and businesses were destroyed, hundreds of lives were lost, and tens of thousands of lives were deeply disrupted.

The widespread loss and damage to documentation and records was a major tragedy of the Katrina disaster, and much of the damage was as a result of the heavy reliance on the use of paper records. It is another reminder that disasters like floods, fires, tornados, and hurricanes come with little warning and can bring about devastating results. The previous largest disaster prior to Katrina for losing historical documents happened in Florence, Italy in 1966 due to flooding.

In the case of Katrina, the loss or damage of records wasn't limited to individuals; institutions and government agencies were heavily affected too. Historical treaties and photographs were destroyed. Vital records of all kinds were affected by Katrina that included medical records, school records, law enforcement records, birth records, and marriage and driver's licenses.

After documents come into contact with water or moisture, it takes only 48 hours before mold starts growing, and after that, the deterioration of paper documents accelerates quickly. The flood waters in many areas hit by Katrina were several feet high, forcing many residents to evacuate and leave behind their belongings, only being allowed to come back into the area many days later. But by that time, for many documents that were damaged, it was too late.

Some buildings in New Orleans containing legal and vital records were bulldozed before the records could be removed. Emergency teams were initially told to discard damaged records to keep city residents safe from molds and other contaminants, a policy that was later retracted, but which resulted in the unnecessary loss of many valuable records.

The loss of legal documents in the Gulf region because of the Katrina disaster was stunning. One-third of the 5000 to 6000 lawyers in Louisiana lost all of their client files. The Louisiana state supreme court lost a significant number of their appellate files and evidence folders. Much of the problem resulted because records were often stored in basements or the lower levels of buildings. For example, court files in Mississippi and Louisiana were both stored in courthouse basements, and in both cases, many of the paper records were irrecoverably destroyed.

All told, an incredible number of records were simply lost. Many others, while damaged, were recoverable and needed to be painstakingly restored. But perhaps most frustrating was the fact that many of the documents that actually did survive the storm were inaccessible for weeks. For example, in New Orleans, the vital records office for Louisiana stored state birth certificates, death certificates, marriage licenses, and divorce papers. Most of the records at this location were paper and dated back over 100 years. But in the aftermath of the storm, the state records office was nearly shut down, being manned by only five percent of its normal staff, making records accessible only after very long waits.

Katrina hit medical records very hard too. Estimates are that tens of thousands and possibly millions of pages of healthcare records, files, and charts were lost in private-practice offices, clinics, and hospitals. More than one million people were separated from their healthcare records during the disaster, with many people forced to relocate to other parts of the country, and of those receiving treatment, many could not continue because the record of their diagnosis and treatment was lost.

Much of the damage from Katrina was as a direct result of the fact that most records were stored on paper. The Tulane Medical Center located in New Orleans presents an interesting contrast to most other New Orleans hospitals. The Tulane Medical Center maintained their medical diagnostic records electronically. Their electronic records included lab, radiology, cardiology, and nursing documentation. Because the data was stored electronically and not physically located in New Orleans, availability of this data was not affected at all because of the disaster.

Disasters are good teachers. After the event at Embry-Riddle, creating and maintaining a disaster recovery plan immediately became a top priority for the school. The school invested in Document Imaging and Records Management software, and after seeing firsthand what could happen when planning and preparation for worst-case scenarios aren't done, the faculty and staff of the university resolved that they did not want to see a repeat episode.

Similarly, less than one year after Katrina, officials, archivists, and records managers from nine Southeastern states affected by Katrina's destruction gathered to begin planning ways to be better prepared for future Katrina-scale disasters. A big deficiency noted in the emergency response to the disaster was the disconnection between archivists and state emergency planners. After meeting, the states resolved in the future to include state archives as part of any emergency response.

Whether they are man-made or natural, disasters happen. Preparation and planning are key for being able to successfully cope with disasters.

The volume of data within organizations is growing at a phenomenal rate. In fact, International Data Corporation (IDC), a research and analyst group, estimates that the volume of digital data is doubling every 18 months. And that growth is having a huge impact on organizational IT budgets. For example, if we assume that the average employee generates 10 gigabytes of data per year, and storage and backup costs are $5 per gigabyte, a company with 5000 employees would pay $1.25 million for five years of storage.

Consider the costs of e-discovery. "Midsize" lawsuits that involve e-discovery typically result in the processing of about 500 GB of data at a cost of $2.5 to $3.5 million. Lawyers and paralegal staff must review the content of the data, determine which documents are relevant, redact, or black-out parts of the documents considered private or company confidential, and finally, output the data into a common data file format like PDF that will be used for delivery to the requester.

The goal of Records Management is to allow organizations to cut back on what information must be retained. Organizations with no Records Management policies in place have no clear guidelines for what documents to save and what documents to discard. The end result is that these organizations typically save everything.

And we've seen, trying to save everything comes at a steep cost. Keeping records that should have been destroyed earlier means that more storage space is required. It means that backup times are longer. It means that data searches are slower because there is more information to search. It means that people's time gets wasted when irrelevant records turn up in search results. Records Management helps clear the clutter and bring greater efficiency.

Records Management isn't going to be able to put a stop to the general upward trend of creating and storing more information, but by strictly following Records Management retention schedules, organizations should be able to significantly reduce the volume of data that they do keep.

The security of records is an important issue and the responsibility of the Records Management system. This is one area where an Electronic Records Management system really shines when compared to manual methods for managing records.

A major advantage of ERM is that the application of security and access controls over electronic records and folders is much easier to implement and can be applied in a much more granular way than over physical folders and records.

Records stored on paper and other non-electronic media are very hard to tightly secure, especially when the requirements for access control become even moderately complex. Physical records require that filing cabinets and storage locations be appropriately secured. They typically need to be controlled and managed by trusted records librarians. Physical Records Management requires far greater day-to-day supervision by people and, because of that, is subject to many more points of potential security lapses than with an automated system.

That is not to say that the physical security of the computer hardware used to run the Records Management system is not important.

With ERM, access rights can be changed or revoked, as needed, protecting records from unauthorized users. The system is able to validate that the data managed is accurate and authentic. An ERM system can also provide an audit trail of all activities for all records and thus demonstrate compliance.

Regulations usually contain detailed instructions about how records should be handled, but often the regulations don't actually mandate that a formal Records Management system be used. But really, what's the alternative?

Not having a Records Management program at all is a recipe for problems, if not disaster. Without a Records Management system in place, tracking down the records that document policies, procedures, transactions, and decisions of an organization becomes extremely difficult or next to impossible.

We've discussed how Records Management can enable important business benefits like accountability, compliance, efficiency, and security. Taken as a whole, these benefits are really the characteristics of doing good business. And at its very essence, that's what Records Management is all about.