Getty Images/iStockphoto
6 best practices for a records management strategy
A records management strategy can boost efficiency and reduce compliance risk. To create this strategy, organizations must first identify business and legal requirements.
Organizations in the early stages of a records management program shouldn't jump immediately to retention schedules and record locking.
Records management (RM) teams often start with emails and treat them all the same and lock and delete them after a period that some product demo recommended. This approach ignores the bigger picture of RM within an organization.
Whether organizations start from scratch or update existing RM efforts, they must first establish a records strategy. To put a strategy in place, RM teams must know their requirements, the content they have and what information they need to manage as records. Teams can then use that knowledge to plan and create RM strategies that will grow and evolve over time.
6 best practices for records management
To implement an effective strategy, RM teams must know their industry's business and legal requirements and list all the information their organizations store.
1. Understand the requirements
RM teams must know the laws, regulations and business requirements relevant to records management and preservation. These requirements define the records lifecycle for different types of information. Often, the sets of requirements don't align, especially for organizations that operate across multiple locations.
This step helps RM teams compare how long their organizations are legally required to keep records versus how long the operational side of the organization would prefer to keep the records. Those needs rarely sync up, so legal and operational teams must negotiate to balance compliance risk against business needs.
2. Create an information inventory
Before RM teams can determine how long to keep records, they must first understand what information the organization stores and processes. The IT department can offer the RM team an overview of the organization's existing systems to help the team locate and manage all information. However, only the RM team can determine which information makes up records.
RM teams must contact every department of the organization so they can accomplish the following:
- List the information each department uses.
- Define the business purpose of the information.
- Identify how each department stores the information, whether in an IT system, filing cabinet or an offsite records storage.
- Document the processes each department uses to manage the information.
Organizations usually have overlaps in reported information. If they don't, then the inventory is likely incomplete. RM teams must understand where all departments store information, so they can map it to their defined RM requirements.
3. Identify incorrect RM processes
Next, RM teams must identify any disparities between current and ideal RM processes. To identify these disparities, teams can ask the following questions:
- What information should the organization manage as records?
- How does the organization manage records throughout their lifecycle?
- Does the organization store any critical records haphazardly?
Information doesn't need to reside in a dedicated RM system for organizations to manage it as a record. For example, finance and HR departments often store records in their own systems, because it helps them do their jobs. RM systems offer more oversight, but some HR and finance systems can also manage records.
Organizations often use different systems to store different types of records. However, the RM team must ensure each system offers the right RM features for the types of records they store.
4. Define the records program's goals
After RM teams understand the requirements and current state of RM within their organizations, they can create an informed records plan or goals. This plan guides the strategy and informs decisions around implementation priorities.
RM teams should link their records goals with the organization's larger mission. A strong plan highlights how an RM program can strengthen the business.
5. Establish a roadmap
Next, RM teams can establish the records roadmap, which is a living document that informs future decisions and guides the execution of the RM strategy. This step requires RM teams to rank the importance of different compliance and business processes, so they must include representatives from across the organization and executive leadership.
As the RM team plans its roadmap, team members will identify important legal processes, such as closing regulatory gaps and establishing formal retention schedules. They might also notice important processes that improve productivity and support digital transformation initiatives.
However, RM teams should not rank any processes equally. Even if the organization performs processes in parallel, teams should always prioritize one process over another. Then, if the organization faces a resource conflict, teams know which process should receive the resources.
6. Follow the roadmap
Finally, RM teams must follow the roadmap. Teams likely won't face many challenges in the first three to six months if they keep up a strong momentum. However, challenges come over time as more tactical concerns consume people's day-to-day activities. So, RM teams should hold regular meetings to review the strategy's progress. These meetings create accountability and help the RM team measure its progress. The RM team should also regularly brief leadership on the program's progress.
The RM team should revisit the roadmap at least once per year because people will likely add new items to it over time. The team must reevaluate all items under the current business landscape. Items that were important a year ago might not be a high priority today.
How to get started
The steps above can overlap. When organizations have incorrect RM processes in place, they may need to move at a faster pace to meet compliance requirements. The RM team should still put all the necessary components into place, but can expedite urgent processes.
Every day, employees and customers create more information that organizations must properly manage. As more information comes into an organization, the risk that someone will improperly destroy it increases. Therefore, organizations should not wait too long before they implement a records management strategy.
Laurence Hart is director of consulting services at CGI Federal and has more than 20 years of IT experience.
