White Paper

2009

Electronic Records Management Survey

Call for Sustainable Capabilities

Prepared by Lori J. Ashley and Robert F. Williams

Co-sponsored by

Cohasset ARMA International Electronic Records Management Survey

About the Authors Robert F. Williams is the founder and president of Cohasset Associates, Inc., one of the nation’s foremost consulting firms specializing in records and information management. Under his direction, Cohasset Associates has provided award-winning consulting services to clients throughout the United States for over forty years. Mr. Williams also is a renowned educator. He has delivered over 1,000 presentations and since 1993, has co-chaired the premier National Conference on Managing Electronic Records (MER) which focuses on the legal, technical and operational issues associated with electronic records. Mr. Williams is a Fellow of both ARMA International (ARMA) and AIIM – the first of only two individuals so honored. He can be reached at [email protected].

Lori J. Ashley is a Wisconsin-based consultant, editor and educator dedicated to helping public and private sector clients improve information and records life cycle management capabilities and performance. Prior to joining Cohasset Associates, Inc. as a Senior Consultant, Ms. Ashley served as Wisconsin’s statewide data, forms and records coordinator where she supported state and local government forms/records officers and data administrators in the implementation of statutory requirements, policies, and best practice standards. Ms. Ashley worked in the regulated energy sector for more than a decade as a business strategist, process manager and organizational development specialist. She can be reached at [email protected].

1.0 © 2009 Cohasset Associates, Inc. 3806 Lake Point Tower 505 North Lake Shore Drive Chicago, IL 60644 USA www.cohasset.com

This white paper and the survey information contained in it are copyrighted and are the sole property of Cohasset Associates, Inc. Selective references to the information and text of this white paper are welcome, provided such references have appropriate attributions and citations. Permission is granted for limited inter-office reproduction so long as the contents are not edited and the “look and feel” of the reproduction is retained. Full reproduction of the White Paper is prohibited without written approval from Cohasset Associates, Inc. For full reproduction permission, beyond limited-use convenience copying, please contact Robert Williams at [email protected].

Please consider the environment before printing. To help conserve resources, this paper is set up to print duplex.

i About the Authors

Cohasset ARMA International Electronic Records Management Survey

Table of Contents Executive Summary ........................................................................................................................ 5 The Heritage, The Sea Change and The Survey .................................................................................. 6 Survey Highlights ..................................................................................................................... 8 Conclusions...... ..................................................................................................................... 10 Background – The Need for a Survey ................................................................................................... 13 Survey Methodology ...................................................................................................................... 15 Survey Results........... .................................................................................................................. 17 1.

Records Management Program ............................................................................................... 17 1.1 Does your organization have a formal records management program? ...................................... 17 1.2 How would you rate the effectiveness of this records management program? ............................ 17 1.3 Assess the effectiveness over time of your records management program ................................ 18 1.4 Currently, are electronic records included in your records management program? ..................... 18 1.5 Do your records management policies and procedures address electronic records? ..................... 19 1.6 Do you believe “C Level” management at your organization understands that records management is a key component of the organization’s commitment to risk mitigation? ............................................................................................................... 20 1.7 Do you believe “C Level” management at your organization understands that good governance requires successful compliance; and successful compliance depends on good records management? ........................................................................... 20 1.8 Where does Records Management report in your organization? ............................................. 21 1.9 What is the primary source of guidance used by your organization to determine records management requirements and practices? ............................................................. 21

2.

Records Retention Schedules and Email Retention Policy ............................................................... 22 2.1 Does your organization have a records retention schedule? .................................................. 22 2.2 What is the basis for the organization of records series or categories in your current retention schedule? ......................................................................................... 22 2.3 Does your organization have comprehensive records retention schedules which include electronic records? .................................................................................. 23 2.4 Does your organization have records retention schedules for the three primary categories of electronic records?......................................................................... 23

Table of Contents 1

Cohasset ARMA International Electronic Records Management Survey

2.5 When did your organization last update its retention schedules? ................................................. 24 2.6 How many different record series does your current retention schedule have? ............................... 24 2.7 Given the growing capabilities to search vast volumes of electronic records, do you believe the “big bucket approach” is the best way to meet the challenge of classifying large daily volumes of electronic records? ............................................................ 25 2.8 Does your organization follow its retention schedules? ............................................................. 26 2.9 Does your organization have a formal email policy regarding retention practices for email?.......................................................................................................... 27 2.10 Is your organization’s email records policy time-based, user-based or group-based? .......................... 0 2.11 Does your organization have a formal policy regarding retention practices for the following: voice mail, instant messaging, blogs? ................................................................. 27

3.

Discovery Response Process and Records Hold Orders ................................................................... 28 3.1 Does your organization have a formal process to respond to discovery requests for records? .............. 28 3.2 Does your organization currently have a formal system for records hold orders – setting aside for an indefinite period of time those records that are deemed relevant to an existing or pending legal or regulatory proceeding? .................................................................................................... 29 3.3 Does your system for records hold orders include electronic records?........................................... 30 3.4 How would you rate the effectiveness of your organization to fully comply with records hold orders? ................................................................................................................... 31 3.5 How would you rate the effectiveness of your organization to rescind records hold orders following the conclusion of the matter that precipitated the original record hold? ....................................... 31 3.6 Have your attorneys concluded that the legal admissibility of records is media independent? ............. 31 3.7 How would you characterize the impact of the 2006 revisions to the Federal Rules of Civil Procedures (FRCP) on the management of your organization’s electronic records? ........................... 32 3.8 How would you characterize your organization’s capabilities in relation to the 2006 revisions of the Federal Rules of Civil Procedure? ................................................................................... 32

4.

Life Cycle Management of Electronic Records............................................................................... 33 4.1 Which function in your organization currently has primary responsibility for the management of electronic records created and used in the normal course of business? ...................................... 33 4.2 How would you characterize IS/IT’s understanding of the concept of “life cycle” (creation, use and disposition) regarding the management of your organization’s electronic records? ..................... 34 4.3 Which function in your organization do you believe should have responsibility for the management (creation, use and disposition) of these three primary categories of electronic records in the normal course of business? .............................................................................. 35 4.4 Which of the following best describes your organization’s current records destruction practices for electronic records that have met their approved retention and are not subject to a hold order?..... 36

2 Table of Contents

Cohasset ARMA International Electronic Records Management Survey

5.

Long Term Digital Preservation ................................................................................................ 37 5.1 How important do you believe that the process by which electronic records are managed will be important in future litigation? ............................................................................................ 37 5.2 If legally challenged, how confident are you that your business organization could successfully demonstrate that its electronic records are accurate, reliable and trustworthy – many years after they were created? .......................................................................................................... 37 5.3 How would you characterize IS/IT’s understanding that compliance with records retention policies will require the migration of electronic records to new formats and media? ................................... 38 5.4 Does your organization have a formal process to migrate older records so that they will be accessible throughout the prescribed record retention schedule? ................................................ 38 5.5 Is there a specific budget in your organization for record migration? ............................................ 39

6.

Electronic Archiving and Backup Data Management ....................................................................... 40 6.1 What storage device/media does your organization use to back up its computer systems? .................. 40 6.2 What storage device/media does your organization use for electronic archiving? ............................. 41 6.3 Does your organization rely on computer back-up for electronic archiving purposes and therefore retain certain “back-ups” (such as back-ups of email servers) for longer periods of time to meet legal and regulatory requirement or to satisfy longer-term business needs? ................................... 41 6.4 Does your organization have and apply retention rules to electronic archiving and computer back-ups? ...................................................................................................................... 43 6.5 Which function defines your organization’s retention policies for its electronic archiving and computer back up data? .................................................................................................... 43 6.6 How would you characterize your organization’s ability to find and retrieve information from electronic archiving storage devices/media in response to legal discovery requests? ........................ 44 6.7 How would you characterize your organization’s ability to find and retrieve information from computer back-up storage devices/ media in response to legal discovery requests? .......................... 44 6.8 How many computer back-up tapes does your organization currently retain to meet its need to store records and data? ..................................................................................................... 45

Conclusions............................................................................................................................... 47 Self-Assessment ......................................................................................................................... 48 Action Items for Success............................................................................................................... 49 End Notes ................................................................................................................................ 53 ARMA International ..................................................................................................................... 56 Cohasset Associates, Inc. .............................................................................................................. 56 RIM on Demand .......................................................................................................................... 57

Table of Contents 3

Cohasset ARMA International Electronic Records Management Survey

4

Cohasset ARMA International Electronic Records Management Survey

Executive Summary The overall conclusions of this 2009 Cohasset ARMA International Electronic Records Management Survey can be classified into five categories: 1.

There is evidence of an evolution from awareness to action – manifesting continuing improvement of records management programs.

2. For most organizations, much remains to be done to achieve credibility and consistency in the life cycle management of their electronic records. 3. The processes and systems for handling records via electronic archiving and backup media and devices continue to represent major organizational risks. 4. There is a persistent accountability gap for establishing retention policy as well as dayto-day management of all types of electronic records. 5. Significant shortfalls in retention and disposition protocols applied across the spectrum of electronically stored information may jeopardize the future reliability, availability and trustworthiness of many records. The overall findings strongly suggest that since the last survey, some foundational components of records management programs have received much needed attention. For example, a significant increase in the percentage of respondents (87%) that reported their organization’s system for records hold orders includes electronic records – up from 56% in 2007. Cohasset believes that improvements reflected in the findings of this survey are, to varying degrees, the result of six factors: 1.

New and increasingly complex regulations - particularly those relating to information protection and data privacy,

2. Evolving legal requirements and expectations such as the amended Federal Rules of Civil Procedures,1 3. The 2007 Cohasset ARMA AIIM Survey – A Call for Collaboration White Paper which authoritatively detailed the severity of problems regarding electronic records management, 4. The ever-increasing reliance on a diversity of applications and systems to manage organizational records, 5. The robust and integrated enterprise content management technology solutions and services offered in the marketplace, and

Executive Summary 5

Cohasset ARMA International Electronic Records Management Survey

6. The growing realization that effective records management is the keystone to achieving compliance which, in turn, is essential to enterprise governance. Although the findings in this white paper reflect progress in many foundational program areas, the good news should not be interpreted in any way that underestimates the challenges yet to be addressed within each organization and within the RIM profession to bring the comprehensive life cycle management of electronic records to respectable and sustainable levels. There also are troubling findings relating to governance and internal controls. Clearly there still is an urgent need to improve “end-to-end” electronic records management capabilities and controls. This Cohasset ARMA International white paper, like its prior editions, provides a compelling case for senior management to assess how well their organization currently manages its records and electronically stored information against established standards and benchmarks.2 Based on the results, the need to focus expert resources and greater oversight should be quantified and integrated into multi-year strategic enterprise and tactical planning initiatives. To that end, a set of action items for stakeholders in the records management process are provided to encourage cross-disciplinary cooperation and accountability. This white paper renews the 2007 white paper’s call for collaboration and expands the call to advance the development of enterprise capabilities and controls in the comprehensive management of electronic records. For an organization to manifest effective governance over its information and records assets there must be compliance; and to achieve compliance, there must be effective and institutionalized records management commitment and performance.

The Heritage, The Sea Change and The Survey The world remains in the midst of a sea change regarding how records – which many consider the most important asset of any organization3 – are created, received, stored, retrieved, used and managed. To fully understand the significance of this change, both in its present context as well as what it purports for the future, the records management foundation on which organizations have historically relied must first be understood. The Heritage: For centuries, (paper) records were managed on a media-centric basis in accordance with the operational model of materials management which is applied to all types of other business assets. Because these paper records were a physical commodity, their management was driven largely by need and space: the time period “to keep” was based on need, and the location for storing them was determined by space constraints and availability. Accordingly, records were kept where they were readily accessible for as long as space permitted. Over time, records typically were transferred to another location where there was more (and usually less costly) space – where their continued accessibility could be ensured for as long as they were needed.4 This transfer in custodial care of records from the originating business function/owner provided a stable and controlled environment for storage and provided the necessary controls to ensure both the authenticity and availability of the records. For as long as records have been created, media-centric records management practices successfully served the needs of government and business.

6 Executive Summary

Cohasset ARMA International Electronic Records Management Survey

The Sea Change: Now consider the sea change at hand: the transformation of records management from the paradigm of media-centric assets, where management was based on observable physical location controlled by humans, to the age of digitally stored information and content-centric records, where the management process is based on invisible logical location controlled by computers. This sea change reflects the radically different nature of electronic records and has resulted in exponentially greater complexity in the management process. It also has spurred extraordinary research and development efforts for capabilities to improve this process – achieving unprecedented levels and sophistication of control, effectiveness and automation. Content-centric records management is a revolution in more than concept. It revolutionizes every aspect of how records are created and managed: from identification and classification of new record types... to records storage and access controls ... to dependence on technology... to higher performance standards... to new skill sets required for end users as well as business, records, legal/compliance and IS/IT5 managers... to the need for a sustainable enterprise governance framework... and so much more. The Survey: This white paper was prepared to foster dialogue among stakeholders about much needed governance and operational capabilities related to electronic records management. The survey research which is the foundation of this report looked at certain key components associated with the successful life cycle management of records and the degree to which critically important management practices are being applied to electronically stored content and records. In addition to utilizing most questions asked in the five previous Cohasset ERM surveys,6 this year’s survey included three new areas of research: 1) the impact of standards and other guidance on records management programs, 2) records destruction and certification practices, and 3) retention and disposition capabilities related to managing electronically stored information. In 2009, two noteworthy changes to the survey format were made in response to respondent feedback: 1) for some questions, respondents could provide a free text response when responding with the choice “Other” and, 2) in a few instances, a “No” reply resulted in a prompt to “skip ahead” one or more questions which had the effect of splitting results into previously unavailable options. Percentages are used throughout this white paper. The first and most prevalent type of percentage is derived directly from respondent answers. These percentages are reported in columns labeled by year in the matrices. The second type of percentage is derived from a comparative analysis of the 2009 ERM survey results with the results from previous years. Cohasset Associates, Inc. conducted the survey research, performed the analysis and prepared this white paper. ARMA International, the professional organization dedicated to the field of records management, was this year’s survey co-sponsor.7 The nearly 1,200 survey respondents were records, archives and information management professionals – those with the best understanding of the subject matter of this research.

Executive Summary 7

Cohasset ARMA International Electronic Records Management Survey

Survey Highlights The white paper findings provide compelling reasons for leadership throughout business and government to ratchet up their focus on enterprise governance in order to boost their organization’s records management capabilities. While meaningful progress has been made in addressing certain key programmatic aspects, serious problems with regard to life cycle control over electronic records and information assets exist at dangerous levels in varying degrees for many organizations. The complexity of systems used to create and store records as well as an increased reliance on third parties to support mission-critical business activities and functions underscores the need to act decisively to exercise control over the organization’s electronic information assets. To understand the status quo for a majority of corporations and government entities with regard to management of their records, particularly electronic records systems, consider the following survey highlights. These highlights are divided into four parts – each relating to a key records management principle. PRINCIPLE: Records must be retained and disposed of in accordance with specified rules – to comply with statutory and regulatory requirements as well as meet operational and long-term business needs. •

We sought to identify the extent to which electronic records are included in retention schedules and found the situation continues to improve; 75% of the organizations represented now report electronic records are included.

•

We sought to learn about retention practices for emerging sources of records (voicemail, instant messaging, blogs and Web pages) and found the overwhelming majority (78%+) do not have retention practices in place.

•

We sought to identify who is responsible for defining retention requirements for archival and backup media/devices – and found that Records Management runs second (50%) to IS/IT (64%) in this regard, a continuation of the results reported in 2007.

•

In a new question posed in 2009, we sought to assess current records destruction practices for electronic records and found that only a third (36%) reported having formal procedures in place.

PRINCIPLE: Retention must be suspended for designated records and those records held indefinitely to ensure their access and retrievability – and thereby comply with court-ordered record holds and compliance-related discovery requests. •

We sought to assess the degree to which organizations are prepared to respond to records hold orders and found only 64% have a formal system for records hold orders in place – a modest improvement over the 2007 results.

•

We inquired about the inclusion of electronic records and found that 87% of the respondents now report electronic records are included in their organization’s record holds - one of the 2009 survey’s most noteworthy results.

8 Executive Summary

Cohasset ARMA International Electronic Records Management Survey

•

We sought to learn about the degree of difficulty finding and retrieving information from backup and archival storage media in response to court-ordered discovery, and found 65% affirming that their organization had “some” (40%), “considerable” (17%) or “great” (8%) difficulty.

PRINCIPLE: The obsolescence of computer hardware and software - upon which electronically stored information depends to be accessible, retrievable and usable many years after creation – requires proactive preservation commitment, capabilities and infrastructure. •

Virtually all respondents (98%) now believe the process by which electronic records are managed will be “Very important” (71%), “Quite important” (19%), or “Important” (8%) in future litigation.

•

We sought to assess awareness about the need to migrate records retained more than 10 years and found 85% of respondents now believe that their organization’s IS/IT staff “Definitely understands” (36%) or “Marginally understands” (49%) many of the organization’s electronic records will have to be migrated to new formats and media to comply with retention policies.

PRINCIPLE: Life cycle management of electronically stored information and records is a shared responsibility and requires sustained collaboration between record owners and experts in a number of technical and support functions. •

We sought to determine which organizational function has responsibility for managing electronic records and found a downward trend (41% compared to 54% reported in 2007) away from IS/IT having primary responsibility for management of electronic records. A new response option offered in the 2009 survey, “Individual business units,” garnered a 23% response.

•

We questioned the level of awareness IS/IT has about the life cycle principle of records management and found only 36% of respondents believe their IS/IT colleagues understand the concept as it is applied to the creation, use and disposition of the organization’s electronic records.

•

We sought to assess how management responsibility for electronic records is applied to communications/collaboration, document objects and for data objects and found a shift away from business units (from an average of 33% to 29%) and IS/IT (from an average of 27% to 23%) towards Records Management (from an average of 36% to 42%).

Executive Summary 9

Cohasset ARMA International Electronic Records Management Survey

Conclusions From these compelling findings, seven conclusions are clear: 1.

Although significant progress appears to have made on some key programmatic components associated with the successful management of electronic records in the aggregate, a great deal of further improvement is needed in technical and support capabilities.

2. While many organizations are moving in the right direction, Cohasset’s research clearly indicates that, for an alarming number, the efficient and systematic control over business records is still not getting done. 3. Control issues for content-centric electronic records are significant in both number and complexity. 4. Most organizations are not prepared to meet many of their future compliance, legal and governance responsibilities because of deficiencies in the ways they retain and disposition their electronically stored information and records. 5. A majority of organizations still do not have the capability or infrastructure in place to preserve their records for as long as they are needed and cannot ensure integrity and future accessibility to their electronic records. 6. Shifts in perceptions and attitudes about where oversight accountability and responsibility for electronic records management performance continue to be reflected in the survey results. New response options and breakouts by content type highlight significant gaps in life cycle control over valued assets. 7. The pace and nature of changes in the way that information and records are managed is staggering and so continues to have the potential for significant risks associated with cost, internal controls, careers, and even corporate reputations. Life cycle control over electronic records requires that the sustained collaboration of the business and program areas which produce and use the records have sustained collaboration with three professional support and technical areas: a) Legal/Compliance, b) Information Systems/Information Technology (IS/IT), and c) Records Management. Without proactive and sustained efforts, good faith cannot be demonstrated and electronic records management performance cannot be assured. In the final section of this white paper, Cohasset has provided a list of action items which key stakeholders in the organization can use to address gaps in the governance infrastructure and authorities that are essential to the proper functioning of the organization’s records management programs and practices. The significant improvements in some of the fundamental records management program areas highlighted in this year’s survey results need to be leveraged and expanded to include core infrastructure and process control capabilities across electronic records systems and support areas.

10 Executive Summary

Cohasset ARMA International Electronic Records Management Survey

Success cannot be achieved without: •

Commitment of long-term financial and technical resources,

•

Engagement of internal and external resources in collaborative partnerships, and

•

Adoption of long-term perspectives for how business records, especially electronic records, should be managed and preserved to meet organizational needs and obligations.

Executive Summary 11

Cohasset ARMA International Electronic Records Management Survey

12

Cohasset ARMA International Electronic Records Management Survey

Background – The Need for a Survey Records, with their respected accuracy, detail and completeness, have historically been regarded as “corporate memory” – documenting daily business actions and decisions. When records meet both operational and legal requirements, they are recognized as the most trustworthy evidence of an organization’s voluminous transactions and processes. As such, records enable companies and government agencies to review, analyze and document the specifics of their past actions and decisions. In recent years, due to the magnitude of litigation and the demand for regulatory compliance, records have assumed even greater value. Always important in determining the outcome of disputes, records have become pivotal in determining the destiny of organizations as well as the fate of business and government leaders. Records management processes that were sufficient in the past are now inadequate due to the pervasive presence of electronic records and the associated challenges of technology and volume – specifically: •

The adoption of electronic mail and other communications and collaboration technologies which create new types of records,

•

The complexity of electronic records and the business processes which produce them,

•

The increasing reliance on line of business and transactional applications and third parties to create, store and manage electronic information outside the authority and support of the records management program, and

•

The exponential growth of records resulting from the ease with which electronic records can be created, distributed, and stored. 8

With this expansion in the type, complexity, volume and dispersal of business records, there is an urgent need to retool and integrate the processes by which records are managed. It is therefore appropriate to begin this retooling effort by assessing how well records, particularly electronic records, are being managed today. Who better to assess the current state of records management than those who have subject matter expertise and frontline responsibility, namely records and information managers? Recognizing the imperative for an evolving understanding of the current state of records management ARMA International9 (www.arma.org) joined Cohasset in co-sponsoring the 200910 research survey and this white paper which provide senior management with a clarion call to action. Cohasset Associates conducted the survey and prepared this white paper. Cohasset Associates (www.cohasset.com) is one of the nation’s foremost management consulting firms specializing in records and information management. For forty years, Cohasset has served clients throughout the United States. Its distinguished work and innovative concepts have been recognized with the highest professional awards. Cohasset regularly publishes definitive survey and legal research studies. Background – The Need for a Survey 13

Cohasset ARMA International Electronic Records Management Survey

For decades, Cohasset has been internationally respected for its excellence in records management education. For the past fifteen years, Cohasset’s professional educational focus has been organizing and presenting the national conference on Managing Electronic Records (MER) with its special focus on legal, technical and operational issues (www.merconference.com). MER conference sessions are now available in streaming video at Cohasset’s education website (www.mereducation.com).

14

Cohasset ARMA International Electronic Records Management Survey

Survey Methodology The 2009 Electronic Records Management Survey has three goals: •

First, to update and make conclusive the earlier findings of this biennial survey,

•

Second, compare the earlier data against the 2009 survey results and identify changes and trends over the period 1999 to 2009, with particular emphasis between 2007 and 2009, and

•

Third, present the business implications of the survey’s findings.

Cohasset believes the third goal provides the greatest benefit to the records and information management (RIM) community. The survey results also can serve as a powerful benchmarking tool to determine: •

What are the unique and significant problems regarding how electronic records are managed?

•

How do these documented information management challenges represent major risks in the global economy?

This white paper’s “call for sustainable capabilities” seeks to encourage senior management to focus greater support and resources to integrate systematic life cycle controls over their organization’s information assets11 and to leverage the wealth of good practice guidance that exists. Such a commitment by senior management would benefit a) a broad range of professionals who have dayto-day responsibility for managing records, b) users overwhelmed by the volume and complexity of recorded information flows, c) vendors that offer solutions and services, and d) the sponsoring association, ARMA International, whose membership is largely comprised of information management professionals and vendors. To achieve the third goal, presenting the business implications and consequences of the survey’s findings, this report on the results of the 2009 Cohasset ARMA International survey was prepared. It is organized according to six topical areas: 1.

Records Management Program

2. Records Retention Schedules and Email Retention Policy 3. Discovery Response Processes and Records Hold Orders 4. Life Cycle Management of Electronic Records 5. Long Term Digital Preservation 6. Electronic Archiving and Backup Data Management

Survey Methodology 15

Cohasset ARMA International Electronic Records Management Survey

The survey was conducted via the World Wide Web between April 14 and May 6, 2009. Members of ARMA International were invited to participate in the survey via a special e-mail message from Marilyn Bier (Executive Director/CEO). Robert Williams, President of Cohasset Associates, invited all previous MER conference registrants and also members of the Records Management LISTSERV to participate. Members of the Business Forms Management Association (BFMA) LISTSERV were invited to participate and the invitation was also issued via LinkedIn, the business-oriented social networking site. The total number of those having the opportunity to participate in this survey was over 14,000. There was duplication among the groups. Accordingly, the total number of unique potential respondents was estimated at 8,000-10,000.12 Based on this estimate, the number of respondents (1,190) was approximately 12-14% – a rate that reflects a keen interest in the topic and the desire to better understand the current state of electronic records management performance. The consistency of the responses over time continues to provide added credibility to the findings and conclusions detailed in this report. The survey featured 47 close-ended, issue-based questions. To optimize measurement of trends over time, most questions were identical or quite similar to those presented in the five previous surveys. There is a continuing evolution in the issues associated with the management of electronic records and so this year’s survey also manifests a number of new questions. Cohasset Associates, Inc. is solely responsible for survey design, tabulation of results, the analysis of the findings and preparation of this white paper. Cohasset wishes to express appreciation to all the survey respondents: those who participated in this 2009 research as well as those who participated in the five earlier surveys referenced in this report. A special “Thank You” is due the leadership of ARMA International for their willingness to work together with Cohasset on the 2009 Electronic Records Management Survey. The large number of respondents underscores the success of their efforts.

16 Survey Methodology

Cohasset ARMA International Electronic Records Management Survey

Survey Results 1. Records Management Program 1.1

Does your organization have a formal records management program?

The majority of respondents (83%) affirmed their organization currently Response 1999 2001 2003 2005 2007 has a formal records management A. Yes 83% 83% 93% 85% 87% 88% program. Over the course of the B. No first five surveys there was a modest 17% 7% 15% 13% 12% 17% improvement rising to 88% in 2007. In 2009 however, this number slipped back to the result (83%) recorded in 1999. Respondents answering “No” to this question were directed to question 6.

2009

Every organization, regardless of mission, size, or affiliation, produces records and has a duty to institute practices and standards for systematic and efficient management of their recorded information assets. Organizations that do not manifest a formal commitment to manage their records potentially face significant legal, compliance and operational risks and costs. These risks should be recognized by leadership and addressed promptly through the establishment of a formal records management program. 1.2

How would you rate the effectiveness of this records management program?

Of the respondents who answered affirmatively to the first question above, three quarters (76%) now evaluate the effectiveness of their organization’s records management program as “excellent” (6%), “great” (19%) or “good” (51%), the three highest categories in the five point semantic scale. This result is a significant increase over the result in 2007 (64%). Those evaluating their program as “good” increased from 43% to 51% - a noteworthy improvement.

Survey Results 17

Cohasset ARMA International Electronic Records Management Survey 1999

2001

2003

2005

2007

2009

A. Excellent

5%

4%

6%

6%

4%

6%

B. Great

23%

12%

14%

19%

17%

19%

A+B

28%

16%

20%

25%

21%

25%

C. Good

41%

41%

39%

43%

43%

51%

A+B+C

69%

57%

59%

68%

64%

76%

D. Fair

17%

30%

23%

21%

22%

20%

E. Marginal

14%

13%

18%

11%

13%

4%

C+D+E

72%

84%

80%

75%

78%

75%

D+E

31%

43%

41%

32%

35%

24%

Response

1.3

These findings are an encouraging sign that foundational work to update records management programs has been undertaken over the past several years and that many records management professionals are feeling more positive about the capability of their programs to impact recordkeeping performance.

Assess the effectiveness over time of your records management program.

This question was added in 2007 Response to cross-reference the program assessments provided in the A. Significantly more effective than three years previous question. A strong B. Marginally more effective than three years ago majority (80%) of the respondents in 2009 viewed their program as C. Same effectiveness as three years ago more effective (37% “marginally” D. Somewhat less effective than three years ago and 43% “significantly”) than E. Significantly less effective than three years ago three years ago. This optimism was manifested in their program assessments (as detailed in question 1.2). 1.4

2007

2009

40%

43%

32%

37%

20%

15%

5%

4%

3%

1%

Currently, are electronic records included in your records management program?

Three quarters (75%) of respondents stated that electronic records are currently included in their organization’s records management program. This year’s results continue a slow but steady improvement in this situation over the past four surveys. Cohasset believes professional records and information managers as well as senior management must view the inclusion of electronic records under the authority of their organization’s records management program as absolutely essential. With 25% of respondents responding “No,” the fundamental importance of including electronic records in the enterprise records management Response 1999 2001 2003 2005 2007 program still has not been fully communicated to all A. Yes 62% 62% 59% 65% 70% stakeholders in the chain B. No 38% 38% 41% 35% 30% of custody. From the survey findings, it appears that 18 Survey Results

2009 75% 25%

Cohasset ARMA International Electronic Records Management Survey

records management professionals continue to be challenged in educating their employers and colleagues about the special challenges associated with the life cycle management of electronic records. It is imperative that researched and approved retention and disposition rules and controls be applied diligently and consistently for all types of records storage media and devices. Failure to include electronic records in an organization’s records management program greatly increases the risks associated with those records in three ways:

1.5

•

First, records which no longer have legal or operational value to the business will continue to be stored. Retained records which could have been destroyed, but were not, are subject to potential discovery – with all of the associated production and review costs. Costs for storage and subsequent legal production of any unneeded records (online, near-line or offline) are completely unnecessary and, as such, are a 100% wasted expense.

•

Second, disposition13 of records in the normal course of business in compliance with the organization’s established retention and disposition authorities will not take place. This reflects a major deficiency in any organization’s records management program.

•

Third, records will not have their scheduled disposition suspended in accordance with record holds/preservation orders. Do your records management policies and procedures address electronic records?

2009 Given that 75% of the respondents Response 1999 2001 2003 2005 2007 affirmed electronic records 80% A. Yes were included in their records 57% 59% 56% 64% 72% management program, it is not B. No 37% 40% 40% 31% 28% 20% surprising a similar number C. Don’t know (80%) reported their records 6% 1% 4% 5% • • management policies and procedures address electronic records. Cohasset believes it is essential to both include electronic records in the records management program as well as in the governing policies and procedures. With approximately 25% of all organizations not manifesting one or both of these essential program “inclusions,” prompt action on this dual issue is likely to represent “low hanging fruit” for those organizations newly committed to improving management oversight of their electronic records.

Survey Results 19

Cohasset ARMA International Electronic Records Management Survey

1.6

Do you believe “C Level” (senior executive level) management at your organization understands that records management is a key component of the organization’s commitment to risk mitigation?

1.7

Do you believe “C Level” (senior executive level) management at your organization understands that good governance requires successful compliance; and successful compliance depends on good records management?

1.6 Response

2007

2009

A. Definitely understands

29%

35%

B. Marginally understands

57%

54%

C. Does not understand

14%

11%

1.7 Response

2007

2009

A. Definitely understands

28%

33%

B. Marginally understands

58%

55%

C. Does not understand

14%

12%

By a 2:1 margin, the findings in these two questions show that respondents believe senior level executives in their organization do not adequately understand the relationship between records management performance and good governance (33% vs. 12%), nor the role that records management plays in risk mitigation (35% vs. 11%). Perhaps more importantly is the belief that a significant percentage of C Level management (55% and 54%) only marginally understands these interdependencies. Cohasset believes a continued effort to reduce the “marginal” and increase the “definitely understands” ratings are critical to obtaining greater management commitment, along with better funding, to improve capabilities to manage one of the organization’s most important categories of assets – its records.14

The demographics identify a corollary problem: a significant difference in perspectives among respondents on these issues is correlated to seniority in the organization – specifically, the more senior the respondent, the better they thought C Level management understands these issues. This is clearly shown in the accompanying matrix where the similar findings for the two questions have been averaged together. The diversity of findings among the stakeholders highlights two issues: perception (executives may be better informed) and reality (those on the front line may know best what is really going on). Executive

Director

Manager

Support Staff

Other Staff

A. Definitely understands

75%

40%

35%

30%

32%

B. Marginally understands

24%

46%

56%

57%

56%

1%

14%

9%

13%

12%

2009 Response

C. Does not understand

20 Survey Results

Cohasset ARMA International Electronic Records Management Survey

1.8 Where does Records Management report in your organization?

2009

Response 2005 2007 In the last two years, there has been a continuing 23% shift towards having records management A. Legal/Compliance 14% 20% report to Legal/Compliance. This continues B. IS/IT 16% 17% 16% the trend since the question was introduced in 2005. In its records management consulting C. Administrative Services 39% 36% 35% practice, Cohasset has seen firsthand this D. Other 30% 27% growth related to the area of Compliance where 26% success is dependent on proactive and sustained records management practices. The largest, although declining, percentage who still report to Administrative Services reflects the legacy reporting structure that was prevalent in the past, before the advent of electronic records management.

In 2009 the option to write in a response was used by 26% of respondents who identified reporting relationships to functions ranging from the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Business Planning, Global Services, Knowledge Management, Library, Human Resources, Quality Assurance, Operations, and the Board Office. 1.9

What is the primary source of guidance used by your organization to determine records management requirements and practices?

Response

2009

A. ISO 15489-1:2001: Information and documentation – Records management

47%

B. DoD 5015.02 STD: RMA Design Criteria Standard

14%

C. MoREQ2: Model Requirements Specification for the Management of Electronic Records

6%

D. Industry-specific requirements

30%

E. Professional associations

23%

F. Other

27%

In a new question posed in 2009, respondents were asked to identify the primary source of guidance used by their organization for records management requirements and practices. Nearly half (47%) identified ISO 15489-1:2001: Information and documentation – Records management, as their primary source. With 70% of the respondents coming from non-government sectors, the second highest response (30%) for “industry-specific requirements” provides a baseline for exploration of this topic in future surveys. About a quarter (23%) of respondents indicated that “professional associations” play a role in influencing their organization’s records management program requirements and standards. Survey Results 21

Cohasset ARMA International Electronic Records Management Survey

ARMA International and AIIM garnered the majority of the write-in responses for associations but other submissions included the American Bar Association, the American Institute for Certified Public Accountants, the International Records Management Trust, International Legal Technology Association, numerous national archives as well as state, provincial, and local government associations.

2. Records Retention Schedules and Email Retention Policy Records Retention Schedules have long been considered the cornerstone of Records Management Programs. This section explores the availability of retention “rules” for categories of records and information assets to assess whether organizations have effectively adapted traditional tools to address electronic records requirements and challenges. 2.1 Response

Does your organization have a records retention schedule?

2009

A. Yes

88%

B. No

12%

2.2

This question was posed in the 2009 survey to baseline the percentage of responding organizations that had a records retention schedule. The result was a resounding 88%. This is a 10% higher result than those indicating in the first question in the survey that they had a formal records management program (83%).

What is the basis for the organization of records series or categories in your current retention schedule?

In the 2009 survey this question was added to explore the classification of records categories or series. As detailed in the matrix, just over half (54%) of respondents indicated that their records retention schedule is organized by business functions. Organizational unit (21%) was the second most significant means of assembling records categories, followed by business process (14%).

Response

2009

A. Business Function

54%

B. Business Process

14%

C. Organizational Unit

21%

D. Location or Region

2%

E. Information System

2%

The “Other” response garnered a variety of combination F. Other strategies which included: Business Function + Organizational 7% Unit; Business Function + Subject; Business Function + Location; and Business Function + Process. Legal practice areas, compliance areas, line of business and quality systems were also identified. Future surveys will provide perspectives on whether information systems (or business applications) become a more common means of organization for records retention.

22 Survey Results

Cohasset ARMA International Electronic Records Management Survey

2.3

Does your organization have comprehensive records retention schedules which include electronic records?

2009

Only 65% of respondents stated their organizations have comprehensive A. Yes 65% 51% 57% 53% 57% 60% records retention schedules which B. No include electronic records. This is a 49% 43% 47% 43% 40% 35% modest (5%) improvement since 2007 but a 27% improvement since 1999. This continues to represent a significant deficiency in too many records management programs that will require a concerted and collaborative effort to overcome. Response

1999

2001

2003

2005

2007

Cohasset believes all professional records managers must view the application of retention schedules to electronic records as an essential requirement of a records management program. A thorough review of this program component should be promptly undertaken by each organization to determine gaps and vulnerabilities in their appraisal and records scheduling processes. Where deficiencies are identified, a cross-disciplinary action plan should be developed as soon as possible. 2.4

Does your organization have records retention schedules for the three primary categories of electronic records?

2009 Yes

2009 No

Response

2007 Yes

2007 No

A. Communications (email, instant messaging, blogs, collaboration tools)

45%

55%

46%

54%

B. Document Objects (word processing, presentations, spreadsheets, etc.)

57%

43%

65%

35%

C. Data Objects (application data, etc.)

46%

54%

53%

47%

This question was added in 2007 to explore and thereby expand the information provided in the previous question. More specifically, given the significant number of organizations (35% or higher since 1999) that do not currently include electronic records in their records retention schedules, Cohasset sought to determine if the findings would be somewhat different if the term “electronic records” was posed in an expanded and more detailed context – the three primary types of electronic records. These types include: communications (which incorporates collaboration); document objects; and data objects. While there was improvement in all three categories, the change was negligible for communications. For the other two types of electronic records (document objects and data objects), more than 50% of organizations now include these two types of electronic records in their retention schedules. These findings reinforce two of this survey’s important overall conclusions: the life cycle of electronic records is not sufficiently managed today, and a great deal needs to be done at most organizations to integrate recordkeeping requirements for electronic information assets into core records management program tools in order to achieve compliance and governance objectives. The responses to this

Survey Results 23

Cohasset ARMA International Electronic Records Management Survey

question clearly indicate that major gaps in records management controls and capabilities exist in the digital environment, and that much remains to be done to manifest a “good faith” effort in a regulatory or legal proceeding regarding the application of retention schedules to all types of electronic records. 2.5

When did your organization last update its retention schedules?

It is encouraging to report that more than half of the responding organizations (59%) updated their retention schedules in the last year. When updates over the last five years are taken into account (last year (59%) + “3 years ago” (20%) + “5 years ago” (12%)) a stunning 91% have performed some update to the organization’s retention schedule. Based on Cohasset’s consulting experience however, many of these “updates” were part of a periodic refresh process and did not necessarily reflect a comprehensive realignment and update of all the organization’s retention rules and policies to match its enterprise information assets.

Response

2007

2009

A. Last year

53%

59%

B. 3 years ago

20%

20%

A+B

73%

79%

C. 5 years ago

12%

12%

A+B+C

85%

91%

D. 10 years ago

6%

4%

E. 15 years ago

2%

2%

F. Longer than 15 years ago

7%

3%

D+E+F

15%

9% Retention schedules manifest an organization’s commitment to apply consistent rules regarding the management of its records. As such, retention and disposition management requirements (record schedules supported by quality legal research) are identified, validated and implemented to support the organization’s overall records and information management policies and commitments. To be effective, retention schedules must remain current and be regularly updated to reflect internal and external changes in business activities and recordkeeping requirements. They also must be complete – applicable to all types of information and records that may be created, received, used and retained. In this context, records retention schedules must be viewed as requiring routine maintenance. All organizations should update their records retention schedules – at least every five years – or run the risk of creating gaps between recordkeeping obligations and business operations. Some organizations may also choose to update select components of their retention schedules in the interim period to address specific regulatory changes or significant business events such as acquisition or divestiture. 2.6

How many different record series does your current retention schedule have?

There is a growing conviction that a large number of different records series, which historically have been used in many record retention schedules, are cumbersome and impede the application of established retention rules to electronic records. The number of different record series can be reduced if the number of unique record “categories” can be simplified. For some organizations, this can mean a reduction from several thousand to just a few hundred record categories; some have successfully reduced the number to fewer than 100.

24 Survey Results

Cohasset ARMA International Electronic Records Management Survey

This aggregation process has come to be known as the “big bucket” approach to appraisal and retention scheduling. New classification and search technologies have greatly facilitated the viability of this approach – where electronic records in “groups” of unprecedented size now can be categorized, rapidly searched, and found. This presents exciting new options for improving the management of electronic records and reducing the burden and inconsistent application of retention by end users. 28% of the respondents stated that their organization has less than 100 retention series and 55% have less than 250. Cohasset’s consulting and educational experience confirm a strong level of interest in retention schedule modernization and category aggregation however many organizations have yet to embark on a serious effort in this regard. 2.7

2007

2009

A. Strongly agree

16%

15%

B. Agree

48%

51%

A+B

64%

66%

C. Disagree

31%

14%

D. Strongly disagree

6%

4%

C+D

37%

18%

•

16%

2.8

2007

2009

A. Under 100

31%

28%

B. 100 - 250

26%

27%

A+B

57%

55%

C. 250 - 1,000

27%

31%

D. 1,000 -3,000

10%

8%

E. 3,000 - 5,000

3%

3%

C+D+E

40%

42%

F. Over 5,000

3%

3%

Given the growing capabilities to search vast volumes of electronic records, do you believe the “big bucket approach” (i.e., significantly fewer records categories containing a broader spectrum of current record series) is the best way to meet the challenge of classifying large daily volumes of electronic records?

Response

Don’t know

Response

With two thirds (66%) of the respondents in agreement (“Strongly agree” 15% and “Agree” - 51%) that an aggregated approach is the best way to meet the challenge of classifying large daily volumes of electronic records, there is clearly widespread recognition that a) significant challenges persist with respect to applying traditional records retention concepts to managing electronic records, and b) the concept of the “big bucket” approach is of widespread interest. The strength of these statistics may spur further analysis of the “big bucket approach” among those responsible for managing electronic records and, in turn, solution providers and business application developers to design systems that are predicated on it.

Does your organization follow its retention schedules?

The findings to this question in 2009 manifest a positive change to what had been a significant setback in 2007 – namely a nearly 50% improvement in organizations “always” following their retention schedules, for example (up from 14% in the 2007 survey). A stunning 84% of respondents (up from 64%) reported this year that their organizations ‘always’ or ‘generally’ follow its retention schedules. Given the benign neglect that the records management function has endured in many organizations for too long, this appears to be encouraging news related to a core program component. Based on its more than 35 years of records management consulting experience, however, Cohasset believes Survey Results 25

Cohasset ARMA International Electronic Records Management Survey Response

1999

2001

2003

2005

2007

2009

7%

11%

17%

21%

14%

22%

that the reality of adherence to B. Generally retention schedules 53% 58% 45% 51% 50% 62% still falls far short A+B 60% 69% 62% 72% 64% 84% of acceptable levels. C. Not regularly No organization can 23% 16% 26% 18% 20% 16% credibly represent D. When time permits 17% 15% 12% 11% 16% • that they are making a good faith effort to manage their records if they do not comprehensively address all of their records and do not regularly follow their established records retention policies. A. Always

Committed, sustained senior-level support is required for a records retention program to be successful and to effectively reach across functional, process, and domain boundaries. Without such support, a records retention program has inadequate authority and visibility and so systematic records controls never becomes integrated into the organization’s business processes. Records managers continue to be challenged to take a sufficiently strong leadership role in the deployment of consistent retention policy throughout their organizations. More specifically, consistency in retention policies must apply: •

Across media (paper, microfilm, optical and magnetic);

•

To all types of records in digital and non-digital format; and

•

To the application of life cycle management requirements over time.

2.9

Does your organization have a formal email policy regarding retention practices for email? Response

1999

2001

2003

2005

2007

2009

As detailed in the matrix, a 53% majority (53%) reported their A. Yes 45% 53% 41% 51% 49% organization has a formal B. No 55% 47% 59% 49% 51% 47% email retention policy. This is a modest improvement – up from 49% in 2007. Given the extraordinary publicity that email evidence has had in the mainstream press, Cohasset finds it disconcerting that since 1999 all of these surveys (and many other surveys) have identified a serious problem, yet only modest (18%) progress has been achieved in increasing the number of organizations who have a formal policy regarding retention practices for their email. Retaining email indefinitely or indiscriminately (which is inferred in the absence of retention policies and procedures) is an unacceptable course of action for any organization given the extraordinary increases in the volume of email and its criticality to business operations. When the challenges of volume and duplication are combined with legal risks associated with retaining emails longer than needed, the result mandates aggressive remedial action. Delay simply invites significant and unnecessary legal, compliance and operational risks. This survey question intentionally focused on the issue of having an email retention policy, not the broader matter of having an email usage policy. Many organizations have an email policy whose focus is on content (what should not be written in emails), and not retention. At such organizations, senior 26 Survey Results

Cohasset ARMA International Electronic Records Management Survey

management may have a false sense of security from policies focused on content – believing they also address retention and other recordkeeping issues, when they do not. 2.10

Is your organization’s email records retention policy time-based, user-based or group-based?

Response

2007

2009

A. Time based (emails over a certain age are automatically deleted)

33%

36%

B. User-based (users determine whether to save or delete messages based on your organization’s policy)

60%

44%

C. Group-based (emails deleted automatically, based on the association an individual has with a particular department or business function)

7%

4%

•

16%

D. Other

The goal of adding this question to the 2007 survey was to assess the extent to which existing email retention rules are applied at the individual versus an organizational level of control. The preliminary findings show that end users (44% down from 60% in 2007) administer email retention rules for many organizations and time-based retention methods are also in use (36%). Cohasset believes these responses reflect that most email storage remains decentralized and therefore leads to local (user) administration of the retention policies. A decentralized (user) administration of email retention rules poses two potential risks. The first risk is inconsistency – while some users may be attentive and relatively adept at following the retention rules, others may be less so because their attention is focused on matters of greater self-perceived importance, or because they lack an understanding of recordkeeping requirements. The second potential risk is the user may have a vested interest (and the power to act on it locally) in retaining certain select records longer than the organization’s policy stipulates. 2.11

Does your organization have a formal policy regarding retention practices for the following: voicemail, instant messaging, blogs, web pages?

Some or all of these emerging potential sources of records are likely to have legal significance in the future. In 2009 “Web pages” were added and came in with the strongest response (22%) among the other potential sources. It appears that these widely used communication and collaboration technologies are not currently perceived as having sufficient risk to address. The

2009 Yes

2009 No

84%

20%

80%

15%

85%

18%

82%

7%

93%

10%

90%

•

•

22%

78%

Response

2007 Yes

2007 No

A. Voicemail

16%

B. Instant messaging C. Blogs D. Web pages

Survey Results 27

Cohasset ARMA International Electronic Records Management Survey

recent past has highlighted that some regulatory agencies may have specific retention requirements for one or more of these different types of electronic records. Security and Exchange Commission (SEC) requirements, for example, may account for most of the 20% response rate for organizations that have retention policy in place for voicemail.

3. Discovery Response Plans and Records Hold Orders Discovery response processes and records hold orders are foundational elements of a compliant records management program. A discovery response process consists of policies and procedures which an organization applies in response to a legal discovery request. The primary objective of the process is to take action in a timely and responsive manner. Records hold orders are a critical component of such processes. Records hold orders are issued to suspend or extend indefinitely the established records retention for any records that are subject to the discovery request. These suspensions are designed to preclude the destruction of records relating to actual or threatened litigation or investigation. Although records hold orders are typically applied after litigation is filed and the opposing side has identified the relevant records it seeks in discovery, records hold orders can also be self-initiated in anticipation of litigation, investigation or audit. Many people mistakenly believe the primary cost related to discovery is the expense of finding the targeted records (via the services of external or internal computer forensics experts). The largest cost is actually the time for lawyers and paralegals to review the documents – ensuring that the materials: a) are relevant and within the scope of the discovery request and, b) are not “privileged” in any context. Privileged records are exempt from production (i.e., being included in a response to a discovery request) for one of a number of specific legal reasons which protect certain types of records – such as communications between attorney and client. The presence and successful administration of a records hold order process is an essential capability for every records management program – especially in today’s environment of unprecedented levels of litigation and regulatory inquiries. Most records hold orders are the result of a court- or agencyordered discovery request, and full compliance is mandatory. Anything less than full compliance can put at serious risk an organization’s legal position on a matter. Non-compliance may result in costly and potentially devastating consequences. 3.1

Does your organization have a formal process for responding to discovery requests for records?

2009

Response

1999

2001

2003

2005

2007

A. Yes

56%

48%

54%

57%

56%

66%

B. No

44%

52%

46%

43%

45%

34%

28 Survey Results

In the 2009 survey, 66% of the survey respondents stated their organizations had a discovery request response process. As

Cohasset ARMA International Electronic Records Management Survey

detailed in the matrix, this represents a significant improvement over the 2007 results and suggests that this significant deficiency may have begun to be addressed in earnest. Cohasset believes the 66% “Yes” response may be, to some extent, an unintentional understatement of the current situation. In some organizations, for example, such processes are viewed as primarily an internal legal department matter and therefore the existence or nature of discovery policies and procedures may not be known to the survey respondents. For many other organizations, their formal discovery response policies may be mature, but not fully operational or sufficiently tested. 3.2

Does your organization currently have a formal system for records hold orders – setting aside for an indefinite period of time those records that are deemed relevant to an existing or pending legal or regulatory proceeding?

2009 For many organizations, Response 1999 2001 2003 2005 2007 litigation is an endemic A. Yes 64% 70% 60% 54% 57% 61% part of doing business. B. No With litigation, there is 30% 40% 46% 43% 39% 36% almost always discovery and with discovery, comes the requirement for a coordinated and timely means of responding to discovery requests. Only 64% of this year’s respondents reported their organization has a formal system for records hold orders – a modest increase over the 2007 results. For the other 36% – representing all the organizations that do not have a formal record hold order system in place – their situation could be perilous and runs counter to the current management focus on risk mitigation. Respondents answering “No” in 2009 were directed to skip the next question relating to whether electronic records are included in their hold order system. As detailed in the matrix, one of the more positive year-to-year findings is an 18% increase over the past six years - from 54% in 2003, to 57% in 2005, to 61% in 2007, and 64% in 2009 – in organizations having a formal system for records hold orders. Given the level of national media coverage on the issue of illegal document destruction and the substantive growth in the number of court-ordered records hold orders issued in the past decade, Cohasset finds it worthy of note that there has not been more dramatic improvement over the ten year period of this survey. The collective findings of all six Cohasset surveys should spur much greater management action on this serious matter. Cohasset believes several factors may have affected the number of respondents reporting that their organizations do not have a formal system for responding to records hold orders. 1.

Small organizations are not likely to face the quantity or severity of litigation and regulatory inquiries as larger organizations and therefore are less likely to have a formal record hold order system in place.

2. In some large organizations, the respondents may be so far removed from this aspect of their organization’s records management practices they answered “No” because they did not have first-hand knowledge of such a system elsewhere in the organization. 3. Third, recent publicity and increased public awareness (in the period 1999 – 2009) about hold orders and their importance may have resulted in successively more accurate responses in each of the six surveys. Survey Results 29

Cohasset ARMA International Electronic Records Management Survey

Cohasset is aware that some organizations make a deliberate decision not to have a formal system for records hold orders so they then cannot be held responsible for failing to follow any specific protocol within the system. This is faulty reasoning, however, since organizations without a formal system may in fact impair their ability to respond in full accordance with a court or agency’s hold order. The indisputable fact: an extraordinary number of organizations are negligent with regard to a formal system to ensure records hold orders can be successfully administered. Any organization may become a target of litigation or regulatory inquiries and thus the absence of a formal plan to respond to discovery requests ought to be considered an unacceptable risk. Where there is no formal system for records hold orders in their organizations, records management professionals need to work proactively with their legal and technology colleagues to correct this significant deficiency. 3.3

Does your system for records hold orders include electronic records?

The significant increase in respondents reporting their organization’s A. Yes 87% 47% 37% 35% 47% 56% system for records hold B. No 53% 63% 65% 53% 44% orders includes electronic 13% records (from 56% in 2007 to 87% in 2009) is one of the survey’s most notable findings. The 87% response rate in 2009 reflects a 36% improvement from the results of the previous survey. Response

1999

2001

2003

2005

2007

2009

No finding from the earlier surveys sparked greater amazement and debate among attorneys than responses to this question. It is Cohasset’s belief that, at many organizations, this conspicuous statistic precipitated a policy review and corrective action which, in part, explains why there continues to be such noteworthy improvement to report this year. When 13% of respondents still reporting their organizations do not include electronic records in their records hold orders, a serious problem remains which should compel priority action by senior management. Cohasset believes this 13% response manifests a continuing disconnect between those responsible for oversight of the application of an organization’s retention schedules (records managers) and those responsible for creating, storing and managing electronic records in the normal course of business. The result is that for many organizations, the job of life cycle control over records and information assets is not getting done. Records and information managers must view the inclusion of electronic records in their organization’s record hold system as an essential requirement. A thorough review of this aspect of every organization’s records management program should be promptly undertaken to determine if there is a problem and, if there is, to address it immediately. A major process improvement effort, but not necessarily significant expense, will be required to rectify this situation. This effort/investment can result in significant cost avoidance as well as reduced operating costs.

30 Survey Results

Cohasset ARMA International Electronic Records Management Survey

3.4

How would you rate the effectiveness of your organization to fully comply with record hold orders?

With a third (33%) of respondents evaluating their organizations as being either “fair” (20%) or “marginal” (13%) in their effectiveness to comply with record hold orders, a risk is clearly represented and improvement is strongly recommended. This gap in confidence, although meaningful (15%) less than in 2007, represents another compelling reason for organizations to review their current practices and capabilities in order to determine how to improve the processes and controls by which their electronic records are managed. Additional future research by Cohasset and others is needed to better determine why this situation is so pervasive. 3.5

2007

2009

A. Excellent

8%

10%

B. Great

18%

19%

C. Good

35%

38%

A+B+C

61%

67%

D+E

39%

33%

D. Fair

21%

20%

E. Marginal

18%

13%

Response

How would you rate the effectiveness of your organization to rescind hold orders following the conclusion of the matter that precipitated the original record hold? 2007

2009

A. Excellent

7%

7%

B. Great

13%

13%

C. Good

31%

32%

A+B+C

51%

52%

D+E

49%

48%

Response

Many organizations have serious deficiencies in their ability to remove a legal hold when the matter which precipitated the legal hold has been resolved. The 2009 findings to this question re-confirm the gap, with no improvement since 2007. Nearly half (48%) providing a negative “fair” (27%) or “marginal” (21%) assessment and only 52% providing a positive “good” (32%), “great” (13%) or “excellent” (7%) evaluation.

Large organizations with complex and/or frequent litigation encounter greater instances of the same document being the D. Fair 25% 27% subject of multiple hold orders, and therefore have difficulty E. Marginal 24% addressing this issue. Technology can provide capabilities to 21% address such needs and hopefully reduce this gap over time. If this technology is widely adopted in conjunction with supporting processes and procedures, future survey findings may reflect a lessening of this problem. 3.6

Have your attorneys concluded that the legal admissibility of records is media independent?

2009

Response

1999

2001

2003

2005

2007

A. Yes

51%

29%

30%

32%

45%

37%

B. No

18%

50%

46%

21%

55%

8%

C. Don’t know

31%

21%

24%

47%

•

55%

In 2009 this question was reworded and the option to respond “Don’t know” was re-introduced. As detailed in the matrix, just over a third (37%) replied affirmatively

Survey Results 31

Cohasset ARMA International Electronic Records Management Survey

that their attorneys had concluded that the legal admissibility of records is media independent. This represents a decrease from the response in the 2007 survey. More than half (55%) of the respondents indicated that they did not know. The findings for this question are difficult to interpret and it is anticipated that the question will be dropped or significantly reworked in future surveys. 3.7

How would you characterize the impact of the 2006 revisions to the Federal Rules of Civil Procedure (FRCP) on the management of your organization’s electronic records?

Response

2007

2009

A. Significant impact

16%

11%

B. Meaningful impact

33%

29%

C. Minor impact

29%

30%

A+B+C

78%

70%

D. No impact

22%

30%

3.8

In the 2009 survey, a majority (70%) of respondents reported an impact on the management of their organization’s electronic records, a drop from 78% in 2007.

How would you characterize your organization’s capabilities in relation to the 2006 revisions of the Federal Rules of Civil Procedure?

The purpose of this new question was to begin to assess the impact of the RFCP revisions with regard to records management controls and capabilities. Cohasset believes that awareness and growing understanding of the implications of the FRCP revisions among stakeholders provides another outstanding opportunity for records management practitioners to demonstrate the value of their expertise and knowledge in what must become a collaborative and sustained response effort. Future surveys will be required to assess how responses to the revisions manifest within records management program components and controls.

32 Survey Results

Response

2009

A. Excellent

3%

B. Great

9%

C. Good

26%

D. Fair

16%

E. Marginal F. Don’t know

9% 37%

Cohasset ARMA International Electronic Records Management Survey

4. Life Cycle Management of Electronic Records 4.1

Which function in your organization currently has primary responsibility for the management of electronic records created and used in the normal course of business?

2009

Response

1999

2001

2003

2005

2007

A. IS/IT

70%

77%

71%

61%

54%

41%

B. Records Management

30%

23%

29%

35%

26%

26%

C. Legal/Compliance

•

•

•

4%

3%

2%

D. Individual business units

•

•

•

•

•

23%

E. Other

•

•

•

•

18%

8%

Continuing a downward trend since 2001, 41% of respondents reported Information Systems/ Technology (IS/IT) had primary responsibility for management of their organization’s electronic records – 24% less than 2007, 33% less than 2005 and 42% less than 2003. Clearly there has been strong movement away from IS/IT having responsibility for managing electronic records created and used in the normal course of business. If the role of IS/IT is declining, which function in an organization now has this responsibility? Records management’s role remained stable at 26%. An additional option, “Legal/Compliance”, was added in 2005, but this option applied to only a small number of respondents (4% in 2005, 3% in 2007 and 2% in 2009). This year an option was added to designate “Individual business units” as the responsible party which garnered a 23% response. On the basis of its consulting and educational experience, Cohasset has witnessed shifts in accountability as the sophistication and maturity of cross-functional stakeholder groups charged with records management oversight increases. Along with this understanding often comes an overwhelming sense of the enormity and complexity of the management task at hand. Cohasset believes that much additional dialogue and work is required to “share” the responsibility of electronic records management through the full life cycle and across organizational units.

Survey Results 33

Cohasset ARMA International Electronic Records Management Survey

4.2

How would you characterize IS/IT’s understanding of the concept of “life cycle” (creation, use and disposition) at your organization regarding the management of your organization’s electronic records?

The life cycle management 36% concept is A. Clearly understand 28% 25% 33% 30% 30% predicated on all B. Do not understand 72% 75% 67% 70% 44% 37% records having a birth, life and C. Don’t know • • • • 26% 27% death. It calls for the ultimate disposition of records to be defined and integrated into the ongoing management of each record series or category. In this way, records are retained only as long as needed to meet the organization’s legal and business requirements. Records which have long term or permanent retention requirements (see Section 5) should receive particular attention in order to proactively address migration and other preservation requirements. Response

1999

2001

2003

2005

2007

2009

Only a third (36%) of this year’s survey respondents, those who have the greatest knowledge about the management of records (records managers), believe that IS/IT really understands the life cycle concept – one of the most important tenets of records management. As detailed in the matrix, this perspective is finally showing some signs of progress. 27% of respondents indicated “Don’t know” which may indicate the level of interaction between records management and IS/IT is low. This low average for the “Clearly understand” response reflects a significant problem – one which Cohasset believes portends three potentially significant and unnecessary costs: •

Higher Storage Costs – If electronic records are retained without clearly defined disposition triggers and specified time periods, the volume of records will grow rapidly and that growth will be mirrored in the cost for electronic records storage.

•

Greater Discovery Costs – Since unnecessarily retained records can be the subject of legal discovery, the costs associated with producing records that should have been destroyed represent totally unnecessary expenses.

•

Unwittingly Assisting Plaintiffs – Unnecessarily retained records can be used against the organization in future litigation. This is potentially the most significant cost.

Cohasset believes there is a twofold need: 1) greater awareness by IS/IT regarding records management concepts and practices, and 2) records management education for IS/IT by the subject-matter experts in this field, the records managers. Further, the education of both IS/IT and records managers on how to apply records life cycle management requirements to electronic systems and content stores should be aggressively proactive and undertaken as part of continuous process improvement initiatives.

34 Survey Results

Cohasset ARMA International Electronic Records Management Survey

4.3

Which function in your organization do you believe should have responsibility for the management (creation, use and disposition) of these three primary categories of electronic records in the normal course of business? Individual Business Units

Records Management

IS/IT

Legal/ Compliance

A. Communications (email, instant messaging, collaboration tools)

36%

33%

26%

5%

B. Document Objects (word processing, presentations, spreadsheets, etc.)

40%

46%

10%

3%

C. Data Objects (application data, etc.)

23%

30%

44%

3%

Average

33%

36%

27%

4%

2007 Response

Individual business units

Records Management

IS/IT

Legal/ Compliance

A. Communications (email, instant messaging, collaboration tools)

30%

38%

25%

7%

B. Document Objects (word processing, presentations, spreadsheets, etc.)

35%

53%

7%

5%

C. Data Objects (application data, etc.)

21%

36%

38%

5%

Average

29%

42%

23%

6%

2009 Response

This was a new question in 2007 and so the 2009 findings represent only the second data point. Respondents clearly do not believe Legal/Compliance should be responsible for the management of electronic records – regardless of the type. Because this survey’s respondents are generally associated with the records management function in some context, it is not surprising they believed that, on average (42%), records management would be the business function best suited to manage electronic records in the normal course of business. This is particularly true for “Document Objects” (53%). IS/IT as the clear choice to manage “Data Objects” (44% in 2007) slipped considerably to 38% in 2009. In fact, the response rating for IS/IT rating dropped in all three categories. It is interesting to note that across-the-board there is a drop in strength of the response reported in 2007 for individual business units to manage all types of electronic records.

Survey Results 35

Cohasset ARMA International Electronic Records Management Survey

4.4

Which of the following best describes your organization’s current records destruction practices for electronic records that have met their approved retention and are not subject to a hold order?

Response

2009

A. Records destruction certificates are routinely issued and retained

18%

B. Procedures are in place regarding authorization for destruction but there is no mandate for creating/retaining records destruction certificates

18%

C. No formal procedures for electronic records destruction exist; some documentation for records destruction may be produced but practices vary across the organization

25%

D. Ad hoc destruction by users and/or custodians of electronic records

22%

E. Don’t know

10%

F.

Other

7%

This question was added for the 2009 survey in order to begin to assess how organizations are handling the “end of life” management of electronic records that have met their approved retention requirements and are not subject to a records hold order. Future surveys will be needed to explore the implications of the findings. Only 18% of respondents indicated that records destruction certificates are routinely issued and retained. This practice is well established for physical records, whether they are managed by an internal records management team or stored with a third party. Another 18% of the respondents indicated that destruction procedures exist but certificates are not required. 47% of respondents indicated that ad hoc (22%) or varied (25%) practices are applied across the organization. Cohasset believes that there is much needed dialogue and debate within organizations and across the industry with regard to the appropriate level of destruction certification for electronic records. This pertains particularly to outsourcing arrangements where all or some of the records management responsibility associated with business activities is delegated to a third party, one that often performs without the benefit of clear expectations from the organization that owns the records. Organizations need to do more than ensure that their own records management controls and capabilities extend across the enterprise; they also need to make sure that entrusted third parties are knowledgeable about and accountable for meeting the organization’s recordkeeping requirements.

36 Survey Results

Cohasset ARMA International Electronic Records Management Survey

5. Long Term Digital Preservation 5.1

How important do you believe that the process by which electronic records are managed will be important in future litigation?

Virtually all respondents Response (98%) believe the process A. Very important by which electronic records are managed B. Quite important will be “Very important” A+B (71%), “Quite important” C. Important (19%), or “Important” (8%). Only 2% responded A+B+C “Somewhat important” D. Somewhat important and no one thought they would not be important E. Not important – this was consistent with findings from the last two surveys.

2001

2003

2005

2007

2009

58%

57%

80%

77%

71%

22%

20%

15%

16%

19%

80%

77%

95%

93%

90%

15%

16%

4%

6%

8%

95%

93%

99%

99%

98%

2%

3%

1%

1%

2%

3%

4%

0%

0%

0%

Records management professionals now have a virtually universal recognition that the processes by which electronic records are currently managed will impact greatly the future accuracy, reliability and trustworthiness of records – and their organization’s ability to meet its future compliance and legal responsibilities. 5.2

If legally challenged, how confident are you that your business organization could successfully demonstrate that its electronic records are accurate, reliable and trustworthy – many years after they were created? 2001

2003

2005

2007

2009

A. Very confident

4%

5%

8%

14%

14%

B. Quite confident

5%

9%

17%

26%

27%

A+B

9%

14%

25%

40%

41%

C. Confident

19%

24%

26%

14%

16%

A+B+C

28%

38%

51%

54%

57%

D+E

72%

62%

49%

46%

43%

D. Slightly confident

33%

29%

28%

25%

25%

E. Not at all confident

39%

33%

21%

21%

18%

Response

The findings of the 2009 survey manifest a slight improvement in respondent confidence that their organization could successfully demonstrate that its electronic records are accurate, reliable and trustworthy – many years after they were created. This confidence has doubled from 28% in 2001 to 57% in 2009.

Survey Results 37

Cohasset ARMA International Electronic Records Management Survey

It must be recognized that a significant need for improvement exists. Nearly half of the respondents (43%) indicated they are either “Not at all confident” (18%) or “Slightly confident” (25%) that their organization’s electronic records will be accurate, reliable, and trustworthy – many years after they were created. Senior management attention and resources must remain focused on improving the future trustworthiness of the organization’s electronic information assets. Records that are not accurate, reliable, and trustworthy have no substantive regulatory or legal value. 5.3

How would you characterize IS/IT’s understanding that compliance with records retention policies will require the migration of electronic records to new formats and media?

Response

1999

2001

2003

A. Yes

47%

46%

47%

B. No

53%

54%

53%

2009

Response

A. Definitely understands

36%

B. Marginally understands

49%

In 2009 the wording of the response options were changed from “Yes/No” 57% 58% to “Definitely, Marginally or Does not understand” to match the wording 43% 42% in related questions on life cycle management (see Section 4). As shown in the matrix, only 36% of respondents believe IS/IT “Definitely understands” it will have to migrate15 many of the organization’s electronic records in order to comply with established records retention policies. 2005

2007

The findings of all six Cohasset surveys clearly demonstrate that records managers believe IS/IT must improve their understanding of the impact of technological and media obsolescence and its potentially devastating consequences on successful records management performance. In many organizations preservation planning has a low priority largely because it is seen as a potential risk, not a current risk exposure or compelling business requirement. However, electronic records with a retention period greater than ten years will have to be migrated to a new file format and the storage media refreshed so there is an urgent need for organizations to address digital preservation today rather than ten years from now when the cost of migration and media refreshment is likely to be significantly higher.

C. Does not understand

15%

Decisions about how electronic records will be preserved should be part of the routine business planning process for technologies and storage. IS/IT must recognize that these real-time concerns will only grow in severity if they are not promptly and effectively addressed. Progress will required that records managers promote the preservation of electronic records as a current and future risk exposure. 5.4

Does your organization have a formal process to migrate older records so that they will be accessible throughout the prescribed records retention schedule?

The 2009 results for a positive response are identical to the 2007 findings: only 30% of the respondents indicated their organization has a formal process16 in place to migrate their electronic records over time. The response option “Don’t know” was added in 2009. The 70% who indicated “No” plan for

38 Survey Results

Cohasset ARMA International Electronic Records Management Survey

migration was in place in 2007 were divided into “No” (46%) and “Don’t know” (24%) in 2009.

2009

Response

1999

2001

2003

2005

2007

A. Yes

27%

21%

30%

32%

30%

30%

B. No

73%

79%

70%

68%

70%

46%

•

•

•

•

•

C. Don’t know

Cohasset believes the 24% 70% response results may be modestly inflated by two factors: a) respondents working for small organizations which would not necessarily have migration policies and procedures, and b) those who are part of very large organizations where the respondents are not aware of such processes. 5.5

Is there a specific budget in your organization for record migration?

The previously detailed findings concerning lack of awareness about migration and an absence of supporting processes are reflected in by the 2009 survey findings regarding budgets for record migration. 2009 Response 1999 2001 2003 2005 2007 This year’s findings show a drop in affirmative 10% A. Yes 20% 7% 15% 18% 17% answers and a breakout of B. No 80% 93% 85% 82% 83% 57% the ‘No’ (57%) and ‘Don’t know’ (33%) responses. C. Don’t know • • • • • 33% As can be seen, there has little or no progress on this important matter. The overwhelming majority of respondents (90%) indicated their organization did not have a specific budget to migrate their electronic records. There have been similar findings over the course of the survey’s ten year history. Although having a budget for record migration is an important indicator of awareness and planning for digital preservation, it is acknowledged that there undoubtedly are many organizations which successfully address the issue of digital migration even though they do not have a specific budget for this activity – migration simply may be included in their operating budgets. Collectively, these findings lead to three important conclusions: •

Many organizations are not prepared to successfully address the challenges of digital preservation,

•

Rarely have so many organizations been so ill-prepared for something as important to the successful long-term management of their information assets, and

•

With records recognized as its “corporate memory,” this lack of awareness and preparation is likely to manifest itself in “Corporate Alzheimer’s” – digital records exist on storage media but are not accessible due to hardware and/or software obsolescence.

Survey Results 39

Cohasset ARMA International Electronic Records Management Survey

6. Electronic Archiving and Backup Data Management The questions in this section were first added in 2005 to explore electronic archiving and backup practices for four reasons: 1.

First, in major court cases and regulatory inquiries over the last decade, locating and producing older electronically stored records and information (especially emails) have proven to be difficult and very costly. As a result, improved management of email has become a business imperative. In certain instances, the inability to locate and successfully produce electronic records has been pivotal in the outcome of regulatory inquiries and court decisions.

2. Second, with so much electronic information being regularly retained (in both backup and archiving contexts) for much longer than needed, the opportunity to reduce operating costs is significant for most organizations. From a cost/benefit perspective, unnecessary storage and discovery costs associated with data backup constitute “low hanging fruit” which ought to compel management attention and prompt, coordinated effort to reduce the business risk. 3. Third, disciplined controls over expanding caches of electronic records have not been effectively managed. At many organizations, this situation can be best described as a “black hole.” 4. Fourth, records management professionals generally have not sought to integrate this information media within the scope of the organization’s records management program. Ironically, many of these RIM professionals both possess and also lack many of the skills needed to address this situation successfully in dynamic business and technology environments. 6.1

What storage device/media does your organization use to back up its computer systems?

More than one third of the respondents (38%) still did not know which storage devices/media are in use at their organizations. This reflects the fact that the records management function historically has had very little involvement in policy-setting or monitoring for computer backup systems. It also manifests the nature and low level of interaction which often exists between IS/IT and records management.

Response

2005

2007

2009

A. Magnetic tape

46%

55%

48%

B. Magnetic disk

11%

29%

25%

A+B

57%

84%

73%

C. Optical disk

6%

18%

14%

A+C

52%

73%

62%

D. Other

5%

12%

5%

E. Don’t know

32%

38% At 48%, magnetic tape continues to be the clearly preferred backup storage media. Interestingly, however, the prevalence of magnetic tape drops significantly (from 48% to 23%) when the storage function changes – from a backup to archival context – in the next question. In the 2009 40 Survey Results

33%

Cohasset ARMA International Electronic Records Management Survey

survey, the results show the use of magnetic storage declined for both backup (-11%) and archival storage (-17%), yet it remains the most preferred storage media. The “Don’t know” response rate (38%) suggests that additional dialogue is needed to define and document current backup practices. 6.2

What storage device/media does your organization use for electronic archiving?

Response

2005

2007

2009

Compared to the previous question, the 21% 34% “Don’t know” response was 12% greater (from 38% to 50%). Cohasset believes this reflects B. Magnetic disk 20% 11% 26% that the survey’s community of respondents A+B 32% 60% 43% has not yet focused on records archiving to any significant extent. This manifests the key C. Optical disk 12% 23% 15% historical distinctions between the discipline A+C 33% 57% 38% of records management (traditionally D. Other serving as custodians of temporary records) 11% 18% 11% and archival science (preservationists of E. Don’t know 44% 40% 50% permanent or long term records). The high incidence of “Don’t know” is understandable given the fact archiving has not been a “mainstream” responsibility of records management professionals. Ironically, those responsible for archiving electronic data and records are typically not trained archivists; rather, IS/IT staff. A. Magnetic tape

23%

Magnetic storage (43%) is clearly the preferred option (23% for magnetic tape and 20% for magnetic disk) for archiving electronic records, with the use of optical disk reported at 15%. 6.3

Does your organization rely on computer back up for electronic archiving purposes and therefore retain certain “backups” (such as backups of email servers) for longer periods of time to meet legal and regulatory requirements or to satisfy longer term business needs? Response

2005

2007

2009

43% An important electronic records management issue A. Yes 44% 45% has emerged in regard to legal discovery: creation B. No 23% 24% 27% of copies for one purpose (such as backup) that C. Don’t know are used for another purpose (retrieval). Generally, 33% 31% 30% given the way backup data is formatted on tapes, it is extremely difficult to retrieve records in the context of file referencing. In discovery, considerable controversy has arisen when those who protest about the cost of searching vast volumes of magnetic tapes as part of discovery subsequently concede they accessed that same information when “emergencies” required such action in the regular course of business. Courts have refused to accept a dual standard where parties had accessed back-up media for their own needs but objected to doing it for discovery. Courts, therefore, have concluded that similar accessing is required to meet discovery responsibilities – albeit at significant cost. Survey Results 41

Cohasset ARMA International Electronic Records Management Survey

This survey question was posed for two reasons: 1.

Determine the extent to which professional records managers were aware of the practice of accessing backup media as part of an organization’s records management retrieval efforts, and

2. Assess the degree to which the initial media retention for backup is extended with some regularity to satisfy legal or regulatory requirements or longer term business needs. As detailed in the matrix, nearly one half of the respondents’ organizations (43%) use backup media to meet other records management objectives which had required extending the original backup retention schedule. Only 27% could answer “No” while 30% reported “Don’t know.” These 2009 findings are essentially unchanged from the previous two surveys. Cohasset believes these findings soundly confirm what many courts believe: a dual standard has been widely argued – where organizations have retrieved from backup media for their own “emergency” needs, but objected to the cost of doing it in response to discovery. Largely, this situation comes down to matters of volume. The volume was considered low and the costs reasonable when meeting their own business needs; for discovery, however, the volume of requested records made the cost very high and therefore a point to argue before the courts. The findings also illuminate a broader problem: the marginalized management of backup media at many organizations. Specifically, if electronic records are not included in the organization’s records management program (see Section 1) and retention schedules are not applied to electronic records (see Section 2), there are bound to be situations where backup media created for one purpose is used for another, and the official rotation schedule is adjusted on an ad hoc basis. Cohasset believes more rigorous oversight of backup media in alignment with the organization’s information and records management governance protocols will alleviate this problem substantially. This should also clarify which function is responsible for defining and applying the retention and rotation schedules. Given a clear mandate, records management professionals can work with their IS/IT colleagues to comprehensively inventory what is being retained. Cohasset has found that all too frequently many more backup tapes are retained by organizations than is necessary. Poorly managed “oceans” of insufficiently labeled and inadequately inventoried backup media constitute major compliance and legal risks. Management needs to view these risks as “unacceptable” and place all backup media under an effective, integrated management control system. For the records management profession, facilitating the mitigation of these unacceptable risks should be viewed as an exceptional opportunity – one that can make the function of records management more relevant in the era of predominantly electronic records.

42 Survey Results

Cohasset ARMA International Electronic Records Management Survey

6.4

Does your organization have and apply retention rules to electronic archiving and computer backups?

Response

2007 Yes

2007 No

2007 Don’t Know

2009 Yes

2009 No

2009 Don’t Know

A. Electronic archiving

37%

31%

32%

34%

36%

30%

B. Computer backups

33%

32%

35%

45%

29%

26%

This year’s findings reflect a significant increase (from 33% in 2007 to 45% in 2009) in respondents who affirmed that retention rules are being applied to computer backups. No improvement in the application of retention rules to electronic archiving was reported. With only one third (34%)responding that retention rules are applied to their electronic archiving media, these findings underscore the overall lack of established records management practices for this area – with the resulting operational problems and legal risks. The current situation needs additional management attention and timely action. 6.5

Which function defines your organization’s retention policies for its electronic archiving and computer back-up data? Check all that apply.

The function of Records Management has traditionally provided oversight for the development and administration of retention schedules for media-centric (paper and microfilm) records. The matrix shows the role of records management for in the realm of electronic archiving and backup data is moving, albeit very slowly, with an increase from 47% in 2007 to 50% in 2009. IS/IT historically has led this effort and continues to dominate (64%) over the other functional areas listed.

Response

2005

2007

2009

A. Records Management

32%

47%

50%

B. Legal/Compliance

15%

32%

29%

C. IS/IT

39%

58%

64%

D. Business Operations

5%

21%

18%

E. Other

9%

7%

4%

•

11%

12%

F. Don’t know

This survey’s findings show Legal/Compliance a distant third (29%) and dropping (down from 32% in 2007). For organizations to gain effective control over the retention of archival and backup media, greater clarity must be established by senior management regarding which functions oversee the definition and administration of an organization’s retention schedules for the entire enterprise – including electronic archiving and backup media.

Survey Results 43

Cohasset ARMA International Electronic Records Management Survey

6.6

Assess your organization’s ability to find and retrieve information from archival storage media in response to legal discovery requests.

The retrieval of electronic records for discovery remains a formidable A. No problems 8% 8% 6% organizational and technical challenge. The costs associated with discovery B. Not much difficulty 24% 25% 27% have made it the second largest A+B 32% 31% 35% uncontrolled cost in business and government, second only to health care. C. Some difficulty 38% 39% 40% Many private sector organizations have D. Considerable difficulty 21% 20% 17% made substantial investments in recent E. Very difficult years to professionalize the process of 9% 10% 8% locating and producing records to meet C+D+E 68% 69% 65% regulatory and legal needs. Cohasset is aware some organizations have measured their return (savings in discovery costs) on investment and are attempting to use this model to make the case for significant investments to further improve their capabilities. This type of mindset needs to be more broadly applied. Response

2005

2007

2009

As detailed in the matrix, nearly two-thirds (65%) of respondents reported (Lines C+D+E) varying levels of difficulty finding and retrieving information from electronic archiving storage devices/media – from “Some difficulty,” 40%; to “Considerable difficulty,” 17%; to “Very difficult,” 8%. Only 8% responded they had “No problems,” a modest increase from 2007. Another 27% indicated they had “Not much difficulty.” One-third (35%) of the organizations represented by the respondents therefore had little or no difficulty responding to their legal discovery requests. As detailed in the matrix, the 2009 findings were similar to results in 2005 and 2007. 6.7

How would you characterize your organization’s ability to find and retrieve information from computer back-up storage devices/media in response to legal discovery requests? 2005

2007

2009

A. No problems

7%

6%

7%

B. Not much difficulty

25%

24%

25%

A+B

32%

30%

32%

C. Some difficulty

39%

37%

39%

D. Considerable difficulty

19%

21%

21%

E. Very difficult

10%

12%

8%

C+D+E

68%

70%

68%

Response

44 Survey Results

As detailed in the matrix, the findings for backup storage media track closely the archiving storage device/media results in the previous question. Nearly onethird (32%) of respondents had few or no problems, and two-thirds (68%) had similar degrees of difficulty – whether the organization is seeking to find and retrieve information from archiving or backup storage media/devices.

Cohasset ARMA International Electronic Records Management Survey

6.8

How many computer back-up tapes does your company currently retain to meet its need to store records and data?

The great majority (71%) of respondents answered “Don’t know” and therefore did not provide a quantitative response. Of the other 25% who believed they could provide an “order of magnitude” response, their organizations conservatively report having more than 20 million backup tapes. These results only hint at the magnitude of the digital storage management challenge at hand and reveal a huge knowledge gap for the records management profession.

2005

2007

2009

A. Over 500,000

1%

2%

1%

B. 300,000 to 500,000

1%

1%

1%

C. 150,000 to 300,000

1%

1%

1%

D. 50,000 to 150,000

2%

2%

2%

E. Under 50,000

23%

23%

20%

F. Don’t know

72%

71%

71%

•

•

4%

Response

G. Does not apply

The objective of this question was twofold. The first was to gain a better perspective about the staggering volume of backup tapes which exist and, in turn, create a forum for records management professionals concerning the extraordinary opportunity at hand to address a major problem. The second objective was to provide senior management a much needed perspective on the magnitude of the situation and to highlight associated risks. In this context, Cohasset believes substantial resources will be needed to address this problem. Additionally, senior management must realize the underlying need is not a “cleanup” project; instead, there must be commitment to an ongoing, improved management of backup and archiving media/devices containing electronic records. To achieve success in this regard, records management professionals must dramatically improve both their understanding of the specific environment within their organization and also their technical competencies in order to provide leadership and to collaborate with technical experts in addressing this significant dilemma.

Survey Results 45

Cohasset ARMA International Electronic Records Management Survey

46

Cohasset ARMA International Electronic Records Management Survey

Conclusions There are five principal conclusions of this 2009 Cohasset ARMA International survey of records and information management professionals. No statement of their relative importance should be associated with the sequence in which they are presented. 1.

Most organizations have serious operational shortfalls regarding the processes by which they identify, manage and preserve electronic records, one of their most important assets. The findings of Cohasset’s earlier surveys continue to be verified in this regard.

2. This year’s results confirm that some deficiencies in core records management program components have begun to be addressed but the overall effectiveness of these programs with regard to systematic control over electronic records remains grim. 3. The number and magnitude of organizational and operational problems reflected in the survey findings collectively represent stunning business risks. Senior management must consider these risks unacceptable to have and untenable to continue. 4. Much greater engagement from the “C Level” down is needed to break down traditional barriers between stakeholders and encourage new approaches to designing and integrating retention and other recordkeeping requirements into business processes and systems. 5. The integration of electronic records into the organization’s records management program should be a priority, and electronic records control gaps should be the focus of immediate corrective action. The electronic records survey results provide compelling evidence of the continuing sea change that businesses and government entities are experiencing with regard to the management of their information assets and records. The fundamentally different nature of electronic records, the complexity of today’s business information systems, and the steady rise in regulation and litigation over the past decade have combined to create enormous pressure on organizations to adopt new and more integrated ways of protecting and preserving their “organizational memory.” Stakeholders are encouraged to take the self-assessment provided on the next page and leverage the results as a springboard for focused, strategic dialogue concerning how their organization can adapt and enhance records and information management controls and processes to meet their legal, compliance and operational needs well into the future. Until sustainable capabilities to meet recordkeeping requirements are designed into the processes and systems used to create/receive and manage electronic records that are maintained in the normal course of business, organizations will continue to fall far short of their obligations to protect and preserve their information assets in a manner than meets established thresholds for other asset types.

Conclusions 47

Cohasset ARMA International Electronic Records Management Survey

Self-Assessment Use a pass/fail standard to determine the outcome of this self-assessment.

Yes

No

Yes

No

1. Are electronic records addressed in your organization’s records management policies and procedures?

2. Are electronic records included in your organization’s retention schedules?

Yes

No 3. Does your organization’s hold order system include electronic records?

Yes

No

Yes

No

Yes

No

4. Have funding and resource levels in your organization for records management kept pace with the growth in the volume, types, and complexity of electronic records? 5. Are electronic records created/received or stored on behalf of your organization by third parties managed in compliance with your records management policies and procedures? 6. Is there a forum for regular interaction between business units, records management, legal/compliance, and IS/IT to collaborate and cooperate on recordkeeping requirements and initiatives?

Yes

No

Yes

No

7. Are business units and individuals held accountable for compliance with records management policies and procedures?

8. Does your organization have a plan and budget to periodically refresh media and to migrate electronic records that must be retained for more than 10 years or preserved permanently?

Organizations that ‘fail’ any of these questions should consider the message of this self-assessment to be a “wake-up call” to action.

48 Self-Assessment

Cohasset ARMA International Electronic Records Management Survey

Action Items for Success Cohasset offers the following specific action items intended for those responsible for the management of electronic records.

Senior Management Recognize and address the many significant existing problems in how records are currently managed. Assess the effectiveness of the organization’s records management practices as part of a comprehensive, long term risk management strategy by focusing on: •

Inclusion of electronic records in all facets of the records management program;

•

Assessment of the organization’s use of electronic archiving and backup storage media and devices in order to bring them under appropriate management and policy controls;

•

Determining what levels of management support and funding for records management process and controls are adequate to meet the organization’s long term obligations and resolve any outstanding gaps in capabilities;

•

Establishing a program to preserve digital records, including migration of records to mitigate the impact of technological obsolescence.

Institute a cross-functional team (representatives of line of business and support functions, legal/compliance, IS/ IT, records management and archives) and collaborative approach to ensure an integrated and sustainable records management program. Adopt international, industry and professional standards of performance and accountability for managing the organization’s valued information assets, particularly electronic records.

Business Unit Management Be able to identify and describe the inputs and outputs of core and administrative business functions activities, and systems. Work collaboratively with users, third parties, technology support and other stakeholders to apply approved retention rules to all records created and used by the business unit.

Action Items for Success 49

Cohasset ARMA International Electronic Records Management Survey

Understand recordkeeping requirements and stakeholder interests for the records that the business unit own, stores and uses in support of ongoing operations. Communicate to senior management the on-going need for records management support and expertise. Identify recordkeeping issues and help to develop plans to mitigate or eliminate risks.

Records Management Become change agents in the improvement of records capabilities and controls, and seek opportunities for collaboration with other internal and external stakeholders. Actively promote awareness and education about the life cycle requirements of information and records throughout the organization. Learn more about how their organization manages electronic archiving and backup storage media/devices and help raise awareness about best practices for storing electronic records. Coordinate a periodic review of recordkeeping laws, regulations and best practices to ensure the organization’s program continues to meet evolving business needs and legal requirements. Sponsor an annual review of how retention schedules and destruction protocols are applied within business areas to ensure the records management program reflects current operating conditions and compliance requirements. Seek and acquire new skills and competencies to successfully manage electronic records and collaborate with subject matter experts inside and outside the organization.

Legal/Compliance Establish an ongoing interactive relationship with IS/IT and records management regarding the organization’s management of its valued information assets, especially electronic records. Promptly communicate all legal records hold orders to the records management function and develop the capacity to rescind hold orders when the matter has been resolved. Seek and acquire greater knowledge and understanding of IS/IT issues and the organization’s business information system infrastructure and architecture. Develop and maintain an audit process by which compliance with records management program directives and performance targets can be measured and assessed.

50 Action Items for Success

Cohasset ARMA International Electronic Records Management Survey

Information Systems/Information Technology Become fully informed about the concept of life cycle management of business records. Work in partnership with the records management function and records owners to apply good practices to the organization’s centrally managed systems and repositories. Become proactive in addressing the issues of digital preservation and planning for records migration. Oversee adherence to hold orders that impact electronic content and recordkeeping. Collaborate with legal, compliance and records management experts to assess and apply the appropriate retention requirements to backup and electronic archiving storage media and devices.

Action Items for Success 51

Cohasset ARMA International Electronic Records Management Survey

52

Cohasset ARMA International Electronic Records Management Survey

End Notes 1. Recent rulings and changes in the law are having a major impact on standards of conduct for organizations and their legal counsel. Readers are encouraged to read about the 2006 and 2007 changes to the Federal Rules of Civil Procedure (www.law.cornell.edu/rules/frcp/). 2.

ARMA International offers two self-assessment tools: the Risk Self-Profiler for organizations, and the RIM SelfAssessment for professionals. The Risk Profiler suite of diagnostic tools allows organizations to identify their risk potential and have access to best practices so the organization can remain compliant and competitive. This Web-based tool allows organizations to assess and document their records management program against ARMAinterpreted best practices in the spirit of ISO 15489, the international records management standard. The standard is recognized worldwide as establishing the baseline for excellence in records management programs. More information can be found at www.arma.org/profiler. The online RIM Self-Assessment tool is designed to help individuals identify strengths and any gaps in their skills and knowledge, and point them to resources to address those gaps. The tool is based on ARMA International’s Records and Information Management (RIM) Core Competencies, which give RIM practitioners and organizations insight into the skills needed to successfully manage records and information. The assessment covers six domains: business functions, RIM practices, risk management, communications and marketing, information technology, and leadership. More information can be found at www.arma.org/competencies.

3.

Throughout this document, the term “organization” is used to refer to companies, businesses, government agencies, institutions, associations and other entities conduct profit and not-for-profit activities.

4.

Microfilm supported this paradigm since the 1930’s by miniaturizing records and thereby enabling the retention of more records in less space.

5.

IS/IT, as the term is used in the document, stands for the Information Services or Information Technology function and is intended to reference the computer systems development and operations group.

6.

Cohasset believes that using the same questions from survey to survey increases the statistical credibility of the findings and trends reported.

7.

AIIM did not participate as a co-sponsor of the 2009 ERM survey.

8.

Lyman, Peter and Hal R. Varian, “How Much Information 2003?” which can be accessed at: www.sims.berkeley.edu/research/projects/how-much-info-2003/.

9.

ARMA International (www.arma.org) is a not-for-profit association serving more than 10,000 information management professionals in the United States, Canada, and over 30 other nations. ARMA International members include records and information managers, archivists, corporate librarians, imaging specialists, legal professionals, knowledge managers, consultants, and educators. The mission of ARMA International is to provide education, research, and networking opportunities to information professionals, to enable them to use their skills and experience to leverage the value of records, information, and knowledge as corporate assets and as contributors to organizational success.

End Notes 53

Cohasset ARMA International Electronic Records Management Survey

10. This year’s survey is the sixth such Cohasset ERM survey (1999, 2001, 2003, 2005, 2007 and now 2009). All surveys have been conducted in conjunction with Cohasset’s annual national conference on Managing Electronic Records (MER). Respondents to the first survey were the 350 attendees at the 1999 conference. To provide greater confidence in the data, Cohasset expanded the number of survey respondents with a second sample. The same key issues (using identical questions) were posed in 2001 to members of the Records Management LISTSERV, a public, independent Internet based forum dedicated to the discussion of records management and related issues. There were 150 respondents – a response rate of 9% from the approximately 1,600 subscribers, and the results were similar to those of the first survey. The results of the first two surveys, based on the input of over 400 respondents, were integrated and presented at the 2001 MER conference, detailed in an article in the September 2002 Issue of the AIIM E-DOC Magazine, and included in the landmark AIIM/Cohasset White Paper, Realizing the Need and Putting the Key Components in Place to “Getting it Right” in Records Management. Summarized results of the 2005 and 2007 surveys were presented at the MER conferences by Robert F. Williams. Highlights of the 2009 results were presented during the MER conference Keynote address by Lori J. Ashley. 11.

The primary business assets are capital, human resources, materials, information (data and documents) and facilities.

12. Aside from membership in one of the survey sample groups, there were no qualifications for participation. Because there was overlap among members of those groups, it was recognized some individuals would receive multiple invitations to participate. It was assumed they would participate only once in the survey. Although members in all respondent sources predominately work for organizations in the United States, the survey had no limitations regarding participation by persons residing outside the United States. Demographic data was collected for the first time in the 2005 survey. 13. Cohasset’s president, Robert Williams, provided expert testimony for State Farm in Campbell v. State Farm Mut. Auto. Ins. Co., 2001 UT 89, 65 P.3d 1134. The testimony indicated using the verb “disposed” versus “destroyed” is not only more accurate, but serves to preclude any substance to the legal attack that records were destroyed in anticipation of litigation – however undefined the litigation may be – and therefore potentially subject to the charge of spoliation. The process by which records are verifiably disposed of in the regular course of business (in accordance with established policies and procedures) should not be the subject of a legal controversy. This case subsequently was appealed by State Farm to the United States Supreme Court, in State Farm Mut Auto. Ins. Co. v. Campbell, 538 U.S. 408 (2003), where the Court decided in favor of State Farm in a landmark punitive damages ruling. 14. Readers seeking additional information on the interrelationship between records management, compliance and governance, are invited to download the Cohasset White Paper, The Eternal Charter: Improving Corporate Governance through Compliance and Assured Records Management, at www.cohasset.com/whitepapers.php. 15. The 2002 AIIM/Cohasset White Paper, Realizing the Need and Putting the Key Components in Place to “Getting it Right” in Records Management, addresses this issue and is available at www.cohasset.com/whitepapers.php. 16. The primary resource on migration is Charles Dollar’s Authentic Electronic Records: Strategies for Long Term Access, Chicago: Cohasset Associates, 2002. The key strategy detailed in this book is the essence of ISO standard 18492 Document Management Applications – Long-term Preservation of Electronic Document-based Information.

54 End Notes

Cohasset ARMA International Electronic Records Management Survey

End Notes 55

Cohasset ARMA International Electronic Records Management Survey

ARMA International (arma.org) is a not-for-profit professional association and the authority on records and information management. Formed in 1955, ARMA International is the oldest and largest association for the records and information management profession with a current international membership of approximately 10,000. ARMA International provides education, publications, and information on the efficient maintenance, retrieval, and preservation of vital information created in public and private organizations in all sectors of the economy. ARMA International also publishes Information Management magazine.

www.arma.org

Cohasset Associates, Inc. is one of the nation’s foremost management consulting firms specializing in records and information management. For more than forty years, Cohasset has served clients throughout the United States. Its distinguished work and innovative concepts have been recognized with the highest professional awards. Cohasset also is widely known for its excellence in education – organizing and presenting the National Conference on Managing Electronic Records (MER) – with its special focus on the legal, technical, and operational issues of managing electronically stored information. Cohasset regularly publishes thought leadership white papers and surveys to promote continuous improvement in the management of records and information.

www.cohasset.com

56

Cohasset ARMA International Electronic Records Management Survey

RIM on Demand brings Cohasset’s Managing Electronic Records (MER) conference to anyone, anywhere, anytime. RIM On Demand answers the great, ongoing need to have the knowledge and experience of the best experts and peers come to you. It also facilitates sharing needed knowledge within your organization. RIM On Demand delivers, via the web, the best Records and Information Management content – using videos synchronized to the presenters’ slides. A unique navigational system facilitates your obtaining optimal benefits in minimal time. RIM On Demand provides unlimited, yearlong access to all the MER conference sessions wherever you are, without any travel, at a fraction of the usual conference/ seminar cost.

www.RIMeducation.com

Additional copies of this white paper are available at:

www.rimeducation.com/survey.php

57

Prepared by

Additional copies of this white paper are available at:

www.rimeducation.com/survey.php