Big buckets for simplifying records retention schedules.

Like it or not, all of an organization's recorded information is potentially discoverable in a court-ordered legal discovery or regulatory investigation. This means all recorded information needs to be managed for retention purposes throughout its life-cycle depending on its legal, regulatory, industry, and business value/risk.

Because records retention compliance begins with employees who create, receive, and use records, organizations are searching for ways to make it easier for them to classify records into the correct retention categories.

One solution for helping employees is to use a "big bucket" strategy for simplifying records retention schedules by consolidating record types related to the same business function or process and with similar retention requirements into bigger retention buckets or record series.

With fewer buckets resulting in fewer retention choices, employees and auto-categorization tools are more likely to classify information consistently, which ensures better compliance with an organization's record retention requirements. This, in turn, reduces risks associated with keeping records too long and reduces costs for maintaining and responding to e-discovery demands for large volumes of unneeded records.

Despite these advantages, big bucket proponents cite difficulties associated with managing exceptions. Exceptions include records with event-driven retention requirements and case-type files made up of multiple record types that have different retention requirements. Project files that contain contracts, statements of work, proposals, and deliverables are one such example. (See sidebar, "The Pros and Cons of the 'Big Bucket' Approach.")

This article examines approaches for managing retention of all an organization's recorded information assets, including exceptions, and assesses the progress toward a standardized approach for using bigger retention buckets.

Managing Official Records

An up-to-date retention schedule protects the interests of an organization and its stakeholders by ensuring that the official business records are kept for as long as they are needed to meet legal, regulatory, and operational needs and provides a "safe harbor" for disposing of outdated information. Records and information management (RIM) professionals became familiar with the term "safe harbor" when the U.S. Federal Rules of Civil Procedure were amended on December 1, 2006. Rule 37(e) states that, "absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, goodfaith operation of an electronic information system"

In addition to complying with its retention schedule, an organization can do several other things to demonstrate good faith. Bill Tolson, director of legal and regulatory solutions marketing for Mimosa Systems, said this includes establishing policies, processes, and procedures, including for litigation holds; training employees on the policies and procedures on a regular basis; understanding its technology infrastructure, including which systems automatically delete records and ensuring that deletions can be overridden when required for preservation; and adding infrastructure automation to help in meeting the 37(e) responsibilities.

RIM and IT professionals are beginning to agree that about 100 record series is a reasonable number of buckets in an enterprise-wide (even global) retention schedule for most industries, depending on an organization's risk tolerance.

According to Galina Datskovsky, senior vice president and general manager of CA's information governance business unit, risk can increase because bigger buckets may have longer retention periods. "The right size is a carefully measured balance between risk of lengthened retention periods versus the everyday practical benefit of bigger buckets," Datskovsky said.

She said she senses a trend toward big buckets, driven largely by the need to get a handle on electronic records.

"I am actively recommending the big bucket approach to my clients" Datskovsky said. "They have achieved good results where the number of buckets has not been too few, and retention schedules with around 100 buckets have been quite successful to date."

Developing Retention Schedules

When organizations develop a new retention schedule with big retention buckets, they must start by identifying the recorded information assets across the enterprise in both physical and electronic formats. Next, the recorded information is organized by record type and business function/process into a preliminary classification scheme comprised of record series or buckets. Then, legal research is conducted to identify relevant federal and state laws and regulations affecting retention, which are organized into legal groups that are related by industry and subjects.

Approximately 15 to 20 percent of the records series or buckets in a schedule will not have legal or regulatory retention requirements (budgets and organization charts, for example), and business or operational requirements for retention will have to be defined. The process of mapping the record series or buckets to the appropriate legal groups produces the first draft of the retention schedule.

The next step is to consolidate the buckets in the first draft of the retention schedule into fewer buckets by assigning the longest retention period (considering both the legal and business requirements) among a group of consolidated buckets to its new bigger bucket. Consolidation into bigger buckets is a collaborative process that requires active participation from the legal, RIM, IT, and key user departments.

The process can be time-consuming because many factors must be considered--the organization's risk tolerance, history of litigation, intensity of regulatory scrutiny, record volumes, and resourcing constraints.

For more detailed information on developing retention schedules using the big bucket approach, refer to "How to Win the Compliance Battle Using 'Big Buckets" in the July/August 2008 issue of The Information Management Journal.

Revising Retention Schedules

When revising an existing retention schedule, make sure legal research and business requirements for records retention are up-to-date. Refreshing the legal research every 18-24 months is recommended for highly regulated industries.

The consolidation process for an existing schedule is nearly the same as for developing a new schedule; however, organizations will need to provide crosswalks (tables indicating the relationship between two systems or data structures) to legacy content classified to the old schedule. Retention codes assigned to boxes of inactive records in storage or to documents maintained in enterprise content management (ECM) systems may need to be updated to reflect the new, bigger retention buckets because destruction processes usually proceed under the retention schedule and laws existing at the time records are destroyed.

Implementing Schedules

Before rolling out the new retention schedule, a pilot implementation of the schedule in a select business unit is recommended to collect feedback from the people who are actually going to use it.

The pilot allows the implementation team to get a sense of how usable and acceptable the schedule is and to make any requisite changes before it is shared with the entire organization.

Managing "Non-Records"

Anecdotal information suggests that the majority of the information, documents, records, and content retained by most organizations is probably unnecessary. General Mills, for example, found that only 5 percent of its recorded information is considered to be "official business records," according to "Implementing Record Retention" a presentation given by Elliot Gerard at the Microsoft SharePoint Conference in Seattle in March.

The most common kinds of information unnecessarily retained include duplicates, superseded records, draft versions, content that has exceeded its retention period, and orphaned documents from employees who have left the organization.

Microsoft, according to Evan Richman's 2008 presentation "Enterprise Content Management from Microsoft," refers to the large volume of non-records retained by most organizations as "the long tail" a term to describe statistical distributions in which 80 percent of the effects come from 20 percent of the causes.

When the model is applied to records management, the head or the tall neck (20 percent) represents the official records of an organization, and the long tail (80 percent) represents all the other recorded information, documents, and content that have to be managed.

The long tail of recorded information requires additional buckets not included in an organization's retention schedule because a schedule applies to official business records. As evidenced by the following examples, organizations frequently are categorizing non-records into two to four retention buckets.

According to Gerard, General Mills' records retention approach requires a "managed state for all assets," The organization surveyed 1,330 employees to determine how many retention categories would be tolerated, and 682 (51%) responded. General Mills shaped its non-record retention periods on the results:

1. General working records (35% of all information)--Lifecycle is 24 months and is "not renewable," which means it cannot be changed or updated. Examples are informal communications and team meeting minutes.

2. Business reference records (35% of all information)--Lifecycle is 36 months and is renewable. Examples are standards and marketing plans.

3. Permanent reference records (25% of all information)--Lifecycle is "life of company," so renewability is not needed. Examples are consumer contacts and divisional presentations.

4. Official business records (mentioned above is 5 percent of all information)--Lifecycle is the retention schedule.

In another example, Rohm and Haas Company established three conceptual "zones" for managing e-mail messages, according to Sandra Hostetter in "Managing E-mail--Finally, An Enterprise Reality," a presentation given at the May 2008 Managing Electronic Records Conference in Chicago:

1. Transient information that is no longer useful and can be destroyed (automatic delete zone)--disposal after 60 days for inbox, sent box, and folders not designated as one of the other two zones

2. In-progress information (work space zone)--Each person has 100MB of space, and the organization is considering a two-year maximum retention.

3. Final information (company records zone)--retention per retention schedule.

One of Gimmal Group's Fortune 200 clients is considering three broad categories to manage recorded information in all formats and media:

1. Non-records--very short retention

2. Transitory content--one to five years retention

3. Official records--retained per retention schedule

These examples suggest that a standard approach for how to "bucket" non-records is still emerging. Some will argue that in the General Mills examples of "permanent reference records" and examples listed for some of the general working and business reference records are considered official business records in most environments. Also there is ambiguity around the definition of transient and transitory information. Nonetheless, a pattern is emerging, and it has two lifecycle states/buckets for non-records:

1. Ephemeral, transitory information--retention limited to hours or days

2. Work in progress--one to three years retention

Training End Users

To be successful, the big bucket retention approach needs to be part of an overall enterprise content and records management strategy. "Big bucket retention approaches should be built around a keen insight into the enterprise's needs and a refined and tested education program that reinforces those internal needs" according to Thomas Utiger, president of Data Empowerment Group.

He suggests that to successfully implement a big bucket retention approach, it also needs to be embedded into the enterprise's organizational training systems. Communication with end users can take many forms including carefully targeted email blasts, a strong, well-focused website, as well as an on-target wiki for records management resources. Other outreaches include an online newsletter, interactive blogs, and periodic, web-based employee town-hall meetings.

"However," Utiger explained, "experience shows that every other means of internal promotion and system reinforcement is secondary to an effective, productive, and on-target formalized internal training program."

Tailoring the training and education is necessary to meet the needs of various groups of employees within an organization, including new employees, existing rank-and-file employees, managers, and supervisors at all levels within the enterprise, executives, information technology managers, and records coordinators.

Conclusion

A standard practice is emerging for the use of bigger retention buckets (around 100 categories) for managing official business records in retention schedules. This author predicts that the buckets will get even bigger (50 or fewer?) as RIM and IT professionals gain more experience in implementing ECM systems and users, including legal professionals, feel more confident with processes to assign retention periods to a broader set of official business records.

Retention buckets are also needed for information that does not have record value (non-records). A pattern of having two lifecycle states/buckets for non-records is gaining momentum: one for the ephemeral content (retention period in days) and one for work in progress (retention period in years). An investment in training and education will be necessary to ensure employees understand the retention process and adapt to the simplified retention rules.

The Pros and Cons of the 'Big Bucket' Approach

The potential benefits of big bucket retention schedule categories are compelling:

* Users can more easily manually classify records for retention. Ideally, organizations want to keep end user involvement to a minimum by using templates, workflows, and automatic categorization tools. When users have to manually classify records, presenting fewer, better-defined choices is more likely to lead to accurate and consistent selections, less frustrated and more confident users, and simplified training.

* Correctly classifying records helps mitigate risk from retaining records too long. When users are confident they know how to classify records for retention correctly, they are more likely to do it consistently, and fewer unnecessary records are retained "just in case."

* Approvers are more likely to approve dispositions. For organizations that require pre-approval to dispose of records, approvers are more likely to approve destruction because they have more confidence that users are classifying content accurately and consistently.

* Reduced maintenance lowers the total cost of ownership. Less complexity in a retention schedule requires less training and takes less time for periodic maintenance, which lowers the total cost of ownership for an organization to maintain its schedule.

* Using this approach provides compelling benefits from the technical perspective. Having fewer buckets improves machine-driven classification and improves operating efficiencies of document management and enterprise content management (ECM) software solutions. See "Strategies for Improving Electronic Recordkeeping Performance" in this Hot Topic for more details.

The difficulties associated with using the big bucket approach include:

* Records with conditional or event-driven retention requirements need special consideration. In a typical retention schedule, 30-50 percent of the records series will have event-driven or conditional retention requirements (for example, expiration of a contract + x years). Additional buckets will be needed to properly manage these records because chronological and conditional periods are not easily combined due to potential risk or extra cost from longer-than-necessary retention. When possible, assign a fixed year or create date to these event-based buckets.

* Permanent records or those with indefinite periods may need to be handled differently. To the extent possible, organizations should replace the terms "permanent" or "indefinitely" with an actual number of years (say 50 years).

* Managing retention periods for case-type files is more difficult. Case files are usually composed of multiple record types that have different retention requirements such as personnel files containing benefit, payroll, and medical information.

* Using bigger buckets often result in longer retention periods, potentially increasing costs and risk. The final decision to make a bigger bucket versus several more granular buckets is risk/cost-based--whether separating specific record types by retention period is more costly/less risky than keeping them together for the longest retention period.

* Using bigger buckets decreases the amount of descriptive data found in more granular schedules. RIM managers and attorneys often rely heavily on the descriptive information embedded in granular retention schedules to locate physical records for litigation and retention purposes. When using an ECM system, organizations can leverage additional metadata such as creation date, creator, role, business function, and server, so that descriptive information embedded in the retention schedule is not the only metadata available for searching. Also, powerful search tools offered by Google, Autonomy, and others can be used to enhance findability.

Susan Cisco, Ph.D., CRM, FAI, is a director in Gimmal Group's Enterprise Content and Records Management (ECRM) services organization. Gimmal Group's expertise is focused on helping large enterprises improve business performance and compliance through the effective planning, implementation, and integration of ECRM, geographic information systems, web design, and user experience. Cisco has more than 25 years of experience as a RIM practitioner, educator, and consultant. A Certified Records Manager, Cisco earned a master's and a doctorate degree in Library and Information Science from The University of Texas at Austin. She may be contacted at [e-mail].