From the mouths of CIOs: organizations can meet the biggest challenges facing them today by getting their records management and IT professionals to work together and develop solutions.

At the Core

This article

* focuses on how CIOs perceive their electronic records challenges

* discusses what CIOs expect from RIM professionals

* offers ways that RIM professionals can be part of electronic records teams

In the current environment, organizations large and small are struggling to deal with massive amounts of e-mail, convert years of paper records to electronic formats, and meet compliance and regulatory mandates such as the U.S. Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HIPAA), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Organizations are storing records in multiple media formats--but paper records are increasingly yielding to electronic records because almost everything created today is electronic. Handling and managing electronic records is one of the biggest--if not the biggest--challenges facing organizations today. In a recent study commissioned by ARMA International and conducted by Forrester Consulting, the clear message from business and IT was that electronic records management (ERM) is considered a technology issue that falls under the purview of IT in most organizations.

ARMA's research revealed:

* Records and information management (RIM) professionals are losing their influence in records management as ERM emerges.

* Business and IT perceive few challenges to ERM, other than organizational priorities and budget; unlike business and IT, RIM professionals see many challenges surrounding RIM.

* Business and IT do not fully understand what ERM is; nor do they understand ERM's role in compliance regulations and legislation.

According to Connie Moore, vice president of Forrester's Information Delivery Research Group, RIM will gradually shift from administration to IT, compliance, and legal. "We think this will give RIM professionals more clout because they have knowledge that's very important in moving the organization into ERM. But some RIM professionals who don't move with this shift are going to get left out ... they've got to understand how things are changing" and that most of the changes are inevitable.

ERM is being driven by many different factors, including corporate policies, regulations, technology, archiving needs, best practices, legal, discovery, and audit concerns. In order to successfully implement and effectively maintain an ERM program, as well as meet pervasive compliance and regulatory demands, RIM must be part of a multi-disciplinary team that includes IT, legal, and compliance staff.

There is a great need within organizations for RIM and IT, especially, to work more closely together than ever before. RIM and IT professionals both possess critical knowledge that must be shared. For example, IT and business need RIM assistance in developing methods and metadata for identifying, preserving, classifying, and handling critical records. This is complicated by the fact that, in many organizations, records and IT professionals do not enjoy an effective working relationship and may not even be on the same page when it comes to ERM, archiving, or compliance regulations and legislation.

The Information Management Journal recently spoke to three chief information officers (CIOs) who are in different stages of employing and handling electronic records. The discussions centered on working with records and IT professionals to handle, manage, and maintain their organization's electronic records as well as deal with compliance concerns. Although the situations are different, these CIOs share the same challenges that are confronting most organizations today.

1. How would you describe your organization's general approach to handling electronic messages and records (including e-mail and instant messages)?

Rick Bauer, CIO of The Hill School, a boarding school in Pennsylvania, and Chair of the Storage Networking Industry Association (SNIA) End User Council: Only after a long period of discussion are we waking up to the reality that organizationally, we need a strategy to capture, archive, and manage our electronic communications. What had in the past been ad hoc personal or departmental archiving and management has to give way to a more systematic and effective means of ensuring that this vital information is saved. While legal exposure and regulatory compliance matters drive academia far less than other organizations, it is nevertheless critical that all organizations have some strategy for understanding and managing the ever-increasing volume of digital communications that take place within their respective domains.

John DeVouassoux, CIO, Blackwell Sanders Peper Martin law firm in Kansas City, Missouri: [We have] quite a well-defined policy for dealing with electronic records. The key thing we're trying to accomplish is to be able to regroup all the documents or information in retrievable space. They are grouped essentially by client and/or by matter, and there is a retention schedule attached to that.

L. Reynolds Cahoon, CIO, U.S. National Archives and Records Administration (NARA): Speaking as the CIO of a small federal agency whose work processes are still primarily paper-based, NARA is taking a deliberate approach to managing electronic records, testing records management application (RMA) technology through a series of pilots that will implement the software in diverse environments throughout the agency. At the same time, NARA will continue its internal policy of printing and filing records until such time as it is satisfied that RMA technology will meet its needs.

2. What do you think is the key to managing electronic records?

RB: First of all, getting leadership buy in is critical. When top managers are unable to reconstitute a chain of communication (a digital "paper trail," as it were) or are unable to respond to a legal challenge brought against the institution for lack of effective electronic communications management systems, there then comes a clarion call for the creation of such systems. Savvy technology and information managers must clearly articulate not only the cost of provisioning and deploying such systems, but also the cost of not deploying them.

Second, any system deployed to manage electronic communications must capture metadata about the particular transaction or communication in a manner that has little footprint on that activity. In other words, the system should be transparent to the organization, and yet facile enough to accurately capture and recapitulate those communication activities.

Third, for any system to truly be effective, it must be flexible to reflect the needs of the particular organization. I may want to manage and capture IM instant messaging] traffic for a period far less than a brokerage house or SEC [Securities and Exchange Commission]-regulated entity; our systems must provide that flexibility, or they will neither be adopted nor utilized in the long term.

JD: It starts with an anti-spam tool, all the protections we can put in place, and education of the population here to delete as much as possible up front as quickly as possible. We have a system that deletes evidently massive spam and junk mail, but we are restricted because ... frequently we have attorneys who still need to have access to [Internet] sites that normally would not be part of what a place should deal with.

RC: Based on our findings to date, we feel that the key to managing the electronic records that NARA creates is simultaneously dealing with people, process, and technology.

* People: Users' awareness of and commitment to the need to preserve the electronic documentation they create and use in the course of daily business is critical. Without this "user buy-in," no amount of technology or process or policy will assure the preservation of an organization's electronic documentation.

* Process: Records management requirements must be integrated into IT capital planning, business process design methods, NARA's systems development lifecycle methods, and into our enterprise architecture as a layer that cross-cuts all of our lines of business.

* Technology: For NARA's records, we believe records management services should be integrated into the applications that create records. In fiscal year 2005 we will work with government, industry, and academia to develop requirements that will result in the ability to integrate records management components into the computer applications that create records. We are also developing the Electronic Records Archives (ERA) that will be able to authentically preserve any type of electronic record created on any type of computer or software and to provide these electronic records any time, any place, and to anyone with an interest and legal right to access. The technology developed for ERA will then be adapted to manage NARA's own operating records.

Instant messaging is not yet part of NARA's technology infrastructure. However, we are planning a limited test to extend our understanding of the records management implications of this popular communications tool.

3. What do you think is the single biggest challenge in managing electronic records?

RB: The cost of deployment and ongoing management, and lack of desire to fund such activity in light of other competing priorities.

JD: To, in a sound and responsible way, eliminate all that needs to be eliminated to avoid [having to] later manage mountains of e-mail, especially as time passes. E-mail is growing at exponential rates, and other forms of documents also. So [the challenge] is to become selective and to have [a] process [that is] very efficient and very much up front when that information is incoming. The retention is expected to take care of eliminating what is already here, what has been kept for some time.

RC: We see two major challenges within NARA:

1) Designing records management into applications that create records. We believe this is best accomplished by integrating records management requirements into the IT management processes. An organization's methods for business process design, IT capital planning, and systems development life cycle, as well as its enterprise architecture, should all be designed to assure that records management requirements are included in all systems. We are doing this at NARA.

2) Making filing so easy and natural that it almost seems to be an automatic user response. Because of the nature of NARA's mission, agency staff have a better understanding, appreciation, and commitment to filing that make this more possible. Other circumstances may require greater involvement on the part of centralized RM staff to assure filing.

4. What are the biggest challenges you're facing in the areas of compliance, litigation, and/or investigation? How do Sarbanes-Oxley and other regulations affect your approach to handling electronic records?

RB: E-mail exchanges between students, between teachers and parents, faculty and families, between the school and its alumni can occasionally touch on matters that may prove valuable in some evidentiary sense in the future. How can such "high-value" transactions be captured, archived, and easily retrieved, usually in the frantic, "find-the-smoking-gun-e-mail-or-IM-immediately" nature of the environment at the time? On a few occasions over the years, we have had threatening or harassing communication taking place between one or more parties. On one occasion, there was an attempt to "anonymize" that communication, and law enforcement personnel needed a pretty accurate set of information regarding not only the content of the communication, but [also] the manner, systems, original locations, etc., of the information. We learned on the fly that we needed better systems.

Thankfully, our school is not required by federal or state law to be SOX-compliant. We do, however, follow best practices and accepted standards mandated by HIPAA with respect to healthcare information for our students and teachers (as a boarding school, we have students whose medical treatment, even overnight stays in our health center, fall under the auspices and direction of HIPAA). Our academic records are also subject to privacy restrictions, and we are required to produce transcript information for our students who apply to colleges throughout the world. With a school that is 155 years old, some of those transcripts range from beautiful hand-calligraphied report cards from the 1800s to today's online records from our ERP systems.

JD: We have to give attention mostly to confidentiality. We are not subject to Sarbanes-Oxley because we are private. Privacy is a very critical aspect and something that is close to that is to make sure we give access rights to the right people and the right people only. We are automating as much as possible in that regard. What applies to us is privacy and confidentiality for our clients and the attorneys.

RC: Fortunately, NARA has not been tested significantly in these areas to date. As a federal agency, NARA is not subject to Sarbanes-Oxley. However, we are governed and affected by the Federal Records Act and the records management regulations NARA issues for all federal agencies.

5. What departments/personnel are involved in setting policies and procedures for managing/handling electronic records within your organization?

RB: Our academic, alumni relations, health center, library archives, and IT department, all working under the leadership of our Information Services department, are involved in crafting policies, procedures, and programs that will effectively manage the various information produced by each department.

JD: Essentially, we work with three entities for that: legal counsel, records department, and IT--all three together. Records and IT both report to me, but we have also an attorney who is specialized for those kinds of things. Now, we feel that we have made so much progress that he uses what we have developed and put in place here to provide the advice to outside clients, and some of those are major firms in the country. Basically, we feel very good about what we have done in that field ... but there have been some challenges that have delayed this accomplishment. On the records side, they were at the beginning not understanding what I was asking them--that is for them to assume responsibility for defining our retention policy, and that policy should apply to all kinds of information and that means especially all the information that is processed and stored by IT. So the key relationship that I wanted and that essentially we have now is to have a records department responsible and able to audit the retention schedule in respect of the legal requirements within IT. The difficulty with IT has been precisely due to the fact that people in records have absolutely no knowledge--zero knowledge--about IT, which is strange to me but I had to make a special effort to really get those people [up to speed] ... and also to get our IT people to help them like they would help any of their own IT people to get of the knowledge required for information and processing.

RC: The NARA records officer and his records management team (RMT), who report to the CIO, are responsible for developing records management policy. They do this together with the agency's Policy and Communications staff. The RMT also works with the Information Technology Services Division and the Information Resources Policy and Projects Division (both of whom also report to the CIO) to verify that electronic records management policy and strategies are appropriate and feasible and to assure that these policies and strategies are implemented.

6. Is the responsibility of managing/handling electronic records falling on your shoulders? If so, what kind of help would you like to have from records management? From IT?

RB: Of course! As each department adopts a self-conscious strategy, it is my job to make sure that such strategies dovetail into the overall records management framework for the school. Many times I feel as if I am repairing the airplane in mid-flight: What do I need to save? How best should I save it? What are the "best-practice" templates for practitioners in my field (education) that I can apply to my particular organization?

I feel better about the IT issues, because I have a better sense of the tools and capabilities. But I fear that we can confuse ends and means here. I want the philosophical and legal framework of a clearly articulated records management policy to drive our technology, not vice-versa. Just because we can capture a digital transaction or communication, do we necessarily need to? These issues must be resolved before we start writing POs [purchase orders] for more hardware and software.

JD: Records must become more familiar with IT language, concepts, and challenges and they should qualify themselves to operate in what I would call a fully electronic environment. Initially, they had a sense of responsibility only for the paper documents that were moving around in the firm. I made it very clear to them, and to IT as well, that they are responsible for all forms of documents and all forms of information media. That evidently includes e-mail and instant messaging. I want them also to own it and to provide advice and recommendation for the disaster recovery or regarding those assets, the backups, the storage and recovery. I want to make sure we have people outside the traditional IT who are looking into this and who have the capability to be effective at it.

This year, [records has] moved from a totally manual environment to a Records department that is fully on [an] automated system and essentially provides access to the electronic documents directly on the desktop. The next step coming next year is [providing] capability for Records to image the documents that will first be applied to all new documents, all incoming documents from clients and other sources. Later, every time there is a previously existing record that is becoming active, they will have to image that document, which after a while will include all active documents. It's very critical that it is very consistent together. Right now, we don't have imaging in place so when we have a paper document coming from clients they are still processed in the traditional form. But we are integrating into Records all the e-mail, all the electronic forms of documents. More critically, Records is going to have some responsibility in the management of the e-mail and other electronic documents.

RC: Although as CIO I am ultimately responsible for managing electronic records, the day-to-day operating responsibility is actually held by the NARA records officer. He works with program management staff, legal staff, and IT policy and operations to develop policy and implement electronic records management procedures.

We see the NARA records officer as having primary responsibility for ERM within NARA. He is assisted by IT staff. Records management sets overall policy and strategies; IT, with its operational capabilities, helps implement the policies and strategies.

The NARA records officer reports to the CIO. His operation is fully integrated into our overall information management strategy, process, and structure.

7. Is there a relationship between records management and IT in your organization? If so, characterize that relationship.

RB: Yes, thankfully so. As the CIO, I am the steward of all the information for the school. From alumni records, from the library archives, from medical case histories and permission forms, to academic records, curriculum, and learning materials, all fall under my responsibility to safeguard and protect. The relationship between these departments is cordial, and we help each other by developing policies that complement each other's information management strategies.

Regular department meetings, sharing best practices, and the occasional crisis-management "opportunities" place an information retrieval task directly between our departments. Putting out fires is a great way to get to know folks' stress levels! I appreciate the fact that we can forge better ties when we aren't in a crisis mode, so we strive to have regular opportunities for our departments to meet and share concerns.

JD: Both IT and Records report to me. So that's how we can get those to things to work much better together. [I have] full control without any restriction [over that relationship]. That makes it easier, and I think we have moved forward much faster than many organizations in that regard.

We are the information group, including Records, IT, and Library--I think it's a good way to organize and structure because it brings together all the people who are handling information in one way or another. It has happened for one single reason; it's not a reason that is sufficient, but it is required, and that is to have under the same head--the same person--these three departments. That person has to be ready to accomplish that and fully understand what it takes. But unless there is this kind of common management above both (records and IT), I don't think this can happen easily at all.

As a result [of this working relationship], Library has already been automated, and Records will complete automation next year. I am the champion for getting that to happen, so I don't believe that big position should be given to Records itself because it's just not going to make it happen. Records is just too far behind in terms of electronic information processing. They have to be really brought in a very close, deep relationship with IT first to nurture that development, which is a prerequisite for Records people. Unless this is really addressed in very precise terms and effective ways, there's not much progress to expect.

There will be some pain in some organizations for accomplishing this but it has to happen because whether you look at Records or IT, they both manage information. IT is more on the side of processing and storage, but Records I feel should assume a full responsibility to make sure that legal requirements are respected.

RC: Yes, both IT and records management report to the CIO. The NARA records officer is a member of the CIO Technical Advisory Group and is included in all project and program reviews. He has developed processes that integrate records management requirements into the new systems capital planning process and the systems development life cycle. The NARA records officer has authority to prevent an IT project from moving to the next development phase if records management requirements are not met. He also works closely with our IT project managers.

8. What are the top three skills, competencies, and/or solutions that you need from RIM professionals? From IT professionals?

RB: RIM professionals must understand:

1) Best practices for smaller organizations

2) Best practices for digital archiving of e-mail (generation of metadata, etc.)

3) Policies on media formats (we have microfilm/fiche/paper/various other film and recording tape, and various digital storage media)

IT professionals must contribute:

1) Compassion and humility (and I'm a former IT guy! We simply can't be "digital dictators" without understanding the business units and their needs)

2) Listening ears. There's a proverb that states, "He who answers before listening, it is his folly and his shame." We IT folks can blurt out our "solutions" before we even understand the problem! Not a great way to get buy-in from the business units, either.

3) Systems that work within the parameters of the organization. If we can't afford it, can't easily use it, can't understand it, or can't sustain it at our current personnel levels, please don't install it for me!

JD; RIM professionals must:

1) Be IT knowledgeable

2) Assert themselves to ensure the application of records policies

3) Collaborate fully with IT in a proactive manner

IT professionals must:

1)Help records professionals become better informed about IT

2) Open document database management to records people to allow them to ensure the application of records policies

3) Perceive records as a necessary component of information management: IT manage processing and storing of information; Records manage the application of policies relevant to document and information management

RC: RIM professionals must:

1) [Have] complete knowledge of records management requirements and in depth understanding of the business processes and culture

2) Understand and be conversant in business process design, requirements analysis, systems analysis, project management, and the systems development life cycle

3) [Have the] ability and willingness to speak in terms IT professionals can understand and competent in "IT speak."

IT professionals must have:

1) Competent understanding of records management principles and requirements and an appreciation for the complexities of preserving and providing access to electronic records across multiple generations of technology and over time

2) Awareness of technologies available to meet records management requirements

3) Ability and willingness to communicate in non-technical language

As records management functions increasingly take on greater emphasis in organizations of all kinds, RIM professionals must be prepared to play a more proactive role in reinforcing RIM policies and procedures. A recent study by AMR Research found that 40 percent of companies think records management is a whole-company issue and 32 percent believe RIM affects multiple areas, though not the entire organization. These statistics illustrate the importance of forming a multi-disciplinary team of RIM, IT, and legal professionals to implement and manage effective ERM and compliance requirements.

In today's business environment, records managers can lead, follow, or simply get out of the way. There's never been a more critical time to be a leader.

How Can RIM Professionals Help Themselves?

* Develop IT skills (taxonomy development, auto-classification, storage, document management systems, message archiving), particularly focusing on enterprise content management (ECM) architecture and skills.

* Leverage subject-matter expertise in establishing records management policies; within the IT organization.

* Develop skills in message (e-mail and instant messaging archiving to communicate how the technology does and does not address electronic records management (ERM). Get involved in message archiving projects.

* Build IT awareness of RIM professionals' skills in preserving, classifying, and identifying critical records, and also handling metadata.

* Proactively seek positions as business analysts within IT (focusing on RIM policies) or proactively seek positions in legal, or compliance, or risk management to help in compliance initiatives.

* Proactively seek to understand and get involved with the organization's ECM strategy and implementations.

* Help IT develop solutions for ERM implementation challenges.

* Communicate to IT the differences among back-up, archiving, and ERM concepts.

* Form and join multi-disciplinary teams addressing ERM issues (IT, legal, compliance, and others). Remember that every interaction is an opportunity for learning, teaching, and establishing goodwill.

* Ramp up knowledge of the technology, compliance, legal, and business issues of e-records.

* Proactively demonstrate the value of RIM to IT.

* Pursue education, career development, and training.

* Try to contribute to solutions and workarounds. Phrase criticism in terms of "trade-offs" rather than emphasizing why something won't work. No solution is perfect, not even yours!