Integrating an ERDMS in an IT environment: as the U.S. EPA's experience illustrates, effective electronic records management solution must consider yesterday's, today's, and tomorrow's systems. (Lessons Learned).

At the Core

This article

* defines the key issues and strategies organizations must address to adopt an integrated ERM system

* discusses implementing an enterprise-wide, integrated electronic records and document management system (ERDMS)

* examines the EPA's ERDMS strategy

Many modern enterprises have decided to acquire electronic records management (ERM) capability. The U.S. Environmental Protection Agency's (EPA) recent experience highlights the key issues and strategies that enterprises must address in order to successfully adopt an enterprise-wide ERM system.

Although they originate from a U.S. federal agency, the issues and strategies examined in this case study are applicable to other non-federal and private sector enterprises as well.

The factors motivating an enterprise decision to acquire ERM capability vary and include:

* laws and regulations that dictate scrupulous enterprise records management

* enterprise architecture initiatives and capital planning and investment management processes that illuminate the potential corporate weakness posed by the absence of an ERM system

* fiscal or political crises such as bankruptcy proceedings or public scandals that spotlight severe records and information management (RIM) deficiencies

* intensive litigation that demonstrates the crippling costs of legal discovery arising from poor recordkeeping

* natural or manmade disasters that result in committing new resources to vital records protection and continuity of operations planning

Where E-Records Come From

An enterprise may begin with the naive assumption that it can simply acquire and deploy one of the many capable, commercial-off-the-shelf (COTS) ERM systems available in the marketplace today. However, this assumption may be quickly dashed because electronic records (e-records) originate from the enterprise's existing or legacy information technology (IT) environment. According to the International Organization for Standardization (ISO) definition, a record is "information created, received, and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business." Legacy systems can include:

* electronic document management (EDM), including workflow applications

* electronic mail

* correspondence management

* image management

* Web content management

* database management

* case management

* customer relations management

* word-processing, spreadsheet, and database applications

Each legacy system in the enterprise's IT environment represents a multimillion-dollar investment and generates e-records. While managers understand that not all digital files in legacy systems are records, they know that some percentage, however small, are records. As many managers know, these e-records must find their way into an ERM system in order to protect the enterprise against risk and to facilitate efficient future access and retrieval of important information. Consequently, ERM systems integration and compatibility must be considered for legacy systems. Managers also may recognize that any future information system must be designed so that the e-records it generates will come under the ERM system's control.

Therefore, a key issue when acquiring an ERM system is how it will integrate with legacy and future information management systems. An enterprise that has invested millions of dollars in a smoothly functioning e-mail or word processing application must ensure that any planned ERM system integrates with its legacy systems.

Additional strategic and tactical issues include whether to embrace a single enterprise-wide ERM solution or to allow multiple interoperable solutions. Factors that will influence these decisions include product selection factors, the need and ability to organize enterprise records in the electronic realm, system user-friendliness issues, the need for employees to acquire the skills necessary to operate the ERMS, and planning for rollout.

The EPA Case

The EPA's mission is to protect human health and safeguard the natural environment--air, water, and land--upon which life depends. Within the EPA, the Office of Environmental Information (OEI) helps ensure that the agency collects high-quality environmental information and makes it available to Americans so that the public and policymakers can make informed decisions about the environment.

OEI manages information in support of the agency, aiming to improve data integrity and access through good RIM practices. The EPA is institutionally aware of the importance of records. Using the Situational Factors model elaborated upon in the National Archives and Records Administration-sponsored Report on Current Recordkeeping Practices Within the Federal Government, the EPA ranks high on the factors motivating agencies to pay careful attention to their RIM programs: threat of litigation, number of Freedom of Information Act (FOIA) requests, and the amount of public scrutiny given its policies and practices.

The EPA's goal is to implement an enterprise-wide, integrated electronic records and document management system (ERDMS) to manage documents and records throughout their life cycle, (i.e., collection, management, maintenance, and preservation). This integrated system will be able to manage, in a legally acceptable electronic manner, any electronic document or record that supports the agency's mission. The system will enhance the retrieval of information in response to electronic FOIA requests and incorporate means to protect privacy and other sensitive information. The system will be centrally managed and user friendly. By centralizing agency records into an integrated electronic system, OEI expects that the time and cost devoted to fulfilling FOIA requests will decrease, agency data will be more easily accessible to the public, and the public will be able to provide input into the agency's decision-making process in a more efficient "e-government" interaction.

Issue 1: How Will the ERDMS Integrate with the Organization's Existing and Planned Information Management Systems?

The foundation of EPA's proposed ERDMS is an electronic document and RIM system with version management, workflow, and storage capabilities. Once a document or other information object, such as a database, image, or Web page, is designated as a record, it comes under the control of the integrated ERM application, which has electronic records scheduling and disposition capabilities. This integrated system will manage any electronic document or record that supports the agency's business in accordance with the EPNs record schedules.

The EPA previously had documented functional requirements for ER/VI principally by adapting DoD 5015.2 specifications to the agency's environment and adding some specifications idiosyncratic to the EPA.

The agency engaged SRA International to provide consulting support for its ERDMS project. The SRA team's first task was to determine if the EPA's ERM functional requirements were sufficient. To accomplish this, SRA conducted interviews with the EPA staff and examined other federal agencies' ERM system requirements development efforts. The team then moved on to functional requirements for EDM and other systems. Here the team relied on work previously carried out by other EPA contractors and literature sources to determine the adequacy of the EDM requirements. SRA's resources included the final report of the EPA's National Administrative Systems Evaluation Study and The Response Management Pilot Project EDM/DRM Functional Requirements Document.

The exercises yielded the EPA's functional requirements for its ERDMS. The EPA/SRA project team then turned its attention to developing integrated functional requirements for ERM and EDM systems. The project team approached the integration question by combining the two sets of ERM and EDM functional requirements into a tabular format below. From this table, the team could identify which functional requirements were unique to ERM or EDM systems and which were common. The common functional requirements became the major focus of interest because they represented the metadata channel across which the two systems will interoperate.

The ERDMS also must process FOIA requests by querying to locate, retrieve, screen, and respond with documents deemed to be legally releasable at any point in the information object's life cycle. In order for an e-FOIA system to function effectively in an ERDMS environment, the e-FOIA system must be functionally integrated into the environment.

Because the EPA uses WordPerfect for word processing and Lotus Notes for email, it stipulated that any ERDMS solution must integrate with these legacy applications. In addition, various components of the agency already had acquired other document management systems that represented substantial investments and had to be considered in the EPA's selection of an ERDMS.

The EPA identified several limitations in its existing, information processing systems that it believed any ERDMS should address. Those limitations were:

* Currently, when EPA employees create an electronic document, they typically do not have software to control versions, workflow, and storage of the document. If an office has such a software tool, it is often inadequate in identifying documents that become records, so these could be stored for inappropriate amounts of time and not associated with records schedules.

* A document determined to be a record may be stored in a variety of separate systems, each of which must be searched to locate the record.

* Many offices have systems to track the location of paper records, but few have a system to maintain and schedule records in electronic form. Instead, employees must print electronic documents such as e-mail, causing significant paper generation and burdensome procedures to search, retrieve, and even re-use materials.

* Electronic materials such as databases and Web pages are not captured in recordkeeping systems in a consistent manner, if at all.

* When FOIA requests are received, the process of locating and sending information is largely manual. Subject matter experts must search manually for information in a variety of physical repositories, causing a backlog in requests.

* Problems such as incomplete FOIA responses, sending the same document with different redactions ("blacking out" unreleasable information such as personally identifiable data), poor use of previously requested materials, and poor maintenance and tracking of retention of materials sent to requestors occurs with unacceptable frequency.

* The EPA does not have universally accepted procedures for ensuring that FOIA responses reach the agency's e-FOIA Reading Room Web site.

Issue 2: One Enterprise-wide System or Independent ERM Systems?

Enterprises that have decided to adopt an ERDMS can implement their decision under a variety of system architectures. The project team explored three strategies: (1) one agency-wide ERM application and EDM application; (2) one agency-wide ERM application with multiple EDM applications; and (3) multiple acceptable solutions. These strategies were assessed against the ability to

* manage records--classify agency material appropriately, and retain, destroy, and perform records accession at the correct time

* manage documents--efficiently create documents (including collaboration)

* minimize--maintenance burden on IT staff and leverage knowledge of applications within the agency; long-term maintenance and upgrade costs; and short-term purchase and installation cost

* align with current EPA culture--promote a feasible solution for the EPA enterprise environment from end user and system owner perspectives

* enable disaster recovery--recover agency records and documents on- and off-site

After weighing the pros and cons, the EPA decided to pursue a single, agency-wide ERM and EDM application. Although this will be the norm for the agency, exceptions may be made under the following conditions:

* a program's ERM must be funded in a way that requires separate financial accountability (e.g., under a specific Congressional requirement)

* there is an urgent need, such as national security, for an ERM to be implemented prior to the availability of an agency-wide system

* the ERM has unique functionality that cannot be supported by an agency-wide system (e.g., integration with non-supported hardware or software)

* there are security requirements that prevent the storage of classified data in a centralized system

Issue 3: Product Decision

To assess and evaluate the many available COTS ERDMS products, the project team combined the ERM, EDM, and e-FOIA requirements into master tables, functionally organized into the types shown in the first column of the table format on page 56. The team then grouped the requirements into functional criteria against which the products could be judged. The criteria were developed so that:

* each requirement was mapped to a criterion and served as a basis for scoring how well a product met that criterion. Products could thus be compared and contrasted at a moderately detailed level.

* additional criteria not based on the requirements document could be incorporated. For example, there is no requirement pertaining to system cost, but cost will be an important factor in the selection process.

* the relative importance of features as determined by EPA stakeholders could influence the product recommendations. For example, if XML import/export was twice as important as a Web-based application, products that have better XML import/export tools would have greater influence on the overall recommendation.

The detailed requirements served as the basis for developing the COTS evaluation criteria. From a total of 451 requirements, the project team identified 13 top-level evaluation criteria. SRA also developed an additional nine criteria that are useful "decision factors for selecting products" based on ease of use; scalability; deployment factors, such as cost of professional services, training, and implementation time; market presence, defined as whether the product is currently used by the agency; vendor viability; and other federal agency implementations.

Issue 4: Conventional RM As a Prerequisite to ERM

The basic input information of any ERM COTS product is derived from the enterprise's conventional RIM program. This means that prior to implementing an ERM system, the enterprise must update its records inventories; records retention schedules, especially schedules for e-records; and file plans.

Like any other system, no ERM system can overcome the barrier of incomplete or deficient input data. A thorough and efficient RM program is an essential prerequisite to a successful ERM system.

Issue 5: Access Issues--Who Can See What?

An obvious benefit to a centralized ERDMS is increased information sharing--an agency can locate valuable information, re-use work products, and improve the efficiency and completeness of public responses. Many agencies have a mission to disseminate information, but not all information can be shared.

Most agencies recognize that privacy mandates require certain human resources and financial data to be kept under strict security control. Personal e-mail and labor union correspondence are also items that employees would not like to have made public. EPA scientists, in particular, value the protection of their work in progress. Unintentional or premature release of these materials could not only make an agency vulnerable to legal action but also could result in the loss of its users' trust. Therefore, when designing the ERDMS's file structure and access controls, it is vitally important to consult with agency departments and user groups.

Issue 6: Overcoming Barriers

Today, enterprises face language and cultural barriers between IT managers and records managers. RIM professionals have a poor understanding of IT concepts and structures and IT professionals have a poor understanding of RIM concepts and structures. Linguistically, the two groups frequently use the same terms to mean very different things. To an IT professional, a "record" may mean any computer file or object containing information in digital form. To a RIM professional, "record" has a very different meaning, one that connotes something admissible in a court of law.

Overcoming these barriers is essential to acquiring ERM system capability. For example, the RIM meaning of "record" necessitates the characteristics of authenticity, reliability, integrity, and usability. Therefore, IT systems used for RIM must be designed and operated to incorporate measures for ensuring the ability to prove in a court of law that the records are what they purport to be, that they are full and accurate representations of the facts, that they are complete and unaltered, and that they can be located, retrieved, presented, and interpreted.

Records managers must become educated in IT concepts to the point that they can intelligently question whether either custom-designed or COTS ERM systems guarantee authenticity, reliability, integrity, and usability of records. Conversely, IT professionals must become sufficiently versed in records management so that they understand and incorporate the necessary measures into IT systems architecture and operations.

Issue 7: Planning for Rollout

The EPA will implement its ERDMS in a phased approach. It designed the process to ensure product compatibility with the agency infrastructure, to test constructs, and to identify any needed process changes through business process engineering that would increase agency efficiency and effectiveness.

The ERDMS Strategy graphic below consists of five anticipated phases of implementation. Within each phase, subphases break out the implementation further to support a controlled rollout of ERDMS across the agency. A pilot will be part of the initial system development to minimize financial risk and test constructs.

The EPA's ERDMS Strategy

Phase 1: Initial System will provide basic out-of-the-box functionality to a specified set of initial users. The users' business processes will be reviewed to identify: 1) when and how the system will be used and 2) any necessary changes to the business processes to ensure successful use of the system.

Phase 2: Initial Integration will tie in key agency applications. The EPA will integrate the initial system with applications such as Lotus Notes e-mail and word-processing applications.

Phase 3: Integrated System will migrate some legacy EDM applications into ERDMS and integrate other legacy EDM applications. The decision to migrate or integrate will be made by regions or program offices following EPA-wide guidance. The agency-wide EDM system will be scaled to include migrated EDM applications. This phase also includes the rollout of ERDMS to regions and program offices that do not have a legacy EDM system.

Phase 4: Expanded System will integrate non-EDM applications with ERDMS. The expanded system will be integrated with applications such as human resources systems, scientific databases, and so forth. This phase will be rolled out to include the non-EDM systems consistent with the maintenance schedules of these systems.

Phase 5: Target System will complete migrations of legacy EDM applications, including some that originally were integrated into ERDMS. EDM applications will remain integrated only where the EPA determines that they cannot be migrated. This phase will be rolled out as the appropriate regions and program offices are prepared to do so.

Enterprises frequently approach ERM at an excessively practical level. That is, they begin with the notion of automating the manual processes of records management and proceed to acquire and pilot one or more ERM systems in isolated work units with varying degrees of success and failure. This grassroots approach has some merit because personnel acquire first-hand experience with ERM systems that will prove useful in larger-scale planning.

For ERM to become fully integrated into the IT systems environment of an enterprise, attention also must be paid to the macro-level policies and processes at work. Governmental and private-sector enterprises are focusing on enterprise architecture, for example, asking what role IT plays in pursuing the basic business lines of the enterprise.

The forces of increasing automation appear to be driving RIM toward becoming an IT function, a development that requires RIM to assert its basic reasons for existence within both the enterprise's fundamental business administration and its IT systems environment. Records managers know that when enterprises ignore RIM they court disaster and perhaps extinction, but all too often senior line and IT managers do not comprehend this basic fact.

Within the federal government, for example, recent laws and policy initiatives have placed increasing emphasis on capital planning and investment control for IT systems. To date, this emphasis has not included planning and management for the investments necessary to sustain and nurture ERM as an integral part of the IT systems environment.

To the extent that conditions in federal agencies are mirrored in the non-governmental world, enterprises must give top-down as well as bottom-up attention to RIM. Senior management must comprehend that records represent a function that underpins the survival and welfare of the enterprise and an integral element of day-to-day business operations.

Editors' Note: This article was drafted based on the authors' experience in providing consulting services for the Environmental Protection Agency. The views expressed in this article are solely those of the authors and not of the Environmental Protection Agency.

NARA Endorses DoD 5015.2 for All Federal Agencies

The National Archives and Records Administration (NARA) has endorsed the Department of Defense's DoD 5015.2-STD Design Criteria Standard for Electronic Records Management Software Applications for use by all federal agencies.

NARA took the step as part of the E-Government Electronic Records Management Initiative for which NARA is the managing partner. According to John Carlin, archivist of the United States, "We share the belief that a single standard with broad federal support will provide a consistent voice to the developer community identifying our baseline of functional requirements. Multiple standards may negatively impact E-Government objectives related to improving interoperability and consistent information assurance capabilities."

More information can be accessed at www.archives.gov/records_management.

Standards and Integration

In recent years, national and international electronic records and document management system (ERDMS) standards have emerged. For the U.S. federal government, the electronic records management (ERM) system de facto standard is the Department of Defense's DoD 5015.2-STD Design Criteria Standard for Electronic Records Management Software Applications. The DoD operates a testing and certification program for DoD 5015.2, and virtually all U.S. federal agencies require that any ERM systems possess DoD certification. The National Archives and Records Administration also recommends that federal agencies use DoD 5015.2 when evaluating and acquiring ERM systems.

The International Organization for Standardization (ISO) addresses ERM systems in its standard,/SO 15489-1: Information and Documentation--Records Management--Part 1: General. The European Commission has published Model Requirements for Electronic Records Management (MoReq). Recently, the U.K.'s Public Records Office published its updated ERM system standard and standards are available from other nations as well.

Standards development in the RIM field has significantly affected the software systems market. Some efforts have been made toward an EDM system standard, and several de facto standards for EDM systems are in use, including the Open Document Management applications programming interface. However, no recognized standards-setting body has endorsed and tested an electronic document management (EDM) standard to the extent seen by DoD 5015.2.

Integrated EDM/ERM Functional Requirements Table Format

                                                           Is this
                                                         requirements
          Type             Requirement      Text of       unique to
     of requirement         ID number     requirement        EDM?

Ingest
Workflow
Storage
Search/Retrieval
Redaction
Publishing/Disseminating
General
Management
System

                             Is this        Is this
                           requirement    requirement    Requirement
                            common to      unique to        source
          Type               both EDM         ERM?
     of requirement          and ERM?

Ingest
Workflow
Storage
Search/Retrieval
Redaction
Publishing/Disseminating
General
Management
System

References

AIIM International. Glossary of Document Technologies (ANSI/AIIM TR2-1998). Silver Spring, MD: AIIM International, 1998.

Entner, Diane. Requirements for Document Management Services Across the Global Business Enterprise. Silver Spring, MD: AIIM International, 1999.

European Commission. Model Requirements for the Management of Electronic Records. March 2001.

International Organization for Standardization. ISO 15489-1, Information and Documentation--Records Management: Part 1: General. Geneva, Switzerland: International Organization for Standardization, 2001.

National Archives and Records Administration. "Endorsement of DoD Electronic Records Management Application (RMA) Design Criteria Standard, version 2." NARA Bulletin 2003-03. 15 January 2003. Available at www.archives.gov/records_ management/policy_and_guidance/bulletin_2003_30.html (accessed 25 February 2003).

--.Report on Current Recordkeeping Practices within the Federal Government. 10 December 2001. Available at www.archives.gov/records_management/initiatives/ Report_on_recordkeeping_practices.html (accessed 25 February 2003).

"ODMA, The Open Document Management API" Available at www.infonuovo.com/odma (accessed 25 February 2003).

Patterson, Giovanna and J. Timothy Sprehe. "Principal Challenges Facing Electronic Records Management in Federal Agencies Today." Government Information Quarterly, vol. 19, no. 3 (2002).

Public Records Office. Requirements for Electronic Records Management Systems. United Kingdom: National Archives, 2002. Available at www.pro.gov.uk/recordsmanagement/ (accessed 25 February 2003).

U.S. Department of Defense. DoD 5015.2-5TD, Design Criteria Standard for Electronic Records Management Software Applications. 19 June 2002. Available at http://jitc.fhu.disa.mil/recmgt/index.htm (accessed 25 February 2003).

Lauren Fernandez is a senior member of the professional staff of SRA International Inc. She may be contacted at [e-mail].

J. Timothy Sprehe is President of Sprehe Information Management Associates, a Washington, D.C., management consulting firm. He may be contacted at [e-mail].