Stand & deliver: for records and information management professionals, now is the time for self-assessment, professional betterment, and business execution.

A court orders a federal agency to disconnect its computer systems from the Internet due to inadequate network security that could potentially allow a hacker to alter, delete, or move original government records.

The developer of a popular instant messaging (IM) software advises users that vulnerabilities in their product could expose computers running the software to security risks--potentially allowing remote access to records on company computers, even when the IM client is not being used to "chat."

A Venezuelan election is called into question long before it takes place when the opposition candidate asserts that the voting records captured in an electronic system can be manipulated.

It is a records manager's dream come true: executives are finally paying more than lip service to information management. A senior vice-president has even made recent inquiries to your supervisor about the records management program's status. After years of stagnant or decreasing records and information management (RIM) budgets and the inattention of senior management, your RIM program is getting the attention it deserves for the first time, and a bit more money has been made available to fund RIM initiatives. The IT department has even invited you and your colleagues to discuss Web records and the company's electronic communications policy, as they have finally recognized that storage and retention are not synonymous. Employees regularly contact your department with questions about what company records they need to keep and where they should keep them.

Who could have predicted it? RIM has gone from being the unwanted stepchild, relegated to the basement of corporate priorities, to the company rock star overnight. RIM, believe it or not, is red-hot sexy.

No doubt having a presence in the corporate spotlight has its advantages. But elevated status comes with newfound responsibilities and higher stakes. Being noticed and, therefore, subject to new levels of internal scrutiny from people who never paid much attention before should make you ask whether your RIM program is really good enough and whether your skills are ready for prime time. Can you really handle the host of serious and increasingly complex information management problems that confound your company?

Modern RIM issues have taken on a whole new meaning for companies today and most likely impact your organization in ways that even you may not fully appreciate. Are you prepared to take on these new challenges and develop the knowledge base required to add real value to the organization? Do you have the skills necessary to address retention issues that involve complex and evolving technologies? Are you prepared to work closely with the company's lawyers to deal with electronic records integrity issues that may have an impact on the company's ability to use its records as evidence or to aid litigation counsel in electronic discovery matters? Will you be able to advise business units on records creation and capture issues when electronic business transactions allow database entries to replace manually executed paper contracts?

Although RIM now matters to executives, lawyers, auditors, regulators, and judges in ways you could never have predicted, it may be a different RIM than the one you are familiar with. The records management of old that focused on the inventory, offsite storage, and retrieval of boxes of paper records has given way to a more dynamic discipline--information management compliance.

Your company and its executives expect and need you to deliver a comprehensive, compliant, and consistent RIM program that makes the business "faster, better, cheaper" and legally compliant. An effective program should provide at least a modicum of protection to the institution from the mistaken, reckless, or intentional missteps of its employees.

To do all that, RIM needs to be understandable to the employees, reasonable in design, proactively implemented and built, and managed with service-oriented professionals rich in new e-records management skills. Perceptions of the program as being complex and arcane have to give way to a new perception--that information management is valuable and doable.

The Business Environment Has Changed

It is the perfect storm. There are growing volumes of electronic information that are ubiquitously mismanaged by institutions in every industry. This exploding volume of e-content has great business value--whether the company's employees know it or not. And nearly every time information management practices and controls come under the scrutiny of regulators, courts, or the media, there is a new horror story illustrating just how woefully lacking corporate information practices really are. In a world where information is truly an asset, the mismanagement of that information is tantamount to mismanaging corporate assets for which executive after executive is paying the price. Simply put, trustworthy records and good recordkeeping promote accountability and transparency. Without them, executives and the companies they run are naked and exposed.

Given the seemingly unending array of high-profile news clips that have graced the newspapers for the past several years, it is becoming increasingly clear that the rules for information management have changed. There is evidence that organizations are trying to address these new challenges. A 2004 survey that resulted in the "Information Management Compliance: 2004 Progress Report" revealed that 80 percent of organizations have recently made or soon plan to make changes in the way they manage information. This is significant in that it suggests that deficiencies in the way organizations manage their information are being recognized and corrective action is being taken, at least to some degree. However, another way of interpreting the statistic is that much work still remains to be done. Indeed, according to the statistics, fewer than one-third of those surveyed believe that their organization has made real progress in modernizing and preparing their RIM program to deal with the new information management challenges. A mere 13 percent reported their organization had deployed an enterprise-wide approach to managing content.

All companies face new compliance challenges that have an impact on how records and information are retained, captured, created, preserved, transmitted, stored, indexed, found, controlled, protected, produced, and used. As illustrated in Figures 2 and 3 (see page 28), issues companies have not spent much time dealing with--issues that may even be out of your comfort zone--are driving information management today. Nevertheless, this is a good problem for records managers to have. It is better to be a bit overwhelmed than to be irrelevant.

Figure 2: Top 5 Factors Driving Industry-wide
Change in Information Management Practices

1. Issues discovered through compliance
auditing and monitoring

2. A regulatory action or penalty

3. Failure to find information needed
for a lawsuit, audit, or investigation

4. A lawsuit or court action

5. A security breach

Figure 3: Top 5 Information Management
Changes Planned or Already Made

1. Create new policies/update existing
policies

2. Conduct employee training

3. Conduct IM audits and assessments

4. Make a technology purchase

5. Change organizational structure

Source: "Information Management Compliance: 2004
Progress Report" Kahn Consulting, Inc. August 2004

www.kahnconsulting.com [c] 2004 Kahn Consulting, Inc.

In short, to get RIM right, records managers need to be able to deal with complex information management issues and related IT, legal, and business matters that now meet RIM at the crossroads. Records managers must be the RIM warrior their company really needs to turn the tide of battle.

A Multi-Disciplinary Approach

Due to storage limitations, the U.S. government's computer systems delete huge volumes of terror-related intelligence records before they have even been translated or reviewed.

Having spent billions of dollars to intercept communications from terrorists, it is unthinkable that the intelligence value of these investments was nullified when an IT professional purged the information before it was reviewed in order to make room for more data. Had they been consulted before the intercepts were destroyed, the business personnel (the agents in this case) and records manager most assuredly would not have allowed the destruction of state secrets (in the form of government records) due to an apparent lack of storage space. To the technology person, the content of these government systems was mere data whose value was someone else's concern. A team approach with input from legal, technology, the business process owner, and RIM could have made this disaster a non-event.

It is estimated that a government litigant will spend in excess of $2.5 billion in a large class-action suit--just to search for potentially relevant information pertaining to the case.

For years, certain government records were stored improperly and haphazardly--perhaps because no one anticipated the day when they would be needed. The agency that maintained the records was apparently mired down by ineffective information management and inadequate retrieval capabilities. The lawsuit referred to above and the real-life drama confronting the U.S. federal government concerns its failure to manage its records. Did the agency involved properly fund records management and involve RIM at the outset to ensure that its records were properly managed and could be found and accessed anytime they were needed? Clearly, the answer is a resounding no. As the government's RIM failures continue to come to light, they must now confront the daunting task of finding records required for the case that cannot be found. Indeed, the government's lawyers, records manager, and technology personnel all could have helped organize this information, but perhaps the business folks did not believe it was important enough to expend the necessary resources up front in order to save billions down the road.

These real-life scenarios are only the tip of a growing iceberg of issues that require input from records managers with insights and bolstered skills necessary to confront these new challenges and do what it takes to make it right.

What Are Records Managers Really Made of?

RIM has become a complex discipline that may continue to become more complicated as more and more business is done electronically, as technologies grow in sophistication, as volumes of information continue to spawn dramatically, and as new laws and regulations impose new mandates.

Today, to be successful as an evolving records manager, it is essential--at a minimum--to have a good foundation in four fundamental areas: IT, legal, business, and the RIM fundamentals. It is also critical that records managers' thinking about RIM continues to evolve and that they continue to learn and take on new challenges. An organization will still need old RIM skills--but these skills must be honed for today's business reality as records managers continue to develop new ones.

Are Your Skills Prime-Time Ready?

To determine your preparedness as a RIM warrior, answer the questions below. Be honest with yourself--your organization is depending on you to either possess or acquire the needed skills. If you find it difficult to answer the following questions, you may not yet possess the right tools to really get the job done in today's environment.

From an IT perspective, could you

* justify an information management software purchase on the basis of return on investment or total cost of ownership?

* advise the chief information officer (CIO) on how you intend to work with the IT department to get e-records management issues under control? Have you ever met the CIO?

* act as liaison to the IT department to help with recordkeeping issues related to new e-business processes as they come online? Do you even know about new information management problems affecting IT?

* advise the IT department on what functional requirements the organization needs in an information management application?

* help the IT department make decisions about system configuration to ensure adequate audit trails and log files to record company business?

From a legal perspective, could you

* help the organization's employees understand the difference between information, records, and evidence and what the courts expect the organization to preserve once it gets notice that a lawsuit has been commenced? Do your current RIM policies make clear what information employees need to retain as records?

* help the business units understand (with the help of lawyers) how regulators expect e-records to be managed?

* guide the business units in what records to retain when they use "click wrap" agreements to do business? Do you even know what a "click wrap" agreement is and that they create complex recordkeeping issues?

* train the executives about the information management implications of the Sarbanes-Oxley Act?

* help the lawyers notify employees of the need to preserve information through their formal records hold procedures?

From a business perspective, could you

* bring your RIM initiatives in line with the chief executive officer's top-five priorities for the coming fiscal year? Do you even know what his or her priorities are?

* help the senior executives attain their coming year's business goals through any information management activities that you have planned?

* assist with company profitability through any of your work this year?

* convince employees company-wide that they are really your internal customers for whom you plan to develop and implement better information management processes?

Do You Need Information Management Boot Camp?

If you are not yet equipped to deal with today's RIM problems, you need to make a greater investment in yourself and take the time to retool your skills. No one expects records managers to be lawyers, business executives, or technologists, but they definitely need to have a basic understanding of their worlds and the things that matter to them. After determining what your skills are really worth, commit to bettering what you can do for yourself and your company. Going forward, you must take the following steps in order to acquire the skills you will need to be able to really make a difference.

Build Your Technical Knowledge

Information technology is now central to the way that organizations do business. As a result, they create information in greater volumes and of greater value than ever before--information (some of which would be considered records) that must be controlled and managed.

Which one of these challenges will you take on this year to help your organization get it right?

* Develop training to further implement the RIM program to address e-records and various types of computer output.

* Provide procedures to ensure employees know what data is considered a company record for records retention purposes.

* Work with IT to build system requirements to retain company e-records.

* Educate the IT department on building trustworthy e-records.

* Acquire technology to help with information management.

* Cost justify RIM, document management, and electronic content management purchases.

* Evaluate and research new technologies that can address e-records-retention issues.

* Review IT and information security best practices and industry standards to augment control around electronic records.

Build Your Legal Knowledge

So much damage to reputation and company stock valuations has flowed directly or indirectly from mismanagement of corporate information--whether it is destruction of evidence, not being able to find a contract to support the company position, or having to make huge efforts just to find the records relevant to a formal proceeding. Also, so many new laws and regulations have an impact on the way that information must be managed, and it is critical that you understand the legal fundamentals as well.

Which of these tasks will you take on this year to help your organization?

* Communicate to and educate the employees about legal issues that have an impact on information management.

* Work with the law department to translate new legal requirements into technological reality to ensure proper storage, transmission, and management of e-records.

* Simplify retention rules so employees can quickly apply them, but make sure they are based on legal requirements and business needs.

* Build a compliance methodology into your RIM program and develop audit criteria to ensure RIM policies and practices are being followed by employees across the enterprise.

* Help ensure that RIM rules are consistently applied to all business units.

* Learn about the new laws and regulations that have an impact on the way your organization manages its information.

* Help devise a legal hold procedure or a litigation response plan.

Manage RIM Like a Business

A critical challenge to RIM has been--and continues to be--finding and building support for the program. By learning how to think like an executive and how to speak the language of business, records managers can help ensure that RIM is addressing critical business goals and running the program like a business, providing value-added services to internal company "clients."

Failing to consider the business drivers of RIM will have an impact on your ability to align your program services with company needs. You do not live in a RIM ivory tower. You should recognize that your department provides a valuable service to customers that need help--just like the law or IT departments. Make sure your activities can be cost-justified and your program is business-savvy. Executive leadership is much more likely to view your services as "value-added" when you are able to articulate and demonstrate how RIM will have an impact on the bottom line.

Which one of these tasks will you take on this year to help your organization get it right?

* Learn what the business executives seem as the major corporate objectives for the year and build those expectations into your program.

* Position RIM and information management initiatives as advancing core business objectives.

* Assess current RIM projects or initiatives against stringent business criteria to determine where to put limited resources.

* Find a business unit champion for the program.

* Align the information management initiatives with the organization's high-level goals, values, and interests.

* Market RIM successes across the company through ongoing education and a monthly e-newsletter.

* Learn how to demonstrate the business value of information management activities.

* Apply real management discipline to the RIM department.

* Develop a change-management process.

Now Is the Time

Opportunities to transform your career do not come every day. Profound resurgence of interest in information management activities will not last forever. At the intersection between corporate governance and harnessing the information explosion sits an incredible opportunity for which records managers are uniquely positioned. But these demanding times require business- and compliance-driven solutions that incorporate legal, technical, and business interests as well your own. The choice is yours--learn, transform, and execute--or get left behind. In this moment of heightened RIM interest when records managers finally have the opportunity they have been waiting for, it is time to stand and deliver. If you do not, someone else will--whether you like it or not.

At the Core

This article

* examines the role RIM plays in the business environment today

* lists the top-five factors driving industry-wide change in information management practices

* discusses the skills records managers must possess

Figure 1: Planning to Make Major IM Changes
(as a percentage of respondents)

Yes:   80%

Note: Table made from pie chart.

Randolph A. Kahn, Esq., is an educator, internationally recognized authority on the legal, compliance, and policy issues of information management, and author of dozens of published works, including Information Nation Warrior, Information Nation: Seven Keys to Information Management Compliance, and E-Mail Rules. He may be contacted at [e-mail].