The ISO 15489 imperative: even organizations without RIM problems can benefit from an ISO-driven records management "health check".

At the Core

This article:

* Describes the business benefits from applying ISO 15489

* Explains how these can be communicated to senior management

Managing corporate records is not easy. In fact, numerous recent headline cases have brought to the public's attention the pressing need for a high-quality, standardized approach to records and information management (RIM). The highly competitive marketplace demands that companies are easy to do business with and efficient but flexible. Public bodies must meet the ever-rising expectations of their customers in the face of budget cuts and funding justification. The recently published international

standard ISO 15489 plays a crucial role in helping organizations meet their goals through best practice in managing their information assets.

ISO 15489 represents a major milestone for the worldwide community of people whose job it is to help manage corporate records. The standard is written specifically to bring significant business benefits through its implementation. One objective, stated in Clause 4 of the standard, is to "integrate records management into business systems and processes," thereby providing sources of information that can support business activities and decisions, as well as ensure accountability to all stakeholders.

ISO 15489 is not a "tick-the-box-for-compliance" type of standard. Its developers have recognized that the business drivers in private and public enterprises are quite different, that various sectors have differing information needs and widely varying business goals. Nevertheless, the principles and methodologies contained in the standard are equally applicable in the medium-sized charity, the small engineering enterprise, the global pharmaceutical company, or the European financial institution.

However, if RIM professionals want their organizations to adopt ISO 15489, they must prepare a business case that expresses those benefits in terms that CEOs and their colleagues can immediately relate to.

Business Benfits

In essence, a business case is a set of arguments, logically developed and supported by relevant facts, that is presented to management to enable them to decide whether or not to commit time and resources to a particular change in the way things are done. There are many ways of presenting a business case, and each organization probably has its own preferred style. A senior manager would expect to see information about why a proposal is being made, the costs and other resource implications, benefits, risks, how changes will be managed, and the timeframes involved.

The key issues for most senior managers are to increase revenue, improve quality, reduce costs, and manage risks. Management usually sees supporting services such as records management as yet another cost to be justified, minimized, or eliminated. Historically, the tendency has been to express the benefits of RIM programs in the form of savings on storage costs, fewer forms, and the like. ISO 15489, if applied intelligently to business, will provide not only an information and records "health check," but also

* identify opportunities to improve an organization's quality of services or products and, thereby, contribute to its profitability

* support efforts to reduce the organization's exposure to risks and, therefore, its potential for losses

The key stakeholders whose interests will be met by implementing the standard are managers who may not be familiar with the advantages of good records management or aware of the consequences of its absence--for example, the executive board, legal department, sales and production, and information systems. For each of these groups, which particular benefits would appeal and how could ISO 15489 help them?

The Executives

Charged with developing strategic vision, running the company, and being accountable for the results, executives are concerned about corporate governance. They need not only to discharge their duties in a fair and equitable manner, but also to be clearly seen to be doing so. Mark R. Moss, in his July/August 2002 Information Management Journal article "Spreading the Ethical Word," notes that

   Non-governmental organizations (NGOs)--Greenpeace, Amnesty International,
   and the Coalition for Environmen-tally Responsible Economies (CERES), for
   example--have exposed unfair labor practices, environmental malfeasance,
   and corruption, and multinationals are now well aware of their unrelenting
   scrutiny.

Obviously, any unfair practices should be changed, and ISO 15489 can ensure that appropriate records exist in the form of policy documents, procedures, guidelines, and directives as well as transactional records, which enable enterprises to clearly demonstrate that they conduct their business in an orderly, accountable, consistent, and equitable manner. Especially when such scrutiny is unfounded, a clear record of the company's conduct will provide the best defense.

Not long ago, Royal Dutch Shell faced adverse publicity concerning its plan to dispose of an offshore oil storage installation by dumping it deep in the ocean, some 150 miles off the northwest coast of Scotland. Today Shell is taking the initiative to advertise its environmental and social policies. Its Web site, shell, corn, includes information on its nine business principles. Each principle contains statements that are mirrored in ISO 15489 benefits, a clear indication of the standard's effect in achieving business goals. Shell publications, which highlight all initiatives and partnerships based on the principles, clearly indicate that the records of achievements are properly managed so that they can be turned directly into a means of defending and, indeed, promoting Shell's attitude of responsibility toward corporate governance.

Applying the principles of ISO 15489 can help organizations avoid expensive litigation or counter litigation. Moreover, the standard can offer protection against reputation damage by providing accurate evidence of activities. Adverse publicity not only affects stock value, but also the willingness of current and potential clients to do business with the firm, as the Enron/Arthur Anderson debacle illustrated all too well.

Many organizations enthusiastically seek ISO 9001 certification as part of their quality management initiatives, but may not have made the connection between ISO 9001 and ISO 15489. Johanna Gunnlaugsdottir, assistant professor in the Department of Library and Information Sciences at the University of Iceland in Reykjavik, writes in regard to ISO 9001:2000

   It has been my experience as a consultant in RM that organizations seeking
   to implement a certified quality system have often needed to introduce a RM
   program as part of their quality system. They have discovered that their
   quality system cannot function without a good RM program. RM has admittedly
   been the most serious missing link in making the quality system
   operational.

She states that not only was initial certification hampered by a lack of quality records management systems, but also that subsequent failure of RM systems proved to be the most frequent cause of things going wrong later, according to quality inspectors. She goes on to say that evidence indicates that similar experiences have been found in other countries where 60 percent of companies fail to win immediate recommendation for certification because of serious problems with document control.

Section 4:2:4 of ISO 9001:2000 and 4:16 of ISO 9000:1994 (as well as ISO 14000) specifically require certain characteristics for both records and recordkeeping systems. ISO 15489 shows how to meet those requirements and maintain them to ensure continuing certification.

The Legal Department

Credible records sustain defense in law. In the United States, companies wish to destroy records at the earliest opportunity for fear of discovery actions. In Europe, records often are kept for extended periods for fear of not being able to produce them in defense if and when required. Multinational organizations find this especially challenging. The standard assists with workable solutions by addressing the issues of responsibility and accountability, risk management, and records management processes and controls. It explains how to determine which records to create and capture, and how to determine the appropriate retention and disposal periods. It does not contain a long list of legislative requirements; rather it contains a methodology in Clause 9 that takes the reader through all the necessary decisionmaking steps.

Two recent cases in the United Kingdom highlight how important this is. In the first, the police investigated allegations of fraud regarding the British Museum's infamous South Portico, which was reconstructed with the wrong type of stone. The investigation focused on the contract between the museum and the stonemason who supplied the stone. A PriceWaterhouseCooper's report on the affair noted that there was, in addition to conflicts between the museum's governors and the project team, a lack of contemporaneous records of decisions made at the time and that the museum should have acted more swiftly to make checks.

The second example is the equally infamous Millennium Dome in Greenwich, London. The much-hyped but commercially disastrous celebration of the last millennium has attracted criticism from many quarters. Following its close at the end of 2000, operating costs continue to run at 78,000 [pounds sterling] (approximately $122,000 U.S.) per day. The London Financial Times reported that "closing the New Millennium Experience Company, the Dome operator, took more than 12 months because of the absence of adequate records, the National Audit Office says in a report." Incredibly, "a legally binding contract could not be found for 129 suppliers that had submitted invoices totaling more than 50,000 [pounds sterling] ($78,000 U.S.) between October 1998 and September 2000. The project, which consumed [pounds sterling] 628 million ($981 million U.S.) of national lottery money, has been a continual embarrassment to the government."

The audit office report says that there was often a "lack of transparency in contracting suppliers, allied to poor recordkeeping in general." It went on to describe a lack of basic controls including the absence of a detailed asset register. As a result, allegations of fraud have been hampered, and there has been an appalling waste of public funds.

While not as high profile as Enron, these examples emphasize the absolute necessity of operating "fit-for-purpose" records management programs that help prevent losses and support civil and criminal investigations. The standard shows how these controls, checks, and balances can be put in place.

Sales and Production

Although they are different parts of a manufacturing or service company, sales and production departments have--or should have--a common objective, namely to meet or exceed customer needs and expectations. Managing client relationships and responding to changing markets and customer requirements are underpinned by records systems that make the right information available to the right people at the right time.

McGonagle and Vella's article in the July/August 2002 Journal, "A Case for Competitive Intelligence," lamented the shortcomings of knowledge management (KM) and competitive intelligence (CI) systems, citing the absence of internally generated and available information that could be garnered from within the organization--from the sales force, for example. They note that up to 90 percent of all public data (i.e., the raw data that can be found within CI systems or that may be bought via subscription) can be found or developed from leads within the enterprise itself. They observe that very few CI units have developed effective ways of accessing that internal data on a regular and formal basis, and provide the following data:

* what customers are saying about competitors, and why they are switching

* who provides the enterprise with what goods and services, and who can be contacted for more current information

* what industry conferences have employees attended, what did they learned, who else attended, and what materials were distributed there

This is a very revealing set of observations. Most, if not all, of this immensely valuable information is either not recorded or is locked away in recordkeeping systems not accessible to others. Fortunately, ISO 15489 explains how to deliver benefits in full support of KM and CI systems by showing how to decide what records to create, aggregate, and summarize, and how to make them accessible to legitimate inquiries for sharing. Because it starts with and keeps its sights on an organization's mission and goals, the methodology will point to records that should be created and maintained to continue to provide maximum support.

Brand loyalty, as manufacturers know all too well, is affected not only by product performance but also by customer perception of the company, its activities, and its history. Some national retailers have used advertising, cultural, and social material from their archives to support marketing schemes, exhibitions, museums, and publications. Similarly, employees appreciate working for an organization that can provide evidence of its care for and interest in its staff. In-house publications can draw information from records of training programs, awards for excellence, successful projects, retirements, anniversaries, and so on--provided the organization created and kept the records of these activities and made them available over time.

The standard contains tools for analyzing organization processes with the objective of reducing unnecessary recordkeeping and making useful information accessible, thereby opening up opportunities to provide new records that more closely support the research and development, marketing initiatives, human resource, and general management decisions.

An Electronic Records Health Check

It is an unfortunate fact that the world's most popular suite of PC software products has almost no RIM functionality that meets the requirements of ISO 15489. In fact, many IT systems fail to deliver satisfactory records management solutions. They are there primarily to facilitate a user process, whether to pay insurance claims, create spreadsheets, write documents, or execute any one of a myriad business processes.

Electronic document systems can be quite effective when a well-defined workflow process is required. However, they are not strong on managing retention and disposal, corporate classification schemes linked to organizational taxonomies, thesaurus terms, and authority tables for indexing purposes. Even vendors of powerful searching tools have come to realize that completely unstructured data is less accessible than systematically categorized information--and some are adopting a "Yahoo"-style approach to the corporate memory.

Although electronic records management (ERM) is a relatively new and certainly challenging area, the standard provides a clear set of principles for e-records and e-records management. It predicates that the place to start is at the design stage, not after the system is installed. Even existing systems, however, can be audited against the requirements of ISO 15489 to ensure that performance does not compromise the real business-driven needs of recordkeeping systems.

IT project managers are much more practiced at presenting business cases than most RIM professionals. A need is identified and a solution proposed. Unfortunately, a recurring problem in many organizations is that the solution is based on a perceived need that is too narrow in its definition and that creates another set of problems further down the road. One example of this is the problem of the explosive growth of e-mail, which causes IT network managers huge headaches in managing their servers. As a consequence, several products have emerged that purport to manage e-mail. In fact, they manage the server memory problems by removing messages from the native e-mail system--which was never designed to be a long-term repository--and moving or copying them into a "vault." The vault may or may not have features such as a classification scheme, indexing ability, or retention and disposal facilities. These products do solve the immediate server problems but continue to isolate messages from other records that are part of the same business activity. It has been pointed out that they were not part of that process in the first place, and that is true because the e-mail system is only a communication device, not a recordkeeping system.

In this instance, the standard can assist with the consistency, continuity, and productivity in administration and management of the organization's affairs by providing a more holistic approach. Clause 9--RM processes and controls--can be used to provide a template to audit software products as well as existing systems. Each of the requirements can be turned into a question or series of questions, and in the context of the business function under consideration, the qualitative answers can be evaluated to see if the business needs, as well as the requirements in Clauses 7 and 8, are being met. Following this process and ensuring that errors and omissions are addressed can achieve the benefits offered in the standard.

Britain's e-government initiative, whereby government agencies must provide citizens with the opportunity to interact and request services electronically by 2004, has dramatically raised the profile of the RIM profession in that country. Several records management software products have qualified for Public Records Office approval, indicating that they have a minimum acceptable level of functionality.

Commenting on the importance of the new standard and the implications for e-government during a live link from Britain to the September 2001 Montreal ARMA Conference, Sarah Tyacke, the United Kingdom government's keeper of public records, said, "Good recordkeeping underpinned democratic accountability, as those of us who work in the public sector are particularly aware, but that good recordkeeping rarely happened of its own accord--it needed a management framework, and one of the strengths of this standard is that it focuses on the business interest in good records management and provides a strategic and holistic approach to it."

The place of records management in e-government and the integration of information sources and systems were very much the business themes of other Montreal conference speakers. The 2004 target was not an end in itself; it had been devised to ensure that government addressed its future electronic information needs and did not end up with a mismatch between the way services were delivered and the means for capturing the information needed for those services. It is clear that ERM is critical to effective e-service delivery; without it a modernized service delivery will not be possible. It may mean that

* Savings from online services could not be realized.

* Confidence of citizens that the information provided will remain unaltered and private will be jeopardized.

* Fraud will not be reduced.

* Efficiency and speed of service will not be improved.

In confirmation of the strategic importance that the U.K. Public Record Office places on this issue, it has formally adopted ISO 15489, which, as already noted, can be used to translate high-level aims and objectives into practical working systems--whether they be paper, electronic, or some as-yet-undiscovered medium.

Implementing ISO 15489

Other parts of the organization, such as finance, human resources, and facilities, also have issues and problems that vex them: compliance in a heavily regulated sector, data protection, compliance with freedom of information laws, and the new processes to enable access to records that legislation requires. Business continuity management and risk management have RIM components. Security, equipment obsolescence, discontinuance, and blending of systems following company mergers and acquisitions or reorganizations all call for quality records management input. ISO 15489 delivers international best practice drawn from many sectors and cultural backgrounds.

Meaningful support from senior management to implement the principles of the standard will come only in response to a well-developed business case documenting how the organization will benefit from applying ISO 15489, how risks can be better managed, and why resulting changes will be worth pursuing. In the first instance, this means considering what needs the enterprise has, how well they are currently filled, and what gaps remain. The eight-step methodology suggested in Part 2 of the standard provides an excellent framework to use and has a cross-reference section linking each step with the corresponding clause in the main body of the standard itself.

Even an organization that has no apparent or significant RIM problems can benefit from an ISO-driven records management "health check" as a way of uncovering new opportunities for developing the business and for improving existing systems.

References

Gunnslaugsdottir, J. "The Quality Must Be on Record: A Survey of Organisations Having an ISO 9000 Certification in Iceland." Records Management Journal, Vol. 12 No. 2, 2002.

McGonagle John J. and Carolyn M. Vella. "A Case for Competitive Intelligence." The Information Management Journal, July/August 2002.

McLeod, Julie. DISC PD 0025-2:2002. British Standards Institute: London, 2002.

Moss, Mark R. "Spreading the Ethical Word." The Information Management Journal. July/August 2002.

Records Management News. Conference proceedings. December 2001. Available at www.pro.gov.uk/recordsmanagement/information/default.htm (accessed 10 October 2002).

Bob McLean is Records Manager and Archivist at The Wellcome Trust. He may be contacted at R.mclean@ wellcome.ac.vic.