The New International Records Management Standard: ITS CONTENT AND HOW IT CAN BE USED.

AT THE CORE

THIS ARTICLE EXAMINES:

* the content of the first international standard for records management

* how it can be used for assessment

* how it can impact an organization's business plan

Earlier this year the world voted on and approved a final draft of the first international standard for records management, formally titled ISO 15489-1: Information and Documentation -- Records Management -- Part 1: General. Committees from more than 80 countries reviewed and commented on the draft that had been several years in the making. Soon to be published by the International Organization for Standardization (ISO), this standard is a normative document that sets the parameters within which a records management program should be established, regardless of the size of the enterprise, the type or location of the organization, or the level of technology to be used. It describes how records programs should be established, how they may be structured, and how they may be monitored and audited. It also identifies the benefits that can be achieved. For the first time, records managers will have a widely accepted standard against which to evaluate and improve their programs.

The international records management standard is to be supplemented by a more detailed technical report, ISO/PDTR 15489-2: Information and Documentation -- Records Management -- Part 2: Guidelines. Although still under development, ISO TR15489-2 will be an informative document, giving a specific useful -- but not mandatory -- methodology for implementing and complying with the standard.

ISO 15489 is meant to comply with other relevant international standards, such as the ISO 9000 series of quality management standards and the ISO 14000 series of environmental management standards. ISO 15489 cautions that organizations should make use of related national standards and the records management legislation that apply in their jurisdictions.

The records management standard is substantially different from AS4390, the Australian records management standard on which it is based. For example, it reflects the multiplicity of approaches, methods, and practices used in the global workplace. In the past 50 years, a number of related but less comprehensive approaches and de facto standards have been developed by individual countries, including the United Kingdom, the United States, Canada, and Australia. (In fact, ARMA International has published two American national standards, Alphabetic Filing Rules and Glossary of Records Management Terms.) All of these have had a degree of impact on governments and major corporations that have followed these initiatives. Now, however, technical committees from all over the globe have banded together to develop the first common standard for records management. This is truly a milestone in records management history.

Impact of the Standard

What will be the immediate effect of ISO 15489? Will there be a sudden growth in records management programs? Will there be an increase in resources allocated to records management? Will there be more staff with raised profiles and increased salaries? Perhaps not.

Too often records management staff look upon policies or standards as levers to stimulate what they perceive to be listless management or line staff. In some cases, such documents are used for little more than gaining compliance from those unstirred by promotions of records management initiatives. A program that has to rely on enforcement, however, is likely doomed to fail. Records management is most often successful where its users have understood the benefits of a program and chosen to follow the concepts and principles of records management for their own self-interest in areas such as litigation support and operating cost reduction.

Published over the last two decades, the ISO 9000 and ISO 14000 standards have strongly supported maintenance of quality and environmental procedures with their emphasis on uniform and effective documentation. Newer versions of them have increased the visibility and importance of standards for recordkeeping. The result of their implementation in many organizations has been either more reliable manufacturing of products or more consistent provision of services. In some process-driven organizations, especially in the manufacturing sector, improvements have been made. But, for the most part, the practices defined in these standards have little to do with what is an ever-mounting information-driven marketplace populated by governments, insurance companies, banks, educational organizations, and others. Many records management professionals, especially those working for multinational organizations, have embraced these standards wholeheartedly. An endless parade of seminars and technical papers has been sold to records management professionals. We must remember, however, that standards lend legitimacy to programs that follow them; they do not confer it.

Content of the Standard

In its latest form, the standard has two parts: 1) a high-level description of the broad principles and requirements of records management programs and 2) a technical report that outlines a variety of possible procedures and practices that comply with the standard.

The need for two documents arose from discussions during the writing of the first draft, which then combined many of the "thou shalts" with suggested implementation methods. With many countries participating, however, it was soon obvious that there were a number of diverse -- yet acceptable -- approaches to establishing records management programs. For example, many European countries focus on archival concerns; programs develop in different fashions accordingly. New Zealand, for instance, is one of the countries that does not espouse the concept of the records continuum (that records have value and must be managed at all stages of their existence). This is a precept that has been prevalent in Australia and Canada for several years. Likewise, definitions of terms vary from country to country. In fact, no agreement could be reached on a term for what in Canada is called "retention and disposition programs." As a result, one ISO 15489 section is titled "Determining how long to retain records."

Accordingly, a German proposal was made to split the document so that the standard would remain a high-level policy document usable by all countries, while the technical report would serve as a non-mandatory implementation guideline. This would allow organizations to be free to take guidance from the technical report without being bound by specific methodologies for establishing a records management program satisfying the standard's requirements.

Parts 1-3: Scope, Normative References, Terms, and Definitions

There are 11 parts to the standard. These divisions are also reflected in the technical report. The first three parts ("scope," "normative references," and "definitions") are introductory in nature. The scope indicates that the standard is to be used by both public and private organizations to ensure adequate recordkeeping (i.e. creation, capture, and management of records). The normative references link existing allied ISO standards. The definitions section provides a common reference point for technical terms (e.g., "archival authority" and "action tracking").

Many organizations may find that their internal definitions are more detailed than those in ISO 15489. The simple reason for this is that definitions shaped to apply to organizations in more than 100 countries by necessity must be at a higher, more general level than is necessary in single organizations.

Part 4: Benefits of Records Management

The first significant segment of ISO 15489 concerns the benefits of records programs. Many records managers express concern that it is difficult to explain to management why accurate and efficient record-keeping is important. In a succinct page, the standard lists the benefits to management of establishing -- and nourishing -- a vigorous records management program, one that complies with ISO 15489. Such a program should improve, among others, the following areas:

* service delivery

* policy formulation

* managerial decision making

* continuity in the event of a business disaster

* regulatory compliance

* litigation support and risk management

* maintaining the corporate memory

Parts 5-6: Regulatory Environment; Policies and Responsibilities

The first section here deals with understanding the regulatory environments -- including laws, regulations, and codes -- in which organizations find themselves, as well as the establishment of policy and procedure frameworks necessary to assist the development and maintenance of a records program.

The regulatory framework may include national or international statutes or codes; best practices; codes of ethics or professional responsibility; and national or local standards. Most records professionals will recognize this framework as the basis for establishing minimum records retention periods, but the larger intent is for records programs to follow such standards in all aspects of the program -- not merely disposition. For example, a country's legislation on digital signatures or electronic record-keeping should influence internal components of the records program dealing with records capture and use.

The policy and responsibilities sections broadly define the content of an overall records policy and how responsibilities should be allocated within a program. Often, organizations have included a broad records policy as well as specific policies on e-mail, Internet use, and electronic records management systems. The technical report does not offer samples of these policies, so some organizations may find this section is of limited use. A set of linked policies is desirable, and the roles of executives and systems administrators are noted.

Part 7: Requirements

This section will be of considerable value in that it defines the principles or basic functions of a records program. It lists such functions as

* determining records needed for each business process

* formatting of records and media selection

* establishing metadata and links

* managing records retrieval and distribution

* managing risks (e.g., business continuity)

* managing preservation of records

* managing security of records

* managing retention of records

If a records program is involved in only a few of these functions, it is reasonable to assume that under the standard the program will not be effective. This segment also defines the basic duties of a program manager.

Included is a further definition of the characteristics of a record. Sections 7.21-7.24 take the traditional view of the physical record a step farther by addressing authenticity, reliability, integrity, and usability. Records programs must be able to assure each of these four characteristics with respect to each records series in use by the organization. The utility of each record is key to good business practices and efficiencies, while the other characteristics are crucial to ensuring the legality of documentation and the accuracy of the corporate memory.

Part 8: Design and Implementation

The next section contains a list of strategies that may be used in developing and implementing records systems. It defines the characteristics of a records system as including the following:

* reliability -- accuracy and immediacy of recordkeeping

* integrity -- control systems, especially with respect to electronic recordkeeping

* compliance -- regulatory expectations

* comprehensiveness -- covering the complete range of business activities

* systematic creation and maintenance -- policies and formal methodologies

It also includes a listing of the functions to be covered in a records system (e.g., documentation, physical storage medium, distributed management, access and retrieval, use, retention, and disposition).

One section (8.4) also outlines a possible high-level, nonlinear methodology for the design and implementation of such systems. Fortunately, there are additional and specific suggestions for this section detailed in the technical report. Some organizations believe design of systems to be a clerical activity, a function akin to sorting an existing file list in search of common titles. This section should disabuse people of the notion that system design is easy and rapid. Inherent in design are preliminary investigation, business activity analysis, recordkeeping requirements, identification, systems assessment, and strategic plannings in addition to the actual design and implementation of the system.

A final segment deals briefly with decommissioning of records systems. It also mentions conversion and migration, but for a very complex part of records program management, this explanation is not as comprehensive as it perhaps should be. Unfortunately, the technical report fails to address this in any further detail.

Part 9: Processes and Controls

This is the largest section of the standard. It includes broad descriptions of each of the processes necessary for an effective records system. In essence, it provides an outline of a records-system procedure manual. The technical report divides this section into instruments (activity classification, disposition authority, security, and access classification) as well as processes.

The component areas are

* determining which records are to be captured

* determining retention

* capturing records

* registration

* classification

* storage

* access

* tracking

* disposition

* documentation

Identification

A key component of determining which records are to be captured is the determination of accountability of the organization and the organization's knowledge of its regulatory environment. More precisely, the section refers to "business or personal actions" that should be captured as records when they commit an individual or an organization to action, render someone or the organization accountable, or document an action or decision.

This wording provides clear criteria from which to determine if records are "transitory" or "official." Liaison types of files or reference files may "render someone accountable." These are the "I-told-you-about-that" records often considered to have short-term retention.

Retention Determination

Here there are broad concepts to be used in determining retention periods. There have been many books and articles about determining retention periods, especially with respect to the legal questions surrounding disposition. The standard does not seem to reflect recent discussions with respect to electronic records. It is clear, however, that records should be kept to meet current, legal, and future business needs and, finally, to meet current and future stakeholder needs.

ISO 15489 explicitly does not address archival issues. Yet it reflects here an archival bent by identifying types of records that could have continuing value and, thus, longer retention. Such records series would include evidence of policies or actions, evidence or interaction with a client community, documentation of individual or organizational rights, corporate memory retention for scientific, cultural or historical purposes, and, finally, evidence of actions of interest to stakeholders.

Capture

This segment outlines the need for informal or formal processes for records capture so that records are identified as to creator, recipient, and business context. It goes on to define different methods for records capture including

* classification and indexing

* use of structured and logical groupings (a schema)

* registration systems

* profiling or metadata systems

Many are not convinced that they need to contribute a considerable effort in the area of records capture. Staff in organizations, for example, are a bit reticent about contributing information towards indexing, profiling, or identifying the records series in which their documentation should be kept. In part, this arises from the pace of business that leads people to reduce time spent on what they see as administrative tasks. Too many people in organizations may see records capture as just a formal term for pitching their documents into a tray marked "to be filed."

As businesses and governments become even more information oriented, people must be convinced that document capture is important and that those who create documents must play a role in managing them. Not only do people always have a responsibility to help assign a document's location in the corporate schema, but additional information is now needed to help the organization develop a better corporate memory, both paper-based and electronic.

Registration

Registration provides evidence of a document's transmission or receipt. Registering all documents can be a time-consuming exercise for support staff when organizations are trying to keep administrative costs down. Registering junk mail, magazines, and transitory documents, for example, has little value.

But although uncommon, registration systems can be of value (e.g., to manage court records, medical records, or even time-sensitive applications). In such cases, registration should be encouraged. Experience shows that many of these registration systems are eventually incorporated in more complex databases that provide functions other than tracking (e.g., statistics, work regulation, research, and workflow).

Classification

The standard provides detail on classification systems and processes. Although it stops short of espousing one system over another, it encourages functional hierarchies and warns against using organizational divisions as part of the schema. Unfortunately, this can be counterproductive when an organization is firmly structured by business function.

Since such hierarchical systems have been in increasing use for the past 20 years, there should be little difficulty in organizations moving to structures that meet this standard. Schema based on function-activity-transaction appeared in the United Kingdom in the late-1970s. Since the early-1980s, governments and even some private sector organizations in Canada have moved to strong function/subject-based hierarchical schema. In the 1990s, Australia moved to adopt stricter functional schema.

However, the need for "hierarchy" means that some functions will be given dominance in the schema and that groups of functions will still be needed -- depending on the business of the organization. Also, the concept of common functions is not well addressed in either the standard or the technical report. Nor is a strict hierarchy of much value in matrix-based or team-centered organizations. Accordingly, organizations should be careful in taking adherence to the principles of functional classification to extremes.

The standard does identify a number of benefits of having a hierarchical system including

* consistent naming

* easier provision of security and access

* distribution of responsibility

* accountability for managing groups of records

* assistance in the definition of retention periods

The standard identifies other classificatory tools, such as indexing, vocabulary controls, numbering, and coding. Indexing appears to be an ISO 15489 requirement, whereas vocabulary controls and numbering are options. But one should assume that self-indexing or alphabetical schema could meet the requirement of the standard without an indexing system per se.

Storage

This section offers a very high-level view of storage and handling requirements. It indicates that records storage concerns arise throughout a record's existence -- not merely when it becomes inactive. Also, there is special reference to the need for media-sensitive storage requirements (e.g., for microforms, electronic, or optical media). Development of migration strategies for long-term electronic records storage is encouraged.

The technical report goes into some detail regarding storage facility requirements and the values that should be taken into consideration when selecting records storage equipment. First and foremost are risk management concerns. Other factors are

* costs

* physical characteristics

* security requirements

* volume

* growth rate

* retrieval needs

Omitted here are issues related to those supplies that may help in the protection, storage, or retrieval of records. Folders, binders, fasteners, and other supplies used to assist the organization in managing records will have a considerable impact on what equipment is chosen and even what long-term storage containers are used. Whether tapes or optical media are used to manage electronic documents will affect longer-term storage and even later data-mining applications.

Access

The standard has some important declarations about access restrictions. Records should be restricted only if there is a business need or a regulatory issue to be addressed. This articulation suggests that arbitrary assignments of security classifications should not be made. It indicates as well that security restrictions, if applied, should be in place for a specified time. There must be rules, then, for security classification as well as eventual declassification where appropriate.

Finally, the standard touches on encrypted records that must be readable when required and authorized. It is clear that managing security of hard-copy records depends on locked cabinets, locked file rooms, and security checks. Managing electronic records should, in theory, be simpler. Here user restrictions or directory restrictions that can be imposed through network controls would apply. However, with linked tools such as intranets, groupware, and geographical information systems, one should recognize that it may be complicated to ensure that security controls are consistent.

Most importantly, classification schema can assist organizations in managing such security provisions. Just as records groups have a records retention period, they could also have security classifications and specific periods in which these classifications are enforced.

Tracking

In the standard, tracking refers to both action tracking and location tracking. Location tracking or loan systems involving manual, bar code, or radio-frequency charge-out systems are more common in offices, while action tracking is often an extension of the registration functions previously noted.

ISO 15489 indicates that action tracking may be used where time limits are imposed by or on an organization. Tracking should encompass who is accountable for the action and when specific actions are to take place. Workflow software can assist in managing this type of records function.

Location tracking is necessary to ensure record accessibility. It should include issuance, transfer, and return to storage of any record within the system. Most offices use manual systems of ledgers, re-usable loan cards, or forms. The trend in large file rooms, however, is towards use of lending software to automate the process.

Disposition

Here ISO 15489 is very specific. Disposition processes must be systematic and routine; destruction may not take place until there are assurances that there is no further need for the record, no outstanding work on it, and no relevant litigation pending. This is a clear signal to organizations to include this precept in their final "consent to destruction" documents.

Disposition refers not only to destruction but includes

* extended retention

* transfer to internal storage

* transfer to another medium

* alienation

* transfer to a storage provider

* transfer to an internal archive

* transfer to an external archive

* transfer of management accountability while retaining the records in the same storage site

This last may seem unusual, but in some situations, such as when companies change hands, it may be more efficient not to pay the so-called "hostage" or deletion fees and let the retention period of the records in storage run out. A simple contractual agreement or protocol agreement between organizations can allow for this. Reference is also made in the standard to providing adequate security of destruction for confidential records. And needless to say, effective destruction of confidential electronic records is also included.

Documentation

This section seems to refer to established policies and procedures that document the regulatory environment of the organization. The emphasis, however, is on maintaining documentation of disposition processes.

Special mention is made of documenting the decisions surrounding the assignment of closure rules and years of retention for records series. Experience has shown that while many organizations establish retention periods, they neither provide citations to the regulatory documents that influence the decision nor do they document the discussion or rationale for selecting or extending a retention period. When it comes time to review retention periods, it is useful to have a narrative description of, for instance, why five years was selected over a regulatory requirement of two years.

The standard also indicates that instructions for media migration should be included in disposition schedules and that records of disposition activities be maintained. The standard further encourages establishment of an authorizing or reviewing body external to the organization where possible.

Part 10: Monitoring and Auditing

The standard indicates that compliance monitoring is an essential component of any program. It notes that records processes and controls must abide by internal policies and procedures and that they are meeting "anticipated outcomes." A further requirement of monitoring is an assessment of user satisfaction and organizational performance.

The technical report refers more specifically to benchmarking or establishing measures of performance as well as ensuring evidential weight of records in the event of a court case to prove the authenticity and accuracy of records, as follows:

"The records managers ... have readily available evidence to demonstrate and prove the organization's compliance with legislation, policies, and procedures throughout the life of the system. This evidence would be available from records of the monitoring and auditing of system processes" (ISO TR 15489-2 Draft 2000).

Part 11: Training

A very brief reference is made to the need for training all staff whose work involves making or capturing records. The technical report refers to the need for records staff who are qualified professionals -- or those trained by them -- to train employees to the level required. Training may encompass

* classroom training for employees

* the organization's employee orientation programs and documentation

* on-the-job training

* briefing sessions and seminars

* leaflets and booklets

* computer-based presentations

* training courses provided by educational institutions

Using the Standard for Assessment

The standard is of such value that all records management professionals should find ways to make use of it, and there are a number of ways to take advantage of it. The most obvious use of the standard would be to measure the relative effectiveness of one's program against a widely supported international standard. A second use would be to ensure that one's management is fully aware of all the benefits that a records program can offer. Often, records managers bemoan management's indifference. They present, however, business cases that identify marginal savings and often offer minimal productivity improvements and soft-dollar savings. But nothing can escape the fact that records management is "overhead." Here in Part 4 of the standard, though, are clear benefits that may never have been included in budget submissions or presentations to management.

A third use can be to establish programs or update job descriptions. Some organizations have people in charge of outdated records in storage but no real records program. The components outlined in Part 7 can be effectively melded into a records manager's job description or used to outline a program that can then be taken to management as an integral part of the organization's administration.

Some managers may say, "My program is working well; why should I review my progress against some arbitrary standard?" To them, we must say that "working well" may be in fact their arbitrary standard. It is always useful to measure a program's performance against a standard. No program is perfect. All programs can be improved in some fashion, and this standard provides the benchmark.

Other managers may say, "My organization is too small; the standard does not really apply to us." But whether it has a staff of five or 5,000, all records programs should have similar components and outcomes.

The standard gives clear direction that any assessment must include the following evaluation of the program's regulatory component:

* Are there policies and procedures? Are they "in synch" with the organization's policies and/or regulatory environment?

* Is there an evaluation of user satisfaction?

* Is there an evaluation of the establishment and performance of the component parts of the records program?

Organizations may wish to conduct at the same time an evaluation of the cost effectiveness of their program. Policy and procedure reviews are fairly common within organizations, and it is fairly simple to develop a questionnaire or data capture form that will help to assess the regulatory component of the program.

Outcomes or benefits such as those suggested in Part 4 could be presented to users in a number of ways. This could be achieved through interviews or questionnaires to determine levels of satisfaction as well as to determine which benefits have been realized. Part 8 could provide measures to determine the effectiveness of the key component of any program (e.g., the corporate records classification and retention schema). Part 9 of the standard would provide a listing of component parts that could be measured at both the organizational unit and overall organization level. Depending on the size of the organization, one, two, or three levels could be assessed.

Finally, an evaluation of cost effectiveness may be useful (especially since much of the information obtained can be translated into costs of improvement projects). Such figures as records volumetrics, average salary levels, and work statistics would need to be determined before any relevant cost figures could be obtained.

Using the Standard for Defining Business Plans

How can an organization make use of the standard in defining its business plan or projects? With the advent of the standard, organizations now have an independent measure or gauge for assessing their programs. A value could be assigned to each of the six areas identified on the checklist identified in Section 4. It may differ slightly depending on what the organization deems to be of most value about the records program (see chart on next page).

If subsidiary questions could be developed and assigned values, the result would be a rough estimation of the extent of compliance with the standard and the value of its effectiveness. Those items that the standard identifies as mandatory would of course have a higher value. Until all minimum or mandatory requirements are met, an organization could not be said to be in compliance with the standard.

AREA                       POINT VALUE

Policies and Procedures            100

User Satisfaction                  200

Effectiveness of the
Classification
and Retention Plan                 200

Program Establishment              100

Program Performance                300

Monitoring and Training            100

TOTAL                            1,000

Through a combination of questionnaires and interviews, information as to the program's effectiveness could be gathered. If an organization obtains, say, a total of 670 points, it would then be said to be achieving 67 percent of the effectiveness of the standard. If it also met all mandatory requirements, it could be said to be in close compliance with the standard.

If an organization's goal is to achieve a higher effectiveness and compliance rating, the business plan could include how to improve performance in several specific areas over a specified time, which would be followed by a reassessment of the program. The business plan would include new goals and projects that would focus on bringing the organization into 100 percent effectiveness and in closer compliance with the standard.

Variances and Cautionary Notes

The results for each portion or segment of the organization may be different. If all areas of the organization are experiencing difficulty with the classification plan, then steps should be taken to review the overall plan. If, however, certain departments or sub-levels of the organization are experiencing difficulty, then perhaps only those portions should be reviewed.

Note also that a program may achieve a rating of, for instance, 50 percent and still be in compliance with the standard. It may be a compliant program but one that does not reflect its effectiveness.

Assigning point values results in arbitrary figures. These should be taken not as precise measurements but merely as indicators of effectiveness. Nothing can replace narrative assessments of programs.

Independent Review

The standard also suggests independent reviews be conducted because internal reviews may have biases. However, organizations that routinely conduct internal management reviews should be able to conduct a records management assessment without difficulty.

REFERENCES

ISO 15489-1: Information and Documentation -- Records Management -- Part 1: General. Available at www.niso.org/dis15489.htm (accessed 11 June 2001).

ISO TR 15489-2: Information and Documentation -- Records Management -- Part 2: Guidelines. Committee draft 2000.

Steemson, Michael. "ISO15489: You're Gonna Ned It, So Remember It!" Available at www.caldeson.com/iso15489.html (accessed 11 June 2001).

Editor's Note: See David Stephens' column about the standard on page 68.

James C. Connelly, CPM, is Director of Connelly Consulting in St. Albert, Alberta, Canada. He has 28 years of experience in information management with a focus in program planning and electronic records management. His work has taken him to Libya, Columbia, and the United Arab Emirates. He has been Chapter Member of the Year in the Edmonton Chapter of ARMA International and a four-time recipient of the R. P. Morin Literary Award. His B.A. is from the University of Ottawa. Connelly last wrote on the impact of classification on the World Wide Web in the July 1998 issue of The Information Management Journal. He can be contacted at [e-mail].