Taking electronic records retention management to the next level

By Kate Evans-Correia, Executive Editor 09 Dec 2008 | SearchCIO-Midmarket.com

Technology news and tips for midmarket CIOs Digg This!     StumbleUpon     Del.icio.us

He's got one.

Despite all the hoopla over the need for electronic records retention policies -- particularly given the need to produce records for litigation for compliance with the Federal Rules of Civil Procedure -- many midmarket companies fail to have or enforce standard practices to retain electronic records. In fact, recent research shows that a third to a half of U.S.-based organizations still do not include electronic records as part of their records retention policies.

More on electronic records Electronic records retention: What's your company policy? E-records management moves up the state CIO agenda What CIOs should know about e-records Easing e-discovery preparation by mapping enterprise data

But the city of Riverside, Calif., where Reneker is the CIO, took a proactive approach to records management and is now ahead of the curve. Reneker, who took the city's top IT job in 2006 after a two-year stint at Dell Inc., has an electronic records retention management policy that's specific and routinely enforced -- though also flexible enough that it accommodates the specific needs of each department. For example, one department might have an automatic 30-day email purge, another, a 60-day automatic purge.

"From an enterprise perspective, we've gone hybrid," said Reneker, about the city's decision not to tie each department into one way of doing records retention. "We wanted to centralize and still give flexibility."

Electronic records management (ERM) is a set of practices related to the lifecycle of electronic records, such as identifying, classifying, archiving, preserving and destroying records. Electronic records include emails, instant messages, images and videos.

Creation of electronic records retention management policies is on the rise, but they're still lacking at many companies. According to Cohasset Associates Inc., a Chicago-based document management consulting firm, 60% of the 1,596 respondents to a 2007 survey said their organizations had comprehensive records retention schedules that include electronic records, an increase from 51% in 1999. Only 49% of organizations have a formal policy focused on retention practices for email, up only slightly from 45% in 1999.

Perhaps more alarming is that the enforcement of these policies is still lacking. According to the Cohasset survey, only 14% of organizations say they always follow their retention schedules, while another 50% say they do so most of the time. Another survey, this one commissioned by CA Inc. and conducted by ARMA International, indicates that only 38% of respondents reported that they manage these records according to their retention schedules.

Part of the problem is that most midmarket companies have not been able to shift from a hard-copy records management mind-set to an electronic document management mind-set. "They just haven't made that leap," said Brian Hill, an analyst at Cambridge, Mass.-based Forrester Research Inc.

Within two years, Reneker was able to move from a siloed records-keeping system, in which every department had essentially its own policy and documents were not accessible from one department to another, to one where records (including hard-copy records that are scanned) are now accessed cross-departmentally. Part of that process included collaboration with city officials, including the mayor and city attorney, to set e-records retention rules regarding everything from how long to keep a document to where it will be stored. An across-the-board policy that could be restrictive to some departments didn't make sense to another department, so policies are set based on each department's needs.

"We ask ourselves what are the benefits, the pros and cons of going longer rather than shorter," Reneker said. "How long do we have to keep something by law … how long do we have to in terms of costs?"

When it comes to electronic discovery issues, content that could possibly be tagged for use in litigation e-discovery is the purview of the city's attorney. The attorney determines what is considered public records, what the city is required to keep and for how long.

The foundation of the city's records retention program is a series of applications from Long Beach, Calif.-based document management company Laserfiche. The Laserfiche records and document management system was first used in the city clerk's office then rolled out citywide because of its scalability and ease of use, Reneker said.

From an enterprise perspective we've gone hybrid. Steve Reneker CIO, city of Riverside, Calif.

Laserfiche is used to capture, secure and distribute imaged and electronic documents, including those of the police department, which stores audio and video files and case-related documents in the archiving system. Laserfiche's Microsoft SharePoint integration will automate workflow. The finance department will integrate Laserfiche with its primary software to add functionality and simplify everyday tasks. And integration with the city's geographic information system software will enable city staff and the public to access information related to land parcels online.

The city is working toward an agreement with Laserfiche under its current licensing program to implement the advanced features of Laserfiche Records Management Edition, Workflow and Web Access throughout all city departments.

The Laserfiche applications are stored on an EMC Centera, a data archiving appliance.

Reneker said the city keeps a master list of applications detailing how data is stored and for how long. Establishing a database was vital to the success of the program. "The critical part is that we had to differentiate between online (real time) and archived (tape stored off-site with Iron Mountain)." SunGard Availability Services is used for hot-site backup.

The biggest issue, Reneker said, "is that the city's records management practices were siloed." Every department had their own records program. "But when you take a look at your whole organization, there's no [easy] way to retrieve [any information]."

Content is tagged, dated, marked and then stored in the EMC Centera product. It's purged from the online format according to the pre-established records retention policy. Documents at the hot site are handled a little differently. There are associated backup tapes that are purged using a manual policy. "Each year we have to go through and destroy the backup," Reneker said. Tape can be backed up from multiple systems, which each have multiple retention periods. "That's where it gets fuzzy."

"[Records management] is the biggest headache for any CIO," Reneker acknowledged. "There isn't any one common rule that fits all your systems or all your efforts. Every application has a unique requirement. It becomes a full-time job to manage just backup. It takes several IT-related positions to handle all of the various aspects of electronic records retentions. From systems administrators, database administrators, computer operators and application support personnel. Records management is an aspect of every IT systems resource which manages an electronic system.

Tags: Data storage for the midmarket,  Compliance management for the midmarket,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Data storage for the midmarket Data storage technology: Know your FAQs and options Midmarket data center management guides: Tips and best practices What do you know about data center outsourcing? Virtualized storage and SANs drive disaster recovery plan Disaster recovery plans solve bare-metal recovery problem via VMware The price of data center outsourcing: Security, costs and more explored Data center virtualization: User best practices Firm moves from tape backup to managed backup and recovery service IRobot CIO dishes on virtualization, disaster recovery and compliance Leading iRobot's IT: Virtualization, disaster recovery and compliance Compliance management for the midmarket What will net neutrality mean for SMBs? At your peril, disaster recovery testing gets short shrift From software prices to EHR security: The latest advice for CIOs Security and risk management in the midmarket A CIO's advice for implementing single sign-on solutions Compliance management: From virtualization to licensing agreements 2008 top 10 technology articles: Social media, Vista, IT salaries Healthcare compliance gets boost from national HHS privacy framework Data center virtualization: Four steps to compliance When Microsoft shuts you down and other IT horror stories

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary