Record Risks

Computerworld - A few years ago, most companies didn't give much thought to electronic records management. But a spate of scandals, lawsuits and new regulations has changed all that. Despite renewed attention to e-records management, however, many organizations still lack automated systems to efficiently process all e-records requested during a legal discovery proceeding. Yet retrieving such records -- and the penalties for noncompliance -- can cost businesses millions of dollars.
"E-litigation is an extremely expensive endeavor," says Jane Connerton, corporate records manager at The Procter & Gamble Co. in Cincinnati. While P&G has a records retention policy, finding and retrieving records during legal discovery can be a daunting challenge -- especially when the records are on backup tapes.
"We had a case that, after a week's worth of discovery, we calculated that backup tape suspension and legal review of the e-records was going to cost us a million dollars," Connerton says. And, she adds, such requests aren't uncommon for businesses of P&G's size.
In response, companies are turning to records and content management systems to automate the processes for identifying and categorizing records of all types, establishing and enforcing retention schedules, and maintaining accessibility to those records.
"You're trying to identify what has become a record, associate a rule with it and blow it away when it's no longer needed," says Julie Gable, principal of Gable Consulting in Philadelphia.
Companies must also comply with myriad local and federal regulations that vary by industry. For example, SEC Rule 17 requires that brokerages store records in a nonrewritable, nonerasable format. Sarbanes-Oxley Act Section 802 requires some records to be held for seven years. Other requirements are triggered by events, such as health care regulations that require records to be kept for a certain period after a patient's death.
The Elusive E-record
Records serve as evidence, says Gable. "They accrue to business processes, show what transpired during transactions, confirm rights and obligations, and provide motive for corporate action." What constitutes a record is determined by business, regulatory and legal requirements. Those definitions and policies are typically set by a corporate records manager, but IT must manage those records.
Today, records take many forms. While printed documents may be collected in file cabinets, e-records are scattered across a wide range of repositories. They may be embedded in e-mail, instant messages and other unstructured data that account for up to 40% of business data flows, according to the Storage Networking Industry Association (SNIA).
"E-mail is the biggest issue we see," says Barclay T. Blair, director of the IT