Traditionally, organizations have thought of records management as the cataloging and storage of inactive paper records. They may have document management systems, where the emphasis is on author collaboration, document creation and publishing. But the fine points of archiving methods, retention schedules, physical storage, security, retrieval methods and so on are often neglected or handled on an ad hoc basis.
Issues surrounding the retention of electronic messages, which companies typically haven't considered archivable records, can be especially troublesome.
It's difficult and expensive to selectively retrieve e-mails from tapes because the files aren't indexed, says Margaret Rimmler, a vice president at records-storage company Iron Mountain. And it's dangerous to keep too much information. "So a company has five years of backup tapes, and ... they think they have this great records management program. But you know what? Those backup tapes are still discoverable, and they have everything on them," she says.
Keep records management and disaster recovery separate, Rimmler advises. "You set up your good records management program for e-records, then you set up your backup tape rotation to be just for disaster recovery. Don't let the tapes just hang around like a lot of IT people do; put them on a 30-day rotation."
Commercial ERP and CRM systems typically don't have records management and archiving capabilities that meet regulatory requirements, Rimmler says. Until they do, she says, users will need add-on products such as IBM's Content Manager and Records Manager, FileNet Corp.'s Records Manager or Records Manager from the Documentum Inc. unit of EMC Corp.
Many of the pitfalls associated with digital records management and archiving can be avoided by outsourcing the job to companies such as Iron Mountain, Recall Corp. or Zantaz Inc., says Patrick Gordon, a principal consultant at Compliant Systems Consulting LLC in Medfield, Mass. "The benefit is there's a whole infrastructure you don't have to deal with," he says. But, Gordon warns, "you still have fiduciary responsibility for that information. You ... are giving up some control and taking on another level of risk when you outsource."
Deciding what to save is complicated by the fact that any given file, such as a word processing document, usually exists in six or seven places in a company's IT systems, says Alan Pelz-Sharpe, an analyst at Ovum. Moreover, companies lack the tools -- and sometimes the will -- to classify files as official business records to be archived or "garbage" that should be deleted as soon as possible.
But the biggest records management challenge of all, according to Pelz-Sharpe, is this: "Nobody wants to do that work. It's boring, and there's no ROI. You have CIOs and CFOs saying, 'Well, I guess we have to do this because it's the law,' but there's absolutely no enthusiasm for it."