Continuing the myth that backups and archiving = records management

A recent Computerworld article, White House e-discovery squeeze puts e-mail backup in focus, raised a lot of questions regarding how to best manage e-mail, and continued the ever growing discussion on what is happening at the White House. While Mr. Osterman raised some good points for consideration and seems to understand the need for sound RIM policies and practices, the use of the term "archiving" and subsequent comments from Ms. Whitehouse regarding "backups" continue to perpetuate the myth that these are Records and Information Management (RIM) practices.

There is no question that managing e-mail is a daunting task, most RIM practitioners and Professionals have been trying to convince organizations of this for over a decade! The problems seems to be that no one is willing to properly take on the 800 pound Gorilla in the room.

This situation didn't happen overnight, and it's a not going to be repaired overnight either ... but to institute bad policies and practices as stop gap measures only exacerbates the problem. As pointed out in the original article, e-mail MUST be managed as a business record, and it must be done in a manner consistent with existing RIM policies and practices. It isn't a "record series", it's a means of conveying information. To simply create a store of ALL E-MAIL, whether you incorrectly identify it as an "archive" or correctly identify it as a repository, only results in more mismanaged information.

And to confuse things further, the discussion of "backups" always enters the picture. Backups, whether incremental or full system, are intended to serve as a means of restoring data following an unintended or catastrophic loss of information. Their main purpose is to protect continuity of operations, and once they have been replaced by a more current "snapshot", they should be recycled and/or discarded in accordance with appropriate procedures.

Failure to ensure that IT practices are consistent with organizational records management policies and retention schedules can result in costing organizations substantial amounts of money. The fact that they exist and may include information that has been disposed of "in the course of normal business" make them subject to disclosure in the discovery phase of a legal action, and under the rules of the FRCP, you may be required to re-initialize the backups and search them to prove requested information doesn't exist on them.

Solution? Well, it's a multi-pronged effort. One involves policy, another is training, and the third is effective records and information management.

Policy

Ensure you have ONE policy for records management that applies to ALL forms of information meeting the definition of a record. Key elements of the policy include: establishing the definition of a record for your organization, responsibilities for who provides guidance on how to institute practices, developing a business based records retention schedule consistent with the laws, statutes and regulations impacting your industry segment, regular audits for compliance, and management commitment to support compliance with the policy.

Training

Just as employees are required to understand how to properly operate equipment and work in a safe manner, they should be aware of the risks of poor management of records. You wouldn't give an employee the keys to a piece of heavy equipment without providing proper training on how to use it, and the same should apply to the use of e-mail and other applications that generate information that may bring harm to an organization if not used properly. Time after time, we see stories of information committed to e-mail that have resulted in lawsuits. Yet most organizations still fail to inform their employees what e-mail CAN and CANNOT be used for. They also fail to inform employees that if there is a records policy for the organization, it applies to ALL FORMS of information that meets the definition of a record, paper, electronic, video, voice or other. Regular required training on the basics of RIM should be mandatory for ALL employees.

Effective RIM

The application of effective RIM practices within an organization and use of consistent methods of managing "information as an asset", results in bottom line savings in the long run. The ability to locate the right information quickly and routinely improves an organization's ability to respond to requests, act on opportunities, and meet daily business needs more efficiently. Retaining ONLY the information that meets the definition of a record for prescribed periods of time reduces the volume of unnecessary data that clogs storage systems and networks. Consistent RIM practices mean employees in all aspects of an organization know how and where information exists and improves their ability to meet their daily needs.

It's important to remember that e-mail is only a conveyance for information, it's the content in the e-mail that determines if it's a record, and how long it should be retained. You don't retain every envelope that postal mail arrives in, nor do you retain every piece of postal mail. Why wouldn't you apply similar practices to e-mail?