"Some companies have concluded that they should archive, forever, anything and
everything — boring and unboring, sexy and unsexy, damning and defensible — just to err on the safe side. But that's not quite right ...," said Sarah Scalet, senior editor for CSO Online.
"In records-retention land, there is no 'safe-side,'" Scalet continued. "Keeping too much information is a risk too."
Establish a Records Retention Schedule
What can companies do to protect themselves? Many companies have a records retention schedule that assigns a timeframe in which to keep records. Schedules which have been developed with the assistance of legal counsel will help to establish parameters for the records for which you are liable, thus identifying your level of risk and making it more manageable.
Legal counsel can help to determine the timeframes in which particular types of documents should be maintained. Some documents, such as phone messages, have a short lifespan; others, such as contracts and property deeds, should be maintained for the life of the contract or ownership of the property, plus five or ten years afterwards.
But when a retention period has expired, are documents being actively purged? A records retention schedule does not just apply to the files you have in archives. Multiple copies of an archived document may exist throughout the office; they can be stored electronically in various forms, as well as in hard copy.
What Is a Record?
"A record, technically, is something that you need to keep around for a set period of time, either for regulatory, legal, or business reasons," Scalet said. "Records encompass both structured information, like financial transactions stored in the company's enterprise resource planning system, and unstructured information, like financial spreadsheets exchanged by email that might eventually feed into the ERP system (or just sit on someone's desktop computer indefinitely). Records probably don't encompass emails exchanged by two accountants about whether to lunch on Thai food or Mexican."
Archives versus Records Retention
Records retention should not be confused with archiving. Archiving only involves those files that are too bulky and too old to keep onsite. They are files that are not accessed as frequently but need to be retained for legal reasons or otherwise. Records retention is the umbrella that covers the management of your archiving, as well as your in-house hard copy and electronic filing systems. It also includes individual files of staff members, including their emails.
Pack Rats
Almost every company has at least a few staff members who are pack rats. Their offices consist of stacks and stacks of paper. The individuals often have legitimate excuses for keeping all that paper. They are often too busy to keep up with their filing, and their motivation to keep documents labeled and in file drawers is lacking, since records retention has rarely been a priority in any office. Now imagine those stacks and stacks of abandoned paper as the years and years of electronic files that these individuals have stored on their hard drives. Do any of those papers present liabilities? If so, would your staff know where to find them?
During a legal discovery, a team of attorneys may get permission to search an office for relevant records pertaining to a case. However, businesses who can attest to maintaining a tight retention schedule are often viewed by the courts as cooperative and trustworthy, much to the relief of the pack rats. This also means that your retention schedule serves as a legal document to this effect.
Be Practical; Also, Be Flexible
The trick to maintaining your records retention schedule is to have staff apply the schedule to their individual filing systems. Staff should only maintain files at their desks and in their individual drives on the computer network with which they are actively working, which will reduce the amount of sensitive documents — confidential or otherwise — that staff keep at their desk at a given time. Files that multiple members of staff need access to should be available in a hard-copy file system or on a secure shared drive on the computer. Make sure the shared files are frequently updated and easily accessible so that staff will be more likely to use them.
Will staff support this change? They will if you keep open communication. Explain to them why records retention is so important. Ask for their input and feedback. Break the work into stages and give staff deadlines for each stage. Have staff help to determine which types of documents should be given priority. Soon, staff, particularly those who have been around for a while, will get accustomed to the new system.
Although retention schedules must serve their purpose by establishing parameters for the liabilities of records, they must also be practical and maintainable. Can individual or shared office filing systems be designed so that you can easily review files whose retention period has expired? If you can, it will be easier to identify these records and review them accordingly. If you can't, you need to revisit your retention schedule. However, not every category in your retention schedule will be easy to file based on expiration date, particularly if you use a schedule that is variable per item, such as the life of a loan, plus five or ten years. Nonetheless, use a separate file folder for each item that should be reviewed individually.
Does this mean that you must reorganize your entire filing system? Perhaps, but again, practicality is the rule. Should you reorganize files that have already been archived? Probably reorganize from this point forward, but you should still have a working knowledge of how archived files have been organized in the past, since you will still need to purge them based on the new retention schedule.
Sarbanes-Oxley
If you belong to a publicly traded company, the Sarbanes-Oxley Act of 2002 established retention periods for financial documents, and you should be in compliance with those when developing your retention schedule.
Electronic Data
MySpace.com and Facebook.com were subpoenaed in a child rape investigation this fall, where dozens of Internet community regulars were arrested for transmitting illegal photos and video footage. The companies were required to provide the identification of users, and they assisted police in tracking the suspects' Internet whereabouts.
"The use of electronic data is rapidly increasing, and companies must find ways to manage it now so that they can effectively control compliance risks," said Cynthia L. Jackson of Baker and McKenzie. "Proper archiving, retention, monitoring, filtering, and encryption of electronic data are no longer options: they are imperative."
Risk Assessment
Keep abreast of changes in the law which could affect records retention in your business. For example, the Honest Leadership and Open Government Act, which imposes rules on businesses that lobby with government officials, was passed by Congress this fall. This is the first time that internal rules governing members of Congress were broadened to include the accountability of private businesspeople.
Another example is the No Child Left Behind Act, which provides additional funding for public schools but also requires them to provide statistical information about the progress of their students and staff, as well as equipment inventories. As a result, a number of schools have needed to upgrade their filing systems. Anthony Dragona, school business administrator for the Union City Board of Education in New Jersey, implemented a database in his school over the last five years.
"What started off as a quest for a way to satisfy state requirements has turned into an incredibly enlightening period for our school district," Dragona said. "We now have a system that simplifies data input, allows flexible analysis, shows trends over time, facilitates standardization across the district, provides security and flexibility, and reduces costs."
Maintaining a records retention schedule is an essential part of your business, particularly as we, in the Information Age, must account for and manage both electronic and hard copy records.
