Moving From Paper to Electronic Records

As more business is transacted electronically and organisations expand into the global marketplace, legal and compliance requirements become more stringent, while documents and records that are created to support the business can bring benefits and liabilities.

In the 1990s, organisations used personal computers to automate the typing process but still maintained paper as the official ‘file’. Records were created and received on paper and kept in the office to meet business needs. Departments determined their own requirements and maintained central file areas usually staffed by file clerks who filed and retrieved them for their clients. Once the records were no longer required in the office, they were sent to the basement storage area, or to offsite records centre facilities where they stayed to meet legal retention requirements. The traditional perception of records management was focused on moving paper from expensive office space into cheaper, low cost storage.

In 2007, over 95% of records were created and stored electronically, and e-mail is now the main means of transmission within and between organisations. There are no longer central file areas and each individual using a computer has the potential to make decisions about how records are captured and managed.

The Data Environment

As technology has evolved, the data environment, like the records environment, has changed. Ten years ago, data was transferred via tape or disk and typically located, processed and accessed in the same location, smaller networks managed the data transmission and the regulatory environment did not yet address electronic records issues.

Now, the situation is much different. Data flows transparently across borders; it is processed remotely or in many locations and can be accessed at any time, from anywhere depending on the rules associated with the data.

The need to be aware of how records, information and data are created and managed is resulting in legal and compliance changes. The means of creating, transmitting and storing records and data are also changing dramatically. No longer are organisations faced with managing records on paper but addressing the challenges of managing records, information and data on:

• Databases.
• Network servers.
• RAM.
• Enterprise applications.
• Legacy systems.
• Backup and archiving (e.g. tapes, discs and drives).
• Desktop computers.
• Laptop computers.
• Removable media (e.g. thumb drives and CDs/DVDs).
• Handheld devices (e.g. PDAs, mobiles and pagers).
• Audio systems (e.g. voicemail).

The Legislative Environment

Trends towards outsourcing, centralisation of data processing resources and the overall transition towards an electronic workplace is forcing organisations to look at the data management legislation they must comply with.

When considering compliance requirements, as paper records are converted through scanning and imaging projects, decisions are made to outsource or computer records are maintained in place of paper. In doing so, organisations should be aware of some of the areas that could affect their decision:

• Corporation, business and company laws may affect which records are to be maintained in which location and may have an impact on corporate records centralisation or outsourcing.
• Electronic Evidence Acts determine whether or not electronic records are admissible in court in place of paper. Case law may support the admission of electronic records in place of evidence acts. Such laws and cases will support the transition from paper to electronic records management.
• Digital signatures will allow for the use of digital signatures on documents in place of written signatures on paper documents and records.
• eCommerce and eTransactions provide for the use of electronic records in place of paper, on the assumption that certain processes are in place to ensure that the electronic records are authentic and reliable and can be trusted in place of paper records. The requirements for authenticity and reliability drive system design for electronic records capture and management.
• Data protection and privacy defines what is meant by personal information. They provide details about how personal information must be collected managed and protected, if and how it can be shared across geographic boundaries, what access may be granted to it and how it must be disposed of.
• Laws governing different types of records, such as financial (in particular income tax laws) and human resource (labour, pension and benefit related laws) records, govern requirements to maintain records for specific periods of time.
• Industry-specific laws, such as pharmaceutical, financial and environmental industries provide guidance on business requirements and can be used to develop records policies and procedures.

Legal Situations that Affect Records and Data

Stringent data protection and privacy requirements in the European Union and differing levels of privacy protection laws outside the European Union have resulted in ‘safe harbour’provisions in a number of areas. Laws in one country may conflict with requirements in another.

In the US, recent changes to the Federal Rules of Civil Procedure have established that ‘electronically stored information’ (ESI) stored on and in the various technologies listed are subject to discovery in a litigation situation. ESI includes e-mails, word processing documents, spreadsheets, presentations (PowerPoint, etc), graphics, images, voicemail, audio visual recordings and data in databases, data warehouses and enterprise applications.

Security breaches are becoming more common, identity theft is an issue and privacy and data protection are of concern to all organisations. As a result of situations which have pointed to the gaps in effective management of electronic records, legislation is forcing organisations to comply with new rules and build controls. IT and business are focusing on the need to address the challenges of building electronic records frameworks.

The legislation with which organisations must now comply varies according to specific countries and industries. While not all specifically focusing on records and information, there are sections in the following laws which impact or require that the records be available:

• Data Protection and Privacy.
• Anti-Money Laundering.
• Sarbanes-Oxley.
• Basel Accord.
• Evidence Acts/FRCP.
• Electronic Transactions/Commerce Acts.
• Securities Acts.
• Financial Institutions Acts.
• Banking and Insurance Acts.
• Income Tax Acts.
• Human Resources Legislation (i.e. Labor, Health and Safety).
• Environmental laws.

The reality is that non-compliance with the laws has led to:

• Substantial fines.
• Sanctions.
• Executive liability.
• Drop in stock prices.
• Increased reputational risk.
• Shareholders and stakeholders concerns over accountability.

Implementing Solutions Requires a Review of the Laws

As we move into the next phase of records and information management and begin to address both paper and electronic records issues, we are seeing changes to the legal and compliance environments in which records are created and maintained. Standards are being developed to ensure that records can be located and used over time. As the Gartner Group stated in 2003, ‘records management has moved out of the basement into the boardroom’.

As legislation changes and more emphasis is placed on electronic records, organisations tend to forget that the paper records are just as important as the electronic ones and still need to be managed as part of the overall records management program. International and local standards can be used to implement programmes that meet the requirements of the legislation. Internal policies and procedures must address paper and electronic records and information created, received, managed and disposed of so that organisations are in compliance with the legal requirements. It is important to review all the various issues as decisions are made to transition from paper to electronic records.

When organisations implement an imaging project, a question is always posed about the legality of the images in court and the potential for disposing of the paper, to reduce costs. In order to make the decision to destroy the paper, the organisation must look at the laws under which they operate, the requirements of those laws and how they impact the records being imaged. For example, if the imaging solution scans documents which contain original signatures and related laws require the organisation to maintain an original, signed copy of the record it may not be possible to destroy the original after it is scanned. The legal department or legal representatives should work with the IT and records management groups to assess the relevant laws, review the imaging programme procedures and make a determination

Centralising data processing functions is another way in which organisations are saving IT budget resources. Before decisions are made about where to centralise the repository, however, consideration must be given to data protection and privacy requirements as well as transborder dataflow issues to ensure that one country’s laws do not conflict with another.

With all the various issues organisations face today in managing their records, information and data, many are developing and implementing records and information management strategies to enhance organisational effectiveness and compliance.

Implementing a Records Management Framework to Support Compliance

The International Organization for Standardization (ISO) created a records management standard, ISO 15489: Information and Documentation: Records Management, Part 1- General to support ISO 9000 and ISO 14000 and define a ‘good practice’ records management program. The standard defines records management as ‘the field of management responsible for the effective and systematic control of the creation, receipt, maintenance, use and disposition of records including processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records’.

The standard goes on to define a record as ‘information created, received, and maintained as evidence and information by an organisation or person, in pursuance of legal obligations or in the transaction of business’.

Many national and multinational organisations, particularly in the US, UK, Canada and Australia, are recognising the importance and benefits of establishing records management programmes. The need is driven by both changes in the laws, recent corporate scandals and the need for greater shareholder accountability. ISO 15489 is being adopted and applied internationally as the benchmark for building a records management program to manage records in all media. The standard outlines the components required to create such a programme and includes some of the following components, which are defined at a high level:

• Understanding the legal framework.
• Policies and procedures.
• Defined roles and responsibilities.
• Classification/metadata schemes.
• Retention schedules.
• Applying legal holds.
• Defining security and access requirements.
• Transfer and disposition activities.
• Training.
• Auditing and monitoring.

The programmes, usually under the direction of a records and information manager and supported by a senior level, cross-functional steering committee:

• Support and document policy formation and management decision making.
• Facilitate the effective performance of organisation functions and activities.
• Conduct business in an efficient and accountable manner.
• Provide continuity in the event of a disaster.
• Help the organisation meet legal and compliance requirements.
• Support litigation and eDiscovery requirements.
• Ensure that electronic records are accessible and usable despite the changes in technology hardware and software.
• Protect the interests of shareholders and employees.
• Protect the corporate memory and history of the organisation.

Records management has now become an enterprise-wide responsibility. Building a successful programme requires that all participants understand the importance of their role and the role that records play.

Complying with Legal and Regulatory Requirements: A Cross-functional Approach

Records management programmes support and are supported by a number of other key groups within the organisation. The key groups, whose activities complement each other include compliance, legal, information technology, records and information management and business users.

Today’s workplace is fraught with challenges that are constantly changing. Whether they are related to new technologies, obsolete software, litigation, changing regulatory requirements or making decisions about whether to keep paper, organisations need to implement an effective records management programme.