Records Management Focus White Paper

Understanding Digital Records Management

Records Management Solutions for Today’s Regulatory Environment

 Contents

Executive Summary ..................................................................................................... 1

Records Management Overview.................................................................................. 2

Understanding the concept of a “record” ................................................................ 2

Determining which records to keep ........................................................................ 2

Defining records management .............................................................................. 3

Identifying the benefits of records management ................................................ 5

Managing electronic records ................................................................................ 6

Understanding Digital Records Management ........................................................... 7

Record series ....................................................................................................... 7

Metadata ................................................................................................................. 8

Linking ................................................................................................................... 8

Versioning ............................................................................................................... 8

Security tags and audits ....................................................................................... 9

Vital records .......................................................................................................... 9

Cutoff ...................................................................................................................... 9

Closing records .................................................................................................... 10

Retention .............................................................................................................. 11

Disposition ............................................................................................................. 11

Freezing ................................................................................................................ 12

Choosing a Records Management Application ...................................................... 13

Transparent records management .................................................................. 13

Legal considerations ............................................................................................ 14

Conclusion: Records Management in Today’s Organizations ................................. 15

Executive Summary
Records management systems simplify the life cycle management of business records. A
records management system supports the automatic enforcement of consistent, organi-
zation-wide records policies and reduces the cost of regulatory compliance. This white
paper explains the specifics of records management, from defining what records are and
what records management is to explaining how to choose a quality records management
application.

Since 2005, records management has become increasingly important for organizations
due to new compliance regulations and statutes. While government, legal, financial and
healthcare entities have a strong history of records management, general record keeping
of corporate records has been poorly standardized and implemented. Scandals at com-
panies including Enron and Arthur Andersen, and, more recently, at Morgan Stanley,
have renewed interest in corporate records compliance, litigation preparedness and other
issues. Most legislation and regulations have been handed down with no road map for
compliance. Security and compliance officers as well as records managers have been left
to fend for themselves in search of the right combination of products and procedures to
ensure that complying with these regulations does not disrupt day-to-day operations or
their ability to do business.

Fortunately, there is a records management standard that has emerged as the de facto stan-
dard across most industries. The United States Department of Defense (DoD) developed a
records management standard, DoD Standard 5015.2, as a requirement for records man-
agement applications implemented within its departments.

Unlike other requirements, the DoD developed very specific criteria, as well as a formal
testing process to determine whether a records management application meets the stan-
dard. Because of the formal testing process and the strictness of the requirements, organi-
zations outside of the DoD have used the 5015.2 standard as a starting point for evaluating
records management applications for their own use. Knowing that a DoD-certified applica-
tion has been rigorously tested against a standard that is much more demanding than the
regulations they must comply with provides a great deal of comfort to compliance officers
and records managers.

The goal of this white paper is to describe the principles and generally accepted practices
of records management. Information presented is of a theoretical nature and is not specific
to any particular product or technology.

1
Records Management Overview

Understanding the concept of a “record”

Records consist of information created, received and maintained as evidence of business

activities. The International Council on Archives (ICA) defines a record as “recorded
information produced or received in the initiation, conduct or completion of an institu-
tional or individual activity and that comprises content, context and structure sufficient
to provide evidence of the activity. While the definition of a record is often identified
strongly with a document, a record can be either a tangible object or digital information
which has value to an organization.”

The Federal Records Act (44 USC 3301) indicates that records include “all books, papers,
maps, photographs, machine readable materials, or other documentary materials, regardless
of physical form or characteristics, made or received by an agency of the United States
Government under Federal law or in connection with the transaction of public business
and preserved or appropriate for preservation by that agency or its legitimate successor
as evidence of the organization, functions, policies, decisions, procedures, operations
or other activities of the Government or because of the informational value of data in
them.”

Records often consist of documents, but they can also contain other forms of content,
such as photographs, blueprints, maps, audio files or even Web pages. Birth certificates,
medical x-rays, office documents, databases, application data and e-mail are all examples
of records.

The notion of a record carries with it more meaning than that of a document: a document
is merely a means of recording information, whereas the notion of a record encompasses
the roles the underlying document plays within an organization over time, the relation-
ship the participant in a society has to that record, and the relationship between the record
and other records.

Determining which records to keep

To identify which records your organization should keep, you must consider several
issues.

What does your organization do that needs to be documented? What types of records are
created in your organization? What are your mission-critical records? Which records
document decisions or are part of the audit trail? Examples might include permit files,
project files, reports, publications, time cards, personnel files, contact files and so on.

2
 Look at each type of record and decide why it is created and maintained. You may be
required to create and maintain records for a number of valid reasons, including program
administration, management reporting, federal or state statute, federal regulation or
organizational policy or procedures.

You may find that many of the series on the list for your office are working files, files
maintained for convenience or reference materials. Reference and personal convenience
are valid reasons for keeping records, too. Frequently, the only justifications for maintain-
ing files are personal ones, such as “I need the records for reference,” “Joe wanted me to
keep a copy,” “Somebody may ask for it” and “I don’t trust anyone else to keep it.”

To determine which records must be kept, focus on the files that directly support your
organization’s mission, corporate history or administration. These are your corporate
records, without which your organization could not function, and these are the ones you
need to control.

Identifying the list of corporate or mission-critical records is the most important and the
most difficult step in the records management process. It takes a little time, but the
benefits are great and it will allow you to manage your information assets much more
effectively and efficiently.

Defining records management

Records management is a specialized branch of document management that deals with

information serving as evidence of an organization’s business activities. Records manage-
ment includes a set of recognized practices related to the life cycle of that information,
such as identifying, classifying, archiving, preserving and destroying records. The ISO
15489: 2001 standard defines it as “the field of management responsible for the efficient
and systematic control of the creation, receipt, maintenance, use and disposition of
records, including the processes for capturing and maintaining evidence of and informa-
tion about business activities and transactions in the form of records.”

The fundamental concept behind records management is the idea that each record has
a life cycle. “Life cycle” refers to the stages that every official business record must go
through. After a record is created, it must be filed according to a defined, logical scheme
into a managed repository where it will be available for retrieval by authorized users.
When the information contained in records no longer has any immediate value, the record
is removed from active accessibility. Depending on the nature of the record, it is either
retained, transferred, archived or destroyed.

3
The practice of records management involves the following activities:

• Creating, approving and enforcing records policies, including a classification

system and a records retention policy.
• Developing a records storage plan, including the short- and long-term housing of
physical records and digital information.
• Identifying existing and newly created records, classifying them and then storing
them according to standard operating procedures.
• Coordinating access to and circulation of records within and outside the
organization.
• Executing a retention policy to archive and destroy records according to operational
needs, operating procedures, statutes and regulations.

Tools for maintaining and using records include file plans, indexes, controlled vocabularies,
taxonomies, data dictionaries, and access and security procedures. The main tool used
to manage the disposition of records is the records schedule. A records schedule is the
official policy for records and information retention and disposal. The schedule provides
mandatory instructions for what to do with records, as well as nonrecord materials, that
are no longer needed for current business.

Other benefits of using a records schedule are:

• Ensures that the important records are organized and maintained in such a way as
to be easily retrieved and identifiable as evidence of your activities (especially in
the event of an audit, a FOIA request or discovery for a lawsuit).
• Conserves office space and equipment by using filing cabinets to house only active
records.
• Saves money by the regular transfer of inactive files to less costly storage areas for
subsequent disposition.
• Helps preserve those records that are valuable for historical or research purposes.
• Stabilizes the growth of records in offices through systematic disposition of
unneeded records.

A records series is the basic unit for organizing and controlling files. Series are file units
or documents that are kept together because they relate to a particular subject or function,
result from the same activity, document a specific type of transaction, take a particular
physical form or have some other relationship arising out of their creation, receipt, main-
tenance or use.

The series concept is a flexible one, and your organization should be careful to create
series by organizing documents in ways that facilitate management of the records through-
out their life cycle.

Each record series should be located separately from all other records, and each record
series must be covered by a records schedule.

4
Identifying the benefits of records management

Records enable and support an organization’s charge to fulfill its mission. Every organi-
zation must address well-defined objectives that add value, either by achieving goals or
reducing costs. Because records contain such valuable information, it is essential to take
a systematic approach to their management.

Records management:

• Enables more informed decision making, by making information readily available.

• Helps deliver services in a consistent and equitable manner.
• Facilitates effective performance of activities throughout an organization.
• Protects the rights of the organization, its employees and its customers.
• Provides continuity in the event of a disaster.
• Protects records from inappropriate and unauthorized access.
• Meets statutory and regulatory requirements including archival, audit and
oversight activities.
• Provides protection and support in litigation.
• Allows quicker retrieval of documents and information from files.
• Improves office efficiency and productivity.
• Provides better documentation more efficiently.
• Supports and documents historical and other research.
• Frees up office space for other purposes by moving inactive records to storage
facilities.

5
Managing electronic records

The general principles of records management apply to records in any format. Digital
records, almost always referred to as electronic records, raise specific issues. It is more
difficult to ensure that the content, context and structure of records is preserved and pro-
tected when the records do not have a physical existence.

Unlike physical records, electronic records cannot be managed without a computer. Func-
tional requirements for computer systems used to manage electronic records have been
produced by the Department of Defense (DoD). DoD Standard 5015.2 has become the de
facto standard for records management software across a wide spectrum of industries.
DoD 5015.2 outlines the baseline functionality required for records management appli-
cations used by the U.S. Department of Defense and has been endorsed by the National
Archives and Records Administration (NARA) as an “adequate and appropriate basis for
addressing the basic challenges of managing records in the automated environment that
increasingly characterizes the creation and use of records.” Records management appli-
cations that have been certified as DoD 5015.2 compliant provide the peace of mind that
comes from an objective, third-party evaluation.

While records management applications that have been certified as DoD 5015.2 compliant
represent an objective, third-party evaluation, they do not guarantee regulatory compli-
ance or records security.

Particular concerns exist about the ability to access and read electronic records over time.
Electronic records require appropriate combinations of software versions and operating
systems to be accessed, and so are at risk because of the rate at which technological changes
occur. A considerable amount of research is being undertaken to address this issue, under
the heading of digital preservation.

6
Understanding Digital Records Management
Records management applications simplify the life cycle management of business records.
A records management application supports the automatic enforcement of consistent,
organization-wide records policies and reduces the cost of regulatory compliance. Records
management applications must protect records from loss and tampering, while allowing
the records manager and other decision makers access to necessary information.

Often, a records management application can help with the capture, classification and
ongoing management of records throughout their life cycle. A records management appli-
cation can be paper-based, like paper medical charts, or it can be digital.

Records management software is a computer program used to track and store records.
This is different from imaging or document management systems that specialize in paper
capture and document management, respectively.

Records management applications commonly provide specialized security and auditing

functionality tailored to the needs of records managers, including:

• Improved efficiency in the storage, retention and disposition of records and

records series.
• Detailed reports of which records are eligible for transfer, accession or destruction.
• Audit trails to track all system activity and the entire life cycle of records.

Records management applications enable the application of systematic controls and policies
concerning the life cycle of those records that detail an organization’s business transac-
tions. Records management applications should allow organizations to file records
according to a determined scheme, to control the life cycle of records, to retrieve records
based on partial information and to identify records that are due for final disposition.

Record series

A records management application must allow users to control the life cycle of records, to
maintain the relationships among records and participants, to provide for filing according
to a logical scheme, and to allow for rapid retrieval based on partial information.

Records management applications are organized around the central concept of a record
series. A record series is a group of records with instructions governing the life cycle of
the constituent records. Record folders are created within record series as areas to file
documents. Multiple record folders can be created beneath a single record series and
processed at different times, but all must follow the guidelines dictated by their record
series. That is, record folders are organized hierarchically under series.

7
 Each record corresponds to at least one document in a record folder. A document is filed
in exactly one record folder. The records management application must allow records to
be re-filed into different folders or series after the initial filing. Every object has a unique
identifier during the lifetime of the records management application.

Metadata

Each record, record series and folder maintains a set of metadata fields. Every metadata
field has a readable name or designator, and corresponding data that can be stored in the
field. Some fields are mandatory, meaning they must contain a valid entry, while other
fields can be filled in optionally. The records management application should automati-
cally fill and maintain fields as is reasonable and appropriate, although it must also enable
users to manually populate fields with information.

There must be an option to search for documents and records using metadata. The records
management application must have a way to constrain the type of data that can be entered
in a field. It must also limit the general editing of all metadata to the time of filing, except
for authorized users who will have the ability to edit and correct filing errors.

The records management application must allow records to be refiled in different folders
or series after their initial filing in order to meet DoD 5015.2 criteria. A records man-
agement application must also have a way to control the metadata fields associated with
every record, record series and record folder. Again, it must limit the entering of metadata
to the time of filing, yet allow authorized users to edit and correct filing errors.

Linking

The records management application must allow users to indicate related records through
linking, a form of metadata that defines and establishes relationships between documents.
Examples include supporting documents, superseded/successor records, multiple rendi-
tions and incremented versioning. A records management application should allow docu-
ment links to be established by all users at the time of filing, but only authorized users
should be able to create, modify or remove links post-filing.

Versioning

Versioning is a special document relationship used to indicate an auto-incremented

sequence of revisions to a particular record. The records management application must
allow users to establish record versioning. Versions must be retrievable as if they were
independent documents and contain their own metadata. A records management application
must clearly indicate whether a record has multiple versions and which version is the most
recent.

8
Security tags and audits

Security tags represent a metadata field intended to define and restrict access to records,
as well as aid in their classification and retrieval. A records management application must
allow the records manager to define security tags and allow users to assign tags to records
upon filing. Only authorized users should be able to modify or remove security tags post-
filing. The records management application must also support the audit of all filing, han-
dling and disposition of records.

Vital records

Vital records—those records deemed essential in order for an organization to resume

business operations immediately after a disaster—are subject to periodic review and
update. A records management application must provide a way to assign a review cycle to
vital records and detail when they were last reviewed. Examples of vital records include
emergency operating records or legal and financial rights records. The records manage-
ment application must also offer a way to retrieve all vital records, identify when they
were last reviewed and indicate vital records due for review at any given moment.

Vital record status is determined by the record folder, such that all records inside a vital
records folder are considered vital records. Vital records cycle periods may be of any time
range, from daily on up, and may also be specified by the records manager. The vital
record review date and cycle period can be set by authorized users only.

Cutoff

Each record series has an associated set of retention and disposition instructions. This
must consist of all of the following: cutoff criteria, which determine when the records in
a series can be cut off; a retention period, which is given as one or more intervals of time
between cutoff and each action; and a list of disposition actions, which describes the
actions that will happen to an inactive record after each retention period is over.

All record series will have a non-zero value for cutoff criteria, although the possible num-
bers of retention and disposition events could range from zero to infinite. A retention
period that occurs between cutoff and the first disposition action can also be known as the
hold period. Logically, disposition instructions can be segregated into cutoff criteria, and
what happens after cutoff.

9
 Cutoff criteria can take three forms: time disposition, event disposition and time-event
disposition. The cutoff criteria define the cutoff eligibility for record folders located
within a given record series. In time dispositions, the record series defines a time-based
cycle period and the records in that series become eligible for cutoff once the period has
finished. As an example, a monthly cutoff period would make records eligible for cutoff at
the first day of the following month.

In event disposition, eligibility occurs when an external event has occurred. The specific
trigger for the event is defined on the individual folder level within the record series. The
records manager will generally have to indicate to the records management application
that the event has occurred, although there are circumstances where it would be prefer-
able for the records management application to automatically note that an event has
occurred, such as when the event involves changes recorded within the records manage-
ment application itself.

In time-event disposition, the triggering of the event inactivates the record, although it
is not eligible for cutoff until further time-based criteria are satisfied. An example of this
would be a record folder whose contents would be eligible for cutoff on the first day
following the month containing the relevant event.

Closing records

When the records manager or records management application indicates that an event has
occurred for a record folder with an event or time-event record series, the folder is closed
so no new records can be filed and all the records in the folder are held inactive, with no
modifications allowed. For time record series, these cannot happen until after the folder
is cut off.

Any time after a record folder is eligible for cutoff, the records manager may elect to cut off
the folder. Because a record series acts to define the retention/disposition process, it can
never be cut off itself—all cutoff and further disposition events must occur at the folder
or record level. While the records management application maintains the status of cutoff
eligibility, it is the records manager who must initiate cut off—there is no automatic cut
off of folders by the records management application. Cutting off a folder prompts the be-
ginning of the retention period and also closes and inactivates folders located within time
series. During the interval between any folder being closed and being cut off, regardless of
cutoff eligibility, the records manager can reopen the folder, allowing for further filing and
re-activation of records. For event and time-event series, this implies that the event did
not occur, clearing the original event date and removing any cutoff eligibility the folder
may have had.

10
Retention

The first retention period, known as the hold period, can be of any duration, including
zero. Once the retention period is over, the records in a folder are said to become eligible
for disposition. During the hold period, the records are stored within the current file area
and must still be accessible within the system. At any time during the hold period, the
records manager may choose to un-cut off folders within an event or time-event series.
This would be done primarily to invalidate inappropriate event eligibility and has the
same effect as reopening a non-cutoff folder. Because there would be no reason to invali-
date time-based eligibility, the records manager should not be able to un-cut off folders
contained within a time series. When a folder is un-cut off, the records management
application changes the status of the event to a non-occurred status. Regardless of dispo-
sition eligibility status, the hold period does not end until a further disposition action is
performed on the specific record folder, moving it out of the current file area.

Disposition

After the hold period is over, inactive documents can be subject to one or more disposi-
tion actions. There are two types of available disposition actions that must be handled by
the records management application: interim transfers and final disposition. Zero or more
interim transfers can be selected. If selected, these actions will be applied in sequence
and there will be a retention period between each transfer. The available actions for final
disposition are accession and destruction. They always occur after any and all transfers
have taken place. At most, one final disposition can be chosen.

Interim transfers and final dispositions also differ in their eligibility requirements. The
eligibility requirement for a final disposition is a strict rule—a final disposition cannot
be performed if the record folder is not specifically eligible for it. Interim transfers are
much more lenient, however, allowing for transfers to take place when they are not neces-
sarily eligible, in different order than outlined by the record series, or even to be outright
skipped. This is because the record is still under the authority of the original institution
and they can choose how to handle it.

Transfer is the act of moving records out of the current storage area. For physical records,
this might entail moving boxes of records out of prime office space into low-cost ware-
houses. For electronic records, this might mean exporting the documents to optical media
and then deleting the online copies.

Destruction is the act of permanently destroying documents. For most records manage-
ment applications, this is deletion. Records located within record series designated as
containing permanent records cannot be destroyed.

11
 Accession is very similar to transfer. The difference is that transfer involves movement of
records while still maintaining authority over them, whereas accession is the transfer of
responsibility and authority over the records to another organization, generally for archival
purposes. Records with no final disposition are held inactive but available for access in
perpetuity.

The records management application must allow for the exporting of entire record folders
and their metadata values for transfer and accession events. Following confirmation of a
successful transfer, the records management application will be instructed to maintain
the records, maintain just the metadata or completely delete the records. Accession or
destruction events require the records management application to delete the electronic
records, although the records manager must be allowed to specify whether to save and
store the associated metadata components. Following each transfer, the next action may be
another transfer, or it may be a final disposition. No action is taken upon the record after
final disposition.

Freezing
At any time, a folder may be frozen by the records manager. The records management
application must also request a freeze reason upon freezing. The act of freezing a folder
halts all dispositions on it. Furthermore, when a folder is frozen, no records can be
removed from it, regardless of whether they were in the folder when the freeze event
occurred, and no records in the frozen folder can be modified. If the folder is active, then
the folder cannot be cut off, even if the folder would normally be eligible for cutoff. If the
folder is being held as inactive, it will not enter disposition, even after the retention period
is over. If the folder is held in disposition, it will not progress to the next action. A frozen
folder may be unfrozen by the records manager once it can re-enter normal reten-
tion/disposition.

12
Choosing a Records Management Application
Records management systems require special considerations above and beyond a document
management system.

• The records management application should support custom searches based on

record properties, retention or disposition properties, full-text content, template
fields, folder location, sticky-note contents and more.

• It should be possible to save search results in a usable format, such as an Excel®
spreadsheet.
• The application should manage the full life cycle of the record, from document
creation through declaration as a record to final disposition.
• The application should provide detailed reports of which records are eligible for
transfer, accession or deletion.
• There should be audit trails to track all system activity.

Transparent records management

The fundamental concept behind records management is the idea that records have a defi-
nite life cycle that involves various stages. For example, when a record is created, it must
be filed according to a well-defined file plan so that it will be easily accessible to autho-
rized users. Similarly, once a record has been retained for a specified time period, it may
need to be destroyed in order to comply with state and federal regulations.

With transparent records management, records management requirements do not inter-

fere with your line of business. Transparent records management allows records managers
to retain control over the way information is categorized and filed outside of the view
of everyday users of the system. A full-featured records management application should
offer a “check-in/check-out” feature, which is a collaboration feature allowing multiple
users to modify documents and track changes while still having the safety of keeping
documents from being overwritten. More than a simple version control, this feature en-
sures the security of documents before they are saved permanently.

Records management staff in departments utilizing documents in a primary role generally

understand your records management needs and will make sure the records management
application will work for all departments, including those that use documents in a
supporting role. In fact, one of the greatest strengths of a digital records management sys-
tem lies in the way it enables records managers to create a file plan and manage retention
schedules without interfering with any department’s line of business. A well-designed
system will handle records management transparently, meaning that once it is set up,
users will not have to actively participate in the process, while records managers still have
control over ultimate file indexing, archiving and disposition. Furthermore, the system
will enable records managers to more easily apply consistent policies to records in a
variety of media, from Web content to archived e-mail messages to audio and video files.

13
Legal considerations

Legally, records must be trustworthy, complete, accessible, admissible in court and

durable for as long as the retention schedule requires. Records management applications
are uniquely positioned to help records managers meet these requirements. Whereas
paper files are vulnerable to fire, flood and theft, digitized files enjoy multiple layers
of protection. Security features protect records from tampering or unauthorized release,
while auditing functionality allows you to monitor the actions users take on a record. To
assist in disaster recovery planning, records management software enables you to copy
records to disc or other unalterable media for off-site storage. If an incident occurs,
you can typically restore your archives in a matter of minutes, which allows you to
access the critical information you need to respond effectively and to ensure organiza-
tional continuity.

Because Web content plays an increasingly large role in service delivery, effective man-
agement of Web records is also critical to mitigating risk. Using a records management
application, you can take snapshots of your Website at regular intervals and retain these
files according to a specified retention schedule. These records will prove highly useful in
the event of a legal challenge, or if the original Web content is compromised or lost.

14
Conclusion:
Records Management in Today’s Organizations
Once a file plan has been established in an organization, a records management applica-
tion will manage the document life cycle as defined within each record series. Users
simply file records in the appropriate folder, and they will be prompted to enter any
required metadata that hasn’t been automatically captured. The records management
application will then take over.

Records managers can run reports detailing where records are in their life cycle, which
records should be reviewed and which records are eligible for transfer, accession
or destruction. Additionally, all system activity is logged, providing an audit trail that
tracks the entire life cycle of the records that can be used to prove adherence to the re-
cords management plan and adherence to legislation and/or compliance with regulations.

While their records management requirements might not be as detailed as the DoD standard,
organizations can use all or some of the tools provided to implement a solution that fits
their exact needs. The right records management application will provide all the tools
necessary to design and implement a DoD-compliant file plan for the management of all
imaged, electronic and physical records.

15
The Laserfiche Institute teaches staff, resellers, and current and prospective clients how to
use Laserfiche most effectively. As part of this mission, the Institute conducts more than
500 Webinars each year, covering a variety of topics. The Institute also hosts an annual
conference where members of the Laserfiche community attend presentations and network
with each other to share ideas and learn best practices. Additionally, the Institute conducts
a number of regional training sessions and provides resellers with content for over 100 user
conferences each year.

The Institute also develops and distributes educational material through the Laserfiche
Support Site. On this Website, clients can access training videos, participate in online
forums and download technical papers and presentations that help them become even
savvier EDMS users.

For more information, contact:

[email protected]

Laserfiche
3545 Long Beach Blvd.
Long Beach, CA 90807
United States

Phone: 562-988-1688
Toll-free: 800-985-8533 (within the U.S.)
Fax: 562-988-1886
Web: www.laserfiche.com

16
© 2008 Compulink Management Center, Inc. All rights reserved. Laserfiche is a division of Compulink Management Center, Inc.
Laserfiche is a registered trademark of Compulink Management Center, Inc. All other trademarks are properties of their respective
companies. Due to continuing product development, product specifications and capabilities are subject to change without notice.
Printed in the USA.