Innovative Ideas for Making IG Happen!

50TH YEAR

AN ARMA INTERNATIONAL PUBLICATION MAY/JUNE 2016

Innovative Ideas for Making IG Happen! Page 20 Quarterbacking a PST Reduction Project: How to Get to the End Zone – No Matter the Opposition Page 24 Applying Archival Appraisal Concepts to Information Lifecycle Management Page 29 Don’t get burned by MISMANAGED INFORMATION.

Your amount of sensitive customer and business data is doubling by the year. And a little loss could have a big impact on your bottom line. Now more than ever, the way you manage your company’s information matters. Find out where you stand with the Next Level Information Governance Assessment. Through this self-administered online assessment tool, you’ll discover areas of strength. You’ll also uncover opportunities for improvement. In the end, you will be empowered to increase your organizational transparency and data integrity. Start turning information into an asset by visiting arma.org/nextlevel. 50TH YEAR

MAY/JUNE 2016 VOLUME 50 NUMBER 3

DEPARTMENTS 4 INFOCUS A Message from the Editor

6 UPFRONT News, Trends, and Analysis FEATURES 20 FELLOWSFORUM Innovative Ideas for Making IG Happen! Susan Cisco, Ph.D., CRM, FAI, and Sue Trombley, IGP, FAI 24 Quarterbacking a PST Reduction Project: How to Get to the End Zone – No Matter the Opposition 20 Ben Greene, CRM 29 Applying Archival Appraisal Concepts to Information Lifecycle Management Stephen Cohen, CRM

SPOTLIGHTS 34 GOVERNMENTRECORDS Establishing a Duty to Document: The Foundation for Access to Information Marc Kosciejew, Ph.D.

38 BUSINESSMATTERS Systems Automation: A Way to Reduce RIM Risk 24 Joao Penha-Lopes, Ph.D. SPECIAL SECTION 42 50THYEAR 50, 25, 10 Years: A Look Back...

44 INREVIEW Information Lifecycle Considered in Context of the Electronic Ecosystem Meg Scofield 45 INREVIEW 29 UK Copyright Law Made Clear for Information Professionals Sarah R. Demb

CREDITS 47 AUTHORINFO

48 ADVERTISINGINDEX

MAY/JUNE 2016 INFORMATIONMANAGEMENT 1 Publisher: Robert Baird, IGP, PMP Editor in Chief: Vicki Wiler Contributing Editors: Nikki Swartz, Jeff Whited Art Director: Brett Dietrich Advertising Account Manager: Jennifer Millett

Editorial Board: Sonali Bhavsar, IBM • Alexandra Bradley, CRM, FAI, Harwood Information Associates Ltd. • Sara Breitenfeldt, PepsiCo • Marti Fischer, CRM, FAI, Wells Fargo Bank • Uta Fox, CRM, Calgary Police Service • Mark Grysiuk, CRM, CIP • Parag Mehta, Esq. • Preston Shimer, FAI, Records Management Alternatives • Sheila Taylor, IGP, CRM, Ergo Information Management Consulting • Stuart Rennie, Stuart Rennie Consulting • Karen Shaw, CRM, BSP Consulting • Mehran Vahedi, Enbridge Gas Distribution Inc. • Jeremy Wunsch • Penny Zuber, Ameriprise Financial

Information Management (ISSN 1535-2897) is published bimonthly by ARMA International. Executive, editorial, and advertising offices are located at 11880 College Blvd., Suite 450, Overland Park, KS 66210.

An annual subscription is included as a benefit of professional membership in ARMA International. Nonmember individual and institutional subscriptions are $150/year (plus $20 shipping to destinations outside the United States and Canada).

ARMA International (www.arma.org) is a not-for-profit professional association and the authority on governing information as a strategic asset. Established in 1955, the association’s approximately 27,000+ members include records and information managers, information governance professionals, archivists, corporate librarians, imaging specialists, legal professionals, IT managers, consultants, and educators, all of whom work in a wide variety of industries, including government, legal, healthcare, financial services, and petroleum, in the United States, Canada, and more than 30 other countries around the globe.

Information Management welcomes editorial submissions. We re- serve the right to edit submissions for grammar, length, and clarity. For submission procedures, please see the “Author Guidelines” at http://content.arma.org/IMM.

Editorial Inquiries: Contact Vicki Wiler at 913.217.6014 or by e-mail at [email protected].

Advertising Inquiries: Contact Jennifer Millett at +1 888.277.5838 (US/Canada), +1 913.217.6022 (International), +1 913.341.3742, or e-mail jennifer.millett@ armaintl.org.

Opinions and suggestions of the writers and authors of articles in Information Management do not necessarily reflect the opinion or policy of ARMA Inter- national. Acceptance of advertising is for the benefit and information of the membership and readers, but it does not constitute official endorsement by ARMA International of the product or service advertised.

Periodical postage paid at Shawnee Mission, KS 66202 and additional mailing office.

Canada Post Corp. Agreement No. 40035771

Postmaster: Send address changes to Information Management, 11880 College Blvd., Suite 450, Overland Park, KS 66210.

2 MAY/JUNE 2016 INFORMATIONMANAGEMENT

INFOCUS A Message from the Editor

‘Seize the Day’ and Lead the Way for a Successful Information Program

to improve information availability, and who benefits from it – enables streamline processes, ensure compli- RIM professionals to determine its ance, control risks, and protect intel- value with respect to business needs lectual assets in their organizations. and regulatory requirements and to Another feature article, by Ben calculate how long it needs to be pre- Greene, CRM, underscores the im- served before it starts to pose a risk. portance of working with IT if one With these articles, we trust of your RIM goals is to reduce the that this publication is continuing volume of e-mail saved as personal to uphold the tradition of “providing storage table (PST) files on users’ lo- a continuing chronicle of our profes- cal drives. While IT may have been sion’s growth and acceptance as a behind the prevalent practice of stor- meaningful approach to information ing Outlook e-mails as PST files, you management” that was begun in can cut the expense and difficulty 1967 with the initial publication of of managing these files by following this magazine’s predecessor, Records Greene’s advice in “Quarterbacking Management Quarterly (RMQ). Hav- a PST Reduction Project: How to Get ing learned of the recent passing of his issue’s articles reinforce to the End Zone – No Matter the Op- RMQ’s founder and long-time editor, the imperative of seizing – position.” William Benedon, CRM, FAI, at the even creating – opportunities Collaborating with IT is also image of 92, we take time to remember Tto collaborate with other infor- portant for those who want to auto- and honor him – not only for this, but mation governance (IG) stakeholders mate systems as a way to improve the for the breadth of his pioneering work to ensure that your organization’s way their organizations manage in- that has been integral to the success information is successfully governed formation. Joao Penha-Lopes, Ph.D., of the RIM profession and this asso- and managed. describes the benefits of automation ciation. Please take time to do some In their cover article, Susan Cisco, in reducing RIM risk in the Business “Looking Back” at his legacy in the Ph.D., CRM, FAI, and Sue Trombley, Matters sub-feature that begins on special section that begins on page 42. IGP, FAI, provide a number of inno- page 38. Also, don’t forget to browse this vative ideas for “making IG happen,” Close collaboration with key issue at http://imm.arma.org to and they all involve records and in- business units is necessary, too, for access several pages of “Bonus Con- formation management (RIM) pro- those who might want to borrow ap- tent” found only online. fessionals taking the lead in collab- praisal concepts from their archives As always, we’re eager to hear orative projects with IG stakeholder colleagues and apply them to infor- from you about the content you need groups, including legal, compliance, mation lifecycle management. In his to advance your career and your or- audit, IT, and lines of business lead- feature article, Stephen Cohen, CRM, ganization’s RIM or IG program. You ers. In five case studies, they share tells how appraising information – can reach us at [email protected]. how RIM professionals were able to determining what the information is, leverage business disruptions and where it came from, how it was used, Vicki Wiler collaborate internally and externally when it was created, who created it, Editor in Chief

4 MAY/JUNE 2016 INFORMATIONMANAGEMENT

UPFRONTNews, Trends & Analysis

E-DISCOVERY Scheindlin to Step Down From U.S. District Bench

he author of the landmark mation. Zubulake put companies Zubulake decision is retir- on notice that they have a duty to Ting her gavel. U.S. District preserve data once they reasonably Court Judge Shira Scheindlin, for anticipate they might be sued, ac- the Southern District of New York, cording to the ABA Journal. Simi- who has presided over many high- larly, lawyers can no longer simply profile cases and made ground- initiate a hold; they now have an breaking e-discovery decisions, obligation – thanks to Zubulake – EHRS plans to leave the bench for private to oversee the compliance process. Former Dept. of practice in New York City, The New The sanctions for not doing so can York Law Journal has reported. be harsh and crippling. Veterans Affairs Nurse Scheindlin told her colleagues According to the ABA Journal, Falsified Records in a written letter that she also Zubulake imposed a far-reaching plans to spend time mentoring, lec- duty to preserve on every business in the United States, as well as any former registered nurse at turing, and working on alternative company in the world that does Veterans Affairs (VA) Medi- dispute resolution, including work business with the United States. cal Center in Miami will as “an arbitrator and mediator and A “Up until that opinion, the spend 60 months in prison after in other neutral capacities with rules of the game for preserving pleading guilty to altering and fal- the hope of doing a fair amount sifying VA computer records. The court record states that En- rique Martinez Mathews interfered with an internal investigation at the medical center related to the death of a veteran in Martinez’s care. The investigation revealed that Marti- nez had altered the patient’s records while the patient recovered in the surgical intensive care unit. Because of Martinez’s actions, appropriate medical treatment was withheld from the patient, who later passed away. Martinez then altered more records to try to hide his prior actions. of public interest work, as well as docs were simple and clear. When Special Agent in Charge Monty working on commercial matters.” the other side was interested in Stokes said, “This investigation rep- Scheindlin, 69, was appointed getting a document, they’d send resents the VA OIG’s commitment to the Southern District of New over a request for it and, putting to investigate obstruction as well as York by President Bill Clinton in aside objections, that’s when the alterations of medical records that 1994. Over the years, she made a duty attached. Scheindlin came needlessly compromise veterans’ name for herself as an expert on along and said ‘no more.’ She care and subject them to harm. We e-discovery in a series of opinions changed the rule – and in doing will continue to vigorously investi- in Zubulake v. UBS Warburg start- so, she created an industry, as gate employees whose actions cor- ing in 2003. well as a drastic mess for corpo- rupt the integrity of VA’s healthcare Of course, that decision changed rate America,” Catalyst CEO and records relied upon by VA clinicians the way companies and lawyers ap- former lawyer John Tredennick who treat our nation’s heroes.” proach electronically stored infor- told the ABA Journal.

6 MAY/JUNE 2016 INFORMATIONMANAGEMENT PRIVACY E-RECORDS B.C. Information and Report: E-Gov Exacerbates Records Challenges in Privacy Commissioner Developing Nations to Step Down n its 2016 World Devel- opment Report, “Digital ritish Columbia Information IDividends,” the World and Privacy Commissioner Bank assesses the impact BElizabeth Denham has an- of digital technologies on nounced that she will step down countries’ development when her term ends in July to and concludes that these become the United Kingdom’s new technologies have been information commissioner this sum- disappointing and unevenly mer. She has served for the past distributed despite boosting growth, expanding opportunities, and six years. improving service delivery. For digital technologies to benefit everyone “I leave believing that the in- everywhere, the report says countries need to strengthen regulations dependence and impartiality of to ensure competition, adapt workers’ skills to the demands of the new this Office economy, and ensure that institutions are accountable. has served the The World Bank report draws on a number of background papers public well,” that are also provided to the public. In “One Step Forward, Two Steps she wrote in Backward? Does EGovernment Make Governments in Developing her resigna- Countries More Transparent and Accountable?,” Victoria Lemieux, tion letter. Ph.D., CISSP, discusses the unintended consequences and risks for “I also leave transparency and accountability associated with the way digitally knowing that recorded information is produced and managed by the public sector government’s in developing countries. awareness of Denham According to the paper, many countries are in the process of tran- the importance of privacy and se- sitioning from primarily paper-based administrative systems to digital curity of personal information, the systems by implementing information and communication technology need for good record keeping of gov- (ICTs) as part of their e-government initiatives. The presumption is ernment decisions and the public’s that this transition should improve accountability and transparency right to know have been enhanced by making information more readily accessible. Lemieux points out during my tenure.” that the transition has not necessarily been a positive one. Denham has been outspoken on “In many countries, the introduction of ICTs has brought about a privacy and access to information deterioration in the quality, management, and accessibility of recorded in the province. Most recently, ac- information with concomitant negative impacts upon transparency cording to CBC News, she wrote a and public accountability mechanisms, such as the operation of right scathing report about the provincial to information (RTI) laws,” the report states. The report presents a government’s “triple-deleting” of compelling argument that “e-government or the rising use of digital e-mails in various ministries after technologies for the creation, communication, and storage of informa- whistleblower Tim Duncan alleged tion within public administrations has created new challenges that he was ordered to delete e-mails exacerbate previous weaknesses in recordkeeping systems constrain- related to a freedom of information ing the availability and integrity of information for transparency and request. accountability.” She also has criticized what she called “oral government” within the In most developing countries, the report notes, legislative frame- provincial government, “where works haven’t been updated and are typically inadequate for addressing business is undertaken verbally and e-records and information management concerns. Given all the digital in a records-free way.” She said this forms of information used today to conduct government business, and undermines the freedom of infor- especially with the rise of e-government, the report says there is a clear mation system by leaving little or and present need for public officials and information commissioners to no record of government decision- have better guidance on how electronic data should be collected and making, CBC News reported. managed under public records and RTI laws.

MAY/JUNE 2016 INFORMATIONMANAGEMENT 7 UPFRONT

National Cable & Telecommunica- tions Association issued a statement saying it was “disappointed by Chairman Wheeler’s apparent decision to propose prescriptive rules on ISPs that are at odds with the requirements imposed on other large online entities.”

E-MAIL IRS Begins Digitizing Records

fter years of high-profile mis- steps and congressional scru- Atiny, top IRS officials recently PRIVACY for ISPs, according to CNET. The told the House Oversight and Gov- FCC Seeks Stricter proposed broadband and wireless ernment Reform Committee that rules to give consumers more con- they are working toward improving Privacy Rules for ISPs trol over their data are similar to their processes for retaining and those for cable TV and telephone accessing data. n March, the Federal Commu- services, which the FCC already “We’re making significant prog- nications Commission (FCC) regulates. The rules would: ress,” Ed Killen, director of privacy, Inegotiated a deal with Verizon •• Require ISPs to clearly disclose governmental liaison, and disclo- in which the company agreed to pay how personal consumer data is sure at the IRS, told the committee. $1.35 million for using technology collected, how it’s shared with FCW.com reported that the that enabled marketers to track its third parties, and how it’s used e-mail messages of senior IRS customers’ online activity, CNET by these outside firms executives are being archived in reported. •• Mandate that customers ac- electronically accessible formats The FCC, according to CNET, tively choose to participate in in perpetuity, and the messages wants to make sure that doesn’t the program rather than be happen again, so it has proposed automatically enrolled regulations meant to protect pri- •• Direct ISPs to strengthen secu- vate consumer information by: rity practices for customer data •• Requiring Internet service pro- According to CNET, the regula- viders (ISPs) to obtain custom- tions would also set broadband and ers’ permission before sharing wireless providers apart from Inter- their data with third parties net and social media sites, includ- •• Preventing phone companies ing Google or Facebook, which also and cable operators from re- collect large amounts of consumer of second-tier managers are being purposing and reselling what data that is used for marketing. But stored for 15 years. According to they learn about consumers’ these companies follow different Killen, the IRS is aiming to archive phone or TV viewing activity rules because they are monitored all employees’ e-mail electronically to marketers by the Federal Trade Commission by the end of the year as part of a At its March 31 meeting, the (FTC), which has limited authority plan to move away from an anti- FCC voted to open the proposal for to create specific regulations. The quated approach consisting of print- public comment. Chairman Tom FTC monitors only data collection ing and filing and using backup Wheeler said actual rules likely will practices in an attempt to prevent tapes. be voted on later this year after the misuse or fraud. Moving to an electronic archive comment period ends. Wheeler may be in for a fight will require moving e-mail servers If approved, the proposal would from broadband and wireless in- into two main data centers, said put in place the strongest set of pri- dustry leaders, who have noted IRS Chief Technology Officer Terry vacy regulations ever established the discrepancy. The lobby group Milholland.

8 MAY/JUNE 2016 INFORMATIONMANAGEMENT

UPFRONT

PRIVACY California Judge Orders Release of 10 Million Student Records

federal judge for the East- requested statewide data to prove a court-ordered special master in ern District of California its case that students with spe- electronic discovery. A has ordered the release of cial needs are not being given ad- According to USA Today, the about 10 million California public equate attention. But the parent attorneys reviewing the records school students’ records – includ- groups said they never asked for, are required by a protective or- ing each child’s name, Social Se- nor do they want, students’ per- der to keep the data private and curity number, address, mental sonally identifiable information. confidential. Once the group com- health assessment, medical his- “We asked repeatedly, many pletes its statistical analysis, it tory, and test scores. times, for the data without iden- is required to “either return or In her ruling, Judge Kimberly tifiable information,” the group’s destroy the confidential data at Mueller granted a small, parent- president, Linda McNulty, told the the conclusion of the lawsuit. No run, non-profit group working for San Jose Mercury Sun. She said student’s identifying records will the rights of disabled children ac- the state education department be disclosed to the public,” the par- cess to the sensitive information refused. ent group said. of each student in kindergarten The state said it’s just follow- through 12th grade who has at- ing the judge’s orders. CLOUD tended public school in California “The California Department of since Jan. 1, 2008. The records Education has been fighting vigor- Use of Cloud Apps Rose must be made available to a court- ously to defend the privacy rights 50% in 2015 appointed data analyst so they of students throughout California, can be analyzed on behalf of the but we are required to comply with he average number of cloud Morgan Hill Unified School Dis- the court order in this case,” de- apps a global business uses trict parent group, according to partment spokesman Peter Tira Trose almost 50% to 917 appli- USA Today. responded. cations, increasing 21% alone be- The parent group is suing the The Mercury Sun said it was tween October 2015 and the end of California State Department of not clear why Social Security num- the year, according to Netskope’s Education because it does not bers and other sensitive informa- “Cloud Report.” believe the state requires school tion couldn’t be redacted. The majority of those apps are districts to provide appropriate The court order allowed par- well known, and the top 20 include special education services for chil- ents who wish to opt-out of the Outlook, Lync, OneDrive for Busi- dren needing them, as mandated release of their child’s information ness, LinkedIn, Facebook, Twitter, under federal law. The California to do so by filling out an exemp- and YouTube. Concerned Parents Association, tion form. which advocates for students with After any exemptions are re- disabilities statewide, joined Mor- ceived, the state will turn over the gan Hill’s lawsuit. The state ve- entire database of student data to hemently denies the allegations the plaintiff’s attorneys. According and is defending itself against the to the Mercury Sun, the court or- lawsuit, a spokesman told USA der allows fewer than 10 people to Today. access the student data, and their The Concerned Parents group review will be closely overseen by

10 MAY/JUNE 2016 INFORMATIONMANAGEMENT the State Department last year after good faith, which cannot be rebutted it said it couldn’t find any e-mails by purely speculative claims” that that Philippe Reines, an aide to a better search might have turned Hillary Clinton and former deputy up files. assistant secretary of state, had Overall, the AP found that the sent to journalists. After the law- government censored materials suit, the agency said it found 90,000 it turned over or fully denied ac- documents about correspondence cess to them in a record 596,095 between Reines and reporters. cases, or 77% of all requests. That FOIA When the government says it includes 250,024 times when it said Obama Administration can’t find records, it rarely provides it couldn’t find records, a person detailed descriptions about how it refused to pay for copies, or the gov- Sets FOIA Records searched for them, the AP said. ernment determined the request to Under the law, federal employees be unreasonable or improper. The S. federal government search- are required to make a reasonable White House routinely excludes ers said they could not find a search, and a 1991 U.S. circuit court those cases from its own assess- single page of information in U ruling found that a worker’s expla- ment. Under that calculation, the response to nearly 130,000 Free- nation about how he conducted a administration said it released all or dom of Information Act requests search is “accorded a presumption of parts of records in 93% of requests. for information (about 17%) in the 2015 fiscal year – a record number, according to a new Associated Press E-DISCOVERY (AP) analysis of government data. The AP’s annual review covered UK Court Approves Technology-Assisted Review all requests to 100 federal agencies during fiscal 2015. In 39% of cases – n 2012, the Da Silva Moore v. or 5,168 times – the Federal Bureau Publicis Group ruling allowed of Investigation couldn’t find any Ifor technology-assisted review records. The Environmental Pro- (TAR) and changed the face of dis- tection Agency regional office that covery in the United States by not oversees New York and New Jersey requiring litigants to look at every came up empty handed 58% of the single document. Three years later, time, and U.S. Customs and Border a judge in Ireland ruled in favor of predictive coding in Irish Bank Protection couldn’t find anything in Resolution Corporation Limited & Ors v. Sean Quinn & Ors. 34% of cases. Now, the world’s second-largest discovery market – the UK – has The review had no way to deter- taken a seat at the TAR table. In the case Pyrrho Investments and mine whether more requests last MWB Business Exchange v. MWB Property and others, Master Mat- year involved non-existent files or thews of English High Court allowed the parties to use predictive whether searches for records were coding, marking TAR’s first use in UK courts. not thorough enough. The Obama In his precedent-setting decision, Matthews cited 10 factors that administration told the AP that led him to favor approving predictive coding in the case, including: it completed a record 769,903 re- •• “[t]here is no evidence to show that the use of predictive cod- quests, a 19% increase over the pre- ing software leads to less accurate evidence than, say, manual vious year, despite hiring only 283 review alone” new full-time workers for the issue, •• “there will be greater consistency in using the computer to ap- an increase of about 7%. The num- ply the approach of a senior lawyer towards the initial sample ber of times the government said it (as refined) to the whole document set, than in using dozens, couldn’t find records increased 35% perhaps hundreds, of lower-grade fee earners...” over the same period. According to Legaltech News, proportionality also influenced The AP noted that in some high- Matthews’ decision. He wrote, “The cost of manually searching these profile cases involving federal law- documents would be enormous, amounting to several million pounds suits, the Obama administration at least. In my judgment, therefore, a full manual review of each found tens of thousands of pages document would be ‘unreasonable’...” after it previously said it couldn’t Counsel in the case estimated that the cost of TAR would be much find any. The website Gawker sued lower, between £181,000 and £469,000 pounds, plus hosting fees.

MAY/JUNE 2016 INFORMATIONMANAGEMENT 11 UPFRONT

E-RECORDS STORAGE the longevity of the media it’s Sony Says System Supports 100-Year Data Storage stored on. •• Technology advances/value of information remains: With each technology improvement, legacy data gets harder to retrieve and read. Sometimes data can’t even be migrated to a new application or system, and vendors drop support for older software and hardware. •• Need for long-term planning: To ensure that the information can be retrieved from any media requires long- term planning. The records and information management department must collaborate with the IT department to en- ony has unveiled technology News Service reported. sure that conversion and mi- it says will keep data safe Everspan will start shipping grations plans coincide with Sand sound for up to a century. to customers in July. hardware upgrade plans, and The scalable, jukebox-like optical Long-term storage promises management must allocate library system from Sony Optical are not new, though, and they fail sufficient resources for data Archive Inc., is called Everspan. to address key factors in long-term conversion and migration. It is designed to store, retrieve, data preservation. For starters: Still, the digital storage devic- and read discs that will hold •• Ability to read the data: The es market looks to be a lucrative 300GB, with 150GB on each side. hardware and software needed global business – worth $5.4 billion Capacity is expected to grow to to retrieve the data from any [£3.75 billion] by 2020, according 1TB over the next five years, IDG media are more critical than to a recent Kroll Ontrack article.

E-DISCOVERY Whistleblower Says VW Deleted Data ccording to a lawsuit filed of justice, according to The New by a former employee, York Times. AVolkswagen workers il- Volkswagen of America said legally deleted electronic data in a statement that the claim of soon after the U.S. government wrongful dismissal was “without accused the carmaker in Sep- merit” and that the dismissal was tember 2015 of cheating on emis- unrelated to the emissions issue. sions tests. According to Donovan’s law- The lawsuit filed in Michigan suit, his superiors told him on workers continued to delete elec- accuses Volkswagen of violating September 18 to instruct the chief tronic data until September 21 the state’s whistle-blower pro- information officer (CIO) at the and that even after that date, tection act in the wrongful dis- company offices in Auburn Hills employees destroyed backup missal of information manager not to delete any electronic records data because they felt there Daniel Donovan in December. and that the CIO replied to Dono- was not enough storage space. Donovan says he was fired be- van’s telephone call demanding Donovan said he told IT man- cause his superiors believed he to know why a lower-ranking em- agers they could be accused of planned to report the company to ployee was giving him instruction. obstructing justice and told them U.S. authorities for obstruction The lawsuit claims that IT he did not want to participate.

12 MAY/JUNE 2016 INFORMATIONMANAGEMENT INFO SECURITY tween 2015 and 2020. cial officers agreed with that as- •• The global market is estimated sessment, IBM’s survey revealed. Digital Forensics to Grow to grow at about 14.2% during IBM separated the respondents to $4.8 Billion by 2020 the same period. into three groups: “[The] Digital forensics market 1. Cyber-secured – 17% he business of obtaining, in- is majorly driven by the rate of dig- 2. Growing capability – 56% terpreting, and uncovering ital crimes in a particular region,” 3. Unprepared – 27% Tdigital data from electronic Sowmya Kulkarni, associate busi- The survey found that 79% of devices is gaining momentum and ness consultant at IndustryARC, cyber-secured organizations had won’t slow anytime soon, accord- told Legaltech News. “Globally, the established an office of informa- ing to a recent report from Indus- rate of digital crimes such as data tion security and appointed a chief tryARC. espionage, cyber-based terrorism, information security officer. Just computer intrusions, hacking, mal- 32% of growing capability orga- ware, and so on is relatively higher nizations and 29% of unprepared in the Americas region. According organizations had done the same. to the FBI, in the U.S. alone there “The world of cybercrime is has been report of over 269,422 evolving rapidly, but many c-suite complaints of cybercrimes received executives have not updated their in 2014 with estimated loss of $800 understanding of the threats,” said million.” Caleb Barlow, vice president at The use of digital forensics by IBM Security, in a statement ac- the federal government “contrib- companying the report. “While utes to 45% of the overall market chief information security officers while the legal sector contributes (CISO) and the board can help to 55% of the overall market,” provide the appropriate guidance Kulkarni added. Digital forensic and tools, CxOs [chief executive revenue from the federal sector is officers] in marketing, human re- “Digital Forensics Market estimated to increase from $1.1 sources, and finance, some of the Analysis” says the digital forensics billion in 2015 to $2.1 billion by most sensitive and data-heavy market is expected to grow at an 2020, Legaltech News reported. departments, should be more annual compound rate of just over proactively involved in security 14%, hitting $4.8 billion in revenue CYBERSECURITY decisions with the CISO.” by 2020. The biggest reason for the growth is a heightened focus Survey: CEOs Feel by companies and government on Left Out of cybersecurity and data theft pre- vention, according to the report. Cybersecurity Plans The exponential growth in the volume of data with the prolifera- nly 51% of chief executive tion of a wide variety of mobile officers (CEOs) believe their devices and formats has led to a Oorganization’s cybersecurity rise in the use of digital forensics. strategy is “well established,” ac- IndustryARC said most of the cording to a recent IBM survey. market growth will occur in the The “Securing the C-Suite” survey Americas and also found that: also found that 77% of chief risk •• The digital forensics market in officers (CROs) and 76% of chief the Americas will hold around information officers or chief tech- 60% share by 2020. nology officers feel the same. •• In Europe, the use of digital They may feel this way because forensics in the corporate sec- 55% of CEOs consider themselves tor will grow at a maximum to have “little to no engagement” rate of 19.2% between 2015 in cybersecurity threat manage- and 2020. ment activities, and more than half •• The Asia-Pacific market will of CROs, chief legal officers, chief grow at a rate of 25.2% be- marketing officers, and chief finan-

MAY/JUNE 2016 INFORMATIONMANAGEMENT 13 UPFRONT

PROFESSIONAL DEVELOPMENT Study Reveals Skills RIM Pros Will Need

he records and information time for them to evolve into next- bile devices (53%). management (RIM) profession generation information profession- •• Organizational expectations Tis becoming more technical als with stronger technical, analyti- for RIM professionals will be and more closely aligned with data cal, and management skills and the broad and include soft skills analysts and IT staff, according to confidence to think, mediate, and like innovative thinking (70% the research report “What will it guide,” said Sue Trombley, manag- of organizations) and change take to be a NextGen InfoPro?” from ing director of thought leadership management (70%). Iron Mountain and AIIM. at Iron Mountain. According to Iron Mountain, By 2020, the study revealed, The study also revealed that the study may reveal a mismatch employers expect their RIM pro- over the next three to five years: between what employers expect fessionals to be competent in risk •• The most sought-after profes- and what information professionals management – with 50% of employ- sional RIM capabilities will be currently deliver. The greatest gap ers desiring them to have security related to information acces- is found in the ability to manage and data privacy skills; 47% de- sibility, including the use of change, which is highly regarded manding content and information mobile devices (53% of orga- by 70% of employers, but only half management skills across a wide nizations); data-quality man- of RIM professionals are confident range of formats and platforms; agement, data cleansing, and about having. and 44% seeking data analytic migration (49%); and informa- Iron Mountain suggests that skills. tion security and access control RIM professionals must educate Beyond that, the report sug- (42%). themselves continuously on the gests, employers want RIM profes- •• The demand for technical latest technology, security, and sionals who can identify new op- knowledge will center on in- management developments and portunities for their organization’s formation security systems how each affects their organiza- data and support colleagues during and procedures (68% of orga- tions. The survey found that 79% disruptive changes, such as merg- nizations); enterprise content of RIM professionals are proactively ers, acquisitions, or divestitures. management, document man- enhancing their skills, while only “It’s no longer enough to be a agement, and records manage- 8% are content with their current competent records manager. It’s ment systems (60%); and mo- abilities.

14 MAY/JUNE 2016 INFORMATIONMANAGEMENT 203 Strong. And Growing. Congratulations to these Certified Information Governance Professionals

Mitchell Abrams Melissa Dederer Mary Janicik Lindy Naj Jason Stearns Elizabeth Adkins G. Derk C’Les Jensema Peggy Neal David Steward Pey-Jia Angell Deborah Dotson Chris Johnson Lee Nemchek Melissa Suek Christine Ardern Christina Doyle Todd Johnson Kurt Neumann Lisa Summers Deborah Armentrout Sandra Dunkin Deborah Jostes Sheri Nystedt Paula Sutton DeAnna Asscherick Priscilla Emery Deborah Juhnke Carolyn Offutt Marjorie Swain Randy Aust Sofia Empel Soo Kang James Owens Sheila Taylor Christie Baird Tony Epler Andrew Keller Eleanor Ozaeta Robin Thompson Robert Baird Debra Farries James Kennedy Lewis Palmer Kathleen Timothy Patty Baldacchino Elizabeth Farthing Anju Khurana Jadranka Paskvalin Louis Tirado Salvador Barragan Carol Ann Feuerriegel Ellie Kim Alan Pelz-Sharpe Brian Tretick Christopher Beahn Glenn Fischer Michelle Kirk Graham Pescod Susan Trombley Richard Berlin Matt Fisher Monica Kirsch Denise Pickett Nathan Troup Margaret Boeringer David Fleming Tamara Koepsel Debra Power Brian Tuemmler Isabel Bracamontes Patricia Franks Greta Krapac James Presley Martin Tuip Aaron Bryant Rhonda Galaske Peter Kurilecz Cindy Pryor Amy Van Artsdalen Susan Burd Caroline Gallego Tera Ladner Fred Pulzello Paul Van Reed Kiji Burston Stephen Garner Richard Lang Angel Ramos James Vardon Doug Caddell Charles Garrett Ronald Layel Tony Ratcliffe Katharine Voldal Stacie Capshaw Irene Gelyk Anna Lebedeva Joshua Rattan Jennifer Watters Farley Melissa Carlis Sue Gerrity Gilles Legare Scott Raynes Bridgett Weldner Diane Carlisle Kimberly Giertz Donnell Long Jessica Rickenbach Erik Werfel Laurie Carpenter Susan Goodman Howard Loos Deborah Rifenbark Steven Whitaker Alexander Carte Joshua Grisi John Loveland Carol Rittereiser-Coritt Kristi Whitmore Mark Carter Komal Gulich Eric Lynn David Rohde Jesse Wilkins Peter Casey Jocelyn Gunter Cindy MacBean Donna Rose Marc Willemse Anita Castora Allen Gurney Rudolph Mayer Shawn Ryan Dylan Williams Elizabeth Castro Michael Haley Brian McCauley Kathryn Scanlan Steven Williams Tod Chernikoff Grace Hammar Stephanie McCutcheon Danna Schacter Rick Wilson Carol Choksy Joshua Hargrafen Cheryl McKinnon Tonia Schneider Terri Wilson Vicki Clewes Paula Harris James Merrifield Teresa Schoch Brett Wise Andrew Cogan Matthew Hebert Bruce Miller Terry Schrader Jennifer Witt Julie Colgan Charles Herbek Sandy Miller Karen Schuler Kristin Wood Bud Conner Margaret Hermesmeyer Dana Moore Karen Shaw Robin Woolen Dani Cook Caroline Higgins Dermot Moore Mary Sherwin Jeffrey Yawman Russ Cottle Gordon Hoke Rafael Moscatel William Silvio Cheryl Young Marvin Cross Patricia Huff Linda Muller David Skweres Margo Young Kristen Crupi Janice Hulme Jen Murray Doug Smith Andrew Ysasi Becky Darsch Bethany Hynes Stephen Murray Michael Smith Ryan Zilm Lisa Marie Daulby Nicolas Inglis Deborah Naas Natalie Spano Nicholas De Laurentis Leigh Isaacs Joe Nadzam Brian Starck

Application deadline: November 12, 2016. Register today at www.arma.org/igp. UPFRONT

CYBERSECURITY where security services are hosted, with close to 90% of Global Survey: Only 1 in 5 Organizations Securely respondents preferring or re- Manages User Identities quiring data centers that deliver IAM services to be located rganizations are rapidly de- technologies and user preferences. within their country or region. veloping and hosting new on- According to the results, allowing “The days of logging into a com- Oline services but frequently users to log in securely with their pany’s system with a username and under-invest in adequate cyber- existing social identities is the goal password specific to that organiza- security measures, according to a of many companies. tion are numbered. Users aspire to recent global survey by Capgemini The report also revealed that: log in from anywhere in a variety and RSA. •• Adaptive authentication is ex- of ways, including with social me- The survey, “Identity Crisis: pected to define the future of dia profiles and existing email ac- How to Balance Digital Transfor- mation and User Security?,” polled more than 800 C-level executives in Benelux and the Nordics, France, Germany, the UK, and the United States and found that 62% consider it critical or very important for their organizations to securely enable or extend access for users to digital services, but only 26% have the technology in place to do so. “As organizations extend to the cloud they must ensure they have solutions in place that address the risk and threats associated with assuring user identities,” Jim Ducharme, vice president of identity products at RSA, said in a news release. “These solutions must understand who is accessing what; manage that access effectively; and control access across the various cloud services. These elements are absolutely essential to giving the organization the assurance that users are who they say they are in a cloud environment.” Eighty-four percent acknowl- device and service access for count,” said Mike Turner, COO of edged they need to offer more users. Most organizations – Global Cybersecurity at Capgemini flexible, adaptive authentication 84% – consider the ability to Group. “The ownership of online methods and IDs, according to the deploy such authentication and identities is moving away from the survey. And, the survey showed, offer users more access options organization to more flexible and companies are trying to do just a high or very high priority. secure services maintained by the that: 68% have increased their •• For most companies (85%), it user, addressing access manage- identity and access management is critical or very critical to add ment needs.” (IAM) budgets, with 28% reporting new services underpinned by Turner added that while it is a “strong” increase. cloud technology quickly and good to see increasing recognition The survey also revealed that efficiently and to ensure these and investment from senior lead- the way IAM is being viewed and are supported by IAM. ership, most organizations have implemented is changing, as a •• U.S. and European organi- a long way to go before reaching result of maturing and emerging zations are very sensitive to that goal.

16 MAY/JUNE 2016 INFORMATIONMANAGEMENT quired to comply with the HIPAA fiscal year. Privacy Rule. This must change,” Thirteen agencies achieved a wrote Jocelyn Samuels, director “moderate” grade between 65% of the HHS Office for Civil Rights and 90%, including the remain- (OCR). ing top-five finishers: Department The OCR has released the first of Justice (89%), Department of of what will be a series of Frequent- Homeland Security (DHS) (86%), ly Asked Questions documents, Nuclear Regulatory Commission as well as a fact sheet, covering (86%), and National Aeronautics patients’ general rights to their and Space Administration (85%). EHRS protected health information, what Scoring less than 50% were the Survey: Patients data is excluded from that right State Department (34%), Depart- to access, how an individual may ment of Housing and Urban Devel- Lack Online Access to request access, and how an entity opment (39%), Department of Ag- Health Records must provide the information. riculture (43%), and Department of

ccording to a recent survey of 502 consumers planning Ato enroll in a health plan in 2016, 53% of patients say they have no online access to their healthcare data. The survey, conducted by healthcare technology company HealthMine, also found: •• 32% have had difficulty accessing their medical records at all. •• 29% have had difficulty accessing their lab records. •• 29% have had difficulty ac- GOVERNMENT RECORDS Transportation (48%). The Depart- cessing their insurance infor- U.S. Agencies Less ment of Defense was deemed too mation. large to receive an accurate grade, •• 25% have had difficulty access- Cyber-Secure in 2016 according to Legaltech News. ing their prescription history. The report found federal agen- However, according to Fierce- any large U.S. federal cies reported 77,183 cybersecurity HealthIT, the Office of the National agencies are less secure incidents, a 10% increase over Coordinator (ONC) for Health IT Mnow than they were in the 69,851 incidents reported in recently reported that online access 2015, according to an Office of FY2014. to medical records is growing for Management and Budget (OMB) According to the OMB, the consumers – from 28% in 2013 to report. Overall, the average “cy- president’s FY2017 budget, which 38% in 2014, the ONC reported. bersecurity assessment score” for includes $19 billion in cybersecu- A $10 million infusion of new the reporting agencies was 68% rity resources, may help. It would funding to expand the OpenNotes for the fiscal year, down 8% from lead to the creation of the Infor- program to 50 million patients the previous fiscal year,Legaltech mation Technology Monetization nationwide may help boost those News reported. Fund, which aims to facilitate “the numbers. The program, which According to the OMB’s fiscal retirement of the Government’s gives patients real-time access to year 2015 “Federal Information antiquated information technol- their doctors’ clinical notes, has Security Modernization Act” re- ogy (IT) systems and transition to grown to cover 5 million patients, port to Congress, of the 24 federal more secure and efficient modern FierceHealthIT reported. departments and agencies named IT systems, funding to stream- “Based on recent studies and within the CFO Act of 1990, only line governance and secure Fed- our own enforcement experience, the General Services Administra- eral networks, and investments far too often individuals face ob- tion – at 91% – scored above 90%, to strengthen the cybersecurity stacles to accessing their health in contrast to the eight agencies workforce and cybersecurity edu- information, even from entities re- that scored above 90% in the 2014 cation across the nation.”

MAY/JUNE 2016 INFORMATIONMANAGEMENT 17 UPFRONT

tionality, he wrote that [Rule 26(b) it had produced to identify which (1)] “states, as a fundamental prin- documents were relevant to its re- ciple, that lawyers must size and quests. However, the court did not shape their discovery requests to appreciate the request. the requisites of a case. Specifical- First, the court said that being ly, the pretrial process must pro- “mired in continuous disputes over vide parties with efficient access the appropriateness of discovery to what is needed to prove a claim served and the adequacy of re- or defense, but eliminate unneces- sponses” for “six months ... is not sary or wasteful discovery.” what the Federal Rules intended.” E-DISCOVERY The federal court of the District Thus, the court’s ruling called the Courts Applying New of Colorado must have taken note defendant’s requests “omnibus re- of Roberts’ writings; it referenced quests” and said that they were FRCP Amendments in them in Kissing Camels Surgery “improper on their face.” It also Discovery Cases Center v. Centura Health Corpora- criticized the defendant for not try- tion (D. Colo., Jan. 22, 2016). ing to tailor definitions of requests The case, which concerned an ourts have not hesitated to to the specific case as well, often antitrust dispute for ambulatory employ the December 2015 including boilerplate terms such as surgery centers, examined both amendments to the U.S. “including, without limitation, any C sides’ production requests after [long list], or any other person(s) Federal Rules for Civil Procedure the defendant asked the plaintiff (FRCP) in rulings on preservation, acting or purporting to act with or to go through the terabyte of data proportionality, and specificity. on behalf of the foregoing.” END In one recent example, NuVa- sive v. Madsen Med. (S.D. Cal. Jan. RETENTION 26, 2016), a court in the Southern District of California cited amend- Most UK Businesses Keeping Too Much Data ed Rule 37(e) in allowing the plaintiff to vacate a prior order that eventy-five percent of businesses in the United Kingdom (UK) imposed an adverse inference for can’t differentiate between a record that must be retained and failing to preserve text messages. Sdata clutter, according to a recent survey conducted by Crown Under the previous Rule 37(e), Records Management. the court said that NuVasive had The survey, which polled IT decision makers in UK organizations spoliated evidence by not saving with more than 200 employees, also found that: messages of four employees who •• 55% do not have an e-mail retention policy in place. were key to the case, and it denied •• 58% do not audit their paper-based data regularly or destroy NuVasive when it tried to make data that is no longer required. a similar claim against Madsen. •• 60% do not regularly review what data is stored in the cloud But, the court did not say that or onsite. NuVasive had intentionally failed •• 64% do not filter what goes into the cloud. to preserve the text messages, and •• 76% do not have systems in place to help them distinguish be- as the court noted in its January tween records that must be retained and other information. ruling, intention matters. The new “These results suggest businesses still aren’t wising up to the rules allow an adverse inference importance of basic common-or-garden records management principle for failure to preserve ESI “only despite the high level of publicity for breaches,” said Mike Dunleavy, upon the finding that the [spoliat- head of customer development and experience at Crown Records ing] party acted with the intent Management, in a news release. to deprive another party of the information’s use in the litigation.” The FRCP amendments got the U.S. Supreme Court’s attention as well. In the court’s 2015 “Report on the Federal Judiciary,” Chief Justice John Roberts addressed the changes. Discussing propor-

18 MAY/JUNE 2016 INFORMATIONMANAGEMENT NEW in the Bookstore

Records and Information Management Fundamentals of Professional Practice 3rd Edition

Records and Information Management: Fundamentals of Professional Practice,

3rd. Ed. William Saffady, Ph.D. William Saffady, Ph.D.

The new edition of this best-selling text has been thoroughly updated and expanded to include more international content and to cover topics not in previous editions, such as information governance and data protection. It is the “go to” book for newly appointed records managers; experienced professionals who want a review of specific topics; supervisors who oversee records management functions; decision makers who develop strategies and tactics for managing information assets; and for students in records management or allied disciplines, such as library science, archives management, information systems, and office administration.

A5026 $85.00 Professional members: $60.00 V5026 PDF $80.00 Professional members: $55.00

Order online today!

www.arma.org/bookstore FELLOWSFORUM Innovative Ideas for Making IG Happen!

Five case studies highlight how records and information management professionals recognized and seized opportunities to enlighten their organizations about the power of information governance (IG) by taking innovative and practical actions to link IG to their organizations’ bottom line.

Susan Cisco, Ph.D., CRM, FAI, and Sue Trombley, IGP, FAI

20 MAY/JUNE 2016 INFORMATIONMANAGEMENT he benefits of information nization’s business goals. In almost simply had no access to files they governance (IG) are now ac- every publically traded and private required to deliver on client commit- knowledged by most indus- business, revenue generation will be ments. Suddenly, attention shifted to tries, and most agree that at the top of the list; the demands the notion of imaging client files and records and information of shareholders and investors must storing them in a secure but accessible Tmanagement (RIM) is not a synonym be met for continued success. For and collaborative content manage- for IG but rather a component of IG, governments, meeting the needs of ment system – the domain of the RIM alongside compliance, e-discovery, the citizenry is tantamount. So, it is staff, who seized the initiative. privacy, and security. logical that savvy RIM professionals Along with creating specifications That said, IG program adoption in align their programs’ activities with and leading vendor selection activi- organizations of all sizes is lagging. being profitable, staying competitive, ties, the RIM team participated in The degree to which they embrace and delivering on a mission statement. updating the mobile use policy and IG varies widely; many adopt only This article shares five case studies conducted training to ensure informa- components of the IG framework in about what some RIM professionals tion is protected according to policy organizational silos, which under- have done to enlighten their organi- and client expectations. All of these mines their organizations’ ability to zations about the power of IG and undertakings have raised the firm’s effectively mitigate risk, cut costs, discusses the vital role they played awareness of information availabil- and leverage the value of information. through innovative and practical ity and protection – and about the While it is ideal to have an IG actions. strength and relevance of the RIM council and/or chief information gov- They highlight unique drivers for team. ernance officer to help ensure enter- IG and the “hooks” these profession- prise-wide IG program implementa- als used to successfully link IG to the Case 2 tion, the chance for those positions bottom line. Sometimes their hook was IG Streamlines Processes being established is slim when there is carefully planned, while other times In the oil and gas industry, com- a lack of understanding, sponsorship, they seized on an unexpected and ser- modity pricing has diminished bud- or resources. It is important for RIM endipitous occurrence. Though these gets and the ability to commit resourc- professionals facing these obstacles cases are taken from organizations in es to new projects. Many exploration, to help their organizations institute specific industry sectors, their lessons production, and oilfield services the components of IG in the best way are applicable across industries and companies have reduced head count, they can. are meant to stimulate readers’ think- eliminated new hires, and delayed or ing about how to promote IG within cancelled technology purchases. RIM Must Take the Lead their own organizations. Forward-thinking RIM profes- To make further progress, RIM sionals have adapted to the boom and professionals must work strategically Case 1 bust cycles of the industry by view- to raise awareness of the importance IG Improves ing the disruption as an opportunity and value of a comprehensive IG Information Availability to streamline enterprise policies and strategy. This is made apparent by Who would have thought the 2015 processes with a focus on efficiency Iron Mountain’s 2015 research “Over- record snowfall in New England could gains and productivity improvements. coming the Disconnect; Establishing be the trigger to raise IG awareness Following are four examples of such Shared Ground between Records and institute new practices? For years thinking. Managers and Business Leaders,” the RIM staff at a particular law firm which indicates 83% of European and had advocated for attorneys to become Consolidating Technology Platforms 70% of North American employers less reliant on paper to manage their Storing information in isolated don’t know what RIM professionals cases. The enduring culture of the platforms undermines an organiza- do. In return, more than half of those practice, though, was to be present tion’s ability to effectively mitigate RIM professionals surveyed admitted in the office with records stored in risk, cut costs, and leverage the in- they are not sure what their senior efficient filing systems. When attor- formation value. To save money and leaders or other functions across the neys ventured out of the building, they reduce risk, RIM and IT collaborated enterprise expect of them. carried a briefcase full of paper files. to identify all platforms and then ap- When significant snowfall disrupt- plied retention and security controls Align IG with Business Goals ed or halted transportation into the as applications and systems were First and foremost, RIM profes- office for consecutive days, casework consolidated and obsolete systems sionals must understand their orga- was negatively impacted; attorneys were decommissioned, eliminating

MAY/JUNE 2016 INFORMATIONMANAGEMENT 21 FELLOWSFORUM

unnecessary licensing fees and main- oil and gas industry seek opportuni- minimal centralized control, the RIM tenance costs. ties to raise the visibility and priority manager assembled regional records of RIM. In this cycle’s “bust,” stream- managers who agreed to put a plan Being Involved in Mergers, lining policies and processes, whether in place to standardize and “globalize” Acquisition, Divestitures through consolidation of technology their records retention schedule to A downturn in the oil and gas in- platforms, streamlined retention man- answer the call for consistency. dustry creates merger, acquisition, agement, or collaboration on MAD In this example, the assertive and divestiture (MAD) activity as com- teams, is proving to be successful. actions of a seasoned RIM profes- panies consolidate to manage scarce sional helped jump start his firm’s resources. Earlier MAD initiatives Case 3 IG program. had created separate work teams of IG Ensures Compliance due diligence business analysts, legal Consulting firms are expected to Case 4 counsel, internal business experts, meet and prove compliance with their IG Controls Risk Financial services have been on …the assertive actions of a the front line of strict regulatory control for years now, and there are more seasoned RIM professional helped regulations on the horizon with the prospect of even heavier fines. Ac- jump start his firm’s IG program. cording to the U.S. Securities and Ex- and IT systems support, as well as clients’ increasingly rigorous require- change Commission’s (SEC) “FY 2016 “islands of information” that left in- ments for protecting their informa- Congressional Budget Justification,” formation assets at risk of being or- tion. And if the firm is global, clients the SEC is planning to hire 225 addi- phaned or lost. also require a consistency of practice tional examiners this year, primarily RIM leaders presented executive across all the locations in which busi- to conduct additional examinations of management with a strong business ness is transacted. investment advisers and other staff. case for involvement in the earliest One firm’s savvy RIM manager Given the intense scrutiny by regu- phase of the MAD life cycle to set recognized that satisfying these cli- lators, shareholders, and customers, realistic expectations in merging or ent demands is crucial to the firm’s RIM managers at some of the major divesting information assets. When ability to retain client business in financial services institutions in the MAD teams are formed now, RIM is a highly competitive environment. world have joined with their compli- part of the core team working in uni- Armed with years of global RIM ex- ance and internal audit teams to cre- son throughout the MAD life cycle. pertise, he reached out to the firm’s ate a set of “controls” for major RIM compliance and audit teams to offer functional categories, such as disposi- Streamlining Retention his services. tion, vendor management, and privacy RIM professionals streamlined re- The RIM manager conducted and security. Controls equate to RIM cords retention schedules into fewer workshops to describe how RIM best policy requirements, and each has a record series/categories and made sure practices could help produce content risk-rating system. legal research was up-to-date. If there for audits and ensure that proper Lines of business are required to was no policy on how long to retain the processes for protection and man- conduct a risk self-assessment to iden- “not records,” they engaged with audit, agement are in place. This involved tify problem areas and, working with compliance, IT, legal, and the business discussions about taxonomy updates, the RIM team, drive the implementa- units to establish organization-wide content repository usage, and e-mail tion of corrective actions to prevent, retention rules for temporary and policy revisions. resolve, or mitigate key operational, work-in-progress information – i.e., Barriers to defensible disposition legal, compliance, and reputational an information life cycle. were explored and a new process ad- risks and costs. opted to enable more timely and com- The RIM leaders in each establish- Planning for the Turnaround pliant destruction of records. Lastly, ment contributed their subject mat- The recovery is inevitable, and refresher training was conducted to ter expertise in the creation of the RIM professionals are looking to the remind employees of their RIM re- risk framework; the compliance and future and planning for the additional sponsibilities for both client and firm internal audit teams did not have the workload that is sure to come with the content. depth of knowledge in RIM and IG to turnaround. Although the firm is essentially create the controls or determine their In boom or bust, RIM leaders in the an aggregation of local practices with risk rankings.

22 MAY/JUNE 2016 INFORMATIONMANAGEMENT Case 5 meetings that include presentations The RIM leader at the pharma- IG Protects Intellectual Assets by experts in the IG field. ceutical company engaged the MAD Within the pharmaceutical and PRIMO develops compliance tools, team and is now involved from the life sciences industry, MAD can including a model records retention beginning due diligence phase of seem like a daily occurrence. To re- schedule focused on the records of MAD through the integration of as- move some RIM inefficiencies and biopharmaceutical companies with sets and beyond. inconsistencies during these complex retention recommendations based on transactions, the RIM group leader legal and regulatory considerations. Collaborate Externally at a global pharmaceutical company External collaboration will broad- made sure she had a place at the Lessons Learned: en and enhance your organization’s MAD table. 3 Best Practices network of IG experts. The phar- In addition to a company’s talent, The five case studies highlight maceutical industry has its PRIMO products, manufacturing facilities, that different triggers can be used consortium. ARMA International and and sales and distribution outlets, to raise awareness of IG and differ- AIIM provide industry-focused net- its records are valuable because they ent tactics can improve IG controls, working opportunities to benchmark often contain intellectual property, even in lean times. Emerging from IG best practices and lessons learned. such as research, formulations, clini- these case studies are three practices RIM professionals in the utilities cal trials, and more; they are, in fact, RIM professionals can use to identify industry established URIM month- business assets. opportunities for improving IG and ly telephone conference calls more Armed with this knowledge, the supporting colleagues through dis- than 15 years ago, according to Gail RIM leader engaged the MAD team ruptive times of change. Ann McCreary, a retired Certified and created a process that supports Records Manager. URIM members the identification of records of value, Leverage Business Disruptions have contributed to more effective paper and electronic, in order to in- When significant snowfall dis- regulations and standards by commu- gest them into the receiving systems rupted a law firm’s business, RIM nicating shared goals to regulatory of record with the proper tags and staff seized the opportunity to shift and standard-setting bodies at the security classification codes. attention to imaging client files and federal and state levels. They also reviewed which infor- storing them in a secure but acces- mation (including databases and re- sible and collaborative content man- Seize Any Advantage cords) can be disposed of based on a agement system. A downturn in the The moral of these stories is to redundant, obsolete, and transitory oil and gas industry refocused the seize any advantage that helps raise – often referred to as ROT – analysis RIM team on streamlining policies awareness of IG. Align with business and records retention schedule rules, and processes. priorities, in particular those that reducing the volume of information they take in from the acquisition. External collaboration will broaden The RIM team is now involved from the beginning due diligence and enhance your organization’s phase of MAD through the integration of the assets and beyond, includ- network of IG experts. ing training new employees on the Collaborate Internally relate to revenue generation. Take company’s RIM program. Improve IG controls through full advantage of the emerging best Another tactic to extend a RIM internal collaboration. In financial practices to breathe life into your leader’s value to the bottom line is to services, the threat of increased own organization’s IG journey. RIM collaborate with other companies to regulatory scrutiny compelled RIM professionals now know that IG is broaden and enhance each company’s managers to engage their compliance more than just hype; it’s a neces- network of IG experts. The Pharma- and internal audit teams to create a sity for organizations to retain their ceutical Records and Information set of RIM controls for major RIM competitive edge. END Management Organization (PRIMO) functional categories. is a membership consortium commit- At the consulting firm, the RIM Susan Cisco, Ph.D., CRM, FAI, can be ted to developing and advancing RIM manager assembled regional records contacted at [email protected]. programs in the industry. Members managers to put a plan in place to Sue Trombley, IGP, FAI, can be contacted have learning opportunities quarterly standardize and “globalize” their re- at [email protected]. See with roundtable meetings and board cords retention schedule. their bios on page 47.

MAY/JUNE 2016 INFORMATIONMANAGEMENT 23 Quarterbacking a PST Reduction Project: How to Get to the End Zone – No Matter the Opposition Ben Greene, CRM

Microsoft Outlook’s capability to store e-mail as personal storage table (PST) files on users’ local drives has freed space in employees’ e-mail boxes and has been widely used by many organizations. But managing PST files is difficult and expensive, and many records and information management professionals are looking to reduce PST use significantly. Learn how to take the lead in this reduction effort and ensure that your team makes it to the project’s end zone.

or years, organizations eagerly adopted the Micro- 1. PSTs are susceptible to loss or corruption if there is a soft-provided capability that allows Outlook users to hard drive crash or malfunction unless they are backed store their messages, calendar appointments, and up, which can be expensive to manage. other items as personal storage table (PST) files, or 2. PSTs contribute to the vast amount of stored e-mail, personal folders, on their local hard drives rather which is the most frequently requested data in litigation Fthan in their mailboxes. While this helped alleviate mailbox proceedings, making it more difficult and expensive to space constraints and allowed users to store their content find the e-mails that are responsive to the legal matter. longer, many information technology (IT) and records and While some organizations have already reduced their information management (RIM) professionals are now PST landscape through good planning and effective team- eager to rid their environments of PSTs. The reasons are work, many others have either just begun or have yet to numerous, but two large issue are: begin what is a two-step process:

24 MAY/JUNE 2016 INFORMATIONMANAGEMENT 1. Block employees’ ability to create new PSTs or save than creating PSTs, given PSTs’ corruption issues and messages to existing ones. the real-life occurrences of employees losing important 2. Remove PSTs from the systems. e-mails due to hard drive crashes. Another benefit of this To borrow an analogy from American football, the RIM approach is that the IT group is already backing up and professional is the “quarterback,” or the most important managing the organization’s network shared environment player on the field, when an organization goes on the of- and would prefer not to have to back up personal space fensive to tackle the problem of reducing its PST environ- storage – if the group is even doing that at all. ment by blocking PST file creation. Adopting some of the RIM professionals should collaborate with their technol- following strategies of successful quarterbacks can also ogy and desktop teams to identify which location is best help RIM professionals “win the game.” for their organizations, as they will know what changes Perform due diligence to identify any obstacles, determine how to manage those obstacles, and document what steps will be needed to be successful on game day. Know When to Stay on the Bench are coming, which could save a lot of time. For example, if A quarterback who is not ready on game day shouldn’t the IT team is going to double the size of mailboxes in two even step on the field. Neither should those that haven’t years, that would likely impact the plan for handling PSTs. identified an alternative location for employees to store Remember, if a repository hasn’t been identified that e-mails. If the ability to create PSTs or save messages to will replace PST storage, stay on the bench and “sit this existing ones is taken away without providing an accept- one out.” able location for saving e-mail, employees will save them in “out-of-bounds” locations, defeating the initiative. Prepare Properly for the Game Depending on the desired level of management over Remember the five Ps in the well-known adage “Proper employee e-mails, an alternative location could be a records preparation prevents poor performance.” Successful quar- management system (RMS), a recently expanded e-mail terbacks must prepare properly if they are to be successful system, or possibly even department shared drives. on game day. There is a saying in football that “Games are won in the film room, not just on the field.” Records Management Systems The same is true for RIM professionals when it comes Using a designated RMS may be the best choice from a to a PST reduction project (or any project for that mat- records management perspective, but implementing it will ter). Proper preparation puts them in the best position surely have the most employee impact, possibly requiring to win. Perform due diligence to identify any obstacles, lots of training and technology dollars. If an organization determine how to manage those obstacles, and document already has a designated RMS that has desktop integra- what steps will be needed to be successful on game day, tion and works well with its e-mail system, then by all whether that is the day of pitching the PST project to a means it should throw the ball long and go for the 80-yard manager for approval or the day of communicating the touchdown. plan to employees. Either way, preparation includes the following steps. Expanded E-mail System With the advent of cloud storage and technologies and Define a Realistic End Objective basic data storage costs overall being lower, employee A quarterback’s end objective is always the same – score mailboxes are becoming increasingly larger. This author’s points on offense. RIM professionals are not so lucky. It mailbox size is 400 times larger than it was just four years takes a little more effort to define objectives and ensure ago, and this is not uncommon. Organizations are paying that they are realistic. The end objective should not be to for that space, so why not use it? eliminate PSTs from the environment, as there likely will be cases where some PSTs must remain, such as PSTs Department Shared Drive that are subject to legal hold. The objective, instead, may While using a department shared drive would not be be to eliminate a certain percentage of PSTs or a certain a RIM professional’s preferred choice, an argument can category of PSTs (e.g., those with no known owner or those be made for it being a better choice for e-mail storage that have not been accessed for a certain period of time).

MAY/JUNE 2016 INFORMATIONMANAGEMENT 25 Evaluate the Opposition emotional impact. Employees often will be upset when When preparing for a game, quarterbacks spend more the way they deal with e-mail is affected, even if they are time evaluating the opposition than they do their own provided an acceptable alternative. RIM professionals team. In the same way, RIM professionals must identify should not underestimate the emotional impact this change those individuals or teams that may have objections to the may have on employees; they need to listen to employees’ PST reduction effort and want to “sack” it. Pinpointing concerns and be empathetic. and meeting with these individuals to learn about their Technology Impact. Blocking PSTs by group policy needs and address their concerns are as important to the will affect certain employees’ ability to do their jobs effec- project’s success as is having support from the legal or tively, so there must be an exception process for certain compliance teams. functions, such as the following: Pinpointing and meeting with these individuals to learn about their needs and address their concerns are as important to the project’s success as having support from the legal or compliance teams. This is where an interesting twist comes into play. •• Forensics – Employees who provide forensic and inves- Quarterbacks do not study film of the opposing team’s tigative data services must be able to continue to ex- coaches, but rather the actions and tendencies of indi- port data to PSTs for delivery to the requesting team. vidual players. So, when evaluating the opposition, spend •• Legal/Human Resources/Audit – These teams are time understanding the baseline employees’ needs and typically involved in discovery and other investiga- not just their managers’ needs. Often, coaches will listen tive actions that require their ability to open and view to and make decisions based on their players’ feedback, messages contained in PSTs. so gaining the support of individual contributors for the •• Desktop Support – The desktop support team will need project makes it more likely that their managers also will to be able to export data into PSTs to perform services support the project. on employees’ computers. In addition, some temporary exceptions likely will be Get to Know the Project Team needed. For example, a manager who needs to access an How quarterbacks direct an offense depends on which old PST from a former employee will need access, and an players take the field alongside them on game day, as a employee who is on leave of absence and can’t perform successful offense requires them to effectively utilize their necessary activities before PSTs are removed will need players’ talents. to be excluded from the process temporarily. In the same way, RIM professionals must develop their game plans based on the talent and resources they Playing the Game have available to them, not on an idealistic approach. For Those who have properly prepared by taking the steps example, they must take time to understand the work described above are ready for game day! Just like quarter- habits and strengths of those on the communications and backs, RIM professionals have a number of responsibilities technology teams who will be helping them push the PST once the “game,” or project, has begun. They must: reduction effort forward. If they can’t get what they need from their teams, they may have to go to back-up players, Watch the Clock but that is only as a last resort. Quarterbacks must constantly watch the game clock when the offense is on the field because they have only a Assess Negative Impact certain amount of time to start each play. RIM profession- Quarterbacks must assess how certain decisions they als that are responsible for implementing PST changes make might impact their team in a negative way on game need to be aware of how much time they need to give em- day. RIM professionals also must assess the potential ployees between announcing the changes and beginning negative impact when they begin blocking and ultimately the technology implementation. removing PSTs from their environment. Depending on their organizations’ culture, employees Employee Impact. An entire article can be written may need as little as a few weeks to as much as a year on the various impacts blocking and removing PSTs could before the changes are enacted. In general, though, this have on employees, but this article will focus on just the author has found success by waiting 90-180 days after an-

26 MAY/JUNE 2016 INFORMATIONMANAGEMENT nouncing the change before taking the first step of blocking Counting on the Whole Team PSTs and then waiting another 90-180 days before taking While quarterbacks may be the most crucial player the second step of removing the PSTs. on their team, being successful requires the efforts of the entire team. Reducing PSTs also takes a full team. As an Call Audibles example, one organization that undertook this effort had After an offensive play is set in the huddle, quarterbacks the records manager as quarterback and had supporting sometimes see from the way the opposing team lines up players from the following functions: computer forensics, that they need to change the play at the line of scrimmage litigation, compliance, project management, desktop comput- in what is called an audible. RIM professionals also may ing, corporate communications, SharePoint support, human need to call an audible, adjusting the plan in response to resources, and IT infrastructure. Why so many players? Whether it is having to adjust the style of communication or the implementation timeline, don’t be afraid to quickly adjust the plan to get the project back on course toward the end zone. how their organization is absorbing the impact of reducing •• The forensics team was asked to identify any impact PSTs. Whether it is having to adjust the style of commu- that blocking PSTs would have on its investigation nication or the implementation timeline, don’t be afraid and e-discovery support capabilities. to quickly adjust the plan to get the project back on course •• The litigation folks needed to approve the plan for toward the end zone. As in football, sometimes an audible blocking and reducing PSTs so there was no accidental is more successful than the original plan would have been. deletion of matter-relevant information. •• A project manager was assigned to help with meeting Monitor Progress schedules and other administrative tasks. No matter whether leading or trailing, quarterbacks •• The communications team drafted and disbursed em- and their coaches are constantly watching their electronic ployee communications. tablets while on the sideline. Quarterbacks are looking for •• SharePoint support assisted with creating an effective things they may not be able to see while on the field and exception request and approval workflow process. reviewing plays to determine if adjustments are needed. •• IT infrastructure and desktop computing teams played Likewise, RIM professionals should continually monitor obvious roles in implementing the technology changes. the progress of their PST reduction projects to ensure that •• Human resources assisted with communicating the they are keeping current with project activities, technol- changes to the non-employees who had company e- ogy developments that could impact how group policies mail boxes. are pushed out, and the amount and type of calls the help The positive of having this many groups involved was desk is receiving from employees. This will allow them to that “no stone was left unturned,” and valuable input adjust the plan quickly when warranted. and feedback were received. The challenging aspect was that each team or individual had its own priorities, and Serving as the ‘Face of the Franchise’ managing them within the scope of the project took much Quarterbacks are often called the “face of the franchise.” skill. Like quarterbacks, RIM professionals have to man- As the designated leaders, they are required to meet the age people as well as know their “Xs and Os.” media – win or lose – and they have off-the-field responsibilities that other players don’t have. Similarly, RIM Being Successful professionals need to be the face of their PST reduction Unlike quarterbacks, who have to be born with athletic projects by being visible in the following types of ways: ability to become star athletes, RIM professionals can •• Make presentations and conduct training for employ- become well-skilled in the strategies and tactics needed to ees. ensure that their PST reduction efforts will be successful. •• Set up a table in a commons and be available to respond They just need to prepare diligently, keep their head in to employees’ questions and concerns. the game, and adjust the plan when needed. END •• Set up a designated e-mailbox for employees’ questions and answer at least some of the inquiries – particularly Ben Greene, CRM, can be contacted at bgreene@landolakes. the difficult ones – personally. com. See his bio on page 47.

MAY/JUNE 2016 INFORMATIONMANAGEMENT 27 NOW SHOWING WEB SEMINARS

What’s Your Type?

Management Skill Level Core Skill Series IGgenius Levels Series Series

Government Strategic Symposium Skill Level Series Series

Regardless of how you define yourself, there’s a web seminar series for you! Visit the ARMA Bookstore to catch up on what you missed at ARMA Live! Conference 2015. Reg: $479 Pro: $349

View online now!

www.arma.org/bookstore Click on “Web Seminars” or search for ARMA 2015 Applying Archival Appraisal Concepts to Information Lifecycle Management Information is the real currency of business today; without it, organizations cannot function. As the value of information transcends and exceeds the value of currencies, records and information management (RIM) professionals are poised to become the new chief financial officers. By integrating archival appraisal methods into their practice, RIM professionals can ensure their organizations are not bogged down with obsolete materials, have the best information, and get more value from it by using it for secondary purposes.

Stephen Cohen, CRM

here is much for records and information manage- siderable value, such as a diamond ring or a house. But, it ment (RIM) professionals to learn from their coun- happens in all facets of life; we are a culture of appraisers. terparts in archival administration. It is archivists’ Anytime we go to buy or sell something, we perform an efforts to cull the 95%-98% of materials that are appraisal at some level – whether it be measuring, assess- not of enduring value to get to their repositories’ ing, and comparing brands of butter at the supermarket, Tarchival core that transcend their field. Identifying, analyz- shopping around for a car, or even clearing out the attic. ing, and selecting just those materials that fit the collecting This last example – sifting through the accumulations scope are known as archival appraisal, or simply appraisal. of life to determine what can go away and what still has People traditionally think of appraisal as an expert value and needs to be kept – is closest to the type of ap- assessing the market value of something of potential con- praisal performed by archivists.

MAY/JUNE 2016 INFORMATIONMANAGEMENT 29 Building Blocks for Appraisal sets of information – determining what the information Context is crucial to performing a sound appraisal. is, where it came from, how it was used, when it was cre- So, before appraisal can begin, the appraiser must first ated, who created it, and who benefits from it – enables determine the material’s “who, what, when, where, why, RIM professionals to determine its value with respect to and how” to build the context for understanding the value business needs and regulatory requirements and then to and purpose of the information. In an archival setting, calculate how long it needs to be preserved before it starts these questions are consolidated into a few foundational to pose a risk. concepts, as follows. In most instances, information’s business value is ex- Provenance is defined by the Society of American Archi- hausted before its legal value. Once both are exhausted, vists as “The origin or source of something.” Provenance the information ceases to be useful to the organization ties to appraisal as it authenticates the source and custo- and should then be appraised for permanent disposition dians, ensuring the veracity of the information. The term – generally destroyed or transferred to the archives. is often heard in auction houses and museums where Archival appraisal concepts are readily transferrable artifacts are verified through their records of ownership to any environment where information is kept. Use the and custodianship. Provenance answers the “who,” “when,” following steps. and “where.” As stated by Luciana Duranti in Diplomatics: New Step 1: Identify the Fonds/Groups Uses for an Old Science, provenance also “leads us to The first step in appraising information is to understand evaluate records on the basis of the importance of the the grouping of the set or series of information, or respect creator’s mandate and functions, and fosters the use of a des fonds. In other words, determine the information’s hierarchical method, a ‘top-down’ approach...” “what.” The grouping into fonds is organic, representing Respect des fonds, literally “respecting the group,” how the business is organized and not how someone thinks means that each group of records must be understood for it should be organized. It is not the role of RIM profession- what it is and not be conflated with other groups or subdi- als to re-arrange information so it fits some other need, vided. Each fond is a distinct group with its own distinct as this would disrespect the group. set(s) of records series and must be treated separately. Provenance and original order, with their traceable Respect des fonds answers the “what.” chain of custody, authenticate and verify the information Original order refers to the way in which the infor- within the fonds that is needed to perform appraisal. mation was kept and used by its custodian. It aids in The larger the organization, the greater the division identifying information within a group, understanding of labor and the easier to see the different fonds and their decision-making and thought processes, and proving that records series. Ideally, the organization chart will match the information is genuine. Original order answers the 1:1 to the fonds or at least be close to that ratio. Each “how” and “why.” fond corresponds to a distinct department or function, as Using these conceptual building blocks to appraise shown in Table 1.

Fond/Function Group/Department

Hire and Maintain Employees Human resources, recruiting Pay Employees Payroll, benefits Plan Budget, executive leadership, steering committee, board of directors Provide a Place to Work Facilities, real estate Ensure Employees Have What They Procurement, IT, mail, training records/archives, library/research Need to Perform Well Secure Assets Security, legal, compliance Track Profit and Loss Accounting, accounts payable/accounts receivable, budget, investment, tax Charity Foundations, pro bono programs, outreach programs

Table 1: Relationship Between Fond/Function and Group/Department

30 MAY/JUNE 2016 INFORMATIONMANAGEMENT The list of fonds is somewhat flexible depending on the narrow buckets mired in item-level detail, which can result size and scope of the organization, but each fond needs in information being overlooked – as can be the case with to be at a high-enough level so it is easy to see the main schedules created at the sub-series level. functions/components of the whole organization. Deciding at what level to create retention schedules is Be mindful that some sub-groups may be embedded subjective and should be based on the breadth and complex- into another part of the business due to political and ity of the organization. Large, complex organizations are structural whims instead of with their logical group and, better suited to working at the series level, while smaller, therefore, they will be out of synch with the fond in which simpler businesses could potentially develop schedules at they fit. For example, the chief operating officer often has the fonds/group level. a few distinct functional groups, such as human resources, Develop the schedule at the level of detail (i.e., fond/ security, and facilities. group, series, sub-series) that it will be the most useful and operable by the offices responsible for the information. Step 2: Identify Each Fond’s Records Series and The important thing is to be able to match records series Sub-Series to a distinct functional group that has ownership of them, With the fonds identified, the next step is to understand so the same group has responsibility for both maintain- the records series within each fond and their context with ing the series and managing the information through its respect to the entire organization and within their func- disposition. tional area. This determines the information’s “where, Determining the “who, what, when, where, why, and when, why, and how.” how” of each series will not only help in the primary goal Since the fond identification effort made clear what of thinning the information volume, it may provide other the departments within a group do and the fonds to which opportunities. For example, it will be easier to see the types they belong, the series and sub-series within each fond and flows of information and identify what information will also be clear and logical. For example, as shown in has value for reuse in other areas, such as for knowledge Table 2, HR will typically have series for recruitment, management.

Fond/Function Group/Department Records Series Records Sub-series Hire and Maintain Employees Human resources, recruiting Recruitment Training New Hires/Employees Evaluations Terminations Compensation

Table 2: The Relationships Between a Fond/Function and Its Records Series and Sub-series new hires/employees, and terminations. There also may Step 3: Determine the Value for Each Series be sub-series for training, evaluations, and compensation Information can possess an array of values, and these if these are not managed by separate and distinct depart- values are not mutually exclusive. For organizations, all ments within the HR group. business records fit under the “administrative” value cat- The complexity of the series level depends on business egory, which is often further subdivided into “operational,” practices as well as the organization’s legal/regulatory “legal,” “financial,” and “historical.” These are more nuanced requirements. Large and multilayered organizations gener- subsets which often possess specific retention and disposi- ally require a greater analysis of groups and sub-groups, tion requirements set by regulatory bodies. each with its own series and sub-series, while smaller and simpler organizations are more readily suited to the fond Defining Appraisal Values more closely matching the CEO example given above with According to Maygene Daniels, in the 1984 National its few distinct functional groups, such as human resources, Archives and Records Administration Glossary, the main security, and facilities. appraisal values are administrative, intrinsic, research, and evidential, as explained below. Establishing Retention Administrative value is the value of records for the Retention rules can be established at the series level. ongoing business or its successor in function (e.g., articles This will result in neither overly broad buckets, which can of incorporation, payroll records, project files, leases). become complicated and difficult to use – as can be the Intrinsic value refers to the qualities and characteristics case with schedules created at the fonds level – nor very of records in their original form (e.g., Abraham Lincoln’s

MAY/JUNE 2016 INFORMATIONMANAGEMENT 31 own handwritten Gettysburg Address). which clearly states what the repository seeks to acquire Information with intrinsic value in most organizations – what is to be kept and how it should be maintained and will generally be in the form of wet signature agreements, made available – as well as what it does not want – what diplomas, and certificates. Depending on the business, is not to be kept at all and what is to be kept for only a there are other instances where the physical state of defined period of time and then disposed. an item itself has informational value, such as a design The clarity and transparency of the collection policy firm’s carpet and tile samples. Intrinsic value adds a make the archives appropriately responsible for what dimension of knowledge that is necessary to understand it has, what it does not want, and how and when it can the information/object. Historic and archival records are dispose of unwanted materials. RIM professionals can a subset of this value. use this same approach, applying archival appraisal to Research value is related to information on persons, corporate information. places, subjects, and things other than the operation of the organization that created them (e.g., subject files, lab Step 4: notebooks). Incorporate Appraisal Analysis into Policy Research value is the value beyond the information’s The culmination of the values analysis sets the ap- primary intent for existence, giving it a secondary value. praisal, which is then embedded into retention policy. Knowledge management comes into play here, which will Just stating what needs to be retained and for how long is affect the weight of the research value in an appraisal. simply not enough; the value of the information has to be An organization that looks at its information from an appraisal perspective will see its inherent value and be able to make the most from it. Evidential value refers to the documentation of the indicated, as well as the context for how the information operations and activities of the organization. is valuable to the organization. Explicitly documenting the value clarifies the purpose of the information. Weighting Appraisal Values Embedding the value analysis into the retention policy Each of these values is considered independently, transforms the schedule into a corporate collection policy. subjectively weighted, and then combined to establish the It then does double duty by explaining what needs to be appraisal. There is no prescribed formula, but weighting retained and for how long due to its value, as well as ex- these values is not as hard as it sounds. Just like people plaining what to destroy and when to destroy it. depend on the context of the materials found in the ar- This bakes the appraisal process into the retention chaeological digs of their attics and basements to determine schedule at the start, bringing transparency to the reten- their value, RIM professionals depend on understanding tion and disposition policy decisions and eliminating the the fonds and records series in their organizations and how need to make the same decisions over and over. When there they fit together to determine business information’s value. are changes to the retention schedules, though, information Nearly all corporate organizations use administrative may need to be reappraised in light of the policy update. and evidential value with risk analysis to produce their records retention schedules. They basically ask themselves, Value Gain from Appraisal “What do we need to memorialize our decisions, stay out Archival appraisal is a methodology that can and should of trouble with regulators, keep off the front pages of be applied in more than just the archival setting. An or- newspapers, and make a profit?” ganization that looks at its information from an appraisal There’s not much appraisal in this approach since it perspective will see its inherent value and be able to make focuses more on risk than value. Appraisal emphasizes the most from it. value and use. It looks at both the negative (risk and For more information on appraisal, visit the Society loss), as well as the positive (increased productivity and of American Archivists online bookstore (https://saa. profits), and weighs it all in a big picture way to make the archivists.org/store/) or reach out to a nearby archive or organization better. historical society. END Equally considering all information values to determine the correct retention for each records series is the nexus Stephen Cohen, CRM, can be contacted at scohencrm@outlook. of appraisal. This is akin to the archives’ collection policy, com. See his bio on page 47.

32 MAY/JUNE 2016 INFORMATIONMANAGEMENT E-mail Management

Best Practices for Managing Electronic Messages (ARMA International TR 24-2013) This technical report provides current information for managing all types of text-based electronic messages or communication, such as e-mail, instant messages, and text messages.

A4938 $55.00 Professional members: $35.00 V4938 PDF $50.00 Professional members: $30.00

E-Mail Retention and Archiving: Issues and Guidance for Compliance and Discovery William Saffady, Ph.D. With its focus on the retention of e-mail to satisfy an organization’s legal, operational, and historical requirements, this book will help organizations avoid over-retention problems and simplify the discovery process.

A4965 $55.00 Professional members: $35.00 V4965 PDF $50.00 Professional members: $30.00

Policy Design for Managing Electronic Messages (ANSI/ARMA 19-2012) This American National Standard sets forth the requirements for a policy guiding the management of electronic messages as records throughout their life cycle – from creation to final destruction or disposition.

A4930 $60.00 Professional members: $40.00 V4930 PDF $55.00 Professional members: $30.00

Order online today!

www.arma.org/bookstore GOVERNMENTRECORDS

Establishing a Duty to Document: The Foundation for Access to Information Marc Kosciejew, Ph.D.

ccess to information is a bed- A Growing Movement verse venues, including their offices’ rock principle of democratic Across Canada, calls are increas- annual reports, Access to Informa- governments and their public ing for the inclusion and implementation Act reviews, and presentations Aagencies and entities. It helps tion of a duty to document in relevant to the House of Commons Standing ensure that democratic governments access legislation. For example, since Committee on Access to Information, are, and remain, accessible, open, and the early 1990s, federal information Privacy, and Ethics. transparent to their citizens, and it commissioners have recommended Over the past couple of years, helps enable citizens to more fully a legislated duty to document in di- moreover, federal, provincial, and engage with, monitor, and hold them to account. Access to information depends upon these public institutions to document their activities and decisions. When they do not, then the citizens’ right of access is ultimately denied. Public accountability and trust, in addition to institutional memory and the historical record, are undermined without the creation of appropriate records. Establishing and enforcing a duty to document promotes accountability, openness, transparency, good governance, and public trust in public institutions. This article begins a discussion on the concept and practice of a duty to document. It presents a case study of Canada where various federal, provincial, and territorial information and privacy commissioners, along with other public officials, have recommended that a duty to document be enshrined in access-to-information legislation and related statutes and regulations. The article’s main aim is to help illuminate the importance and implications of a duty to document in both access laws and records and information management (RIM) policies to help ensure accountability, transparency, and trust for good governance practices.

34 MAY/JUNE 2016 INFORMATIONMANAGEMENT territorial information and privacy governmental activities, decisions, – those that are or should already be commissioners have made similar transactions, etc. The Office of the In- a part of regular and routine practices recommendations. In 2013, for information Commissioner argues that of open, good governance. Further, a stance, the federal information and “without such a duty [to document], duty to document must be enforce- privacy commissioners issued a joint there is a risk that not all information able through full implementation, statement urging Ottawa to estab- related to the decision-making pro- effective oversight, and sanctions for lish a legislated duty to document cess is being recorded or appropriately non-compliance. for all public institutions to record preserved in [public institutions’] in- their actions and decisions. In 2015 formation holdings.” In other words, The Current Patchwork in British Columbia, the information without the creation of appropriate of Requirements commissioner’s submission to the records, public institutions’ work and In Canada there is now a patch- provincial special committee review- results are compromised. work of statutory requirements at dif- ing the province’s access and privacy A recent joint resolution of some ferent governmental levels to create laws urged that government to im- major actors in the field of Cana- specific kinds of records in particular pose a duty to document. Similarly, dian access and privacy legislation circumstances. Indeed, at each gov- that same year, committees review- expressed concern about a seemingly ernmental level, there are many sets ing provincial access and privacy growing trend of irretrievable records of documentary requirements. laws in Quebec and in Newfound- land and Labrador called on their ...when public records are not created, let respective governments to impose duty-to-document provisions. alone preserved, these access rights are A Documentary Obligation undermined, thereby eroding accountability, The Canadian federal Access to Information Act establishes access transparency, and public confidence and trust. rights to public records of the fed- – that is, records not turning up in At the municipal level, for exam- eral government and its agencies response to formal access requests ple, there are various duty-to-docu- and a formal framework for mak- from the public for various reasons, ment provisions in municipal laws ing and processing access requests. including that they were never cre- and regulations. Ontario’s Municipal This federal act relies on robust RIM ated. Act, for instance, mandates that local practices to help ensure that Cana- These public officials argue that municipalities record their decisions, dians’ access rights are handled ap- this apparent lack of records presents resolutions, and other proceedings. propriately. But when public records serious problems. First, it weakens At the federal level, there are du- are not created, let alone preserved, the Access to Information Act and its ty-to-document provisions in various these access rights are undermined, accountability framework. Second, legislative and regulatory areas. For thereby eroding accountability, it compromises public institutions’ example, federal employment laws transparency, and public confidence abilities to be accountable, make evi- and regulations, including the Em- and trust. dence-based decisions, conduct sound ployment Equity Act and the Em- According to the Office of the In- activities, comply with relevant laws, ployment Insurance Act, oblige the formation Commissioner of Canada, and preserve institutional memory federal government, as an employer, “access to information relies on good and the historical record. Third, and to create and maintain employment recordkeeping and information man- arguably most important, it under- and pension records. agement practices. When records are mines Canadians’ right of access to The federal Treasury Board’s not created or appropriately pre- information. policy on RIM, for instance, requires served to document decisions, rights These public officials therefore rec- that government institutions record under the Act are denied. This, in ommend that recording governmental their activities and decisions to ac- turn, prevents government account- activities and decisions becomes a le- count for their decision-making pro- ability and transparency.” gally enforceable obligation enshrined cesses and operations, reconstruct Presently in Canada there is no as a duty to document. It must be policy and program developments, specific legislation or regulation that emphasized, however, that a duty support workflow continuity, and mandates a duty to document. There to document does not mean creating help facilitate independent audit is no legal or procedural responsi- more records; instead, it means creat- and review. Further, the Treasury bility to create records describing ing and preserving the right records Board has a policy requiring deputy

MAY/JUNE 2016 INFORMATIONMANAGEMENT 35 GOVERNMENTRECORDS

heads of governmental departments cords of its affairs, in accordance with mental to any access-to-information to ensure “that decisions and decision- normal, prudent business practice, framework because it helps estab- making processes are documented to including the records of any matter lish and support clear workflows and account for and support the continuity that is contracted out to an indepen- operations, sound decision-making, of departmental operations, permit dent contractor.” strong program and service delivery, the reconstruction of the evolution of Second, “every public office must and accountability. policies and programs, and allow for maintain in an accessible form, so as Fourth, a duty to document needs independent evaluation, audit, and to be able to be used for subsequent to be enforceable. There need to be review.” reference, all public records that are reasonable sanctions for non-com- The Financial Administration Act in its control, until their disposal is pliance and for instances of records imposes a duty to document the finan- authorised by or under this Act or being intentionally altered, falsified, cial administration of the government. required by or under another Act.” mutilated, destroyed, or concealed. Specifically, this act prescribes obli- And, third, “every local author- gations for account keeping of public ity must maintain in an accessible Special Considerations money and property, and it imposes form, so as to be able to be used for There are several implications of a legislated duty to document that Making this obligation [duty to document] a require closer attention and clarifica- tion. This duty, for instance, must be part of RIM helps ensure these records are clear and precise enough that public servants properly understand when, accessible, reliable, retrievable, and usable what, and how their activities and decisions need to be recorded. They must for present and future purposes. also understand when, what, and how duties on various public servants to subsequent reference, all protected their documentation efforts, or lack maintain financial records and pre- records that are in its control, until thereof, may contravene this duty. pare financial statements, annual re- their disposal is authorised by or un- This obligation must be clear ports, etc., regarding public accounts. der this Act.” enough that non-compliance sanctions These related, but different, rules Arguably, this act would be are specific and commensurate with and regulations are steps in the right strengthened if it included reason- the particular contravention. To be- direction; however, they are only able sanctions for non-compliance. gin, there must be a clear distinction piecemeal approaches and less de- between generally poor recordkeeping sirable than a comprehensive one. Duty to Document Components practices and intentionally bad and/ A legislated duty to document or criminal practices. The possible The New Zealand Model should ultimately include four major penalties for non-compliance include It is essential that a duty to docu- components. First and foremost, it disciplinary measures and criminal ment is enshrined in relevant federal must oblige the creation of appropri- charges. legislation and further strengthened ate records with the aim of describing Public servants who misunder- in sound IM policies and procedures the “what” and “why” of public institu- stand this duty or unintentionally to help ensure comprehensive applications’ activities and decisions. fail to document appropriately are not tion across jurisdictions and levels of Second, a duty to document re- necessarily engaging in criminal prac- the public sector. quires practical RIM standards that tices; instead, it is more likely they New Zealand’s federal Public help ensure these records are accu- are not meeting administrative stan- Records Act 2005 serves as a useful rate, authentic, authoritative, and dards. Thus, a sanction commensu- precedent for the Canadian case and complete. rate with their contravention should elsewhere because it establishes a Third, a duty to document must probably be disciplinary measures. requirement to create and maintain be embedded within RIM practices But public servants who deliber- records. It is helpful to present this to help routinize the creation, orga- ately fail to create – or who alter, fal- codified requirement in its full form nization, and management of these sify, mutilate, destroy, or conceal – a to show its detailed scope. records. Making this obligation a part record would be engaging in criminal According to this act’s recordkeep- of RIM helps ensure these records are practices. Thus, a sanction commensu- ing requirements, first, “every public accessible, reliable, retrievable, and rate with their contravention should office and local authority must create usable for present and future pur- probably be dismissal and appropriate and maintain full and accurate re- poses. Indeed, robust RIM is funda- criminal charges.

36 MAY/JUNE 2016 INFORMATIONMANAGEMENT Going Forward tions for non-compliance and other legacy of government activities and A duty to document does not need contraventions. decisions. A duty to document, there- to be complicated or cumbersome. This documentary obligation fore, helps strengthen the business When it is incorporated into exist- helps protect access rights by creat- and operations of public institutions ing access-to-information legislation ing appropriate and necessary public and, in so doing, the fundamental and RIM practices, it can become an records, facilitating more open and democratic principle and practice of effective and efficient routine – not transparent governance, increasing access to information. END to create more records, but to create accountability, fostering public confi- the right records. Further, it needs to dence and trust, and contributing to Marc Kosciejew, Ph.D., can be contacted at be enforceable with reasonable sanc- institutional memory and historical [email protected]. See his bio on page 47.

For Your Information ARMA LIVE! SAN ANTONIO THE PREMIER EVENT FOR RECORDS MANAGERS & INFORMATION GOVERNANCE PROFESSIONALS

arma.org/conference

MAY/JUNE 2016 INFORMATIONMANAGEMENT 37 BUSINESSMATTERS

Systems Automation: A Way to Reduce RIM Risk Joao Penha-Lopes, Ph.D.

ith executive manage- in this article offers an example of a •• Security breaches ment’s buy-in, informa- manufacturing company’s efforts to •• Obsolescence of document for- tion technology (IT) and move from paper document process- mats or media records and information ing to a web-based, digital platform •• Outdated or incomplete retention W schedules management (RIM) professionals using an automated systems solution. can collaborate to execute systems Automated system solutions can automation solutions that mitigate Making the Case for Automation improve document flows and enhance risk. An organization’s legal/regula- RIM-related risks can take a vari- an organization’s compliance with its tory requirements, based on its busi- ety of forms, including the following: RIM requirements and with industry- ness mandates, can be synchronized •• Failure to preserve needed docu- related legal and regulatory man- with automated processes, which is a ments for litigation dates. Risk is mitigated when proper crucial benefit in our dynamic, global •• Incomplete or nonexistent pro- systems and solutions are enacted. business environment. cedures for the use of document When the manual, hands-on steps Further, automation can transi- archives of a task are replaced by a system- tion paper-based RIM tasks to an ef- •• Untimely or accidental destruc- ized, automated process, streamlining ficient, digitally focused environment tion of documents can occur. Generally, more output where activities require fewer person- •• Lost documents can be achieved with less input. In a nel and less time to complete. The •• Inappropriately indexed docu- paper-based environment, the physi- international case study presented ments cal touchpoints where documents are

38 MAY/JUNE 2016 INFORMATIONMANAGEMENT handled, duplicated, stacked, and •• Quality enhancements related to tinuity, an automated systems solu- stored can be numerous. Each touch- the use of a consistent, standard- tion for document management can point represents a potentially risk- ized process, regardless of staff bolster these essential components laden event. For instance, a document changes and reduce risk in these areas. can be ruined by careless handling, •• Greater options for scheduling Collaborating with IT, RIM can it can be misplaced in a disorganized flexibility offered by a web-based integrate digital file backups into cabinet, or its sensitive information solution so that telecommuting a solution that recurs consistently can be revealed to prying eyes as it is feasible within a unified platform. Today, lays on a desktop. By reducing the •• Cost savings in the long term as external storage for backup materi- number of touchpoints, the opportuni- document processing requires als is often in the cloud, providing ties for mishaps decrease. less labor and time and fewer a risk-tolerable, scalable option for employees many organizations. Exploring the Benefits of Automation Benefits of document management Today, external storage for backup via automated systems include the materials is often in the cloud, following: •• A comprehensive audit trail that providing a risk-tolerable, scalable includes essential metadata cap- ture; reports can be ordered on an option for many organizations. ad hoc or regular basis •• Automatic archiving and index- Other Helpful Aspects In addition, disaster recovery ing of documents following the of Systems Automation and business continuity can be aided creation of each scanned, digital Organizations can use systems by an automated systems solution image automation to track operational that incorporates parallel process- •• Automated version control metrics. Because many metadata ing capabilities in an offsite location, •• Digital conversion and migration elements are routinely captured in far removed from the organization’s to maintain file accessibility and these systems, it’s possible to investi- main base. Mirroring or shadowing usability despite evolving tech- gate specific components of an opera- techniques also may be deployed to nologies tional procedure by selecting unique aid with the speedy resumption of •• Improved document security elements for report generation. business activities in case of disaster. through the use of digital safe- For example, in a post-reorga- guards on a system-wide basis nization scenario, it might be help- Potential Drawbacks (e.g., encryption and virtual pri- ful for an organization to examine For most organizations, the ben- vate networks (VPN) for remote metadata associated with documents efits of systems automation (espe- access) managed by a newly staffed contracts cially in controlling risk) outweigh •• Faster turnaround time for pro- department. It would be possible to the downsides. But there are several cess-related revisions to accom- determine the amount of time spent issues to consider before embarking on modate changes in the legal and on each document by each respon- such a project. This list has examples regulatory climates sible individual, revealing the effi- of project-related variables that could •• More robust lifecycle manage- ciency of the process flow from start have a negative impact if care is not ment with the inclusion of re- to finish. taken during planning: tention schedules as part of the Often, metrics-related reports can •• Cost, such as for consultant fees, systems platform design be regularly scheduled for creation vendor fees, and hardware •• Fewer human errors due to less (i.e., automatically generated by the •• Inadequate planning that results physical handling of documents system) or can be programmed on in a disappointing outcome •• Time savings from faster docu- an ad hoc basis. Careful analysis of •• Disruption to the business while ment processing due to less physi- these reports can uncover quality the project is designed, finalized, cal handling of documents improvement areas that lead to cost and implemented •• Fewer staff members needed to savings. •• Insufficient executive manage- perform document processing While an effective RIM program ment buy-in for the project tasks due to less physical han- includes policies related to backups, •• Inadequate training to educate dling of documents disaster recovery, and business con- staff at project completion

MAY/JUNE 2016 INFORMATIONMANAGEMENT 39 BUSINESSMATTERS

Case Study from a through negligence or carelessness. converted it to an XML file. Global Manufacturer Further, the timely processing of •• VPN access to the web-enabled A corporation in Asia with a large such a large volume of invoices was system allowed secure, round- manufacturing hub in western Europe another concern, as late payment the-clock processing; remote staff designed and implemented a custom- could result in extra fees. could work flexible schedules in ized systems automation solution to response to the organization’s reduce RIM risk. The corporation Result: Reduced Risk, needs. wanted the solution to re-engineer a Streamlined Processing •• An audit trail was maintained paper-based invoice processing pro- Many automated features to re- such that metadata remained cedure. duce RIM-related risk were incor- linked to the appropriate docu- The handling of thousands of paper porated. A high-level summary of ment and included an access log. invoices each year had become a drain those features provides insight into With that log, it would be pos- on time and labor resources. In addi- the solution’s design: sible to know when and by whom tion, the antiquated “paper shuffle” brought with it a level of RIM-related VPN access to the web-enabled risk deemed unacceptable. Executive management approved the project. An system allowed secure, round-the-clock external consultant provided design expertise and project management. processing; remote staff could work Front-end planning was crucial. Stakeholders from many departments flexible schedules… were consulted: accounting, executive management, IT, legal, and RIM. It •• Time was saved and entry errors a document was worked at each was particularly important for the were minimized because data stage of the processing procedure. solution to be compatible with the was scanned (digitized) instead •• Relevant staff were automatical- organization’s enterprise resource of typed into the ERP. ly alerted by e-mail when docu- planning (ERP) tool. It was decided •• Invoices were scanned to PDF ments were in queue. Special the solution would be a customized, and archived at initial receipt, notifications were issued when add-on application for the ERP tool. eliminating the need to physi- due dates approached, allowing Stakeholders examined the steps cally circulate them to internal continual monitoring of on-time of the invoice processing procedure: departments. All paper copies processing goals. •• Receipt of paper invoices by the were retained in a single, secure •• Management was able to gather accounting department location within the organization. and analyze metrics and to cal- •• Routing of each paper invoice to •• To guard against duplication, in- culate the total time to process the appropriate group where cost voices were validated upon being (from invoice receipt to payment center and general ledger account archived to ensure there was no issuance). As a result, manage- numbers are assigned and the other document with the same ment could more easily measure receipt of the product or service type, name, date, and so on. performance goals on a monthly, (associated with the invoice) is •• Password-protected access was quarterly, or annual basis. confirmed controlled by employee role or •• Approval by management for re- function. Some individuals could Summary lease of payment view only, while others could view The case study suggests that sys- •• Entry of invoice payment data and modify, for instance. tems automation can offer a techno- into the ERP tool •• Authorized individuals could use logically sound opportunity to control Several areas of risk were iden- a digital signature to approve in- RIM-related risk. It can foster effi- tified. Most of the risky behaviors voice payment. Captured meta- ciency throughout the organization, concerned the deployment of paper data included the approver’s decrease reliance on physical media, copies during processing. The security name, date, and time, effecting and help conserve limited natural of invoices on desks or in briefcases non-repudiation of the approval resources. END was at risk. Documents could be lost action. or misfiled. Ink stamping sometimes •• To incorporate the data into the Joao Penha-Lopes, Ph.D., can be contacted rendered data illegible. Confiden- ERP system efficiently, the au- at [email protected]. See his tial information could be disclosed tomated tool read the PDF and bio on page 47.

40 MAY/JUNE 2016 INFORMATIONMANAGEMENT IS INFOR MATION YOUR ALLY OR YOUR ENEMY?

or ne ata olng te ear. An all t ne ata an eter el o or rt o. Fn ot at t ong or or oman t te Next evel Inormaton Governane Aement. oll over area o trengt an oortnte or mrovement. In te en o ll e emoere to nreae organatonal tranaren an ata ntegrt le ereang r.

Start turning information into an asset by visiting arma.org/nextlevel

IM JULY15.indd 19 6/19/15 9:17 AM 50THYEAR

50, 25, 10 Years Looking Back...

Remembering William Benedon, CRM, FAI ust before this maga- and – as supervisor of public records for New Jersey – for zine was to go to press, writing one of the first records management legislative we learned of the April acts and implementing one of the first state-wide records J14 passing of its found- management programs; and as the originator of ARMA’s er and long-time editor, Wil- records management correspondence course. liam Benedon, CRM, FAI, at Bill was widely esteemed by those who knew about the age of 92. and benefitted from his life’s work. Upon hearing of his Although we acknowl- passing, several people edged Bill’s 18-year contri- posted their thoughts bution to Records Manage- about him on the re- ment Quarterly (1967-1984) cords management list- William Benedon, CRM, FAI, in the initial “Looking Back” serv, referring to him circa 1969 section in January, he made as “an icon,” “one of the so many more contributions to the records and informa- GIANTS of our profes- tion management (RIM) profession and this association sion,” “the best and for which he should be recognized. ARMA International most influential early President Peter Kurilecz, IGP, CRM, CA, highlighted a RIM mover and shaker few of these in a message sent to ARMA members after in our profession; one of learning of Bill’s passing: those who truly defined Bill was a trailblazer for our association and the profession,” and “a profession, serving for two decades as founder true pioneer.” and editor of our first periodical,Records Review, In Bill’s final editor’s and its successor, Records Management Quar- message in the April 1984 Records Management by terly; writing the first definitive textbook for the issue of Records Manage- William Benedon profession – aptly entitled Records Management; ment Quarterly, he said he was stepping down to devote his serving as the association’s president in its earliest time and energy to other activities, having satisfied one of years and later as the president of the Institute his key objectives when he started: “To provide a continu- of Certified Records Managers; and being the ing chronicle of our profession’s growth and acceptance first person inducted into ARMA International’s as a meaningful approach to information management.” Company of Fellows. He said he wanted to continue to “be of service to an Through more than 50 years of writing, speak- organization which I hold in such high esteem” – and he ing, training, and mentoring, Bill had a significant did – fulfilling until near the end of his life what he felt to impact on the career growth of countless records be his professional duty, as described by the quote from management professionals and on the develop- Francis Bacon’s Maxims of the Law, with which he closed ment of the records management principles and his message: practices we all use daily. I, personally, saw him I hold every man a debtor to his profession; as a visionary and a respected voice in records from the which as men of course do seek to receive management. countenance and profit, so ought they of duty to He is remembered on the ARMA International Educa- endeavor themselves by way of amends to be a tional Foundation’s website as “one of the founding fathers” help and ornament there unto. of the profession; as the second recipient of the Emmett What a “help and ornament” he was. As was so aptly Leahy Award for his achievements as an analyst and con- expressed by one of his many admirers, with Bill’s pass- sultant with the National Records Management Council, ing, “We lost a great one.”

42 MAY/JUNE 2016 INFORMATIONMANAGEMENT Advertising •• AIIM – Learn how to implement electronic records management (ERM) •• Allegheny Paper Shredders – “Double your security at the touch of a button!” •• BELFOR Property Restoration – “We listen. Clean and simple.” •• DACS Design Assistance Construction Systems, Inc. – “You’re one in a 60 million.” •• DHS Worldwide Software – “Experience the most flexible and comprehensive records management software in the world.” May/June 2007 •• Fujitsu – “Fujitsu scanners. You’ll see productivity everywhere you look.” The Information •• Greater Los Angeles Chapter of ARMA – “William Management Journal Benedon, CRM, FAI. The First 50 Years!” Association News •• IDC– “2nd Annual IDC IT Forum & Expo” •• The newly elected president of ARMA International •• MBM Corp. – “If You’re Using a Shredding Service… is Carol Choksy, Ph.D., CRM, PMP. You’re Gambling.” •• Former U.S. Rep. Michael Oxley (R-Ohio) is to speak •• O’Neil Software – “Scan. Store. Manage. Deliver.™ on “Sarbanes-Oxley – What’s Next?” in the keynote address for ARMA International’s 52nd Annual Con- •• OmniRIM – “Take Control of Your Records Manage- ference & Expo. ment” Articles •• Smead Software – “Records management that sounds good to everyone.” •• “R U Ready for IM?,” by Jesse Wilkins, CDIA+ •• Tower Software – “Knowledge…where it needs to be.” •• “Cost/Benefit Analysis for Implementing ECM, BPM Systems,” by Doug Allen, CRM, CDIA+ •• Visioneer – “THESE PARTRIOTS ARE ON DUTY. TEN-HUT!” •• “Evolving the Records Management Culture: From Ad Hoc to Adherence,” by Patricia Daum, CRM •• Zasio – “When it comes to managing your electronic records, you’d be happy if Point-Click-Save were all •• “Freedom of Information in the U.K., U.S., and Can- it took. With Zasio, it is!” END ada,” by Sarah Holsen •• “Protecting Personal Privacy in the Global Business Environment,” by David O. Stephens, CRM, CMC, FAI •• Domesticating Information: Managing Documents Inside the Organization by Carol E.B. Choksy was reviewed by Theresa R. Snyder. •• This issue included a special section for ARMA Inter- national’s 52nd Annual Conference & Expo, with a theme of “Where the Business & Technology of Man- aging Records & Information Come Together” to be held Oct. 7-10 in Baltimore, Md. Fujitsu in May/June 2007 issue. Fujitsu in this issue.

MAY/JUNE 2016 INFORMATIONMANAGEMENT 43 INREVIEW

Information Lifecycle Considered in Context of the Electronic Ecosystem Meg Scofield

signature enthusiasm, he regularly Information 2.0, Second Edition: points out opportunities in emerging technological arenas. New Models of Information Production, Distribution Digital Information and Consumption Transforms, Intimidates Authors: :Martin De Saulles Each chapter starts with an intro- Publisher: Facet Publishing duction that provides an overview, Publication Date: 2015 assuming no advanced, high-tech knowledge on the part of readers. Length: 163 pages Throughout his chapters, De Saulles Price: $95 breaks down difficult concepts into ISBN: 978-1-78330-009-9 manageable segments. Source: www.ala.org; www. He also freshens the text with facetpublishing.co.uk numerous case studies selected to daylight challenges to the information community. Readers will recog- explore the drivers of technology and nize in the case studies names like then ponders the present and future, BuzzFeed, Netflix, Amazon, and Spo- emphasizing the hows and whys of ight away, a sense of humor tify, along with companies less well our digital evolution. distinguishes Information 2.0, known, although no less interesting. De Saulles gives easy-to-under- Second Edition: New Models Concluding comments at the end of stand explanations. For example, he of Information Production, each chapter synthesize the array of starts the book with a baseline point R of reference: “What is information?” Distribution and Consumption by ideas and underscore the importance Martin De Saulles. In this updated to information professionals. Then he moves into more advanced textbook, three years after his first A particular strength of this book topics, like privacy: “Does Google edition, De Saulles notes, “…[I]t is is the author’s ability to acknowledge know too much?” doubly ironic that this second edi- and encourage readers who may not Soon readers will find themselves tion is still being printed on dead whole-heartedly embrace all things getting comfortable with complexities trees.” His good nature guides read- digital. Despite technology’s perva- in U.S. and international informa- ers through an introduction and siveness in personal and work lives, tion laws; open government and the conclusion supported by four core there are still plenty of people who public’s right to information access; chapters. write paper checks; who admit they and even coding and apps that work With a focus on information pro- either don’t use a computer or aren’t with search engines to ensure we duction, storage, distribution, and proficient; and who wonder, “What’s find information rapidly and with consumption, an important theme is a blog?” Some technology-averse folks minimal fuss. how platforms and devices (as well may even work in the information as the organizations behind them) management profession. Brevity Is the Soul of This Book keep expanding to accommodate an With such a brief book, an inevi- ever-increasing digital deluge. There Are No Stupid Questions table weakness is space constraints. While the book will appeal to stu- With readers less confident in Topics like big data, including a dis- dents engaged in information science technology, especially, De Saulles cussion about structured and un- programs, De Saulles takes special wants to share his optimistic outlook structured data, fly by in a few pages. care to accommodate more seasoned about the digital landscape. First, he Data preservation is covered in an information practitioners, too. With looks backward several decades to equally brief section.

44 MAY/JUNE 2016 INFORMATIONMANAGEMENT Sometimes, the basic explanations of extensive and current references ing Information 2.0 on hand when feel a little too simplified. The sec- found at the end of the book proves as partnering with colleagues from ar- tion on cloud storage, for example, valuable as the writing. The sources, eas like legal, privacy, and especially touches on cost and security decisions including online and offline mate- information technology will provide that private individuals face when rial, lend themselves to independent background and familiarity with com- thinking about how to keep cherished exploration. mon terms. music or photo collections; however, If this kind of collaboration is the De Saulles raises more questions than Mind the Knowledge Gap key to the future, De Saulles illus- he answers. De Saulles’ technique of clear ex- trates how information professionals To the author’s credit, though, planations makes the book a helpful are well positioned to understand and rather than omit any key topics, he’s tool. For instance, information profes- embrace both the changes and possi- chosen to ensure that readers get at sionals might be thinking about tra- bilities that technology presents. END least get a tiny taste of how each is- ditional responsibilities like records sue relates to information manage- management within the larger frame- Meg Scofield can be contacted at meg@ ment. With his shorter sections, a list work of information governance. Hav- twocoffeecups.com. See her bio on page 47. UK Copyright Law Made Clear for Information Professionals Sarah R. Demb

From 2005 to 2014, while working in museum archives in London, I Copyright for Archivists and was one of the many who benefitted Records Managers directly from his expertise and will- Editor: Tim Padfield ingness to share it. Anyone who deals Publisher: Facet Publishing with records created in Britain, no Publication Date: 2015 matter where they are now located, Length: 360 pages will benefit from his understanding of the UK legalities that govern copy- Price: $85 righted materials. ISBN: 978-1-85604-929-0 As noted by Alison Cullingford in Source: www.ala.org; www. an entry in her 2013 blog “The Spe- facetpublishing.co.uk cial Collections Handbook,” Pad- field has played a vital role in helping us manage and influence changes in updating his seminal text in light of copyright law. In the fifth edition the changes made to the law the year of Copyright for Archivists and he retired. As he says, “If in doubt, Records Managers he continues to consult a lawyer,” but this volume can explain the complexities of the legal reasonably be considered very sound t’s no secret that Tim Padfield has context, enabling archivists to make advice and guidance. been the go-to copyright guru in effective and informed decisions and the United Kingdom (UK) for better manage risk. Updates in This Edition Imany years. After 30 years in Padfield has lobbied for legislative Padfield has made a review easy the sector, he retired from the UK change, delivered workshop training, by using the preface to summarize the National Archives in 2013 to many kept us informed via social media, and updates to the fifth edition. Among well-wishes from colleagues valiantly extended individual solutions when the many summaries are: an outline suppressing a chorus of “to whom will we asked for his help. We owe him a of major changes to the law, especially we direct our copyright questions from great debt and are thankful that he as they apply to libraries and archives; now on?” decided to continue to offer advice by an explanation of the new approach-

MAY/JUNE 2016 INFORMATIONMANAGEMENT 45 es to orphan works; a description of while the book was in press – the ad- and discusses it in relation to protec- the changes relating to performers’ vice on private copying is not relevant. tion; ownership; publication, exhibi- rights, quotation, caricature, parody tion and performance; use; the elec- and pastiche, text and data mining, The Book’s Organization tronic environment; special records disability, and private copying; analy- This edition is laid out in much the (often related to their formats) and sis of Channel Islands and British same way as previous editions, but contexts; and the framework of other overseas territories law; updates on the content has been comprehensively related intellectual property rights. acknowledgments, assignments, and updated. His appendixes include helpful liability; an explanation of how UK His book begins with a summary copyright duration charts, declara- courts determine jurisdiction over of key points – or basic assumptions tions, and model licenses. The book copyright infringement on the Inter- – about the way copyright in the UK also contains a bibliography and relat- net; changes to Crown copyright and works. He then builds on these te- ed legal authorities. These authorities licensing of public sector information; nets by explaining any relevant ex- comprise a list of laws and cases, and consideration of the copyright cases ceptions and case law, and he also refer the reader to related websites for that have been brought to UK and provides checklists of questions to use their full texts. European Union courts since the last as decision-trees for application to edition of the book in 2010, including the records you manage. He provides A Recommended Resource the use of copyright works in libraries, enough information so you can make The beauty of Padfield’s work is archives and museums; and links to your own decisions based on careful that it is both a practical guide and a recent useful websites. consideration of the precedents and philosophical exploration of the im- He has also included a late-break- experiences he interprets. plications and impact of legislative ing erratum on one section that relates Padfield defines copyright, outlines change, best practice, and case law. to legislation that was overturned its development, relates it to records, He is sensitive to what may seem like unrealistic burdens on records managers and archivists and the best way to navigate towards workable solutions. The only drawback to the work is Twice as Hot probably due to the publisher’s house style, as the checklists are in the same Double your professional development with bullet point format as any other list in the book, and as such are not as ARMA International’s readily apparent as they would be if included as appendices. In contrast, sections such as the duration of copy- Free right chart appendices are in table style and easy to read and easier to use. Similarly, the index points the Mini reader to sections rather than the expected page numbers. But these are quibbles. It is hard to imagine a more useful and clearly Web- written guide to what can seem a con- voluted topic that is easily overwhelm- ing to practitioners trying their best Seminars to successfully implement the law. I hope that Padfield continues his lead- Our HotTopic series is now available and includes three to five ing role throughout his retirement 20-minute web seminars brought to you by the industry’s best as copyright evolves over the years and brightest. Sign up just once, and come back again and to come. END again to take advantage of this fantastic education. Sarah R. Demb can be contacted at sar- www.arma.org/rl/professional-development [email protected]. See her bio on page 47.

46 MAY/JUNE 2016 INFORMATIONMANAGEMENT Contact Information AUTHORINFO

CISCO COHEN DEMB GREENE KOSCIEJEW PENHA-LOPES SCOFIELD TROMBLEY

Innovative Ideas for Making IG Happen! Page 20 Establishing a Duty to Document: The Foundation for Susan Cisco, Ph.D., CRM, FAI, is a director at Gimmal. She has Access to Information Page 34 30 years’ experience as a records and information management Marc Kosciejew, Ph.D., is head of department and lecturer in practitioner, educator, and consultant. Cisco’s seminal work library, information, and archive sciences in the University in the application of big bucket theory to the classification of Malta’s faculty of media and knowledge sciences. He has and retention of records has led to the enhanced usability been published in scholarly and professional journals, con- of enterprise content management systems, simplified de- tributed to leading national newspapers, lectured in Europe ployment strategies, and optimized user adoption globally. and North America, conducted research in Africa and Asia, A Certified Records Manager and a Fellow of ARMA Inter- and presented at conferences worldwide. He is also the re- national, Cisco holds a master of library science degree and cipient of ARMA International’s 2014 Britt Literary Award a doctorate degree in library and information science from for his article on personal data rights. He can be contacted the University of Texas at Austin. She can be contacted at at [email protected]. [email protected]. Systems Automation: A Way to Reduce RIM Risk Page 38 Sue Trombley, IGP, FAI, is managing director of thought leader- Joao Penha-Lopes, Ph.D., is an advisor on critical information ship at Iron Mountain. With more than 25 years of information flows in Europe, Africa, and South America. He post-graduated governance consulting experience, she has led Iron Mountain’s in information and document sciences from University Lu- consulting group, managing a team of subject matter experts sofona in Lisbon, Portugal; received an integrated master’s and running large engagements. A frequent blogger, speaker degree in electronic and telecoms engineering from Instituto at events, and Fellow of ARMA International, she sits on the Superior Tecnico at Lisbon, and earned a doctoral degree from University of Texas at Austin iSchool Advisory Council and Universidad de Alcala de Henares in Madrid with a thesis is a past AIIM board member. Trombley can be contacted at related to the economic benefits of electronic document man- [email protected]. agement. He can be contacted at [email protected].

Quarterbacking a PST Reduction Project: How to Get Information Lifecycle Considered in Context of the to the End Zone – No Matter the Opposition Page 24 Electronic Ecosystem Page 44 Ben Greene, CRM, is the corporate records manager for Land Meg Scofieldis a records management specialist in Wash- O’Lakes Inc., based in Minneapolis, Minn. It is the nation’s ington, D.C. Her business, Two Coffee Cups Consulting, second-largest member cooperative and the leading mar- provides records and information management support for keter of dairy-based food products for consumers, foodservice federal agencies, businesses, and nonprofits. She received professionals, and food manufacturers. A Certified Records master’s degrees in writing from Johns Hopkins University Manager who has been in the information management and in library science from University of Maryland. She can field more than 10 years, he earned his bachelor’s degree be contacted at [email protected]. from Western Connecticut State University. Green can be contacted at [email protected]. UK Copyright Law Made Clear for Information Professionals Page 45 Applying Archival Appraisal Concepts to Information Sarah R. Demb is senior records manager/archivist for Harvard Lifecycle Management Page 29 University and has been a records professional for about 20 Stephen Cohen, CRM, is a Certified Records Manager with years. Formerly the museum archivist and records manager more than 15 years of extensive experience in archives, records for the Museum of London and records management advisor and information management, and visual materials manage- for the London Museums Hub, she holds a master’s degree in ment. He has a master’s degree in information science from library and information science from the University of Texas at The University of Texas at Austin and has delivered many Austin. She is co-author of Records Management for Museums presentations on the values of appraisal. He can be contacted and Galleries: An Introduction (Chandos Publications, 2012). at [email protected]. Demb can be contacted at [email protected].

MAY/JUNE 2016 INFORMATIONMANAGEMENT 47 ADINDEX CONTACT INFORMATION

5 Fujitsu Information www.fcpa.com Management IBC NAID magazine is http://directory.naidonline.org the resource for 3 Institute of Certified Records Managers information 518.694.5362 – www.ICRM.org governance professionals. BC OPEX Corp. www.opex.com/falcon-capabilities With a circulation 9 PRISM www.prismintl.org, 1.800.336.9793 of over 27,000 (print and online), this IFC,41 Next Level audience reads and www.arma.org/nextlevel refers to IM much longer than the month of distribution. www.arma.org IM MAGAZINE

Talk to Jennifer about making a splash. Is Your Advertise today! Resumé Ready? ARMA International’s CareerLink is the only job bank specifically targeting records and information governance professionals. Post your resume today Jennifer Millett and search a database of available positions. Sales Account Manager +1 888.279.7378 +1 913.217.6022 It makes job hunting easy! Fax: +1 913.341.6823 [email protected] ADVERTISE IN

48 MAY/JUNE 2016 INFORMATIONMANAGEMENT