The best risk insurance? Good RM
In March of 2023, the Ottawa Citizen published an article describing incidences of poor handling of access to information requests by National Defense.
2021 saw media articles on the legal and long-term historical impacts of poor record keeping practices by former US President Donald Trump and his administration. There were some fascinating examples especially the image of historians taping together ripped records.
A 2016 Toronto Star article reported on the Ontario environment ministry falsifying dates on Freedom of Information requests.
A 2015 CBC story outlined the inappropriate deletion of email records and a general culture of “delete, delete, delete” in the BC Liberal government at the time. In 2017, CBC News wrote about Premier Brad Wall using a private email account for government business. Hillary Clinton did the same in 2015.
These are only a small sample of the media stories appearing over the years about the mishandling of corporate records. This isn’t the type of press any organization needs, whether public or private sector. It negatively impacts reputation, credibility, creates unnecessary costs, and draws time and attention away from more important work.
In addition to creating reputational risk, poor record keeping and information management introduces other important risks as well:
Financial risk – responding to access to information requests, or providing evidentiary records for litigation, can be very labor intensive, and costly, if authoritative records are not easy to find and provide in response to the request. These costs are compounded, along with excessive storage costs, without regular disposition and disposal of eligible records and reduction of inventory to search through.
Opportunity risk – the time spent on gathering records for official requests is time not available to focus on business objectives and take advantage of emerging business opportunities.
Productivity and business risk - poor recordkeeping creates conditions where people can’t find the information they are looking for, can’t collaborate easily, question what they do find, and often as a result recreate work unnecessarily. This can easily lead to poor business decisions and even worse, stifle productivity in your organization. This can create even bigger risks such as the risk that you can't innovate, can’t compete and can’t service customers or constituents well.
Knowledge risk – Poor record keeping directly affects the quality of corporate knowledge and history to learn from and build on.
Security risk – An important element of a good records program is effectively managing security and access permissions so that sensitive information is appropriately safeguarded, while the remainder is open for reference and re-use. This involves secure spaces with controlled access for sensitive information and data, accurate metadata and sensitivity labeling to protect information and prevent data loss.
The challenges and risks are mounting with the increasing number of data sources and platforms common in today’s organizations, as well as the emergence of remote and hybrid work. In some circumstances, access to information and e-discovery requests extend to forensic imaging of devices, investigating browser histories on personal devices, and the collection of deleted or transitory data.
Addressing the risks
The most effective way to meet these challenges and risks is with a thoughtful, intentional, and practical records program. This includes:
Regularly updated retention schedule
With support from your legal team, ensure you have an up-to-date file plan and retention schedule so you know exactly what constitutes corporate records, where and how they are stored, and how long they should be kept.
Clear roles and responsibilities
Ensure you have a policy framework with policies, directives, standards, and guidelines that clarify management, staff and specialist roles and responsibilities for records management across all information and data systems and sources.
Ongoing communications and learning
With technology change and leader and employee turnover, it is essential to communicate roles and responsibilities, and to ensure access to learning material so everyone has the knowledge and skill to fulfill their roles and responsibilities. A video by National Archives of Australia titled Information Matters is one example of how to inform a general audience in an accessible way.
Use technology strategically
Acquire and configure technology to make record keeping and records management as easy as possible, and ensure content has appropriate metadata to help automate records classification as much as possible. Explore an e-discovery tool to facilitate identification, preservation and provision of electronic records for access to information and e-discovery requests. Explore technology solutions for information protection and data loss prevention to protect sensitive information and prevent data loss.
Good housekeeping
From an access to information or e-discovery perspective, everything captured is a record and can be in scope. Identifying and tagging “corporate records” according to the retention schedule provides the opportunity of considering non-corporate records as transitory (e.g. redundant, obsolete, reference, duplicate) and therefore able to be defensibly deleted.
Services and specialists
Records management is a specialized function and skill set, so part of a good records program is to provide services to leaders and the user community. These services range from advisory including requirements for new systems and data disposition in decommissioned ones, to monitoring, inventory management, disposition and archival preservation of information and data records in all formats.
Get your inventory under control
The root of risks in many organizations is not having an accurate inventory of and location for physical and electronic corporate records. In addition, clear ownership identified for those records, which records are eligible for disposal and when, and which need to be preserved for the longer term, and regular ongoing disposal of eligible records are needed. A good records program addresses these challenges.
Engage content owners
Content owners are the leaders of the business areas, departments and divisions that acquire or generate information and data. They are arguably the most knowledgeable about their information.
For a successful records program they should be involved in providing input into the file plan and retention schedule so that the records classification is representative, and information is retained long enough to meet business needs, in addition to legal requirements. They should also be involved in approving disposal at the end of the retention period.
Regular auditing for feedback and continuous improvement
Building and maintaining a records program is a long-term prospect and requires regular monitoring and feedback. Technology helps analyze and present data on elements of the program like inventory counts and growth trends, disposition eligibility, records declaration, and compliance and so on.
More importantly, an internal audit team (or external service) can help design a program that makes sense for your organization, help establish change priorities, monitor progress, and provide ongoing feedback and advice.
Long-term preservation
Some organizations have a need for the longer-term preservation of priority information and data. If this is the case, developing and implementing a long-term preservation strategy will be important to ensure the accessibility of archival information and data records into the future through technology and file format changes, and to mitigate the real risk of data degradation and “bit rot”.
Learn more
How do I Setup SharePoint so that Records Management is Easy? Watch the session:
We can help create an effective records program that meets your compliance regulations and obligations. Reach out anytime to chat.
Bonus: Fun Facts!
Prior to Nixon’s resignation as US president, and the passing of the Presidential Recordings and Materials Preservation Act of 1974, outgoing Presidents could do what they choose with the records they created in office. Following a failed court challenge by Nixon, the Presidential Records Act of 1978 was enshrined in law, making Presidential records Public property.
In Canada, the PM’s own records are not public property, though there is a time honored tradition of providing records to the Canadian Archives.
