Aspects of the embodiments generally relate to a computer system supporting the alignment of records management to a digital records policy.
Records management is the practice of managing the records of an organization from the time they are created until eventual disposal of the records. This may include developing and implementing controls for capturing, classifying, storing, securing, retrieving, destroying and/or preserving records (due to archival value). It also typically includes providing support to litigation (e.g., e-discovery) and regulatory functions. Records retention schedules document the period of time that records must be retained and after which they must be destroyed, absent legal preservation notices. A record may be either a tangible object or digital information: for example, birth certificates, medical x-rays, office documents, databases, application data, and e-mail. Records management is primarily concerned with the evidence of an organization's activities, and is typically applied according to the value of the records rather than their physical format. Records management is a professional discipline, with a body of literature, professional association (ARMA), certification (ICRM) and a key standard that embodies its core requirements (ISO 15489-1 (2001)—Records Management).
Managing physical records involves different disciplines and may draw on a variety of forms of expertise. Physical records typically must be identified, authenticated, filed, and retrieved. This is usually a matter of filing and retrieval; in some circumstances, more careful handling is required. If an item is presented as a legal record, it often needs to be authenticated. Physical records often must be stored in such a way that they are accessible and safeguarded against environmental and human damage (e.g., fire, flood, industrial sabotage). A typical paper document may be stored in a filing cabinet in an office, in a file room, or in an off-site records center. In addition, physical records may be tracked while the records are away from the normal storage area. Tracking may be handled by simple written recording procedures or by a computerized system. When physical records are no longer needed in an onsite location, the physical records are often removed, where records may be destroyed or transferred to an archive. Destruction of records in the absence of legal holds should be authorized by the organization's retention schedule, which is based upon all of the following: law, statute, regulation, industry standard and operating requirements, and the records should be disposed of with care to avoid inadvertent disclosure of information. The process needs to be well-documented, starting with the aforementioned records retention schedule, where policies and procedures have been approved at the highest level.
Many organizations are migrating from physical records to digital records in order to realize cost reductions as well as to facilitate the management of the records. While the general principles of records management apply to records in any format, digital records (typically referred to as electronic records) may raise additional issues. For example, it may be more difficult to ensure that the content, context and structure of records is preserved and protected when the records do not have a physical existence.
Records management has increased interest among corporations due to new compliance regulations and statutes. While government, legal, and healthcare entities have a strong historical records management discipline, general record-keeping of corporate records has been poorly standardized and implemented. In addition, scandals such as the Enron/Andersen scandal, and more recently records-related mishaps at Morgan Stanley, have renewed interest in corporate records compliance, retention period requirements, litigation preparedness, and related issues. Statutes such as the US Sarbanes-Oxley Act have created new concerns among corporate “compliance officers” that result in more standardization of records management practices within an organization. During most of the 1990's, there have been discussions between records managers and IT managers, and the emphasis of this communication has expanded to include the legal aspects, as it is now focused on compliance and risk. Also, privacy, data protection, and cross-border data flow have become issues of interest for records managers. The role of the records manager to aid in the protection of an organization's records has often grown to include attention to these concerns. The need to ensure that certain information about individuals is not retained has brought greater focus to records retention schedules and records destruction.
Consequently, providing digital records management that addresses the above-mentioned concerns is important to the operations of many businesses.
Aspects of the embodiments address one or more of the issues mentioned above by disclosing methods, computer readable media, and apparatuses in which records management of a business unit is aligned to a digital records policy of a business enterprise. The digital records policy may require process, technology and cultural changes to shift from paper to digital records management. Paper intensive processes tend to have higher costs, negative environmental impacts, increased cycle times, and more risk than electronic processes. In addition, state, federal and international regulations are increasingly requiring businesses to be able to locate and retrieve information quickly.
Another aspect of the embodiments is an implementation document that incorporates key requirements (in the form of questions and lists) necessary to implement the policy and related requirements. Information about a business process and related technologies that support the records of a business unit within a business enterprise is collected and compared with the requirements of the digital records policy of the business enterprise. It is then determined whether there are any gaps between the business process and the digital records policy that require mitigation in order for the records in that system and process to be considered trustworthy. However, these gaps may not be considered gaps in the paper-based records environment.
An action plan may be constructed in order to eliminate or mitigate the gaps.
With another aspect of the embodiments, the economic benefits for a business unit migrating to digital records from paper records are analyzed by a business case wizard tool. An exception for a gap may be granted, if the corresponding economic benefit is not sufficient.
Aspects of the embodiments may be provided in a computer-readable medium having computer-executable instructions to perform one or more of the process steps described herein.
These and other aspects of the embodiments are discussed in greater detail throughout this disclosure, including the accompanying drawings.
The present invention is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:
In the following description of the various embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown by way of illustration various embodiments in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural and functional modifications may be made without departing from the scope and spirit of the present invention.
In the description herein, the following terms are referenced.
Business enterprise: A business entity that provides goods and/or services. A business enterprise may vary in size from a one-person sole proprietorship to an international corporation having different lines of business, billions of dollars in assets, and thousands of employees. The size of a business unit within the business enterprise typically varies in size based on the size of the enterprise itself. For example, a business unit may be a line of business in a large business enterprise or may encompass the entire enterprise for a small business enterprise.
Digital records: Information that documents business functions, activities and/or transactions in a form that requires a computer or digital device to process it, such as email, Microsoft Office documents, and electronic reports. Digital records may be created, received, processed and maintained by any associate in a line of business and/or support partners, and may be retained as evidence of business because of the information contained therein.
Metadata: “Data about data” of any sort in any media. An item of metadata may describe an individual datum, content item, or a collection of data including multiple content items and hierarchical levels, e.g., a database schema. With data processing, metadata is typically definitional data that provides information about or documentation of other data managed within an application or environment.
In accordance with various aspects of the embodiments, methods, computer-readable media, and apparatuses are disclosed in which records management of a business unit (e.g., a line of business) is aligned to a digital records policy of a business enterprise. The digital records policy may require process, technology and cultural changes to shift from paper to digital records management. Paper intensive processes tend to have higher costs, negative environmental impacts, increased cycle times, and more risk than electronic processes. In addition, state, federal and international regulations are increasingly requiring businesses to be able to locate and retrieve information quickly.
Adoption of a digital records policy of a business enterprise by its lines of business may have a number of benefits, including: 1) Create a consistent digital records management process, 2) Define and meet requirements to ensure that digital records are considered trustworthy by all stakeholders, including regulators and the courts, 3) Ensure the sufficiency of electronic systems as repositories of official company records, 4) Offset the legal risk and expense of e-discovery, and 5) Define exceptions to the mandate (e.g., where there is a unique legal requirement to maintain hard-copy records related to a specific function).
The embodiments are operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with the embodiments include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
With reference to
Computer storage media include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but is not limited to, random access memory (RAM), read only memory (ROM), electronically erasable programmable read only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device 101.
Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Modulated data signal is a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.
Computing system environment 100 may also include optical scanners (not shown). Exemplary usages include scanning and converting paper documents, e.g., correspondence, receipts, and the like to digital files.
Although not shown, RAM 105 may include one or more are applications representing the application data stored in RAM memory 105 while the computing device is on and corresponding software applications (e.g., software tasks), are running on the computing device 101.
Communications module 109 may include a microphone, keypad, touch screen, and/or stylus through which a user of computing device 101 may provide input, and may also include one or more of a speaker for providing audio output and a video display device for providing textual, audiovisual and/or graphical output.
Software may be stored within memory 115 and/or storage to provide instructions to processor 103 for enabling computing device 101 to perform various functions. For example, memory 115 may store software used by the computing device 101, such as an operating system 117, application programs 119, and an associated database 121. Alternatively, some or all of the computer executable instructions for computing device 101 may be embodied in hardware or firmware (not shown).
Database 121 may provide storage of assessment documents for an enterprise digital records management program as well as digital records themselves. While database 121 is shown to be internal to computing device 101, database 121 may be external to computing device 101 with some embodiments.
Computing device 101 may operate in a networked environment supporting connections to one or more remote computing devices, such as branch terminals 141 and 151. The branch computing devices 141 and 151 may be personal computing devices or servers that include many or all of the elements described above relative to the computing device 101.
The network connections depicted in
Additionally, one or more application programs 119 used by the computing device 101, according to an illustrative embodiment, may include computer executable instructions for invoking user functionality related to communication including, for example, email, short message service (SMS), and voice input and speech recognition applications.
Embodiments of the invention may include forms of computer-readable media. Computer-readable media include any available media that can be accessed by a computing device 101. Computer-readable media may comprise storage media and communication media. Storage media include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, object code, data structures, program modules, or other data. Communication media include any information delivery media and typically embody data in a modulated data signal such as a carrier wave or other transport mechanism.
Although not required, one of ordinary skill in the art will appreciate that various aspects described herein may be embodied as a method, a data processing system, or as a computer-readable medium storing computer-executable instructions. For example, a computer-readable medium storing instructions to cause a processor to perform steps of a method in accordance with aspects of the embodiments is contemplated. For example, aspects of the method steps disclosed herein may be executed on a processor on a computing device 101. Such a processor may execute computer-executable instructions stored on a computer-readable medium.
Referring to
Computer network 203 may be any suitable computer network including the Internet, an intranet, a wide-area network (WAN), a local-area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), or any combination of any of the same. Communications links 202 and 205 may be any communications links suitable for communicating between workstations 201 and server 204, such as network links, dial-up links, wireless links, and hard-wired links. Connectivity may also be supported to a CCTV or image/iris capturing device.
Referring to
As understood by those skilled in the art, the steps that follow in the Figures may be implemented by one or more of the components in
Responsibility list 300 includes responsibilities 301-307.
Integration with Corporate Records Management 301: Communications and collaboration channels; integration with a records management board (typically a group of experts that are knowledgeable about records management within the business enterprise); long term planning with the digital records program.
Communications and Training 302: Communications planning and rollout; user documentation, training development; coordination with corporate records management for communications and training.
Corporate Records Management Requirements 303: File plan development; retention policy management; records management roles.
Legal and e-Discovery 304: Litigation notification process; policy updates; legal and regulatory requirements; industry standards and best practices.
Policy Execution 305: Assessment pipeline management; project prioritization; tracking and reporting financial benefits.
Technology 306: Enterprise content management; metadata rollout; records management platform.
Program Infrastructure 307: Program management office (PMO) activities; financial management; tracking and reporting; problem resolution.
In the flow diagrams shown in
In stage 401 the business unit (in particular responsible members of the business unit) reads a statement of the digital records policy and program. The business unit identifies a business process that may utilize digital records. (A business unit may identity one or more processes, where each process may have different owners.) The owner of the process is identified and performance is integrated into the process owner's performance and development plan.
Registration for assessing the process is initiated by taking an online survey at block 501 and registration is completed at block 503. Documentation is submitted at block 505 that may include pre-work policy implementation checklist 551 and business case wizard tool 552.
Pre-work policy implementation checklist 551 may include current environment documentation such as an assessment workgroup contact list and roles, business unit's organization chart, electronic to electronic process maps, technology diagrams demonstrating the chain of custody and control points, legal and regulatory guidance, audit findings, and regulation and law impacts.
In order to complete stage 401, the registration survey should be completed, and assessment pre-work questions should be answered and documented in policy implementation checklist 551. Once the pre-work is completed at block 507, the measure stage is initiated as will be discussed with
The policy implementation checklist (also known as assessment tool or assessment and certification tool) (shown as checklist 551 during the define stage) may be used during other stages of assessment. With some embodiments, additional worksheets (with respect to checklist 551) may be completed during subsequent stages. For example, during measure stage 402 policy implementation checklist 751 (as shown in
In order to complete stage 402 process and legal questions and metadata questions should be answered and documented on policy implementation checklist 751. Findings should be documented to include next steps, if changes are required and any requested exceptions submitted to PMO. Exceptions may be directed to an identified gap in which the corresponding economic benefit does not justify deleting the gap.
As previously discussed when referring to
At block 901, the business unit continues to follow the business as usual change process, executes changes, and provides status updates to program management organization. The program management organization reviews the final assessment report with the business unit at block 903. If the report is approved at block 905, the report is presented to the records management governance board for approval at block 907. After admittance to the digital records program in blocks 909 and 911, implementation proceeds forward with the digital processes, including destruction of digital records as required, initiating destruction of back file paper records, as appropriate, and ceasing to create hard-copy records going forward.
Aspects of the embodiments have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one of ordinary skill in the art will appreciate that the steps illustrated in the illustrative figures may be performed in other than the recited order, and that one or more steps illustrated may be optional in accordance with aspects of the embodiments. They may determine that the requirements should be applied to third party service providers (e.g., those that maintain records on behalf of the company).
This application is a continuation of U.S. application Ser. No. 12/698,685 filed on Feb. 2, 2010, entitled “Digital Records Management,” which is incorporated herein by reference in its entirety.
Number | Date | Country | |
---|---|---|---|
Parent | 12698685 | Feb 2010 | US |
Child | 14980509 | US |