Records management: five lessons from the trenches - Society of ...

Records management: five lessons from the trenches - Society of ...

Records management: five lessons from the trenches - Society of ...


Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Volume Three<br />

Number Five<br />

December 2006<br />

Bimonthly<br />

Meet<br />

Hal Degenhardt<br />

Partner, Fulbright & Jaworski<br />

“The Caputo<br />

Opinion”<br />

Judge Ruben Castillo<br />

By Bill Prachar<br />

Join SCCE!<br />

Are you a member <strong>of</strong> a<br />

pr<strong>of</strong>essional compliance<br />

and ethics organization<br />

Page 28<br />

<strong>Society</strong> <strong>of</strong> Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org<br />

See pages 24–25<br />

December 2006

Effective records<br />

<strong>management</strong>: Five<br />

<strong>lessons</strong> <strong>from</strong> <strong>the</strong><br />

“<strong>trenches</strong>”<br />

By Ann Straw<br />

Editor’s Note: Ann Straw is <strong>the</strong> Vice<br />

President and Chief Compliance Officer<br />

for Laidlaw International, Inc. Prior to<br />

joining Laidlaw, Ann was Vice President-<br />

Regulatory Affairs and assistant General<br />

Counsel at Corn Products International<br />

Inc, where she was responsible for SEC<br />

reporting, Sarbanes-Oxley and NYSE listing<br />

standards, and o<strong>the</strong>r corporate policies.<br />

<strong>Records</strong> <strong>management</strong> has<br />

become an area <strong>of</strong> increasing<br />

identified risk for companies<br />

since <strong>the</strong> passage <strong>of</strong> <strong>the</strong> Sarbanes-Oxley<br />

Act and, most recently, with <strong>the</strong> implementation<br />

<strong>of</strong> <strong>the</strong> Federal Rules governing<br />

electronic discovery. In addition, <strong>the</strong><br />

world is not going paperless when, in<br />

fact, records are created more easily than<br />

ever before, distributed and forwarded<br />

to larger numbers <strong>of</strong> people, and saved<br />

both electronically and in hard copies by<br />

many recipients. Generation <strong>of</strong> records<br />

has been increasing every year and is<br />

expected to continue. For example,<br />

one study indicates that <strong>the</strong> volume <strong>of</strong><br />

corporate e-mail per day is expected<br />

to increase <strong>from</strong> 31 billion in 2003 to<br />

60 billion in 2006. 1 The end result is<br />

an ever greater volume <strong>of</strong> records that<br />

are being saved unnecessarily or that<br />

are required to be saved but haven’t<br />

been indexed and stored so <strong>the</strong>y can be<br />

searched, reviewed, and produced on a<br />

timely basis in response to a board <strong>of</strong><br />

directors’ inquiry, a government investigation,<br />

or a civil subpoena.<br />

The process <strong>of</strong> finding, retrieving,<br />

reviewing, and producing records is<br />

extremely costly in terms <strong>of</strong> both transaction<br />

time for <strong>management</strong> and <strong>the</strong><br />

dollars involved in <strong>the</strong> process. The failure<br />

to find, retrieve, and produce records<br />

may be extremely costly, if penalties<br />

are imposed as a result. Recognition <strong>of</strong><br />

<strong>the</strong>se risks has caused many companies<br />

to undertake a review <strong>of</strong> existing records<br />

retention policies and procedures. The<br />

ultimate goal <strong>of</strong> such a review is to<br />

implement a records <strong>management</strong> program<br />

that will protect <strong>the</strong> company in a<br />

new era.<br />

In <strong>the</strong> past few years I have been<br />

involved with a variety <strong>of</strong> projects to<br />

implement efficient records <strong>management</strong><br />

programs. Although each <strong>of</strong> <strong>the</strong>se initiatives<br />

is a work in progress, many <strong>lessons</strong><br />

can be learned. This article discusses <strong>five</strong><br />

<strong>lessons</strong> that may be helpful to o<strong>the</strong>rs<br />

who are considering initiating a records<br />

<strong>management</strong> project in <strong>the</strong> future.<br />

Lesson No. 1: Get buy-in <strong>from</strong> <strong>the</strong> business<br />

units <strong>of</strong> your company<br />

In an era <strong>of</strong> increased scrutiny over<br />

spending, most companies are cost<br />

conscious. Successful records <strong>management</strong><br />

programs do not bring dollars to<br />

<strong>the</strong> bottom line in <strong>the</strong> same way that<br />

a successful acquisition or securing a<br />

long-term contract will. This means that<br />

<strong>the</strong> resources necessary to undertake a<br />

records <strong>management</strong> project will not be<br />

Ann Straw<br />

willingly turned over, unless <strong>the</strong>re is buyin<br />

<strong>from</strong> upper <strong>management</strong>, field <strong>management</strong><br />

(where historic records <strong>of</strong>ten are<br />

stored and where many <strong>of</strong> <strong>the</strong> day-to-day<br />

business records are generated), and <strong>the</strong><br />

IT department. At each <strong>of</strong> <strong>the</strong>se levels,<br />

it is important that <strong>the</strong> business sees <strong>the</strong><br />

value <strong>of</strong> <strong>the</strong> undertaking. It isn’t always<br />

obvious.<br />

One effective way to make <strong>the</strong> point<br />

about risk is to describe recent cases<br />

where companies have spent millions<br />

<strong>of</strong> dollars to comply with discovery<br />

requests, or paid fines or settled cases for<br />

failing to produce records or for destroying<br />

records. Examples include Prudential<br />

(a court imposed civil penalties <strong>of</strong> $1 million<br />

for records destruction), Bank <strong>of</strong><br />

America (<strong>the</strong> SEC fined <strong>the</strong> company<br />

$10 million for being slow to produce<br />

evidence and for misleading regulators),<br />

American Express Financial Advisors<br />

(fined $300,000 by <strong>the</strong> National Assoc.<br />

<strong>of</strong> Securities Dealers for failure to<br />

maintain customer account statements<br />

in required format), Murphy Oil USA<br />

v. Fluor Daniel, Inc. ($6.2 million was<br />

spent recovering data <strong>from</strong> 93 backup<br />

tapes), In Re Bristol Myers Squibb (over<br />

$400,000 was spent scanning over 3<br />

million pages <strong>of</strong> documents), Rowe<br />

December 2006<br />

16<br />

<strong>Society</strong> <strong>of</strong> Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

Entertainment v. The William Morris<br />

Agency ($395,944 was spent to restore 8<br />

backup tapes, over $400,000 to restore<br />

47 backup tapes and retrieve email <strong>from</strong><br />

desktop PCs for attorney review), and<br />

<strong>of</strong> course <strong>the</strong> infamous case <strong>of</strong> Arthur<br />

Anderson (involving records destruction<br />

in <strong>the</strong> face <strong>of</strong> an impending government<br />

investigation ). 2<br />

Dollar figures like <strong>the</strong>se help you get <strong>the</strong><br />

point across that records mis<strong>management</strong><br />

is a significant area <strong>of</strong> potential<br />

risk to a company. The need to manage<br />

risk to avoid penalties, or simply to<br />

avoid <strong>the</strong> outrageous transaction costs<br />

that arise in complying with records production<br />

requests, can be conveyed fairly<br />

easily by pointing to <strong>the</strong> misfortune that<br />

o<strong>the</strong>r companies have suffered as a result<br />

<strong>of</strong> not having adequate records <strong>management</strong><br />

programs in place.<br />

But, beyond sending a strong message<br />

regarding risk avoidance, it is crucial<br />

to get buy-in at <strong>the</strong> outset in order to<br />

complete <strong>the</strong> day-to-day drudgery <strong>of</strong> <strong>the</strong><br />

project itself. The drudgery includes:<br />

n Reviewing boxes <strong>of</strong> records stored in<br />

<strong>the</strong> basements, garages, warehouses,<br />

unused <strong>of</strong>fices, or <strong>of</strong>fsite storage areas<br />

<strong>of</strong> <strong>the</strong> company—a time-consuming<br />

and <strong>of</strong>ten dirty task;<br />

n Completing a survey <strong>of</strong> approximately<br />

how many boxes, going back how<br />

many years, and containing what<br />

types <strong>of</strong> records, are being held at<br />

each location in <strong>the</strong> company and<br />

compiling <strong>the</strong> survey results (after<br />

endlessly pursuing those managers<br />

who did not find time to complete<br />

<strong>the</strong> survey within <strong>the</strong> deadline due<br />

to <strong>the</strong> pressure <strong>of</strong> “running <strong>the</strong> business”);<br />

n Determining <strong>the</strong> contents <strong>of</strong> thousands<br />

<strong>of</strong> boxes that are merely labeled,<br />

“HR” or “1998” or “John Doe-<br />

Finance Dept. 2000” or frequently<br />

not labeled at all;<br />

n Discovering which <strong>of</strong> <strong>the</strong> historic<br />

records are being maintained in<br />

duplicate in o<strong>the</strong>r areas, regions, or<br />

corporate <strong>of</strong>fices, and <strong>the</strong>refore, can<br />

be destroyed;<br />

n Creating a common vocabulary so<br />

that personnel around <strong>the</strong> company<br />

are handling similar records in <strong>the</strong><br />

same way. For example, a personnel<br />

file in some parts <strong>of</strong> <strong>the</strong> company<br />

may be broken down into an<br />

“employee file,” “performance file,”<br />

and/or “benefits file” in o<strong>the</strong>r parts<br />

<strong>of</strong> <strong>the</strong> company; a “purchase order”<br />

may be referred to as an “invoice”<br />

in various parts <strong>of</strong> <strong>the</strong> company.<br />

Never assume that personnel who<br />

are reading procedures for maintaining<br />

records will understand that a<br />

personnel file can be <strong>the</strong> same as <strong>the</strong><br />

employee file or that a purchase order<br />

can also mean an invoice);<br />

n Retrieving contracts <strong>from</strong> around <strong>the</strong><br />

company for <strong>the</strong> <strong>of</strong>fsite storage facilities<br />

that house company records and<br />

<strong>the</strong>n reviewing, and if possible, combining<br />

those contracts (if necessary)<br />

to obtain a volume-based discount for<br />

<strong>of</strong>fsite storage;<br />

n Establishing a records retention schedule<br />

that takes into account federal,<br />

state, and municipal requirements for<br />

records retention time periods, and<br />

for multi-national companies, taking<br />

into account foreign law requirements<br />

for records retention; and<br />

n Differentiating between <strong>the</strong> hard copy<br />

records and <strong>the</strong> electronic records<br />

components <strong>of</strong> <strong>the</strong> project and creating<br />

<strong>the</strong> right team to cover each.<br />

All <strong>of</strong> <strong>the</strong> foregoing needs to be done<br />

at <strong>the</strong> outset <strong>of</strong> a records <strong>management</strong><br />

project. Inevitably, you will find that<br />

<strong>the</strong> degree <strong>of</strong> involvement and <strong>the</strong> time<br />

commitment ultimately required by<br />

business managers and administrative<br />

staff is far greater than anticipated, and<br />

<strong>the</strong>refore, buy-in wanes a few months<br />

after <strong>the</strong> project gets underway. It is<br />

important to be realistic about <strong>the</strong> need<br />

for <strong>the</strong>se resources to remain committed<br />

on an ongoing basis. The amount <strong>of</strong><br />

time and energy required to implement<br />

<strong>the</strong> project requires a significant commitment.<br />

Lesson No. 2: Put <strong>the</strong> right team in<br />

place to lead <strong>the</strong> records <strong>management</strong><br />

project<br />

It is logical, initially, to put toge<strong>the</strong>r a<br />

team composed <strong>of</strong> individuals <strong>from</strong> <strong>the</strong><br />

Legal department, <strong>the</strong> Human Resources<br />

department and <strong>the</strong> IT department.<br />

However, it is likely <strong>the</strong> team will<br />

quickly grow to include individuals <strong>from</strong><br />

departments such as Safety and Training<br />

where many records are required to<br />

be maintained for long time periods.<br />

You will probably also want to include<br />

individuals <strong>from</strong> <strong>the</strong> Operations departments<br />

<strong>of</strong> <strong>the</strong> various operating lines<br />

<strong>of</strong> business, <strong>from</strong> <strong>the</strong> Tax department<br />

(which may be notorious for keeping<br />

its records forever), <strong>from</strong> <strong>the</strong> Internal<br />

Audit department (which will likely<br />

be concerned about <strong>the</strong> project <strong>from</strong> a<br />

SOX Section 404 standpoint), and <strong>from</strong><br />

a cross-section <strong>of</strong> your administrative<br />

staff who are ultimately critical to making<br />

a project like records <strong>management</strong><br />

really succeed. The last—and invaluable—addition<br />

to <strong>the</strong> team should be a<br />

Project Manager.<br />

Continued on page 21<br />

<strong>Society</strong> <strong>of</strong> Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org<br />

December 2006<br />


Five <strong>lessons</strong> <strong>from</strong> <strong>the</strong> “<strong>trenches</strong>” ...continued <strong>from</strong> page 17<br />

Lesson No. 3: Assume <strong>the</strong> Project Will<br />

Be Implemented in Phases<br />

Going into <strong>the</strong> project with an eager<br />

team comprised <strong>of</strong> employees <strong>from</strong><br />

<strong>the</strong> departments noted above, it is not<br />

uncommon to attempt to divide <strong>the</strong><br />

work into <strong>the</strong> various areas <strong>of</strong> expertise.<br />

Often, however, <strong>the</strong> various experts are<br />

put on roughly <strong>the</strong> same timetable for<br />

completion. In o<strong>the</strong>r words, once <strong>the</strong><br />

work is divided, everyone is expected to<br />

move forward in tandem toward completion,<br />

both on <strong>the</strong> hard copy records side<br />

and <strong>the</strong> electronic records side <strong>of</strong> <strong>the</strong><br />

project. This is a recipe for disaster.<br />

Development <strong>of</strong> a records <strong>management</strong><br />

system that works for your company will<br />

inevitably require a phased approach.<br />

For example, many aspects <strong>of</strong> <strong>the</strong> hard<br />

copy records initiative and <strong>the</strong> electronic<br />

records initiative are interdependent<br />

elements <strong>of</strong> <strong>the</strong> project. It isn’t possible<br />

to evaluate outside vendors, programs,<br />

s<strong>of</strong>tware, hardware, or systems improvements<br />

for electronic records <strong>management</strong><br />

without understanding <strong>the</strong> nature <strong>of</strong> <strong>the</strong><br />

records being generated and maintained<br />

in hard copy in <strong>the</strong> field, knowing what<br />

records <strong>the</strong> company would want to continue<br />

maintaining in <strong>the</strong> field as opposed<br />

to centralizing at <strong>the</strong> corporate headquarters,<br />

and especially without knowing<br />

<strong>the</strong> legal and practical (<strong>from</strong> a business<br />

standpoint) retention requirements for<br />

certain types <strong>of</strong> records over a number<br />

<strong>of</strong> years.<br />

Generally (although not always, depending<br />

upon <strong>the</strong> sophistication <strong>of</strong> your current<br />

systems), <strong>the</strong> cost commitment will<br />

be far more significant for <strong>the</strong> electronic<br />

records <strong>management</strong> program than for<br />

<strong>the</strong> hard copy records. In addition, in<br />

many companies, pressure on <strong>the</strong> IT<br />

department to address o<strong>the</strong>r priorities<br />

within <strong>the</strong> company takes precedence<br />

over a records <strong>management</strong> project.<br />

The conclusion reached in <strong>the</strong> companies<br />

where I have been involved is<br />

that <strong>the</strong> hundreds, possibly thousands,<br />

<strong>of</strong> boxes <strong>of</strong> historical records in storage<br />

at various facilities were not going<br />

to be cleaned up, re-boxed to eliminate<br />

vermin, indexed and shipped to a centralized<br />

storage area (or alternatively,<br />

shredded and disposed <strong>of</strong>) overnight. It<br />

becomes obvious after a short time that<br />

grappling with <strong>the</strong> daily generation <strong>of</strong><br />

new records, both hard copies and electronically<br />

stored copies, is imperative. It<br />

is crucial to establish ways to reduce <strong>the</strong><br />

generation <strong>of</strong> new records as a first order<br />

<strong>of</strong> business. Addressing <strong>the</strong> problem <strong>of</strong><br />

how to reduce creation <strong>of</strong> new records<br />

and training employees to follow new<br />

document <strong>management</strong> rules on a sustained<br />

basis becomes an immediate priority<br />

<strong>of</strong> any records <strong>management</strong> project.<br />

O<strong>the</strong>r aspects <strong>of</strong> <strong>the</strong> project can be put<br />

on a longer-term timetable, to be phased<br />

in as <strong>the</strong> project progresses.<br />

Lesson No. 4: Seriously Consider Hiring<br />

A Consultant<br />

Early on, your company may determine<br />

that given <strong>the</strong> availability <strong>of</strong> significant<br />

in-house expertise, <strong>the</strong>re is no need for<br />

hiring a consultant to help organize <strong>the</strong><br />

records <strong>management</strong> project. That may<br />

be a mistake. In many companies, <strong>the</strong><br />

competing demands on people’s time,<br />

budgets, space, and o<strong>the</strong>r resources are<br />

too complex for <strong>the</strong> team to reconcile<br />

without an objective outsider’s help.<br />

Seriously consider hiring a consultant<br />

to help define <strong>the</strong> scope <strong>of</strong> <strong>the</strong> project,<br />

set a realistic budget and timetable, and<br />

conduct interviews covering as many<br />

aspects <strong>of</strong> <strong>the</strong> company’s business as<br />

possible, so that no element <strong>of</strong> record<br />

generation or <strong>management</strong> will be overlooked.<br />

A consultant can <strong>the</strong>n prepare a<br />

report that works as a roadmap for <strong>the</strong><br />

team to move forward on <strong>the</strong> project.<br />

After conducting a series <strong>of</strong> interviews<br />

and seeing presentations <strong>from</strong> several<br />

firms, select <strong>the</strong> consultant who fits <strong>the</strong><br />

culture and values <strong>of</strong> your company,<br />

but also emphasize finding a consultant<br />

who will be practical, accessible, realistic<br />

and candid— all qualities you will value<br />

enormously as <strong>the</strong> project progresses.<br />

A well-chosen consultant will help <strong>the</strong><br />

project team stay on track in many ways.<br />

For example, consider holding weekly<br />

conference calls to follow up on <strong>the</strong><br />

interview process (a representative sampling<br />

<strong>of</strong> employees <strong>from</strong> all lines <strong>of</strong> <strong>the</strong><br />

business should each be interviewed for<br />

approximately half an hour to an hour<br />

to assess needs and current practices) and<br />

consider requiring interim reports that<br />

are concise and to <strong>the</strong> point as progress<br />

markers for <strong>the</strong> project. You will need<br />

ways to measure progress and stay on<br />

your timetable toward completion or <strong>the</strong><br />

project will lose momentum, because <strong>of</strong><br />

its inevitable massive scope.<br />

Lesson No. 5: Be realistic about <strong>the</strong><br />

need to “roll up your sleeves”<br />

A records <strong>management</strong> project may seem<br />

easy to delegate, but it is not easy to<br />

get done <strong>the</strong> way you will want it done<br />

without hands on involvement by team<br />

leaders. As a result, your team should<br />

plan to do site visits to locations where<br />

records are stored in <strong>the</strong> field, such as<br />

<strong>the</strong> garages, attics, and basements <strong>of</strong><br />

your company’s various <strong>of</strong>fices and facilities.<br />

You and your team should tour <strong>the</strong><br />

Continued on page 23<br />

<strong>Society</strong> <strong>of</strong> Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org<br />

December 2006<br />


Five <strong>lessons</strong> <strong>from</strong> <strong>the</strong> “<strong>trenches</strong>” ...continued <strong>from</strong> page 21<br />

<strong>of</strong>fsite warehouses where outside vendors<br />

have your records stored. You may find<br />

it very helpful to actually cull through<br />

hundreds <strong>of</strong> boxes <strong>of</strong> old documents,<br />

and <strong>the</strong>n make <strong>the</strong> dozens <strong>of</strong> phone calls<br />

necessary to understand <strong>the</strong> contents <strong>of</strong><br />

<strong>the</strong> boxes you have reviewed. Before you<br />

actually start reviewing <strong>the</strong> old records,<br />

you will also need to determine legal<br />

retention requirements and determine<br />

who in your company wants or needs<br />

<strong>the</strong> type <strong>of</strong> records you discover during<br />

your tour.<br />

At this point, it may become critical to<br />

force records <strong>management</strong> issues to <strong>the</strong><br />

top <strong>of</strong> <strong>the</strong> company radar screen so that<br />

realistic and enforceable decisions can be<br />

made regarding ownership <strong>of</strong> <strong>the</strong> records,<br />

location <strong>of</strong> stored records, length <strong>of</strong> time<br />

for records retention, and responsibility<br />

for records <strong>management</strong> decision-making.<br />

By this stage <strong>of</strong> <strong>the</strong> project, you<br />

will need to have disseminated a realistic<br />

records retention schedule (most<br />

records simply don’t need to be kept as<br />

long as people/departments/companies<br />

are inclined to keep <strong>the</strong>m; some documents<br />

aren’t records at all and should not<br />

be kept). Focus on creating a schedule<br />

that is easy to follow and written in a<br />

vocabulary that is commonly understood<br />

in your organization. This may be a far<br />

more difficult task than you may anticipate<br />

up front. Probably <strong>the</strong> most import<br />

outcome <strong>of</strong> a truly hands-on approach,<br />

however, will be that you continuously<br />

reinforce <strong>the</strong> critical buy-in and set <strong>the</strong><br />

tone at <strong>the</strong> top <strong>of</strong> your organization.<br />

Conclusions<br />

Approximately one year into your<br />

company’s records <strong>management</strong> project,<br />

you should have a great and committed<br />

team <strong>of</strong> pr<strong>of</strong>essionals who represent <strong>the</strong><br />

various functional areas <strong>of</strong> <strong>the</strong> business,<br />

and who know a lot more about <strong>the</strong> way<br />

records are generated and stored in <strong>the</strong><br />

company than anyone did at <strong>the</strong> outset.<br />

By <strong>the</strong>n you should also be well aware<br />

how big <strong>the</strong> project is—something you<br />

may not have realized when it began.<br />

And your team should be far more realistic<br />

about <strong>the</strong> time required to implement<br />

a records <strong>management</strong> program<br />

that allows a rational search <strong>of</strong> records<br />

databases, can produce needed records<br />

upon demand, and consistently disposes<br />

<strong>of</strong> unneeded records on a regular schedule.<br />

These may not sound like huge<br />

accomplishments, but once achieved,<br />

your team will be far better prepared<br />

to maintain a records <strong>management</strong><br />

program far into <strong>the</strong> future, one that is<br />

flexible, usable, and ultimately meets<br />

<strong>the</strong> primary objective <strong>of</strong> protecting your<br />

company <strong>from</strong> risk.<br />

1. Source: General Counsel Roundtable research.<br />

2. Sources: Feith Systems and S<strong>of</strong>tware, Inc., “Building an Effective<br />

Compliance & Litigation Support Architecture” and General<br />

Counsel Roundtable research.<br />

<strong>Society</strong> <strong>of</strong> Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org<br />

December 2006<br />


Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!