ALISON NORTH

Managing Records Retention and Disposal

IN ASSOCIATION WITHPUBLISHED BY

ALIS

ON

NO

RTH

Man

agin

g R

ecord

s Reten

tion

and

Disp

osal

3

Chapter 1: Introduction

Managing records retention and disposal – a definitionManaging records retention and disposal refers to the development of a strategy based on a policy that contains lasting principles. The retention management strategy is a basis for action and is underpinned by up-to-date and organisation-specific legislative and regulatory rules and organisational practice. The purpose of the retention management strategy is to manage the final outcome of the information contained within the records that are created and received by an organisation.

This chapter summarises what is meant by managing records retention and disposal and where it fits in an organisation, if at all. To set the scene for the rest of the report, however, opinions, a little history and certain facts relating to records retention are included at the beginning of this chapter. The chapter concludes with a statement on defining retention rules as a lead into Chapter 2 which addresses legal requirements and research.

An opinion on records management and retentionThe phrase ‘records retention and disposal’ is unfamiliar to the majority of workers; the need for their organisation to develop a programme for retention and implement it successfully is a rarely-understood necessity. If you remember little else with regards to the opinion and guidance in this report, please remember these two opening statements and repeat quietly as you develop a business

case, define a policy and integrate retention rules into your organisation’s daily life.

If you are a records manager you will most likely challenge some or all of the above paragraph. You may remark that your colleagues do know what is meant by records retention and disposal and that they understand the need to abide by the retention rules showing when to dispose of the documents and files they create and receive. You may continue that it is a difficult and time-consuming programme to implement and keep accurate and up-to-date and that your colleagues rarely agree to disposal when they review the archive lists, citing work-related reasons for retaining those records that are due for disposal (according to the carefully researched and approved retention schedule). You may pause for breath and go on that you have little time or money to implement the retention programme, that it is seen as necessary to have a retention schedule but it is not supported well enough by the ‘hierarchy’. You may add that staff have no liking for additional administrative duties and will only deal with disposal as part of a black bag throw-away day (with a suitably amusing acronym) that you have introduced for purposes of archiving and to clear out random storage and dumping areas in your office. This programme is very successful – after all, you do offer bribes in the form of prizes for the most paper disposed of; the hierarchy does support it, although you are unsure why as it is a disruptive and noisy

4

Chapter 1

Before we start: Glossary of terms There are a number of words in common use within the records management profession that may need explanation in terms of this report. There are also some definitions new to records management that are explained here.

Documents, records and filesFor the purposes of this report I have chosen not to distinguish between these three different words, all of which hold information in or on them that in turn makes them part of the ‘information lifecycle’. ISO 15489-1:2001 Information and documentation – Records management does give a formal meaning to the word record: “information created, received and maintained as evidence and information by any organisation or person in pursuance of legal obligations or in the transaction of organisation”.1 Whilst in professional records management circles the differences between a record, a file and a document are recognised and understood, in the wider world people do not find it easy or necessary to differentiate between the three.

DataThe word data, however, is not usually confused with document, file or record and is more often used in connection with electronic information. The terms unstructured data and structured data serve to separate information randomly stored on the server or desktop (unstructured data) from information contained in databases or specific systems such as customer relationship management (CRM) systems (structured data). Metadata is also in popular use in the records management environment and refers to the properties of a record, such as the name of its creator or editor, the date on which it was created, the class to which it belongs, its subject matter and so on.

KnowledgeSimply put, knowledge is what we gather and store inside our heads as we experience life and interact with others. Our knowledge is something we impart to others. Knowledge leads us to opinions. There is a lot of opinion in this report. Some of it is based on knowledge and information being blended to formulate ideas; some is based on my experiences over the past 30 plus years in information management. You may not agree with my opinions and I am pleased about that as debate brings forth different solutions. Other than in this chapter I shall not be using the word knowledge in this report but explain it here to put it into context and to show that it is part of the family of words used by information professionals.

InformationInformation is the result of our knowledge colliding with another’s knowledge whilst communicating. Information enriches our own knowledge and is often laid down in print or shared through the spoken word. Information is contained within the records that we are trying to manage within our organisation.

Managing Records Retention and Disposal

5

day; and, of course, it is an opportunity for you to explain records management to your colleagues and expound on why it is so necessary to the organisation that employs all of you.

If you are not a records manager then please bear with me. There is a purpose to this rant at the beginning of this serious report on managing records retention and disposal, and that is the removal of all the trivia that seems to accompany records management, in order to implement a set of really very simple controls to manage records and introduce retention and disposal from day one.

The information lifecycle and records management Records management (RM) puts into place controls to manage the ‘information lifecycle’ (see below for an explanation). It is firmly believed by the RM fraternity that

these controls should be part of each and every process in the organisation, that they should assist staff to maintain accurately, use effectively, share appropriately and then retain or dispose of records for which they are responsible. Not all staff, however, have a responsibility for the final outcome of every record they use so the records management controls should show where various responsibilities lie. Records management should provide guidance on techniques for filing, searching, retrieving and storing. The records management controls must also provide detailed and accurate information on records retention in terms of both organisation requirements and legal requirements.

Please note that nowhere in this report does it state that records management is the sole responsibility of an individual, a separate department, or a person called a ‘records manager’. True, somebody may have to be accountable for the development

OrganisationI shall use this word to signify every type of business, company, society, charity, institution, family unit.

ProcessProcess is a “sequence of interdependent and linked procedures [I personally prefer tasks] which, at every stage, consume one or more resources (employee time, energy, machines, money) to convert inputs (data, material, parts, etc.) into outputs [information contained in records]. These outputs then serve as inputs for the next stage until a known goal or end result is reached”.2 The outputs referred to include information contained in records. To paraphrase Robert Redford’s 1992 film, information is the river running through the process.

Breakable/unbreakable sets of documentsBreakable sets of documents may have items purged from within them. All documents in an unbreakable set will be retained and destroyed together.

A breakable collection has no document type and merely acts as a cross-reference to link different documents or sub-collections. An unbreakable collection has a document type property of its own which will dictate the retention period. Essentially this collection acts as a single document.

Chapter 1

6

of the records management controls and the records retention information but that person should not be charged with the responsibility of filing and archiving for the organisation. The records management policy, the controls and the auditing to ensure that the controls are working and being used should be developed in line with other information-related policies such as information security, data protection and continuity. This should be part of an overall organisational strategy – not, as in many cases, a separate process born out of archive storage requirements and seen as a paper management exercise.

So if records management puts in place controls to manage the information lifecycle, what is this lifecycle and where does records retention belong? The information lifecycle has four elements and records retention is included in all of them. The information lifecycle is broken down as follows:

Creation − When information is created and may be brought together with other information for a purpose or process. At this stage the words document, record and file become part of the information lifecycle vocabulary and are used and confused. Active use – When the information is in constant use for one or more reasons or processes. At this stage it can be copied, e-mailed, edited over and over again and stored in many different places in different media.Semi-active use – When the information and the many duplicates are left dormant but may be referred to occasionally. The reason for the existence of the information can quite easily be forgotten and the primary or master record lost in the mess.Final countdown – At this stage there are two options for the information:

retain or dispose. Without clear guidelines, the former becomes the status quo and the latter option for disposal is rarely chosen. Records that are badly managed, with no guidance on retention and disposal during the earlier three stages in the information lifecycle, result in a poor, non-compliant and expensive final countdown.

Records management past historyAfter 30 plus years in the information management world, there is no doubt in my mind that the efficient management of records is important to all types of organisations, from parish councils to multinational organisations – even the family unit. The assumption in the late 1980s/early 1990s that staff could ‘deal with’ their own filing without guidance was a cost-cutting mistake made in a time of recession that has resulted in the ‘piles of files’ that lie dormant in commercial storage companies around the world and on various (in some cases redundant) electronic media. This mistake is now costing organisations many thousands of pounds per year in third-party fees, as well as leaving them exposed to legal penalties in terms of records retained that should have been disposed of in previous years. Not that there was a problem with the logic of redundancy for filing clerks ‘back in the day’; however, the idea that the work they undertook was skilled was not understood, nor was it realised that the staff remaining would need to learn those file management skills in order to records manage the files. Educating the staff in records management techniques and including retention and disposal all the way through each process would have removed the risk of fiscal and legal penalties, improved the search and retrieval success rates and reduced an ever-increasing

Managing Records Retention and Disposal

7

annual financial burden for archive storage. This can cost anything between one and ten years worth of storage fees to reduce, thus making it a non-starter in terms of a ‘quick win’ cost-cutting exercise. Educating the staff in records management would also have improved efficiency in each and every process within every organisation. There is nothing complicated about records management. It only appears thus because it is misunderstood and wrapped in a heavy administrative blanket, backed by an ever-growing set of international (and in some cases unnecessary) standards. A list of information and records management standards is included in the appendices at the end of this report.

One other issue ‘frightens’ not only staff but records managers also: managing records retention. The mix of law and records retention is tricky to understand and whilst lawyers can interpret the law, staff and records managers may struggle with this. Whilst records managers can discover the records within the organisation’s files and archives and staff know the names of the files they work with, they can’t easily ‘map’ them to the laws and regulations that govern their sector. Besides which, the legally qualified staff within an organisation may not know all the laws that contain articles relating to the length of time the organisation must retain its records. This conundrum applies to all organisations, small and large, local and international, public and private, charitable and religious, as well as educational and familial.

Three approaches to records managementIn order to deliver a report on managing records retention, a somewhat long word on records management has to be included in this chapter. The principles of records

management and the methods to implement records management controls are worthy of their own report. In an attempt to summarise the topic, the following explanation is limited and covers my account of three approaches that are taken by organisations to manage their records. The explanations of the approaches rely on the reader having some understanding of processes in their organisation. All three would benefit from further exploration and justification of the statements made, however, this report is about managing records retention and the following paragraphs are for scene setting alone.

The three approaches are:

Preventative approach; Proactive approach; and Reactive approach.

Preventative approachThe preventative approach is real-time records management, where the principles are embedded in each process, are largely unseen and are definitely not isolated as a separate administrative process. The staff implement the controls and manage the information lifecycle for those records for which they are held responsible.

This type of records management has a small footprint and, after the initial development and training costs, has few costs associated with the activities. Updating of retention legislation and standards, inclusion of the records management tasks in the auditing of the work, and management of the appreciably smaller archive storage service will incur expenditure, but the employment of a specialist records management professional and possibly a team to work alongside the specialist will be unnecessary. The archive ‘housekeeping’ tasks could be included in

Chapter 1

8

a facilities role, with the auditing being part of the audit team’s responsibilities and the updating of the retention legislation either outsourced or part of the work undertaken by the legal department.

The continual staff education and training would be the responsibility of the human resources team or could be outsourced to a specialist training company. Online training tools and resources (either internally or externally produced and maintained) would allow staff to dip in and out of the guidance as required. The guidance would be related to records management within specific processes, putting the controls into context rather than developing a records management training programme isolated from the work.

The final and most important note on the preventative records management approach is that a senior manager or director should be involved in the development of the strategy and records management policy and remain accountable for the continual update and review of the records management policy and controls, within whichever management framework the organisation chooses. Those managers responsible for the various processes within the organisation must ensure that any changes to the records management controls are embedded within their teams’ work.

Whilst preventative records management sounds as if it is only for large organisations, it can be developed on any scale and will serve a one-man band as well as a large conglomerate or government office.

Proactive approachThe proactive approach involves the establishment of a records and archives management team (dependent on size and type of organisation) with responsibility for the records management controls and

guidance and the undertaking of the various housekeeping roles including updating of the retention rules, training and archive storage service.

Proactive records management is the approach that has grown in popularity over the past ten years, most particularly in the public sector. In theory it is highly efficient, with skilled and experienced staff offering assistance and advice to the organisation. This should lead to an effectively managed and legally compliant records management system within the organisation. In practice, however, it is quite often seen by senior management as an administrative overhead and is continually asked to justify its existence, reduce its costs and limit its ambitions. The time taken in writing reports to show how records management is of value to the organisation stops the team from actually getting on with the work of implementing any of the controls.

The current economic climate dictates the size of the records management team, and some organisations have reduced the team to one records management person or combined the role with work associated with information such as data protection, freedom of information, compliance or continuity. The format for records management does not change with role-combining but may be compromised and forced to focus only on those tasks with the highest visibility, such as the management of the archive storage and the retrieval of information that has been ‘lost’ during the semi-active stage of the information lifecycle. This has two consequences: the records manager does not have the opportunity to develop and implement, across the whole organisation, the records management controls and guidance, resulting in records management being isolated as an administrative chore that has little relevance to the day-to-day

Managing Records Retention and Disposal

9

running of the organisation until something important is ‘lost’.

With positive endorsement from senior management and agreed financial support, plus clear boundaries as to where records management controls are implemented, the proactive approach to records management can work well within large organisations. Unfortunately, records management professionals invariably rank the following as the three biggest hurdles to achieving a proactive records management system in their organisations:

Lack of senior management support; Financial restrictions; and Staff complacency.

As to clear boundaries, they are rarely discussed, which might imply that clarity for implementation of records management controls within specific boundaries is not considered a high priority by the records manager.

Reactive approachThe reactive approach charges into action when an important piece of information is lost, someone remembers it went into the archive and a reaction starts. The reactive approach relies on subjective corporate memory, a member of the team who has been employed for a number of years and remembers ‘Joe and his files’ and roughly the year they were squirreled away into archive storage.

The reactive approach is the most risky and looks like the cheapest option to take, but the archive storage costs are invariably very high and on the increase. Staff can never find any file management guidance to reference so are forever reinventing the wheel and creating personalised systems for filing and archiving. Only when crisis

hits does the management listen to the plea for records management controls. Most likely an information audit (see Chapter 5) will be sponsored as a first and relatively inexpensive step, paid for from a contingency budget. As with all ‘knee jerk’ reactions, little time and effort is spent considering the case for an information audit, what it will achieve, and whether or not any of its recommendations will be implemented. By the time the information audit is delivered and reported on, the crisis will be over and the organisation will most likely not see much value in implementing the recommendations at a cost that will be eye-wateringly expensive (in the opinion of the finance director) and show little quantifiable return on investment. Most likely an archive procedure will be developed, telling staff to complete an electronic form relating to the contents of the archive boxes that they store and include a review date on it so that they can dispose of the records in a legally compliant manner. After all, ‘they should know how long to keep records within their own work area, but if not, they should use the seven-year rule’. The latter statement may or may not start the records retention ball rolling and may engender a ‘cherry-picking’ attitude to the recommendations in the information audit report.

Reactive records management can work. However, it is only really suited to a one-man band, an office with fewer than five people or perhaps the parish council or the home, where everything is in one place or there is very little information to go through to find the one document required. It is very risky, in terms of legal and fiscal penalties within an ever-increasing number of sectors. It may not be cheaper than either the preventative or proactive approach in organisations of more than five people.

10

Chapter 1

Three approaches to managing records retention and disposalAs with records management there are three approaches to managing retention and disposal of records, excluding the ‘do nothing’ approach. However, the status quo should be included when reviewing the business case for managing records retention and disposal (see Chapter 3) as it cannot be ruled out as a viable option. Certain organisations may consider that formally managing records retention and disposal does not fit their culture at all.

Implementation of these three approaches is discussed in more detail in Chapter 5 of the report. They are also put into context in three case studies in Part Two. In this chapter they are summarised, giving advantages and disadvantages.

The three approaches are:

Reference tool approach; Records management approach; and Process and workflow approach.

Reference tool approach The reference tool approach is where an external source, i.e. a retention research service, is used to provide online references that detail legislation and regulations containing records retention rules, mapped to a controlled vocabulary of document types.

This approach works well for small and medium-sized enterprises (SMEs) as the cost is relatively low to access and use the research, train the staff and keep up-to-date. However, it relies on the organisation’s staff referring to the citations and disposing of the records in accordance with the statutory retention periods. Little consideration is given to organisational needs or historical requirements for retaining the records for longer periods, and unless the research service provides details of superseded

rules and conflicting rules across different citations, no consideration is given to either. This latter point may be important if a record has been destroyed under a rule that has since been superseded and the new rule has extended the retention timeframe.

Online retention research services are relatively new, having started in the UK in 2006 and spread to the USA in 2008. The research is updated ‘live’ as the laws and regulations change and can be tailored to suit the sector or country in which the organisation operates. It can work well for larger organisations provided that they contract to develop a tailored model rather than the generic model favoured by SMEs. The tailored model would include sector-specific rules mapped to the document types list extracted from the citations. It could be further developed to include rules from legislation from other countries where an organisation operates.

The reference tool approach can be set up to be accessed via the organisation’s intranet or via an externally-hosted web-based service. The costs are annual, relating to the updating of legislation and regulations, and dependent on the sector and number of countries to be included in the database. As a general rule, the disposal takes place during the archiving process or as the result of an office move or clear-out.

It is a high risk approach if the staff are unaware of the existence of, and guidance on, the use of the tool.

It may also be used as a first step towards a more formal management programme for records retention and could be developed to include retention rules for all the organisation’s records, including those not governed by statute.

Records management approachThe RM approach is the most common approach used when managing records

Managing Records Retention and Disposal

11

retention and disposal. The programme is developed based on the results of an information audit that identifies the types of records within the functions, activities and processes in the organisation. The audit report invariably recommends the development of a formal policy, classification scheme and retention schedule, containing a combination of statutory/regulatory retention timeframes and best practice/organisational-needs retention timeframes. When implemented it is nearly always applied during the fourth element of the information lifecycle of the records, during the archiving process, or as part of a regular clear-out programme or an office move.

The retention timeframes may be based on the research undertaken by a third party such as a legal firm, a management consultant or a retention research service. The person accountable for the delivery of the retention policy and schedule, however, may undertake his or her own research.

Implementation of the retention schedule using the RM approach can be difficult, with staff finding it impossible to match the retention schedule information to the files they work with on a daily basis. There always seems to be a gap between the information about the records on the retention schedule and the actual records themselves, making the staff reluctant to make a disposal decision about a particular file and causing them to revert to the ‘review’ option when archiving their records. This results in the records manager having to ‘purge’ the archives on a regular basis and chase the staff to agree to the disposal date.

Whilst it may sound as if the last two sentences relate only to paper records, the same comments apply to electronic documents, including e-mails, and managing records retention electronically via the RM approach.

The RM approach can work well with positive senior management support and a ‘do as I do’ rather than a ‘do as I say’ attitude from them. It may also work better in organisations whose staff are used to working within a formal structure, such as the military services, hospitals and certain government departments. Staff who work within a job that has formal rules for completing the work are usually more inclined to apply the rules in a records retention schedule developed as part of an RM approach.

The RM approach is not a ‘quick fix’ solution. It takes time – three years, on average, for an organisation with two hundred plus staff – and costs money to implement and maintain.

Process and workflow approach The third approach cares little about the information lifecycle and concentrates on placing the rules within the processes, with a requirement to retain or dispose of documents at a specific point in the process. The process approach limits the management of retention to records that are controlled by legislation and regulations that govern the process. Retention of records outside of these controls is left to the discretion of the ‘owner’ of the process or task.

The process approach is favoured by organisations that are focused on quality and delivery of a premium product or a project that requires certification to pass into the operational phase. They have little knowledge of records management or the principles it advocates. They may be unaware of the RM standards or may not consider them to be necessary for or of benefit to the organisation.

The records are identified as part of workflow with triggers that prompt certain actions within a process and may result

in the creation or retention of specific documents. Manufacturing, engineering and construction are all examples of industries that may manage retention via the process approach.

This approach has advantages as it manages retention efficiently for those records that relate to the delivered product or service. However, it rarely places retention rules within the processes that support the organisation, such as finance and accounting or human resources, believing that the owners of those processes understand the rules relating to retention within their own domain.

The process approach, if extended to include the support processes, could be considered to be the least expensive to implement as the retention controls become a stage in a work process that must be completed before moving on to the next stage. It does not require staff to be trained in techniques specific to records management. The retention timeframes are clearly understood, relate directly to the product or project under completion and are invariably longer than the often-quoted seven years.

One big disadvantage of this approach is that guidance is rarely given as to a standard approach to archiving the records that are retained beyond the end of the process or project that uses the process. This makes retrieval of specific records in the future very difficult and can incur costs that are high and unexpected.

Choosing which approach to takeAll three approaches are valid for managing records retention and disposal and could be applied in different areas of the same organisation. There is no rule that says all records have to be managed with the same retention and disposal system throughout

the organisation. Each of the approaches requires management commitment to implement. Two of the three require specific investment, as well as positive proof that your organisation really does require that its records are managed in relation to retention and disposal.

The status quo approach may yet be your preferred option, provided the risk is regularly reviewed and acknowledged and the penalties for not managing the records retention are fully understood. These penalties will most likely be both fiscal and legal and can only be identified specifically in relation to your organisation and its work. Chapter 3 gives details on how to put together a business case to support an investment in managing records retention.

Defining retention rulesFinding and understanding the laws and regulations that govern the organisation in relation to records retention is a lengthy research process. Whilst there is some research available in the UK that relates to retention rules for ‘generic’ documents (i.e. those that are common to similar processes within all organisations, such as human resources, health and safety, finance and accounting) there are none that an organisation can ‘cut and paste’ directly into all of its processes. Perhaps 30 per cent of the documents that an organisation keeps are governed by laws and regulations. A further 20 per cent may have codes of practice or defined best practice rules that govern them, leaving the remaining 50 per cent with no rules whatsoever. Many of the statutes and regulations leave the decision on the actual length of time the record is kept up to the organisation to decide, based on the needs for and use of the record in terms of the organisation’s business or sector.

Chapter 1

12

Managing Records Retention and Disposal

13

Highly-governed sectors such as pharmaceuticals and financial services have clearer guidelines and more laws, regulations and codes of practice to follow. These sectors have formed groups across organisations to discuss and develop retention guidelines for their sector, as have local government, universities and the health services. Professional bodies and societies have also developed retention guidelines and assistance via their websites and publications (see Appendix 7 for further details). The National Archives of Scotland, Northern Ireland, England and Wales publish various guides and comments on records management and retention. Rarely, however, are any of these complete in terms of accurate citations relating to records retention in the UK. Many of them contain opinion and advice based on subjective experience and rumour about changes to codes, mixed in with un-validated citations with no indication of when and where they were found. Whilst the opinion and advice may give ‘food for thought’ it is risky to manage records retention on the opinion of an unknown person who has no experience of each and every organisation. With the exception of specialist research services (see below) and perhaps certain private sector groups, none of the others mentioned above consider retention rules for countries other than the UK. Nor do they clearly show the differences between the retention rules for the four countries making up the UK (not forgetting the Channel Isles and the Isle of Man).

Who does the research?So where does this leave organisations when they have to define the records retention rules within their business? Some defer to their legal counsel to advise as required or ask their external law firm to provide a list of governing legislation in order to

develop a retention schedule themselves. Other organisations contract consultants to undertake an audit and develop a retention schedule for the organisation or employ a records manager to undertake the task. Yet others ignore the whole subject, relying on staff to know the legal requirements without any formal guidance.

As mentioned earlier, specialist research services have begun to appear in the past two years. These services are undertaken by legally qualified staff who have experience in both the law and records management. The research is provided online and is updated proactively as the laws and regulations change. They cover retention rules for the UK, most countries in mainland Europe and the USA, and are gradually including other countries in the databases. Mapped to the documents and records that are cited in the legislation and regulations, they do not include advice and opinion but stick to fact extracted from the citations. The main research relates to ‘generic’ records but sectors are being added as they are researched. The idea behind this service is to provide the foundation on which to build the organisation’s retention schedule, adding classification schemes and record series/document types as required, and mapping to both the law and internal retention requirements supporting the organisation’s work. The research is delivered in a database that can be linked to various electronic records management systems as well as other applications such as SharePoint.

References

ISO 15489-01:2001 Information and 1.

documentation – Records management,

available from www.iso.org.

This definition is taken from BusinessDictionary.2.

com – see www.businessdictionary.com/

definition/process.html.