Calming the data storm: a risk management model for mitigating risks: using a risk-based approach for prioritizing efforts to mitigate the greatest information risks is a smart way to alleviate the common problems of limited staff, time, and budget.

• Author: Rush, Michelle

[ILLUSTRATION OMITTED]

Records management has become an integral aspect of how most large organizations do business--in fact, it's increasingly taking center stage. While many organizations have implemented or are in the process of implementing enterprise records management solutions, there seems to be varying degrees of utilization, success, and return on investments. Establishing a sound records management program in today's environment requires not only a thorough understanding of the fundamental records management principles but also the legal, regulatory, financial, and operational requirements of the organization.

Frequently, organizations have well-intentioned strategies and well-chosen technologies but have trouble orchestrating them to develop and deliver a cohesive enterprise records management platform. Furthermore, records management is a complex task made more so with the advent of newer types of media, formats, locations, and technologies.

Records managers are being asked not only to manage the traditional paper and electronic files but also to address more esoteric pieces of information such as instant messages, blogs, and wilds. As most corporate records managers will attest, senior management wants to comply with records management requirements, but questions the hard returns and the business value provided by implementing a records management program. Records managers are, thus, increasingly, turning their attention to the tangible value that the records management program can offer the organization.

A clear-cut example of a return on investment is in the e-discovery space. Fifteen years ago when litigations were not as prevalent and legal fines were somewhere on the order of a slap on the wrist, records management was considered an operational/legal expense. These days, however, e-discovery and litigation specialists are propounding the solid benefits of a proper records management program and are providing numerous real life data points on the millions of dollars saved through more efficient ways to locate, search, categorize, and present records.

Chief executive officers, chief financial officers, and chief operational officers are looking at records management in somewhat of a new light and recognizing the bottom line value that a solid records management program provides. This new visibility, however, has not translated into significant new spending on records management. In fact, in some organizations, records managers increasingly face budgetary constraints and ongoing pressure to better manage records in this litigious environment.

Given the long-term nature of records management and the ever-changing landscape, it is no surprise that records managers have felt the need to invest in more systematic approaches, including auto-classification of records, auto-promotion of records when certain events in the business process happen, automated disposition, and having to make somewhat large-scale assumptions around the true scope and requirements of the program. There have been instances where corners have been cut because the work involved was too much, too soon, and there was just not enough time in the day to address it appropriately.

Records managers have thus made the best of what they could with the best of what they have. It has become increasingly clear that attempting to manage the universe of all records will simply result in a black hole. The data ocean in most organizations shows no sign of ebbing; instead it's increasingly akin to a perfect storm, threatening to wash over most well-intentioned controls and processes.

The most well-thought-out records management program can be subverted by the most innocuous of things (e.g., the thumb drive). Records managers thus have the dubious distinction of seeing no new dollars but having to manage a more significant workload. How then are records managers ever going to solve the records management problem? Are they going to be in catch-up mode forever, chasing one fire drill after another? Is there a pragmatic way to address the issues at hand?

There are several methods that a number of records managers across various organizations have implemented to ensure that records are properly managed given all the constraints. One method to seriously consider is a risk-based approach to records management.

The Risk-Based Approach to Records Management

Picture a budget meeting where the first hour goes perfectly. The records manager presents the work plan for the year, talks about accomplishments for the past year, reviews the new litigation and regulatory landscape affecting the company, talks about the return on existing investment around increasing the...