Focusing on points of collaboration for RIM and IT professionals.

• Position: INFORMATION MANAGEMENT BONUS CONTENT - Information management - Records and information management

[ILLUSTRATION OMITTED]

This excerpt from the ARMA International guideline Records and Information Management for Information Technology Professionals offers practical advice about how records and information management and IT professionals can partner to demonstrate their individual and combined strategic value to their organization and ensure the appropriate governance of its information assets.

Records management's principal responsibility is to ensure that a system that captures and receives records can also preserve required record characteristics. In short, the record's authenticity, reliability, integrity, trustworthiness, and usability must be maintained throughout its lifecycle. The IT department may provide consultative assistance so that RIM [records and information management] and IT professionals build a collaborative alliance.

This excerpt focuses on several key records processes involving information technologies that provide points of collaboration for RIM and IT.

Access, Control, and Preservation of Records

Both groups must work together and be aware of the following requirements with regard to the access, control, and preservation of records and records systems.

Access Criteria

The following access criteria are essential:

* Policies stipulating who has access to records

* Policies on restricted records

* Assurance that access and retrieval are timely

* Assurance that records are retrievable to authorized users only

* Relevant metadata applicable to the record that is captured and maintained for the lifecycle of the record or until otherwise designated

* Recognition of privacy issues, specifically:

--Ensuring that privacy and personal information are protected

--Preventing unauthorized access to records

--Ensuring rights to information as well as protecting confidential information

--Ensuring that records of long-term value remain accessible

Required Controls

The following controls are needed on systems that handle records:

* Measures to monitor who has access to records

* Safeguards to protect records from unauthorized access to ensure that the integrity of the record is maintained at all times

* Audit trail of all records systems to capture all activity to ensure the records are not compromised

* Demonstration that migration, systems malfunctions, upgrades, and regular maintenance of records systems will not impinge upon the integrity of the record

* Methodologies to protect the confidentiality, privacy, and security of records from unauthorized access, tampering, or disposal

* Validation/verification techniques that ensure system and functional compliance requirements are met

Protection Requirements

The following records protection and preservation requirements must be met:

* Ability of the records system (and removable media used to store records) to preserve records and their associated metadata and make them accessible for the duration of each record's retention period

* Ability of the records system (and removable media used to store records) to preserve those records and metadata selected for long-term or archival storage, and ensure those records and metadata remain accessible in the future

Classification and Taxonomy

The increasing volume of electronic records and the frequency with which those records change require the development and implementation of taxonomies--classification systems of topics or subject categories --to maximize easy and efficient retrieval of records for legal, business, and regulatory purposes. Taxonomies and classification help to organize information and records according to an organizational and agreed-upon vocabulary, rather than by random topics.

Inconsistent classification can lead to inconsistent records management, including difficulties with managing retention and disposal of information. RIM and IT professionals may wish to capitalize on the collaborative opportunity to implement a taxonomy. Sound technology solutions and a useful, easy-to-follow information structure that has been fully vetted with the end users are essential.

A RIM taxonomy is used to organize large amounts of information and typically identifies hierarchies of broader and narrow terms (classes). The top class is the most inclusive class and describes the domain or major subject of the classification. This ensures that everything that is true for entities in a given class is also true for entities in a subclass. Attributes are inherited by a subclass from its top class. This is a downward flow of information, as illustrated in the example in Figure 1.

Classification is part of taxonomy. Taxonomy may include other metadata that is not part of records classification but is needed for IT operations of an application. Such IT metadata might be related to server name(s), facility name, geographical location, etc.

Taxonomies should inspire trust. If a taxonomy is not trustworthy or user-friendly, users will find a way to develop work-around retrieval methods, and this defeats the purpose of the established structure. Taxonomies should be consistent across hardcopy and electronic environments.

Development and maintenance of taxonomies and classification systems can be quite complex. Both RIM and IT personnel working in this area should consult specific guides such as ARMA's guideline on Controlled Language for Records and Information Management or Guidelines for the Construction, Format, and Management of Monolingual Controlled Vocabularies (ANSI/NISO Z39.19-2005).

Enterprise Content Management

Enterprise content management (ECM) is defined by AIIM as: "The strategies, methods and tools used to capture, manage, store, preserve and deliver content and documents related to key organizational processes." Important points to consider include the following:

1. Implementation of an ECM/ERM [electronic records management] system is a complicated process requiring significant effort on behalf of all parties involved.

2. The RIM professional must be an integral part of the process and needs to be included during the requirements and selection phase, as well as during implementation and ongoing maintenance. RIM professionals have an in-depth knowledge of the documents created, the workflow, and the length of time records are required to be retained.

3. The RIM professional brings specialized knowledge to the selection and implementation process and can provide input into the following areas of the ECM:

   1. Controlled vocabulary, e.g., a taxonomy or thesaurus

   2. Business workflow

   3. Differentiating between records and non-record content

   4. Detailed knowledge of rules and regulations regarding the conversion of analog records to digital and making the digital record the "official record"

4. There is a difference between records and content. An ECM will contain a wide range of content including documents, objects, images, etc. Among this broad content, a subset of business records exists. Business records are subject to legal retention requirements. While an ECM has some minimal capability to manage the retention of documents, an ERM component is required to provide maximum functionality and to preserve evidentiary value. Without such an ERM component, the ECM will become clogged with duplicates and/or unneeded content, making electronic discovery that much more difficult.

5. While many ECMs have a preferred ERM, the ECM should be capable of working with other ERMs.

6. The RIM professional needs to create a capabilities and requirement document for the ERM...