GARP[R] a lens for clarifying legal requirements.

• Author: Montana, John
• Position: Generally Accepted Record-keeping Principles

[ILLUSTRATION OMITTED]

The Generally Accepted Record-keeping Principles[R] (GARP[R]) are eight principles promulgated by ARMA International as codified statements of good practice in the management of records and data systems. The principles are themselves quite new, at least insofar as they exist as formal statements of good practice. However, the concepts behind them are not new; GARP[R] represents a codification of existing understanding and practice within the records and information management (RIM) field.

ARMA International has the credentials and recognized expertise and credibility to stand as an authority recognized by courts and the legal system to offer persuasive guidance as to what constitutes acceptable RIM practice--but only if its pronouncements (e.g., GARP[R]) are consistent with legal requirements. No secondary authority, however expert it may be, can offer guidance or principles that conflict with legal duties and expect them to gain acceptance within the legal community.

If, however, no such conflict exists, such guidance can play a substantial role in legal proceedings. It may serve to validate a legal doctrine, to explain it, to give it context, and to provide many details and specifics that the legal doctrine itself may not contain and which lawyers and judges may not have the knowledge or expertise to provide. The question then becomes, to what extent is GARP[R] consistent with legal requirements and doctrine?

This article will examine the Principle of Transparency and the Principle of Accountability to determine the extent to which they conform to related legal requirements and doctrines and the potential role they may have in the application of these requirements and doctrines in the real world.

Legal Standards, Business Processes, and GARP[R]

As noted in the sidebar on page 34, there are at least three ways in which a legal standard or requirement can serve as or drive a business standard or practice: 1) by forcing a required outcome; 2) by providing high-level requirements but leaving it to organizations to determine the process to comply with them; and 3) by providing detailed requirements that set forth the process and procedure for obtaining a specific outcome.

Legal Outcomes as GARP[R] Drivers

Perhaps the most common form of legal-standard-as-business-standard is the first one listed in the sidebar: the legal standard may force a business standard due to the outcome it demands. Many laws that do not purport to require a particular course of action in fact drive one, often a very specific one, by demanding some outcome and imposing a substantial penalty for failing to achieve that outcome. Consider this requirement from the Sarbanes-Oxley (SOX) Act of 2002 ([section]906, codified at 18 U.S.C. [section]1350):

(a) Certification of Periodic Financial Reports--Each periodic report containing financial statements filed by an issuer with the Securities Exchange Commission pursuant to section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a) or 780(d)) shall be accompanied by a written statement by the chief executive officer and chief financial officer (or equivalent thereof) of the issuer.

(b) Content--The statement required under subsection (a) shall certify that the periodic report containing the financial statements fully complies with the requirements of section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 780(d)) and that information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the issuer.

This law requires only a single affirmative act--the signing of certifications for financial statements by the chief executive officer (CEO) and chief financial officer (CFO) of regulated corporations. It does not require any particular process, or indeed, any process at all, leading up to that signing...