Data is an asset -- and a risk, which is why companies are starting to pay more attention.
Employees are producing records at a record pace in the form of emails, instant message chats, spreadsheets, documents and reports. Those records are posing a challenge for companies as they run out of disk storage and are forced to decide what to save, what to toss, where to store and how to create a formal policy that manages records while meeting compliance standards.
To do that, record management is becoming a group effort among the legal, compliance, IT and records management offices.
"What we're seeing is a much more methodical and interdisciplinary approach because, frankly, this stuff is getting way too hard for one department to handle or for one department to dictate what another one is supposed to do," says Christine Taylor, an analyst at The Taneja Group, an analyst and consulting firm for the technology storage industry. "There's just too much, too many implications, too many questions, too much uncertainty."
The difficulty with records management is that records aren't being produced exclusively by one department like HR applications are for HR, says Sue Trombley, director of consulting at Iron Mountain, a vendor in information protection and storage. "Everybody is creating records to some degree and in all sorts of media -- paper, electronic -- stored all over the place. That's what makes it such a challenge because it's everywhere."
Since records will continue to be produced, managing them will continue to be important. Since 90 percent of business records are shared electronically, companies must be proactive.
IT can't go down one path, compliance another, records management another and legal yet another, Trombley says. There needs to be collaboration through a governance board, advisory body or steering committee so all aspects of the problem are addressed jointly.
"There has to be a plan, there has to be a strategy or roadmap with all of those people involved in order to determine where resources need to be deployed, where there's the highest risk, where's there the highest risk to brand exposure or where are we potentially going to be sanctioned or fined because we're not in compliance with the regulatory body," Trombley says. "All of those pieces have to come together."
The only way records management can be successful is if everybody is at the table, Trombley says. Everybody needs to be present from the early stages of developing a records management program through its implementation and its existence as a compliance program.
Some companies approach to records management has been to save everything. In the proper storage conditions, data can be preserved for decades. But just because companies can save the data, doesn't mean they should.
"Here's the issue, though: How are you going to get it back again? Because you've got to be able to, at the least, prove retention. You have to say ‘Here. Here is this table of contents, here is this index, this particular file,'" Taylor says.
Because what if a company stored the files but cannot find them, Taylor asks. Finding those files could require expensive specialized backup recovery services and recovery isn't guaranteed. It can also put companies at risk in the event of litigation either by including other records that could broaden the scope of the lawsuit or from a more extensive meet and confer or e-discovery process companies are upheld to. Even if records are recovered, it might take too long and courts could punish companies the same as though they never kept the records.
That's excluding the likely possibility a company has gone through different iterations of backup applications or changing vendors, making records even more difficult to track down and access.
"Even when you think about the issue, these big companies have got to put together what is the relative risk and cost of keeping these records updated that they may never need; they've retained," Taylor says. "That may be all they ever need to do with them."
Still, companies need to weigh the cost of having to refresh that data, dispose of it or move it to a new backup and recovery application versus the cost of not managing data, not meeting compliance standards or potential litigation.
"The cost of not doing it correctly can put you out of business," says Peter Sutton, product marketing manager of records management at Iron Mountain. "At the very least, it can hinder your ability to make decisions."
An effective records management program requires a structure for files to be retained, located, recovered and disposed of in a compliant method. Ideally, records management combines short-term, long-term and archiving to store data.
Using those three storage systems, creating a framework for storage and procuring funds to build it may not easy, but it's something companies have to do.
It's a big challenge, and Trombley says the only way to address it is with collaboration, risk and cost assessment and technology.
Sutton says the key to records management is recognizing people do things because it's the way they've been done before and acknowledging the existing status quo is not good enough.
When paper records accumulated, it was noticeable, he says. Companies were forced to either buy another filing cabinet, find another place to store the data or dispose of it. Electronic information sneaks up on you because it's out of sight on servers in back rooms.
"We are deer in the headlights I think as a society, frozen in information," Sutton says, adding he doesn't think organizations have grasped the reality of how much information is being produced and needs to be managed.
"We as a society have been exchanging information in the same way for a long time and maybe the speed of it changed, but we've been doing it the same way and then over the last few years with the invention of email, this rapid shift has occurred," Sutton says. "It's evolving unbelievably quick, and I think we need to expect it to continue to evolve unbelievably quick."
Although they can create headaches, technology and storage advances can also be an asset to companies.
"If they are managing their data properly for value and recovery, they're able to find a lot more not just to defend themselves but to add value because they can find that stuff again," Taylor says.