My View on Content, Records and Retention.
So many talk about records management, when in fact it is just a subset of what is really needed. Businesses need the means to control the information life-cycle for all content. It is not enough to extend records management policies and products to include retention management. A highly integrated way to capture, create, track, audit and discover all content is needed. Forrester called extended records management ‘Retention Management’ and many vendors have since added retention rules to their functionality.
To reduce their exposure to compliance failures and legal discovery processes, businesses rely on message archiving and records management (RM) software that does typically not manage the full content life cycle. The problems are in fact created by the PC, Internet and Intranet and the users ability to create, copy, distribute and destroy content with office tools from i.e. Microsoft.
Businesses need a solution that controls content from the time of creation, destruction of documents at specified dates, standard indexing values, lock down documents during litigation, and integration with storage management. All this includes the need to authenticate, encrypt, sign and lock content and users as required.
Why should records management only start at the end of a business process? There is no reason why that should be the case. It should be impossible for the business user to create a piece of content that is independent of the business context. The reason that vendors offer eDiscovery – which is no more than a fancy word for ‘search’ – in records management is because business users can create documents at their will and put them wherever they want to.
Web content, workgroup content as well as business content from mission-critical business process, such as contracts, claims, proposals, invoices, clinical trials, correspondence, emails or loan approvals, often hide in an intranet, portal or user file systems. Collaborative content is equally dangerous as is Microsoft Outlook/Exchange. The reality is that there is no content without process and no process without content, so retention management must be tightly linked into process management. Effectively we propose that the simple creation of some kind of business content represents a process, even if it seems totally ad-hoc. It does in fact relate to some internal or external business entity and MUST be created in reference to it. So rather than enforcing naming conventions and taxonomies it is a lot more important to force the user to see the document creation as a part of doing business and therefore enforce the business context. It is the business context that in the end defines the retention rules and principles, not the type of content created.
If the above is adhered to then businesses do not need to know what content exists, where it resides, and extend corporate records management policies to all content – even content that is actively updated, changed, and used to support an ongoing business process. Records management practices and RM software products must be extended to provide retention management that guarantees compliance and enforcement of corporate policies starting from the beginning of content creation and going through the final disposition of corporate records at the end of the content life cycle. It is much more relevant how information flows through a business and where it resides from creation through destruction. There is no special point in time when some information becomes a ‘record’ that is worth retaining.
What is the best way to get all content under control? Rather than trying to continuously run inventory checks across all your disc storage and application databases and archives for new and unknown content that then is hardly properly indexed or easily assignable to a context, simply enforce the creation of any kind of content a business process (you might call it an ‘activity’ to not upset the BPM people in your business) and thus ensure that a business context is established. An easy to use case management environment such as the Papyrus Platform makes this activity really easy. Simply enforce that the business user MUST select the right entity to relate this content to. In the best case it will be an existing business process or he can select a process template. if not, then the user creates a content creation business case and all information related will go into this case folder. it is not simply about asking for indexing information (that most people wrongly call metadata – see archive and repository) but guiding the business user to find the process, customer, partner, contract, department or employee this document relates to. If the criteria are not fulfilled the content goes into an invalid state and a correction process and will not disappear into the archive until all information is properly entered. If information has to be distributed it happens simply by referencing the information object to the receiving entity. In the right kind of system duplicating the content is simply not possible and thus saves disk space and consolidation effort.
There is actually no sense in splitting business content into records and ‘other’. All content has to have disposition and retention rules and the records have different ones. That enables to destroy content properly when it is no longer needed.
The obvious benefits for global content management with retention rules in Papyrus are are:
- Applying the same content retention rules to ALL content received and created in the business.
- No accidental or intentional deletion of legally important content.
- Retention rules are closely related to business rules and should be defined and managed the same way.
- Content has to be managed securely and therefore an authentication and authorization scheme is essential.
- A full audit trail for content handling and as well as for changes to the retention rules is provided.
- Discovery and search happen based on the business context which is more accurate and faster.
- Usage data for content ensures that content is kept efficiently and deletion of content in use is avoided.
- Digital signing of content ensures its authenticity and originality without WORM media.
- Create content specific custom workflows for creation, conflict resolution and content management activities.
- Because retention management is embedded into Papyrus there is no additional programming or integration.
- It is possible to search existing file, email and archive systems to catalog all external content.
Managing retention for content globally is a big undertaking but it is very dangerous to do it in a standalone manner. The longterm integration and management consequences are dramatic. The cost for migrating existing archives and records systems will be staggering. The need for records and retention management once more confirms ISIS Papyrus strategy of consolidating all inbound and outbound document creation across applications, web and office collaboration platforms. In fact we recommend that office tools such as MS-Word is one of the biggest problems because content is created, stored and deleted uncontrolled and unmanaged. Business content has to be managed regardless of what users want or would like to have.
We have recommended and offered the ISIS Papyrus Platform for many years already as the Document Switchboard that manages all inbound and outbound content. Managing the retention of all content in the archive was always an integral part. While the file itself could be stored in other places we always recommended to keep the retention information in the Papyrus database. The market has however once again moved into fragmentation and many big RM vendors have now created unmanageable RM islands in most large corporations. The IT industry has not served its customers well by recommending such an approach. When will they learn?
As soon as you consider content as a legally dangerous entity then you will understand how important and far-sighted ISIS Papyrus Inbound/Outbound Strategy was in 2001 when it was announced. Relevant content is everything that goes out and everything that comes into the business! ISIS Papyrus was first to propose and offer a central content management strategy with retention for the enterprise.