Minimizing Risks

As a key resource in the operation of any organization, records must be created, organized, secured, maintained and used in a way that effectively supports the activity of that organization. This information facilitates operations, budgeting and planning and documents compliance.

Mark Lagodinski, a certified records manager in Ernst & Young’s strategic records management practice, says, “Without periodic measurement (audit), a company has no mechanism to assess the organization’s level of records management compliance. Records management, like any compliance function, should have defined controls, effectiveness criteria and test plans developed for each provision of the RIM policy.”

Increasingly, organizations must defend their record-keeping practices to regulatory and other oversight organizations and respond to discovery demands. Excessive discovery costs for records that should have been disposed, regulatory sanctions against organizations that cannot produce required documentation or poor business decisions based on incorrect or incomplete information are risks that can be managed by effective information governance processes.

Like any critical business process, information governance processes should be defined, endorsed by executive management, communicated throughout the organization and assessed regularly. The Generally Accepted Recordkeeping Principles® (GARP®) and its complementary Information Governance Maturity Model are broadly applicable frameworks that organizations of any size and in any industry sector can use to establish and monitor an effective information governance program. (See www.arma.org/garp/ for a listing of the GARP® principles.)

GARP® principles assure the organization that:

•    Information will be protected against loss and critical records will be backed up, protected and easily accessible, allowing business to continue in a disaster.
•    Information will be available when needed. The organization will have processes and systems to find, retrieve and disseminate information to the right people at the right time.
•    Information will be retained as required and disposed
    of when no longer required. The organization will have
    a records retention schedule to ensure information is
    being retained to meet its operational, legal, regulatory
    and historical requirements and is disposed of when its
    required retention has been met.
•    External investigation and litigation obligations can be
    met easily. Processes will ensure all information that
    is relevant to litigation or regulatory investigation can be
    located, placed on legal hold to ensure its availability and
    integrity and produced when needed.