Information Governance is easier when you think of it in terms of The Four “Ws” which are
What are your information assets?
Where are they located?
When can you dispose of them?
Who manages them and has access to them?
In last month’s article we talked about the second “W” – Where. So now that you know where your information assets are we are now ready to get down to the real work of determining when we can get rid of them. Now you might ask yourself “Why get rid of them when I just took all this time finding them?” Well back in the Good Old Days you pretty much kept everything, after all you might need that someday right? Exactly.
That theory worked for us for awhile until two things happened; the first was the amount of information your average organization creates exploded and it quickly became a nightmare to manage (remember how long it took you to find everything in last months exercise). The second only becomes obvious when you are faced with a governmental audit or some type of litigation – there is some information you are better off not keeping because it will be found during the Discovery process. Legal Discovery in the age of digital forensics, while still a tedious slog, is fast, efficient and very adept at finding all kinds of stuff nobody intended to see the light of day. The News is filled with just such stories on a daily basis, which brings us to the subject of Retention Schedules.
A Retention Schedule is nothing more than the Records Schedule we talked about in a previous article with an additional column that details the lifespan of the individual Record Set. The challenge is to come to a consensus in your organization as to exactly how long you truly need to keep each record. This is where your steering committee once again comes into play. It is the steering committee that decides what works best for your organization. This is because there are two sides in the determination as to how long to keep a record type:
The legal and regulatory obligations around the record.
The operational need to retain the record.
You can count on your legal adviser on the steering committee to assist with the first part by reviewing each record type to determine the regulations surrounding them. These can be quite complex and vary widely depending on many local and national factors, but is is critical to understanding what is required before you bring the information before the entire committee. It is important to retain all of this research as well to demonstrate the due diligence the organization undertook during the process. The result is a fixed date that is legally mandated to retain each record type.
While this is certainly a long, drawn out exercise, I usually find it is the easiest part of creating a Retention Schedule. The hard part comes when you bring the entire steering committee together to present this information and the operations people realize they need to keep these records around a lot longer than is legally required. This is where the real work begins because, for the most part, there is no real standard to go by in setting a fixed date to retain information for an operational need. It is truly up to the individual organization as to when they no longer need the information, but it is critical to establish a fixed timeframe to dispose of each record type. It is important to note that there will be some record types that must be kept permanently, but these are few and far between.
When the negotiations are concluded, you will have a complete Retention Schedule. As with any process it is only as good as the last time it was used. It is critical that it is documented, trained upon and demonstrably followed to be considered Defensible Disposition in the eyes of the Court. Next month we will discuss the final “W” – Who.
