Records management: five lessons from the trenches - Society of ...

Volume Three
Number Five
December 2006
Bimonthly
Meet
Hal Degenhardt
Partner, Fulbright & Jaworski
“The Caputo
Opinion”
Judge Ruben Castillo
By Bill Prachar
Join SCCE!
Are you a member of a
professional compliance
and ethics organization
Page 28
Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org
See pages 24–25
December 2006

Effective records
management: Five
lessons from the
“trenches”
By Ann Straw
Editor’s Note: Ann Straw is the Vice
President and Chief Compliance Officer
for Laidlaw International, Inc. Prior to
joining Laidlaw, Ann was Vice President-
Regulatory Affairs and assistant General
Counsel at Corn Products International
Inc, where she was responsible for SEC
reporting, Sarbanes-Oxley and NYSE listing
standards, and other corporate policies.
Records management has
become an area of increasing
identified risk for companies
since the passage of the Sarbanes-Oxley
Act and, most recently, with the implementation
of the Federal Rules governing
electronic discovery. In addition, the
world is not going paperless when, in
fact, records are created more easily than
ever before, distributed and forwarded
to larger numbers of people, and saved
both electronically and in hard copies by
many recipients. Generation of records
has been increasing every year and is
expected to continue. For example,
one study indicates that the volume of
corporate e-mail per day is expected
to increase from 31 billion in 2003 to
60 billion in 2006. 1 The end result is
an ever greater volume of records that
are being saved unnecessarily or that
are required to be saved but haven’t
been indexed and stored so they can be
searched, reviewed, and produced on a
timely basis in response to a board of
directors’ inquiry, a government investigation,
or a civil subpoena.
The process of finding, retrieving,
reviewing, and producing records is
extremely costly in terms of both transaction
time for management and the
dollars involved in the process. The failure
to find, retrieve, and produce records
may be extremely costly, if penalties
are imposed as a result. Recognition of
these risks has caused many companies
to undertake a review of existing records
retention policies and procedures. The
ultimate goal of such a review is to
implement a records management program
that will protect the company in a
new era.
In the past few years I have been
involved with a variety of projects to
implement efficient records management
programs. Although each of these initiatives
is a work in progress, many lessons
can be learned. This article discusses five
lessons that may be helpful to others
who are considering initiating a records
management project in the future.
Lesson No. 1: Get buy-in from the business
units of your company
In an era of increased scrutiny over
spending, most companies are cost
conscious. Successful records management
programs do not bring dollars to
the bottom line in the same way that
a successful acquisition or securing a
long-term contract will. This means that
the resources necessary to undertake a
records management project will not be
Ann Straw
willingly turned over, unless there is buyin
from upper management, field management
(where historic records often are
stored and where many of the day-to-day
business records are generated), and the
IT department. At each of these levels,
it is important that the business sees the
value of the undertaking. It isn’t always
obvious.
One effective way to make the point
about risk is to describe recent cases
where companies have spent millions
of dollars to comply with discovery
requests, or paid fines or settled cases for
failing to produce records or for destroying
records. Examples include Prudential
(a court imposed civil penalties of $1 million
for records destruction), Bank of
America (the SEC fined the company
$10 million for being slow to produce
evidence and for misleading regulators),
American Express Financial Advisors
(fined $300,000 by the National Assoc.
of Securities Dealers for failure to
maintain customer account statements
in required format), Murphy Oil USA
v. Fluor Daniel, Inc. ($6.2 million was
spent recovering data from 93 backup
tapes), In Re Bristol Myers Squibb (over
$400,000 was spent scanning over 3
million pages of documents), Rowe
December 2006
16
Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org

Entertainment v. The William Morris
Agency ($395,944 was spent to restore 8
backup tapes, over $400,000 to restore
47 backup tapes and retrieve email from
desktop PCs for attorney review), and
of course the infamous case of Arthur
Anderson (involving records destruction
in the face of an impending government
investigation ). 2
Dollar figures like these help you get the
point across that records mismanagement
is a significant area of potential
risk to a company. The need to manage
risk to avoid penalties, or simply to
avoid the outrageous transaction costs
that arise in complying with records production
requests, can be conveyed fairly
easily by pointing to the misfortune that
other companies have suffered as a result
of not having adequate records management
programs in place.
But, beyond sending a strong message
regarding risk avoidance, it is crucial
to get buy-in at the outset in order to
complete the day-to-day drudgery of the
project itself. The drudgery includes:
n Reviewing boxes of records stored in
the basements, garages, warehouses,
unused offices, or offsite storage areas
of the company—a time-consuming
and often dirty task;
n Completing a survey of approximately
how many boxes, going back how
many years, and containing what
types of records, are being held at
each location in the company and
compiling the survey results (after
endlessly pursuing those managers
who did not find time to complete
the survey within the deadline due
to the pressure of “running the business”);
n Determining the contents of thousands
of boxes that are merely labeled,
“HR” or “1998” or “John Doe-
Finance Dept. 2000” or frequently
not labeled at all;
n Discovering which of the historic
records are being maintained in
duplicate in other areas, regions, or
corporate offices, and therefore, can
be destroyed;
n Creating a common vocabulary so
that personnel around the company
are handling similar records in the
same way. For example, a personnel
file in some parts of the company
may be broken down into an
“employee file,” “performance file,”
and/or “benefits file” in other parts
of the company; a “purchase order”
may be referred to as an “invoice”
in various parts of the company.
Never assume that personnel who
are reading procedures for maintaining
records will understand that a
personnel file can be the same as the
employee file or that a purchase order
can also mean an invoice);
n Retrieving contracts from around the
company for the offsite storage facilities
that house company records and
then reviewing, and if possible, combining
those contracts (if necessary)
to obtain a volume-based discount for
offsite storage;
n Establishing a records retention schedule
that takes into account federal,
state, and municipal requirements for
records retention time periods, and
for multi-national companies, taking
into account foreign law requirements
for records retention; and
n Differentiating between the hard copy
records and the electronic records
components of the project and creating
the right team to cover each.
All of the foregoing needs to be done
at the outset of a records management
project. Inevitably, you will find that
the degree of involvement and the time
commitment ultimately required by
business managers and administrative
staff is far greater than anticipated, and
therefore, buy-in wanes a few months
after the project gets underway. It is
important to be realistic about the need
for these resources to remain committed
on an ongoing basis. The amount of
time and energy required to implement
the project requires a significant commitment.
Lesson No. 2: Put the right team in
place to lead the records management
project
It is logical, initially, to put together a
team composed of individuals from the
Legal department, the Human Resources
department and the IT department.
However, it is likely the team will
quickly grow to include individuals from
departments such as Safety and Training
where many records are required to
be maintained for long time periods.
You will probably also want to include
individuals from the Operations departments
of the various operating lines
of business, from the Tax department
(which may be notorious for keeping
its records forever), from the Internal
Audit department (which will likely
be concerned about the project from a
SOX Section 404 standpoint), and from
a cross-section of your administrative
staff who are ultimately critical to making
a project like records management
really succeed. The last—and invaluable—addition
to the team should be a
Project Manager.
Continued on page 21
Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org
December 2006
17

Five lessons from the “trenches” ...continued from page 17
Lesson No. 3: Assume the Project Will
Be Implemented in Phases
Going into the project with an eager
team comprised of employees from
the departments noted above, it is not
uncommon to attempt to divide the
work into the various areas of expertise.
Often, however, the various experts are
put on roughly the same timetable for
completion. In other words, once the
work is divided, everyone is expected to
move forward in tandem toward completion,
both on the hard copy records side
and the electronic records side of the
project. This is a recipe for disaster.
Development of a records management
system that works for your company will
inevitably require a phased approach.
For example, many aspects of the hard
copy records initiative and the electronic
records initiative are interdependent
elements of the project. It isn’t possible
to evaluate outside vendors, programs,
software, hardware, or systems improvements
for electronic records management
without understanding the nature of the
records being generated and maintained
in hard copy in the field, knowing what
records the company would want to continue
maintaining in the field as opposed
to centralizing at the corporate headquarters,
and especially without knowing
the legal and practical (from a business
standpoint) retention requirements for
certain types of records over a number
of years.
Generally (although not always, depending
upon the sophistication of your current
systems), the cost commitment will
be far more significant for the electronic
records management program than for
the hard copy records. In addition, in
many companies, pressure on the IT
department to address other priorities
within the company takes precedence
over a records management project.
The conclusion reached in the companies
where I have been involved is
that the hundreds, possibly thousands,
of boxes of historical records in storage
at various facilities were not going
to be cleaned up, re-boxed to eliminate
vermin, indexed and shipped to a centralized
storage area (or alternatively,
shredded and disposed of) overnight. It
becomes obvious after a short time that
grappling with the daily generation of
new records, both hard copies and electronically
stored copies, is imperative. It
is crucial to establish ways to reduce the
generation of new records as a first order
of business. Addressing the problem of
how to reduce creation of new records
and training employees to follow new
document management rules on a sustained
basis becomes an immediate priority
of any records management project.
Other aspects of the project can be put
on a longer-term timetable, to be phased
in as the project progresses.
Lesson No. 4: Seriously Consider Hiring
A Consultant
Early on, your company may determine
that given the availability of significant
in-house expertise, there is no need for
hiring a consultant to help organize the
records management project. That may
be a mistake. In many companies, the
competing demands on people’s time,
budgets, space, and other resources are
too complex for the team to reconcile
without an objective outsider’s help.
Seriously consider hiring a consultant
to help define the scope of the project,
set a realistic budget and timetable, and
conduct interviews covering as many
aspects of the company’s business as
possible, so that no element of record
generation or management will be overlooked.
A consultant can then prepare a
report that works as a roadmap for the
team to move forward on the project.
After conducting a series of interviews
and seeing presentations from several
firms, select the consultant who fits the
culture and values of your company,
but also emphasize finding a consultant
who will be practical, accessible, realistic
and candid— all qualities you will value
enormously as the project progresses.
A well-chosen consultant will help the
project team stay on track in many ways.
For example, consider holding weekly
conference calls to follow up on the
interview process (a representative sampling
of employees from all lines of the
business should each be interviewed for
approximately half an hour to an hour
to assess needs and current practices) and
consider requiring interim reports that
are concise and to the point as progress
markers for the project. You will need
ways to measure progress and stay on
your timetable toward completion or the
project will lose momentum, because of
its inevitable massive scope.
Lesson No. 5: Be realistic about the
need to “roll up your sleeves”
A records management project may seem
easy to delegate, but it is not easy to
get done the way you will want it done
without hands on involvement by team
leaders. As a result, your team should
plan to do site visits to locations where
records are stored in the field, such as
the garages, attics, and basements of
your company’s various offices and facilities.
You and your team should tour the
Continued on page 23
Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org
December 2006
21

Five lessons from the “trenches” ...continued from page 21
offsite warehouses where outside vendors
have your records stored. You may find
it very helpful to actually cull through
hundreds of boxes of old documents,
and then make the dozens of phone calls
necessary to understand the contents of
the boxes you have reviewed. Before you
actually start reviewing the old records,
you will also need to determine legal
retention requirements and determine
who in your company wants or needs
the type of records you discover during
your tour.
At this point, it may become critical to
force records management issues to the
top of the company radar screen so that
realistic and enforceable decisions can be
made regarding ownership of the records,
location of stored records, length of time
for records retention, and responsibility
for records management decision-making.
By this stage of the project, you
will need to have disseminated a realistic
records retention schedule (most
records simply don’t need to be kept as
long as people/departments/companies
are inclined to keep them; some documents
aren’t records at all and should not
be kept). Focus on creating a schedule
that is easy to follow and written in a
vocabulary that is commonly understood
in your organization. This may be a far
more difficult task than you may anticipate
up front. Probably the most import
outcome of a truly hands-on approach,
however, will be that you continuously
reinforce the critical buy-in and set the
tone at the top of your organization.
Conclusions
Approximately one year into your
company’s records management project,
you should have a great and committed
team of professionals who represent the
various functional areas of the business,
and who know a lot more about the way
records are generated and stored in the
company than anyone did at the outset.
By then you should also be well aware
how big the project is—something you
may not have realized when it began.
And your team should be far more realistic
about the time required to implement
a records management program
that allows a rational search of records
databases, can produce needed records
upon demand, and consistently disposes
of unneeded records on a regular schedule.
These may not sound like huge
accomplishments, but once achieved,
your team will be far better prepared
to maintain a records management
program far into the future, one that is
flexible, usable, and ultimately meets
the primary objective of protecting your
company from risk.
1. Source: General Counsel Roundtable research.
2. Sources: Feith Systems and Software, Inc., “Building an Effective
Compliance & Litigation Support Architecture” and General
Counsel Roundtable research.
Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.org
December 2006
23