Thank you for bringing this important topic to CIO. As a records and information management professional, I would like to clarify some terms used. in the RIM field we use the records retention to indicate the topic set forth in this piece.

Records are defined as, "Recorded information, regardless of medium or characteristics, made or received by an organization in pursuance of legal obligations or in the transaction of business." (ISO 15489), and documents are defined as, "Recorded information or object which can be treated as a unit." (ISO 15489). In addition there are separate definitions for records versus document management. Not all documents are considered records thus are not subjected to the same treatment or management regime.

ARMA International is a not-for-profit professional association and the authority on managing records and information – paper and electronic. ARMA is a good source for information on RIM and can be found on the web at http://www.arma.org.

I would like to add to Todd's comments (with which I fully concur). I am a records management consultant with over 25 years of experience in records and information management (RIM). We records management professionals don't use the term "document retention policy" because retention policies aren't used for documents -- they are used for records. Hence, we use the term "records retention."

Allow me to explain the difference between documents and records:

Documents are generally one of the following: in-progress work, extra copies of official records, or reference materials. "Document retention" is a misnomer because documents can be destroyed when a user no longer needs them.

Records have status as being approved evidence of official business that should be destroyed only in accordance with approved retention policies.

Having said this, I am delighted any time an organization develops retention policies no matter what they are called! Records managers are the right people to develop and administer a records retention program and ARMA.org is the place to find one.

Some good advice here but your first step should be to consult your records manager or archivist. If you don't have one, there are qualified consultants in the field who can assist. Archivists and records managers have qualifications, experience and a body of professional knowledge about determining retention periods for records. They take into account all sorts of requirements - legal, business, stakeholders. Todd has already referred to the International Standard for Records Management, ISO 15489. That is a key guiding instrument for professional records managers and archivists.

Carrie,

Thank you for publishing an article on this important subject. Unfortunately, business managers and CIOs greatly underestimate the importance of Records and Document Management – until it is too late.

My only disagreement with the article is that I am afraid a policy alone is not going to cut it. Organizations need a light weight yet robust system in addition to the policy. A “light weight” because CIOs cannot afford yet another monster in production, especially not in a mission-critical domain. “Robust” because otherwise the goal of a business client is not going to be achieved.

I see that the market is full of large and expensive Document Management systems with records management (RM) functionality, implemented as afterthought. Moreover, these systems require quite sizeable investments for customization. This is not what a CIO and her business client needs, especially in small and medium companies. On the other end we have, for example, Microsoft’s SharePoint (MOSS 2007), which offers relatively light weight out-of-the-box RM solution. However, SharePoint is not easy to implement either, and it does not offer adequate solution for managing physical records. At least it allows building full-blown RM solutions.

So, what a CIO in a small or medium company (and her business client) should do when facing a request to implement an RM solution? As an exec of a company that develops RM solutions, I tend to recommend sticking with (now ubiquitous) SharePoint and RM solutions that are built on top of it. To me, this approach gives a CIO of a small and medium company higher degree of control and bigger bang for her buck. At least this is not going to be one more thing she’s going to lose her sleep over.

Eugene Nizker,
www.evidentpoint.com

What we are all talking about is managing the stuff that the Federal Rules of Civil Procedures refers to as Electronically Stored Information (and physical, too). When it comes to discovery, or managing ESI, asking employees to define Documents vs Records only complicates the issue.

When I teach the Electronic Records Management class one definition I use is records are documents with additional retention requirements, beyond the primary business purpose.

Even documents need to be managed, and need policies, which includes when and how they can be destroyed/deleted.

Which is best - separate policies or an inclusive one that covers all of the organizations ESI and physical information objects?