Blogs

**Views expressed in this blog are my personal views and not those of my employer. Any reference to any living person or organisation, past or present, is entirely co-incidental**

How do you approach the, sometimes, thorny subject of Retention Schedules?

This question, on the face of it, appears to be quite simplistic. I can hear you saying “we develop Retention Schedules to determine how long we should keep Records generated/processed/retained by ourselves”. However, different organisations adopt different methodologies in the construction of their schedules such as:-

1. Bucket style – select a limited number of categories and determine the appropriate Retention Period for the majority of Records (e.g., 80%). You can have an exceptions category to cover those Records which, within that category, require a longer or shorter Retention Period.
2. Detailed Schedule – develop a list of all Records generated/processed and/or retained across the organization. Review each line with the appropriate Legal expert and determine the appropriate Retention Period for each.
3. Detailed Schedule – develop a list of all Records generated/processed and/or retained for each department within the business. Review each line with the appropriate Legal expert and determine the appropriate Retention Period for each.

When determining the appropriate Retention Periods it is not just legal requirements which must be given consideration. The following should also be taken into account:-

1. Business requirements
2. Tax investigations
3. Regulatory requirements – including industry/subject specific requirements e.g. HIPPA, SEC, FSA etc.
4. Corporate laws/regulations

Equally important is consideration which must be given to jurisdictions for companies which operate on a multi national/global basis.  There are further decisions to be taken such as do you produce Retention Schedules for:-

1. Each country
2. Each region (e.g. Americas, Asia Pacific, EMEA)
3. Global

Further, do you simplify matters (thereby introducing some degree of efficiency) by adopting a common period across a country or region – for example all customer records across EMEA shall be kept for x years?

Having determined your approach in respect of the above you should carefully consider how the Retention Schedules should be published. Here are some suggestions-

1. Publish on your Intranet
2. Forward (schedule/link) to Risk Officers/Country Officers/Legal and Compliance Officers, Business Heads and COO’s
3. Group and 1-2-1 training of appropriate personnel
4. References within any intra-company Newsletters/other publications

References should be made to Retention Schedules in the Records Management Policy.

Above all Retention Schedules should be clear and concise. If not easily understood they will be ignored – at the company’s peril!

You will note I have not mentioned how Retention Requirements are built into systems containing electronic records – this discussion is for another day!

How does your company compile/distribute Retention Schedules?