Blogs

BACKROUND

One of the greatest challenges faced by firms when implementing retention rules is effectively managing records that have retention periods predicated upon “event based triggers.” The challenge applies to records in all media, but I’ll focus on electronic records for the purpose of this ERM blog. Most firms have a long road ahead to establish effective practice in this arena. Reaching goals will require strong collaboration among key stakeholders – including, but not limited to, the businesses (functional areas, departments), Technology (IT), Legal, Compliance, Risk and Records Management.      

In contrast to situations in which a retention period is satisfied a certain number of years from records creation, “triggering event” based retention periods require maintaining records for a specified period of time after a defined event occurs. In other words, the event “triggers” the clock to start toward defensible disposition. Sometimes these retention periods are dictated by law or regulation; sometimes they are established because of business requirements.

Typical “triggering events” associated with records retention include, but are not limited to, termination of employment, expiration of contract, settlement of legal matter and completion of tax audit. Payment-in-full, closure and transfer related to a specific action are also common events. Some triggering events relate to the records themselves - such as supersession or obsolescence. The disposition date for a particular personnel file would, thus, potentially be X number of years after the termination date of the employee to whom the file relates, which would be written as “Termination + X years” (or equivalent) in the retention schedule.

THE TYPICAL GAPS

Gaps related to “triggering event” based disposition typically include the following:

1. Triggering events” documented in retention schedules are often unclear;

2. Event dates (i.e., expiration of contract) are often not captured in electronic business applications;

3. Event dates, when captured, are often not communicated to the records repository; and

4. The records management functionality often is not in place to apply all of the retention rules and the event dates to the records to enable disposition.

RESPONSES BY FIRMS

When these gaps exist:

1. Some businesses chose to keep the data “indefinitely” (or until server space runs out). This results in records retention which is too long, too short or inconsistent.

2. Others choose to eliminate event-based retention altogether, generating very long retention periods to cover all possible events. This can result in over-retention of large volumes of data, with associated risks and cost. For instance, in this scenario, a mortgage file would need to be maintained for its potential life plus X period (e.g., 30 years + X) as opposed to the actual life plus X (e.g., which might only be 5 years + X for a given mortgage) – a potentially much shorter period.

3. A third group of organizations chooses to mitigate gaps related to triggering events wherever possible and reap the benefits of appropriate, cost-effective and defensible retention and disposition. 

I recommend the third approach.

MEETING THE CHALLENGE

The following, interrelated conditions must be in place for event-based disposition to be implemented in electronic record-keeping systems:

1. The triggering events associated with records series in retention schedules must be clear and actionable.

Triggering events that are clear will be understood in the organization and typically will have associated dates. For instance, “employee termination” is a clear triggering event date for employee personnel files, because the meaning of “termination” is understood and it occurs on defined date. “Termination of a client relationship” as a triggering event is usually not as clear. Does “termination” in this case mean closure of the last account with that customer, closure of all accounts and no communication with the customer for a specified time period, or something else? In some cases the meaning may be written in law, regulation, or industry association requirements. In other cases, the firm may define its own meaning.

The businesses should review the current triggering events in its retention schedule and make needed updates to ensure that they are clear. A centralized Records Management team would be in the best position to spearhead this activity related to the entire retention schedule, working with the businesses, IT and other stakeholders (Legal, Compliance, Risk, Tax, etc.).

They must also be actionable – i.e., enabling the actions below.  

2. The triggering events dates for a particular record must be captured in an information system.

Whereas employee termination dates are typically captured in personnel and payroll systems, this is not always the case with other types of information. A business may need to update a process (and and IT team a related application or technology) to capture these dates if they are not currently being captured.

3. The captured triggering-event dates must be transmitted to systems of record and associated with specific records.

In other words, the event trigger metadata field must be populated and pushed to the system of record, and the records system (e.g., likely using records management software) must link the event date with the record(s) to which they apply. This requires an identifier located in both systems (e.g., employee number in the example above). 

4. Additional Records Management functionality, enabling appropriate retention and disposition, must be in place and implemented in the system of record.

Robust records management software provides this functionality. For instance:

A. The system of record must be configured to incorporate the retention rules (records series code and descriptive data, retention periods and triggering events) as applicable;

B. The data/records must be associated with retention rules upon creation or ingestion into the repository;

C. A records hold and hold release process must be in place and applied to records as applicable;

D. The clock must start toward disposition (absent a preservation hold) once a triggering event date has been received for a particular record;

E. Retention rules must be applied to effect “obliteration” of the data once all conditions for disposition are met – including monitoring and oversight to ensure that only eligible records (i.e., those meeting retention requirements with no legal preservation holds) are destroyed.  

COLLABORATION IS KEY

Collaboration among key stakeholders is key to accomplishing the above. Following are some of the roles and responsibilities that you should consider incorporating when managing event based disposition in electronic records systems:

A. The businesses (functional areas, departments) will need to assess and clarify the triggering events associated with their records, with guidance from partners such as Legal, Compliance, Risk, and Records Management. They will also need to work with their technology (IT) support partners to identify repositories that contain actual triggering event dates. Businesses will need to modify their processes, if needed, to ensure that required information is available so that the retention rules can be applied.

B. Technology (IT) teams will need to assess the feasibility of implementing event based disposition with current systems and processes, identify any required system and process upgrades, estimate resource requirements and make needed technology related changes. IT teams will include those related to core technologies as well as business and other application (including RM software).

C. Records Management will need to provide advice and guidance related to records management policies and procedures, standards, best practices and software.

D. Legal, Compliance, Risk and other support partners will need to review updates to retention rules that include triggering events and assess design and implementation issues that arise in their respective area of expertise.      

The above actions will comprise an important part of creating a comprehensive and defensible electronic records management system in organizations.

Regards,

Susan

The opinions expressed here represent my own and not those of Bank of America (BAC) or AIIM. Susan Goodman, CRM, MLS, ERMs, ECMp