Records and Information Management Assessment

Prepared by John Doe
Month/Year

Sample Assessment

Recordsand Information Management Program Assessment Report
Key Findings and Recommendations

1Contents

2Executive Summary

2.1Background

2.2Summary of Key Findings

2.3High-Level Recommendations

3Approach

3.1Approach

4Key Findings and Recommendations

4.1Physical Records – Findings

4.2Physical Records – Recommendations

4.3Microfilming – Findings

4.4Microfilming – Recommendations

4.5Scanning/Digitization – Findings

4.6Scanning/Digitization - Recommendations

4.7Electronic Records – Findings

4.8Electronic Records - Recommendations

4.9Governance and Policy – Findings

4.10Governance and Policy - Recommendations

4.11Training and Awareness – Findings

4.12Training and Awareness - Recommendations

4.13Legal Holds – Findings

4.14Legal Holds - Recommendations

5Proposed High-Level Roadmap

5.1Short-term (Business Readiness Stage)

5.2Mid-Term (Implementation Stage)

5.3Long-term (Sustainability Stage)

Appendix A.

6GARP Maturity Assessment

6.1Approach

6.2GARP Maturity Scores

6.3GARP Maturity Scores by Principle

6.3.1Principle of Accountability

6.3.2Principle of Transparency

6.3.3Principle of Integrity

6.3.4Principle of Protection

6.3.5Principle of Compliance

6.3.6Principle of Availability

6.3.7Principle of Retention

6.3.8Principle of Disposition

6.4GARP Maturity Scores by Principle – Industry Targets

6.5Key Findings and Recommendations from GARP Assessment

2Executive Summary

2.1Background

Over the past three months, University Records and Information Management (URIM) reviewed current policies, procedures, and practices. URIM identified and met with approximately 20 stakeholders and departments that provided a representative sample of departments across the university’s colleges and divisions. These interviews were conducted in order to gain insight into UNIVERSITY’s current recordkeeping practices. As part of this assessment, current practices were then compared against existing policies, procedures and industry best practices. After completion of the departmental interviews, URIM sent a Records and Information Management survey to approximately 160 additional departments to gain insights into their current practices and needs regarding the management of paper records, microfilm, digital imaging and electronic records. Approximately 60 departments responded. The survey results were then incorporated into this assessment. After gaining an understanding of UNIVERSITY’s current recordkeeping practices, URIM completed an industry-based assessment using the Generally Accepted Recordkeeping Principles (GARP) Maturity Assessment Tool, from ARMA International. The GARP Assessment details are located in Appendix A of this report. The key findings of the GARP Assessment were incorporated into the body of this report.

2.2Summary of Key Findings

  1. There is no active records management advisory committee to provide direction and oversight
  2. There is no university-wide approach or use of technology for the management of electronic records
  3. Electronic records are not identified by departments and are not making their way to the University Records Center or University Archives
  4. Litigation hold procedures exist, but are undocumented and not consistently applied, exposing UNIVERSITY to possible risk during litigation
  5. Records center inventory and departmental request activity is tracked using spreadsheets and is not adequate
  6. Approximately half of departments are performing scanning activities on their own with little knowledge of industry best practices (format, compression, resolution, quality review). Many smaller departments do not have resources to complete imaging projects
  7. Some websites contain historical information that is not being preserved
  8. Some departments are preserving historical records onto CDs or DVDs that may begin to degrade in as little as 3 to 7 years
  9. The retention schedule is outdated and lacks legal authorities

2.3High-Level Recommendations

  1. Develop organizational governance –establish a Records Management Committee
  2. Utilize a Department Records Liaison network to assist departments in the management of paper and electronic records
  3. Update the retention schedule and records management policy to support the management of electronic records
  4. Develop a university-wide electronic records center using SharePoint or some other repository
  5. Provide electronic records management guidance and services to assist departments, including imaging guidance

3Approach

3.1Approach

Over the past three months, University Records and Information Management (URIM) reviewed current policies, procedures, and practices. URIM identified and met with approximately 20 stakeholders and departments that provided a representative sample of departments across the university’s colleges and divisions. These interviews were conducted in order to gain insight into UNIVERSITY’s current recordkeeping practices. As part of this assessment, current practices were then compared against existing policies, procedures and industry best practices. After completion of the departmental interviews, URIM sent a Records and Information Management survey to approximately 160 additional departments to gain insights into their current practices and needs regarding the management of paper records, microfilm, digital imaging and electronic records. Approximately 60 departments responded. The survey results were then incorporated into this assessment. After gaining an understanding of UNIVERSITY’s current recordkeeping practices, URIM completed an industry-based assessment using the Generally Accepted Recordkeeping Principles (GARP) Maturity Assessment Tool, from ARMA International. The GARP Assessment details are located in Appendix A of this report. The key findings of the GARP Assessment were incorporated into the body of this report.

In addition, URIM conducted an in-depth assessment of its own practices for the management of paper records, including the following areas:

  • The process for departments to box up records and send them to the records center
  • The process for how records are requested by departments and then delivered
  • The process for how physical records are identified and maintained in departments
  • The process for how the inventory of records in the records center are managed
  • The process for destroying records and the associated disposition approval process.

4Key Findings and Recommendations

4.1Physical Records – Findings

  1. Many departments have a departmental filing area for physical records. About one-third of these departments are having a least minor difficulty finding their records.
  2. About half of the departments use some form of color-coded labeling to assist in the filing and retrieval of department records, but there is no support to make this process more efficient.
  3. About 60% of the departments store records outside of their department, one-third of these departments are storing records outside of their department, but in a storage area somewhere in their own building.
  4. There are approximately 14,000 boxes of records in the University Records Center. The records center is nearing capacity. Disposition activity is being completed on a monthly basis to make room for the next month’s inflow of new boxes.
  5. The disposition process for boxes of records require department approval. There is no process in place to ensure records approved for destruction are checked against current litigation holds.
  6. The records center inventory and circulation (requesting) activity is being tracked by a spreadsheet, resulting in time consuming, manual tasks to transfer data from phoned in and faxed requests.
  7. The service level to the university is not always consistent. Several departments said they had to wait for at least a week to know what to doto have their boxes picked up.
  8. There is no formal training program. Training is provided on a one-off basis, as requested by departments
  9. Departments are disposing of paper records without Record Center awareness.
  10. Faculty want to get rid of exams but are not sure how long to keep them

4.2Physical Records – Recommendations

  1. Publish guidance for filing efficiency and color labeling on the URIM website. Incorporate this guidance into training materials and deliver ongoing communications to build departmental awareness of the available URIM services and drive URIM Liaisons to the URM website for guidance.
  2. Work with the Legal Department to develop and document legal hold procedures.
  3. Develop a disposition process where departments and legal will only need to review boxes eligible for destruction on a semi-annual or annual basis.
  4. As a short-term measure, migrate the Google Doc-based records inventory and request log to an Excel spreadsheet and management them on a departmental SharePoint site, in order to provide backup, access from multiple computers and version control. Work withIT to acquire a departmental SharePoint site for the URIM department to house the inventory in a multi-user environment. As a more permanent solution, develop requirements for a bar code tracking solution, then work with vendors to review functionality and pricing.
  5. Identify and communicate to the departments a service level that can be consistently followed, in order to set appropriate departmental expectations and student courier commitment. Update URIM procedures to reflect the agreed upon service level agreement, as well as security procedures regarding the pickup and drop off of confidential boxes or backup tapes.
  6. Update the University Records and Information Management Policy. Include language to define departmental disposition responsibilities and the role and purpose of the URIM Records Center. The policy should enable departments to dispose of records that are no longer needed, as long as retention requirements have been met and the records are not subject to a litigation hold order.

4.3Microfilming – Findings

  1. Only two departments surveyed identified they have a potential need for microfilmed records and only one made an attempt to have records microfilmed in the past three years.
  2. The records center has drawers of microfiche and boxes of microfilm created by URIM’s internal microfilming efforts during the past few decades. URIM has been unable to locate indexes for these records and it has been verified that indexes were not created on the first few frames of each roll.
  3. URIM no longer retains the expertise necessary to microfilm records.

4.4Microfilming – Recommendations

  1. It is recommended that URIM no longer provide microfilming services and that URIM use digital imaging stored on M-Disc to service any future microfilming requests made by departments.
  2. URIM should surplus, sell or transfer existing microfilming equipment. URIM should retain enough equipment to fulfill department requests for viewing and printing microfilm, in order to fulfill requests from Legal or other departments.

4.5Scanning/Digitization – Findings

  1. Approximately half of the departments are scanning records or are in the process of beginning a scanning initiative. Approximately half of the departments that scan are disposing of records immediately after the scanning & verification process, while the other half are storing the records at the University Records Center or in a storage area within their building, indefinitely.
  2. Most departments that scan are using available departmental scanning technology, such as an office copy/scanner. When scanning, no document imaging standards are being followed, such as file format, image resolution, file compression and quality control. Using industry best practices, each document should be scanned at 300 dpi with a resulting file size of 20KB (black & white) to 200KB (color) in file size. By conducting samples from several departments, it was determined that most documents ranged from 1MB to 5MB in file size and no compression technologies were utilized.
  3. Approximately one-fourth of the departments transfer scanned documents onto DVDs, many of which require permanent retention. It is unclear whether the DVDs are copies of records retained in their systems or whether the DVD is the official, only remaining record. DVD, CD and Blu-ray discs normally begin to show signs of determination in as little as 3 to 7 years.

4.6Scanning/Digitization - Recommendations

  1. URIM department should acquire at least one scanning station to enable the digitization of department records.
  2. URIM should create and publish digitization guidance for departments, based on industry best practices. This guidance should be published onto the URIM Website and regular communications should be sent to department records liaisons to build awareness of standards and URIM service offerings.
  3. URIM should provide one-on-one assistance to departments that want to move to digital imaging or want to update their current scanning environment to use best practices.
  4. URIM should consider providing digitization services for smaller departments on a cost recovery basis. Particularly if the department cannot justify providing dedicated resources for scanning equipment and personnel.
  5. URIM should consider offering a “Scan on Demand” service for departments requesting files or boxes of records. This service would allow records requests to be fulfilled digitally.

4.7Electronic Records – Findings

  1. Most records created or received by departments are electronic. Electronic records are not being identified by the departments and are not making their way to Records Management or to the University Archives.
  2. There is no university-wide electronic records repository, with records management controls, in which departments can safely store their records.
  3. In nearly every case, departmental electronic files are retained on Shared Drives, Outlook Folders and PC hard drives. These filing areas lack records management controls, audit trails and enhanced security. Department records could easily be deleted without others in the department knowing.
  4. There is no metadata standard used when capturing records and there are no controls to prevent records or metadata from being altered.
  5. Departments are not deleting electronic records and information after it is no longer needed for business purposes and after retention requirements have been met.
  6. Some department records are stored on PCs that are not backed up. Many employees use external hard drives to make copies of their PC in case of a hard drive crash.
  7. Electronic records are being stored in departments and in the Records Center on DVD and Blu-ray that can potentially deteriorate in as little as 3 to 7 years. The majority of these DVDs are used to store permanent records.
  8. UNIVERSITY Websites contain information of historical value. In some cases, this information is not being preserved by departments.

4.8Electronic Records - Recommendations

  1. An electronic records center should be established to facilitate the capture and storage of electronic departmental records. As IT already supports SharePoint, it is recommended that URIM work with IT to develop an approach to capture departmental records into department SharePoint sites, and then having a mechanism for these records to flow into a centralized SharePoint Records Center, where records will be managed per approved retention policy.
  2. Updates to the records retention schedule should include the identification of records series that are to be sent to the University Archives. Rules should be applied to the SharePoint Records Center to enable an automated approach for moving departmental records to the University Archives. Consideration should be given to retain some electronic records in the SharePoint Records Center instead of moving them to the Archives.
  3. URIM should provide training and guidance to departments for the identification of electronic records and the correct use of the electronic records center for storing department records as well as provide guidance for moving away from the use of shared drives and personal computers for the storage of electronic departmental records.
  4. The university should consider implementing technology to enable university employees to more easily store email records. After the SharePoint Records Center has been established, it is recommended that departments have the capability to move email records into the SharePoint environment.
  5. URIM should work with departments to create an enterprise content type model and metadata standard before the implementation of a university-wide electronic records center.
  6. URIM should provide guidance to departments regarding the storage of records onto DVD and other removable media. It is recommended where there is a need to store records onto a removable media for storage, M-Disc technology be used, to support long-term storage.
  7. URIM should consider providing M-Disc guidance and services to departments. This service should include copying regular DVD or VHS to M-Disc.
  8. The university should consider supporting a campus-wide technology for backing up the personal hard drives of university supplied desktop and laptop computers. Mosey and Crash Plan are currently in wide use in industry.

4.9Governance and Policy – Findings

  1. UNIVERSITY lacks adequate organizational governance over its records and information program. UNIVERSITYdoes not have a Records Management Committee at this time.
  2. The Records Manager is responsible for implementing processes but has no direct authority over departments to enforce policies.
  3. University Records Management has focused on the management of paper records, but needs to become better equipped to transition into an electronic recordkeeping environment.
  4. Roles and responsibilities are not formally documented for department employees for the management of records and information within their areas.
  5. The University Records Management Policy does not contain adequate language to facilitate the transition from a paper to an electronic records environment.
  6. The University Records Retention Schedule does not contain citations to back up the defined retention periods.
  7. The University Records Retention Schedule is not suitable for implementation into an electronic environment, as it is not following the best practice functional/business activity approach. Retention periods are defined at the department level and there are inconsistencies in retention periods for the same records in different departments, perhaps based on unique department requirements. Different naming conventions are used for records between departments.
  8. The general perception of University Records Management is that of dealing only with boxes of paper records in the records center. One department interviewed asked why University Records Management would be interested in their electronic information.
  9. There are no formal goals set for departments to achieve a specific level of recordkeeping compliance and there is no compliance assessment process to ensure policy is being followed. Compliance to retention policy is left up to each college/division and is applied inconsistently across departments.

4.10Governance and Policy - Recommendations

  1. The university should establish a Records Management Committee to provide oversight and high-level guidance and goals to University Records and Information Management. It is recommended the committee meet monthly. The committee should have representation from Academic, Finance, Information Technology, Legal, Risk Management and the University Archives.
  2. The role of the Departmental Records Liaison should be defined, formalized and supported by the university and department heads.
  3. The URIM Policy should be updated to facilitate the movement of the university to an electronic records environment. The policy should define the ownership of records and the responsibility UNIVERSITY employees have in maintaining records.
  4. The University Records Retention Schedule should be updated to reflect a best practice, functional retention model that is suitable for implementing into an electronic records environment. The records retention schedule should contain references to citations, so that the university can back up its approved retention periods.
  5. A RIM Charter should be developed to define and document the roles and responsibilities of the URIM Committee, URIM Department and Departmental Records Liaisons.
  6. After the URIM Policy and technology for electronic records management has been implemented, the university should consider measuring department compliance, possibly using a self-assessment process.

4.11Training and Awareness – Findings