Many Records Management practitioners have seen an expansion of their responsibilities from organizational control and governance of physical records to now include the governance of all of their company’s information, data and records whether electronic or in physical form and whether under an author’s control or the organization’s control as a declared record. This shift is defined in greater detail in a blog I posted some time ago entitled, “Creating an Information Governance Strategy …” and may require bringing together multiple strategies to fully address the governance and management of enterprise information as the challenges continue to grow in number and risk posture. A quick look at Information Governance news articles highlights risks and losses from cybersecurity attacks as well as the potential for fines as a result of non-compliance with the EU’s General Data Protection Regulation that goes into effect in May of this year.
For the practitioner that needs to define a strategy or multiple strategies to better govern records, data and information, the first step is to understand the objectives of their organization and align or map their Records Information Management strategy to these objectives. Doing so demonstrates their knowledge and understanding of the wider business and its challenges and how they can help the organization become better positioned for success.
In Life Sciences, there are already a multitude of operational and regulatory challenges ranging from information explosion and proliferation to legal hold orders to 21 CFR part 11 electronic records and signature requirements. An assessment and strategic roadmap project that tackles just Records and Information Management routinely highlights high level records management needs across organization, process and technology. I have not come across a life sciences organization that has implemented a single technology solution specific to managing records retention across their enterprise as a result of such a strategy. The rationale is likely that no single solution is the magic bullet that can handle the creation, management, storage and protection of all types of information, particularly during the highly collaborative and active cycles of this information and the need to be on the bleeding edge of technology in R&D and other areas. In addition, technology can be a high cost solution for a records information management strategy where other steps may be taken at a much lower initial cost, e.g. mobilizing records coordinators embedded in business areas, documenting policies, procedures and guidance, etc… These other activities don’t typically yield substantial cost savings; rather they address risk mitigation and depending on how healthy the organization is at the time, health may change the willingness or ability to take these strategic next steps.
Successful information governance strategies are focused on people, process and technologies that address:
- Records classification - Get the business is involved on the front end of the strategy in generating robust business rules so that minimal participation is required on the back end of classification and management activities, whether the records are active or inactive.
- Archiving or at least managing Inactive records - service definition and implementation where the organization can take control or custody of the inactive records and apply retention, legal, business, regulatory and other requirements
With this in mind, converging records information management and archiving strategies that are aligned with corporate business objectives while addressing the operational and regulatory challenges that face life sciences organizations is a winning strategy because it:
- Addresses governance of inactive records and works to curb information proliferation on the back end of the records lifecycle
- May be embedded in a portfolio rationalization and system decommissioning factory model that yields substantial benefits, e.g. >$1.5M annually in HW, SW, Licensing and Support costs that will cover the costs of operationalizing many other aspects of the RIM strategies while mitigating operational and regulatory risks
- May include File Analysis and Remediation tools as part of the archive toolset and service that may be used to facilitate classification behind the scenes as part of archiving, or set up proactively as a way to add retention classification to repositories of records at any other point in the records lifecycle
- May include Manage in Place capabilities and/or employ connectors to better manage and/or migrate unstructured records that are stored in the most commonly used collaboration repositories in the enterprise; areas such as SharePoint, File Shares, Box for the Enterprise, and other EFSS repositories.
- Enables or facilitates better retention classification of records whether done automatically in #3, or manually as part of archive appraisal and mapping to the archive service
- Supports a centralized, one stop shop for searching, retrieving, managing, preserving and protecting inactive information, data and records with long term retention needs
- Requires establishing service and governance roles that may be armed with both archiving and records management knowledge to support the service and the other strategic steps in maturing the organization with respect to RIM
- Facilitates Legal Hold and discovery processes to enhance legal compliance
- Considers alternative storage options that exist in the organization that may be a better fit for the records than their existing system or the archive service being defined
Conducting a converged assessment and implementing an archive strategy with the above considerations is still not a panacea. There will always be repositories with no connectors and no retention metadata capture capabilities. There is always the M&AD business case and the ‘Leavers’ business case where information is acquired by the organization and little contextual information is available for classification or the templates used in the incoming organization limit the success of these business rules tools. Some of the processes and tools may be employed to facilitate classification and compliance from this strategy, but we may never get to 100%, but in a world where systems are being stored in office closets “just in case” an auditor asks to see the audit trail in the original system, tackling 80% or more of the information is a winning strategy for life sciences.