Stay organized and secure with electronic records management

With pandemic restrictions easing and the full staff heading back to the office, Laura’s boss decided the time was right to perform some workspace reorganization. He put Laura in charge of going through a bunch of drawers with instructions to make folders to organize papers of current worth, box up other documents that somebody might need down the line, and toss insignificant and old material.

Laura did not think this task sounded too difficult, but by the second drawer, she changed her mind. Many gray areas existed as to what was “important” or “old.” Afraid of making a mistake, she erred heavily on the side of caution. This hesitancy created an abundance of random “stuff” destined to sit in the basement until either some brave soul went on a hunt for something he needed or flooding from a storm damaged the cardboard boxes and rendered the papers inside unreadable.

Upon finishing the project, Laura expressed relief to her friend Jan at lunch. She told Jan how hard it was to figure out a good way to organize timely papers since they often fit multiple categories. She also explained that the only items she actually tossed were some electronic mail printouts from last year that were originally sent to the account of a person no longer with the company. Jan asked about the nature of these messages. Laura said that she did not read them in detail but that they seemed to be rather mean-spirited. Jan bit her lip and hoped that Laura had not accidentally tossed evidence the legal department might need in a harassment lawsuit.

Like many other workplaces, Laura’s office could benefit considerably from implementing electronic records management (ERM). Such a management system utilizes information technology to organize and store records in electronic form. Electronic information management eliminates guesswork by providing systematic storage, maintenance, and disposition of records. Electronic documents are available and retrievable when people need them, and electronic information past its usefulness gets deleted in a purposeful, orderly manner.

The benefits of electronic recordkeeping systems

Organizations need to keep various records as proof of business processes and activities. These documents act as official records that certain events took place or that proper procedures were followed. Many serve as supporting evidence when the company files taxes or gives reports to other federal agencies. Some need to be easily retrievable should a government agency such as the Department of Labor (DOL) want to check employment verification or the Occupational Safety and Health Administration (OSHA) need to investigate an environmental concern. Internally, anyone from a manager looking for details of past dealings with a specific client to lawyers building a defense for an improper termination lawsuit benefits from the ability to quickly and easily find what they need.

An ERM system enables people to find the right information when they need it. Capturing document metadata facilitates content management and improves identification, categorization, and retrieval. The seeker need not go on a scavenger hunt to multiple places nor worry that additional information exists elsewhere. A properly maintained electronic records management system serves as an efficient one-stop-shop.

Other pros to employing an electronic format include:

• Saving space. Paper records can take up a good deal of physical room.

• Safety. Fires, floods, and even spilled cups of coffee can render physical copies of documents unreadable.

• Access from outside the building. Many businesses operate out of more than one location. Electronic files allow approved people to get what they need regardless of where they are at.

• Reducing manual workload. A records management program requiring physical filing and retrieving requires more staff effort and introduces greater potential for human error. Similarly, disposal of physical documents past their life cycle means needing to destroy and haul away mounds of paper.

• Avoiding productivity loss. By keeping valuable content organized and discoverable, an audit or compliance request does not create a frenzy that necessitates pulling people away from their regular work to search for relevant material.

The need for company policies

Effective management of electronic records requires an organization to develop specific policies. These policies act as an instruction manual for those involved in managing electronic records. This information also serves as institutional memory. Down the line, people may wonder about the rationale behind recordkeeping decisions they inherited. Knowing, say, how the records retention schedule for a type of document was determined or how individual records management practices came into being clarifies the foundation and assists with future decisions.

Defining what information your organization must keep as a record, the procedures for managing those records, their retention period, and their disposal schedule also gives your organization credibility in the eyes of outsiders. Courts and government agencies frown upon selective deletion by individual employees because such action raises concern about cover-ups. When you can show a thoughtful, organized policy to a relevant third party such as a lawyer or auditor, it backs up your decisions by demonstrating that the business follows a standardized system rather than keeping or deleting information willy-nilly.

As Laura’s situation earlier illustrated, problems can arise when employees are left to their own devices when handling records. They may keep everything because of fear of inadvertently destroying something that should be retained. Or, they may be too quick to dispose of something that to the untrained eye looks old or unnecessary. The first scenario creates a cumbersome mess where finding what you want proves challenging. The second action opens up the company to potential legal and regulatory problems.

Do not expect employees to inherently know what stays and what goes. A good company records policy must define what your organization considers a business record. Basically, the term refers to evidence of business-related activities, such as events, transactions, discussions, and communications. Some types of business records, such as tax forms and legal documents, are relatively easy to spot. Others, such as emails and social media posts, are not so obvious. Be certain employees know not only your organization’s precise definition of a business record but also the various forms such records may take.

Figuring out what to keep and for how long

Examining legal and regulatory guidelines provides a good foundation for establishing what types of electronic records you need to keep and for how long. Research rather than assume. Requirements may prove surprising, such as certain employee medical records that OSHA wants retained for 30 years.

Since many records pertain to tax issues, people involved in records administration may want to seek guidance from the Internal Revenue Service’s website, IRS.gov. The web page entitled “What kind of records should I keep?” provides small businesses and the self-employed with guidance about recordkeeping of supporting business documents such as gross receipts, purchases, expenses, and assets. Another web page entitled “How long should I keep records?” looks at recordkeeping in regard to the period of limitations (the period of time in which you can amend a tax return to claim a credit or refund or the IRS can assess additional tax). “Employment tax recordkeeping” details what records regarding employment taxes a company should keep for at least four years after filing a return.

Another place to check out is USCIS.gov. This website for U.S. Citizenship and Immigration Services provides detailed information regarding retention rules for I-9 forms, the document used to verify the identity and legal authorization to work of all paid employees in the United States.

Other common types of records to address regarding retention and deletion schedules include:

• Records pertaining to time off under the Family and Medical Leave Act (FMLA)

• Accommodation requests

• OSHA forms

• Hiring records (including information on candidates not chosen)

• Employee records

• Payroll information

• Job evaluations

• Termination and layoff documentation

Coming up with an electronic records retention and deletion policy is a large and complex procedure. Creators must know which regulations apply to the organization and address them in the policy. This involves reviewing company and HR requirements, state law, federal law, industry regulations, government regulations, and insurance needs before developing record retention policy and procedures. Assembling a team that approaches the process from different angles and spheres of expertise can prove valuable. Gather input from senior management, human resources, IT, records management, and legal/compliance.

Legal consult proves especially helpful in matters involving the organization’s litigation hold policy. Their advice places a destruction hold on electronic documents that should not be deleted because of potential future use. This forward-thinking measure may, for instance, preserve records pertaining to an employee who has expressed concern about harassment in case he or she later takes the matter to court.

Dealing with permanent records

As discussed in the previous section, every record has a life cycle — a specific amount of time that it needs to be kept. Holding on to records beyond their retention period results in an ever-increasing need for storage space and lowers retrieval efficiency.

Archives are records that possess an infinite life cycle, meaning they never get deleted. The most well-known place in the U.S. for this type of information is the National Archives and Records Administration (NARA), which holds various government records. Archivists there follow strict protocols to ensure the maintenance and safety of these important public records. Interestingly, of all the documents and materials created in the course of business conducted by the United States federal government, only 1%-3% are so important for legal or historical reasons that they are kept forever. State archives serve a similar function at the state level.

While perhaps not as extensive, businesses also typically have permanent records and benefit from creating archives. Transferring items with this type of legal, fiscal, administrative, or historical value to a place where people can still retrieve them as necessary but do not encounter on a regular basis lowers the chance of accidental deletion.

Electronic records with a limited life cycle do not get archived. Instead, they require thought-out, spelled-out placement in your system. Their retention and deletion follow guidelines adhered to by everyone at the company.

Security

Keeping records safe from internal or external theft or unauthorized changes has always been a concern and remains so for electronic documents. While worrying about someone stashing physical copies in his briefcase is no longer the issue when using an ERM system, computer breaches are equally problematic.

Companies must take measures to prevent outsiders from gaining access to electronic files. Software applications such as encryption tools help by making a document intercepted over an open network inaccessible or unreadable. Businesses also must vehemently control access by their own employees. Only relevant parties should be set up with login permission and the information on how to get in – with strict warnings against unauthorized sharing.

Since viruses also can wreak havoc on electronic files, IT personnel should install effective security software and keep it up to date. Companies commonly make backup copies of files in the event a problem occurs. If using cloud-based storage, do research before selecting a provider. Choose a reputable provider that can clearly tell you the security measures it takes.

In addition to implementing various technical measures against theft or tampering, smart organizations also know the importance of monitoring. They run reports that track every action taken on each document throughout its life cycle, who performed the action, and when it took place. Appropriate leaders and gatekeepers can look at these reports for questionable or suspicious activity.

Physical copies

With its many benefits, electronic records management certainly seems like the wave of the future. This begs the question, “Are there any documents to still keep in physical form?” Opinions vary, but experts often recommend hard copies of:

• Annual reports

• Insurance documents

• Employer identification numbers (EIN)

• Contracts

• IRS and government correspondence

• Tax returns

• Articles of incorporation

• Documents with raised seals

• Business licenses and other documents required by law to be displayed

• International financial documents (some countries have specific requirements about electronic vs. paper copies)

• Mortgages

• Leases

Whatever papers you choose to keep in physical form, make sure to store them in a fire-resistant container or cabinet placed in a dry, temperature-controlled area. Laura’s cardboard box in a leaky basement is not a good relocation choice!