IBM Software Group © 2003 IBM Corporation e-Records State of the Art Bruce Miller e-Records...

IBM Software Group

© 2003 IBM Corporation

e-RecordsState of the Art

Bruce Millere-Records Strategy and Business Development Executive

IBM Software Group | DB2 Data Management Software

IBM DB2 Records Manager © 2003 IBM Corporation

1. Market Assessment/Trends2. e-Records Fundamentals3. The New Model4. Compliance5. Implementation6. Conclusions/Recommendations

e-RecordsState of the Art – SAA 2004

Bring Recordkeeping To Your Business Solutions



Records Management is now Critical

CSFB BankerQuattrone Resigns Star During Tech Boom Now Facing Investigations of Document HandlingBrooke A. Masters--Washington Post Staff WriterMarch 5, 2003; Page E1 Frank P. Quattrone, the Credit Suisse First Boston Corp. banker who became a star during the Internet boom, quit today in the face allegations that he destroyed documents to obstruct an investigation. New York state Attorney General Eliot L. Spitzer and U.S. Attorney James B. Comey of the Southern District of New York are expected to complete their investigations of Quattrone within weeks, sources familiar with the probes said. Both are looking at…

CSFB BankerQuattrone Resigns Star During Tech Boom Now Facing Investigations of Document HandlingBrooke A. Masters--Washington Post Staff WriterMarch 5, 2003; Page E1 Frank P. Quattrone, the Credit Suisse First Boston Corp. banker who became a star during the Internet boom, quit today in the face allegations that he destroyed documents to obstruct an investigation. New York state Attorney General Eliot L. Spitzer and U.S. Attorney James B. Comey of the Southern District of New York are expected to complete their investigations of Quattrone within weeks, sources familiar with the probes said. Both are looking at…

Think Records Management is Just “Nice to Have?”

…Think Again !!!

E-Mails Reveal Shuttle ConcernsNASA Engineers In Va. Fretted About InactionR. Jeffrey Smith--Washington Post Staff WriterFebruary 22, 2003; Page A1 NASA engineers at the Langley Research Center in Virginia expressed frustration during and shortly after the space shuttle Columbia's disastrous flight that the space agency failed to investigate thoroughly whether it had been seriously damaged by debris during launch, according to a series of internal e-mails disclosed yesterday. In one e-mail sent three days before the shuttle disintegrated on Feb. 1 as it hit the atmosphere, a Langley…

E-Mails Reveal Shuttle ConcernsNASA Engineers In Va. Fretted About InactionR. Jeffrey Smith--Washington Post Staff WriterFebruary 22, 2003; Page A1 NASA engineers at the Langley Research Center in Virginia expressed frustration during and shortly after the space shuttle Columbia's disastrous flight that the space agency failed to investigate thoroughly whether it had been seriously damaged by debris during launch, according to a series of internal e-mails disclosed yesterday. In one e-mail sent three days before the shuttle disintegrated on Feb. 1 as it hit the atmosphere, a Langley…

Credit Suisse Puts Banker On Leave E-Mail Suggests He Was Aware of ProbesBrooke A. Masters--Washington Post Staff WriterFebruary 4, 2003; Page E1 Credit Suisse First Boston Corp. put star investment banker Frank Quattrone on administrative leave yesterday after discovering e-mails that suggest he knew about ongoing criminal and regulatory probes when he and a subordinate advised employees to "clean up those files," sources familiar with the matter said. The U.S. attorney's office in Manhattan opened a probe into the e-mails after receiving copies of the information from CSFB on Friday…

Credit Suisse Puts Banker On Leave E-Mail Suggests He Was Aware of ProbesBrooke A. Masters--Washington Post Staff WriterFebruary 4, 2003; Page E1 Credit Suisse First Boston Corp. put star investment banker Frank Quattrone on administrative leave yesterday after discovering e-mails that suggest he knew about ongoing criminal and regulatory probes when he and a subordinate advised employees to "clean up those files," sources familiar with the matter said. The U.S. attorney's office in Manhattan opened a probe into the e-mails after receiving copies of the information from CSFB on Friday…E-Mail Evidence Allowed in J.P. Morgan Case Official's Messages May Bolster Claim That Company Helped Enron Hide DebtPeter Behr--Washington Post Staff WriterDecember 24, 2002; Page E2 A federal judge ruled yesterday that e-mails from a J.P. Morgan Chase & Co. official referring to "disguised loans" may be entered as evidence in a civil trial, supporting allegations that the company helped Enron Corp. conceal its growing debt before its collapse. U.S. District Judge Jed S. Rakoff had initially kept the memos by Chase Vice Chairman Donald Layton to others within the financial giant away from the jury, saying their impact could be…

E-Mail Evidence Allowed in J.P. Morgan Case Official's Messages May Bolster Claim That Company Helped Enron Hide DebtPeter Behr--Washington Post Staff WriterDecember 24, 2002; Page E2 A federal judge ruled yesterday that e-mails from a J.P. Morgan Chase & Co. official referring to "disguised loans" may be entered as evidence in a civil trial, supporting allegations that the company helped Enron Corp. conceal its growing debt before its collapse. U.S. District Judge Jed S. Rakoff had initially kept the memos by Chase Vice Chairman Donald Layton to others within the financial giant away from the jury, saying their impact could be…

5 Firms To Pay for E-Mail Lapses $1.65 Million Fines, Promises to ImproveBen White--Washington Post Staff WriterDecember 4, 2002; Page E1 Five Wall Street firms agreed today to pay $1.65 million each to settle allegations that they failed to properly save e-mail. The fines, levied by the Securities and Exchange Commission and the securities industry's two self-regulatory bodies, the New York Stock Exchange and NASD, are separate from the much larger amounts a dozen Wall Street firms are expected to pay as part of a proposed "global settlement" to end several conflict-of-interest investigations…

5 Firms To Pay for E-Mail Lapses $1.65 Million Fines, Promises to ImproveBen White--Washington Post Staff WriterDecember 4, 2002; Page E1 Five Wall Street firms agreed today to pay $1.65 million each to settle allegations that they failed to properly save e-mail. The fines, levied by the Securities and Exchange Commission and the securities industry's two self-regulatory bodies, the New York Stock Exchange and NASD, are separate from the much larger amounts a dozen Wall Street firms are expected to pay as part of a proposed "global settlement" to end several conflict-of-interest investigations…

INS Under Pile of Backlogged Paper Agency Reveals It Shuffled 2 Million Documents to Warehouse in the MidwestChristopher Newton--Associated PressAugust 3, 2002; Page A8 More than 2 million documents filed by foreigners, from change-of-address forms to requests for benefits, have been piling up for years and only now are being reviewed by the government, senior U.S. officials said yesterday. Immigrant advocates said that means some foreigners deported secretly after Sept. 11 might have been in compliance with laws they were expelled for breaking. The government has not revealed previously the extent to which…

INS Under Pile of Backlogged Paper Agency Reveals It Shuffled 2 Million Documents to Warehouse in the MidwestChristopher Newton--Associated PressAugust 3, 2002; Page A8 More than 2 million documents filed by foreigners, from change-of-address forms to requests for benefits, have been piling up for years and only now are being reviewed by the government, senior U.S. officials said yesterday. Immigrant advocates said that means some foreigners deported secretly after Sept. 11 might have been in compliance with laws they were expelled for breaking. The government has not revealed previously the extent to which…

Lawmakers Ask Stewart For More DocumentsBen White--Washington Post Staff WriterAugust 7, 2002; Page E1 A congressional committee today requested more documents regarding the sale of ImClone Systems Inc. stock by high-profile media company owner Martha Stewart. Rep. W.J. "Billy" Tauzin (R-La.), chairman of the House Energy and Commerce Committee, chastised Stewart and her attorneys in a sharply worded letter for not moving fast enough to explain why she sold her ImClone shares Dec. 27, the day before the company announced that the Food and Drug Administration had refused an…

Lawmakers Ask Stewart For More DocumentsBen White--Washington Post Staff WriterAugust 7, 2002; Page E1 A congressional committee today requested more documents regarding the sale of ImClone Systems Inc. stock by high-profile media company owner Martha Stewart. Rep. W.J. "Billy" Tauzin (R-La.), chairman of the House Energy and Commerce Committee, chastised Stewart and her attorneys in a sharply worded letter for not moving fast enough to explain why she sold her ImClone shares Dec. 27, the day before the company announced that the Food and Drug Administration had refused an…Federal Court

Subpoenas United Way Financial DataCharity Asked for Documents Dating to 1997Peter Whoriskey--Washington Post Staff WriterJuly 17, 2002; Page B1 FBI agents delivered a subpoena yesterday to the United Way of the National Capital Area, requesting the charity's financial records, board membership lists and other documents. The grand jury subpoena was delivered to Norman O. Taylor, chief executive of the group, and called for documents dating to 1997, according to Irving Kator, the attorney for the charity. The federal inquiry follows a year of allegations of financial mismanagement at the…

Federal Court Subpoenas United Way Financial DataCharity Asked for Documents Dating to 1997Peter Whoriskey--Washington Post Staff WriterJuly 17, 2002; Page B1 FBI agents delivered a subpoena yesterday to the United Way of the National Capital Area, requesting the charity's financial records, board membership lists and other documents. The grand jury subpoena was delivered to Norman O. Taylor, chief executive of the group, and called for documents dating to 1997, according to Irving Kator, the attorney for the charity. The federal inquiry follows a year of allegations of financial mismanagement at the…



1. To stay out of legal trouble• Risk of Litigation/Embarrassment

– Enron, Microsoft, DoD2. To Prove Compliance with regulations

– SEC, EPA, Privacy, HIPAA, etc.3. Because they are forced to

• Government Mandates

• USA (DoD), Canada (RDIMS), UK (PRO), Australia (VERS), EU (MoREQ) have mandated e-Records

4. To Save $$$• Downstream Cost Avoidance

– Cost of litigation (discovery), cost of major mistakes

Why Businesses are Now Buying e-Records



e-Records as a Contribution to Market Requirements

USA(5015.2)

United Kingdom(PRO)

Australia(VERS)

e-Recordse-Records

e-Records

•Doc Search•GUI

Regulatory Compliance

Financial Svc(SEC)

Pharma(21 CFR 11)

HeathCare(HIPAA)

e-Records

e-Records

e-Records

•WORM Storage•Surveillance•Duplication•Email Capture•Search/Retrieve

•Privacy•Digital Rights•Security

•Privacy•Digital Rights•Security

Mandated Govt. Standards



Avg. Acquisition size Approaching 10,000 users

– Ability to scale up = key!Significant Buyer Skepticism

– Many failed pilots.

– Poor user acceptance.

– Deployment capability = key! IT Managers, not Records Managers, = Buyer

– Records people in support role only.

What You Need to Know About the Market



Current Market Pressures Meet US DoD Chapter 4

– Homeland Defense related opportunities Meet UK National Archives 2002

– 2nd-largest worldwide market Achieve High Performance

– Business partners with large clients

– Email storage and management

– Requests from 3M – 10M transactions per day Achieve Tighter Integration

– With IBM Products (Content manager)

– Easier/tighter 3rd-party apps Overcome e-Records Skills Shortage

– Serious inhibitor Achieve High-Volume Classification

– Email Storage/Management

– SEC-Regulated customers



Serious Skills Gap

1.Not enough people who know how to implement!

2.CIOs & CEOs do not understand RM

3.Records Managers do not understand e-records



An e-Record is:– E-mail

– Anything at the desktop Deleting the right document at the right time

(Retention and Disposition).– Destroy according to law/policy

e-Records puts the organization in control of the destruction.

Consists of (3) new capabilities:– Declare

– Classify

– Apply Life Cycle

The Solution – e-records



e-Records(3) Objectives

1. Declare (User)• Put a document under e-Records

management control

2. Classify (User)• Assign a retention rule to the document

• Automatic or Manual Classification

3. Apply LifeCycle (Records Administrator)• Apply LifeCycle rules to a declared document

• Destroy or Transfer (out) a record



Recordkeeping for End Users

Declare Electronic/Non-Electronic documents

Classify during DeclarationEffort

RewardThe

5-second

Rule

???



Declaring Electronic RecordsUser Reluctance

It’s “my” document

This is “too much work”

Let “Admin” do it!

Declare that Document!

“Filing a document into a records repository is an unnatural act”

R. Medina, 2000



Declaring Documents To Be Records



Declaring a Document

Host AppHost App e-Recordse-Records

Classifying a Document

Safety

Inspections

Incidents

Finance

Budgets

Audits

Travel

Requests

Reports

File Plan

Retention Rule 2

Retention Rule 4

Retention Rule 5

Retention Rule 6

Retention Rule 7

Retention Rule 1

Retention Rule 3

Retention Rule 8

Retention Rule 9

Retention Rule 10

Retention Rule 11

Retention Rule 12

Retention Schedule

Doc. 1

Doc. 2

Doc. 3

Doc. 4

Doc. 5

Doc. 6

Rule 1

Rule 3

Rule 1

Rule 5

Rule 8

Rule 8

Classification



e-Records – A Fresh Approach

Retention/Disposition Scheduling

Structured File Plan

Records Management

Regulations

Laws

Policies

Corporate Information

Retention&

DispositionDecisions



Traditional Records Software Integration

Competing Repositories

When/where to store records?

Users Lose Their Records

Declared records moved to records

repository

Cannot Find Records

Must switch to records software to find

declared records

3-Way Instability

Change to any (3) causes failure

BusinessApplication

RMA

MiddleWare

App 1

App 3

App 2

Repository

RMA IntegrationDesktop

Repository



BusinessApplication

The New Model Declared Records Not Disturbed

– No records software for users!

– Preserve application security No Recordkeeping Application

Software– Nothing to install/maintain on

desktops Recordkeeping for ANY Desktop

Application– No limitations

e-Records Engine

Declare/Classify

-Records Server

Desktop

Repository



Enterprise e-Records

e-Records Server

Metadata

App 1

Declare/ClassifyApp 2



Declare/Classify

App 6


Declare/Classify

File Plan

Retention ScheduleRecords Processes

RecordsAdministration

REPOSITORY REPOSITORY REPOSITORY REPOSITORY REPOSITORY REPOSITORY



Enforcement: Prosecutions and Penalties



What does ROI Mean?

Reduced

Odds

of

Incarceration



Common Compliance Misunderstandings

Records Management = Compliance– RM is just a foundation component of a

compliance solution. Retention Management = Records Management

– They are vastly different! Storage Subsystems are certified by SEC

– SEC does not certify anything! Storage Subsystems Offer Records

Management– They do not (yet!).



The Major Regulations Affecting Many Enterprises

Major Regulations Intent Applicability

SEC/NASD Prevent Securities Fraud All financial institutions and companies regulated by the SEC

Sarbanes Oxley Ensure Accountability for Public Firms

All Public Companies trading on a US Exchange

HIPAA Privacy/Accountability for Healthcare Providers/Insurers

HealthCare providers/insurers. Human and veterinarian

US DoD 5015.2 Electronic Recordkeeping US Government, particularly DoD

21CFR 11 Approval Accountability Pharma manufacturers and regulators, related parties

Many additional smaller, contributing regulations



The Functionality/Capabilities RequiredEight Distinct Technologies

Records Management (e-records)– Controlled, process-driven Document Retention and Destruction

Content Management– Document Storage, high-performance search/retrieval, Version Management

Storage Management– Duplicate/triplicate, non-erasable, disaster recovery

– Contextual metadata (index data) BI/CPM

– Business Intelligence/Corporate Performance Monitoring

– Identify and report on key financial performance indicators Supervision

– Monitor/review/intercept trading correspondence (email/IM/other) Email/IM Capture & Management

– Intercept email/IM, store & review/retrieve Collaboration

– Sharing, production of audit review documents

– Audit process controls Digital Rights Management/Privacy

– Digital Signatures/Authorization

– Access/Rights Management



Translating Requirements to Technology

5015.2 SEC/NASD 21CFR11 HIPAA Sarbanes/Oxley

e-Rec

ords

Content M

anag

emen

t

Stora

ge M

anag

emen

t

BI/CPM

Supervi

sion

Emai

l/IM

Man

agem

ent

Collabora

tion

Rights

Man

agem

ent



Two Foundation Technologies

ECM

e-Records

Supervisionof

Trading

Non-ErasableData Duplication

Email/IM Collection

BusinessPerformance Management

Audit Processes& Controls

DocumentCollaboration

Tools

Sarbanes Oxley

Rights ManagementRights Management

E-Records

SEC/NASD

US DoD 5015.2

21CFR11HIPAA



Do not yet meet recordkeeping Requirements

– Fixed-Term Retention only

– No event-Based retention, Legal Holds Suitable for Transactions & Marketing

SEC/NASD Solutions

62

…. The Commission believes that for record retention purposes under Rule 17a-4, the content of the electronic communication is determinative, and therefore broker-dealers must retain only those email and internet communications (including inter-office communications) which relate to the broker-dealer’s “business as such”.



Fixed Term Retention vs Records Management

Fixed Term Retention Records Management

Time-Based Retention RulesSingle (or multiple) retention periods for records

Time-Based RetentionEvent-Based RetentionLegal HoldsStructured File Plan, retention scheduleStructured Destruction processDestruction AuditingSecurity



Event-Driven Records in SEC/NASD Compliance

All Records (Not all Regulated)

Business as Such (Regulated)

T & M (Regulated)

Compliance Solutions



1.Handles Event-Based Retention2.Legal Holds3.Handles Changes in Regulations/Retentions4.Legal Audit5.Accommodates Paper Records

Five Reasons SEC/NASD Needs RM

62



The Most Frightening Thing in e-Records

•You are a records manager at CISCO (San Jose)•You have to meet FTC Regulations, SOX, others.•Your CIO has purchased e-records software

with year-end funds•The CIO has asked you;

“Tell me what we have to do to implement”



Implementing e-Records

What do we have to achieve? What is our approach?



1. Declare/Classify– Across multiple applications, platforms, attitudes

– Accurate, appropriate retention rule assignment

2. High Scalability– 10’s of thousands of users, <5 second e-records

“experience”

3. Flexibility in the Records Model– Adapt to local customs/realities/conventions

4. Physical Records Management– Paper records handled efficiently, seamlessly

To Achieve Successful e-Records

81

You Have to Bring Together;

User Attitudes Business Software

Technical Platform

To Outwit Your Users

Policies/Procedures



A 3-Stage Approach to e-Records Success

1. Establish corporate policies based on the regulations that effect you

2. Translate these policies into specific business procedures

3. Apply the technologies to automate and control the business procedures

Technology

Business Procedures

Corporate Policy

Mandates / RegulationsMandates / Regulations



For Successful Implementation

Make the e-Records process go away– Automate Declaration and Classification where possible

Integrate e-Records into your business– Make it part of existing business processes

Deploy it properly– Measure the Results and adapt

– Train the Administrators and motivate the end users

– Integrate it sensibly



Three Stages of e-Records Implementation

Stage 1RM Consultants

Stage 2Vendor

Stage 3RM Consultants + Vendor

RM Policies Business Procedures Technology

File PlanRetention ScheduleBusiness PoliciesBusiness Practices

Install e-Records SoftwareEnable Host Business ApplicationsConduct a Pilot/POCLoad File Plan/Retention ScheduleConfigure SecuritySystem Setup/Configuration

Project ManagementTrainingMaintenanceAdditional DeploymentScaling up



Stage 1

1. Build Supporting Organizational Structures2. Build Corporate Awareness3. Establish Underlying Corporate Policies4. Enshrine the New Policies

Stage 2

5. Build/Strengthen RM Foundation6. Develop Implementation Strategy/Plan7. Map Business Processes

Stage 3

8. Implement RM Technology9. Conduct the Initial Pilot10.Enterprise Roll-out

IBM’s e-Records Implementation MethodologyOverview

IBM Capability



1. Build Supporting Organizational Structures

Link IT to RM Involve Legal Counsel, Corporate Compliance and Corporate

Risk Management Define mission, mandate, roles and responsibilities Establish a Strong Project Team

– IT, RM, Business Process People, Legal Counsel, Corporate Compliance and Corporate Risk Management



2. Build Corporate Awareness

Launch an education plan/strategy– Up (to management) Educate Management on importance of e-records

– Across (to stakeholders)

– Down (to end users)

– Tie to business ethics training (when appropriate) Build the business case (if required)

– Tangibles Intangibles



3. Establish Underlying Corporate Policies

Definition of a record. Official vs. Transitory records. When to Declare a record. (this will vary depending on the record and the business process)

Requirements of systems and processes that generate/store records, including quality and reliability of such systems

Email Policy (Usage and application of e-records) Mainframe and Client / Server Applications and Database Policy Policy’s strategic place and role within the greater

organization’s policies/framework– Compliance, Privacy, legal, public’s right to information (FIOA) etc.

Implementation plan Resources Required File Plan and retention schedule Access control (security) Policy review/Audit process



4. Enshrine the New Policies

Communicate clearly from the top. This is really education. Provide the policy to all stakeholders and everyone who has a

role to play



5. Build/Strengthen RM Foundation

– Creation of Update/Revise File Plan & Retention Plan

• Use Skupsky’s Retention Method or other 3rd party retention method or consultation (if applicable)

– Ensure adequate skills and resources (funding, people)

– Conduct a Records Inventory (physical as well as electronic)

– Establish Metadata requirements and standards (leverage existing corporate ones or industry standard ones)



6. Develop Implementation Strategy/Plan

Decide on relationship between ECM and RM– Why/When/How/Where to combine the two

Identify Target Pilot group Define the Target Business Processes to records-enable Set clear expectations, goals and objectives Timeframe, Roles & Responsibilities



7. Map Business Processes

Clearly Define and map every target business process Revise process to include e-records Secure stakeholder agreement on all updated processes (PRM only) Define & Map paper-based processes

– Folder storage/retrieval/tracking

– Box storage/retrieval/tracking



8. Implement RM Technology

Install/Configure Bulk Load File Plan, Retention Schedule (PRM Only) Bulk Load Boxes, Folders (PRM Only) Define/build any required “custom” paper handling

processes Train Records Administrators Establish operational Physical Records management (PRM) Install, Configure any/all connectors/existing RMe’s Design, build, test, deploy, audit, refine any new enablers



9. Conduct the Initial Pilot

Select a Target Business Application (2?) Design/Build Declaration and Classification Methods for target

Host Application Design and deliver user training:

– Training on the policies and procedures

– Declaration/Classification procedures Conduct pilot for 60 days Measure against pre-established customer requirements,

expectations, goals and objectives of pilot Review the Results Apply changes/corrections Measure results again



10. Enterprise Roll-out

Develop Roll-out Strategy/Plan Identify Target group(s) Define the Target Business Processes to records-enable Set clear expectations, goals and objectives Timeframe, Roles & Responsibilities



Conclusions/Recommendations

We have to solve the Skills problem– Before it’s too late………..

Agencies are neither Ready nor Able to implement

– Prepare yourself NOW.The RMA is Dead!

– Embedded model has won



Implementations are Lagging Sales. Why?

00.5

11.5

22.5

33.5

44.5

5

2000 2001 2002 2003 2004

Sales

Implementation



Why the Lag?3 Reasons

1.The Skills Gap No enough people who know how to

implement!2.The Skills Gap

CIOs & CEOs do not understand RM3.The Skills Gap

1.Records Managers do not understand e-records



The e-Records Skills Gap

IBM Software Group © 2003 IBM Corporation e-Records State of the Art Bruce Miller e-Records...

Documents

Transcript of IBM Software Group © 2003 IBM Corporation e-Records State of the Art Bruce Miller e-Records...