One of the most frequent types of questions that Access gets from clients is around building or updating retention schedules. In most cases, organizations are dealing with records retention schedules (RRS) that are incomplete, inaccurate, and/or ineffective – putting their business at risk.
The challenge is that the process can be tedious and difficult to do if you don’t have a clear approach or understand best practices for creating or updating your RRS.
This week we’re going to talk about how to properly build a modern records retention schedule that can be easily updated on a regular basis.
What is Included in a Records Retention Schedule?
During our recent webinar kicking off our Retention Schedules from A-Z Series, Access’ manager of Consulting Services, Andrea Lipari, defined a records retention schedule as:
“a comprehensive list of record series titles that indicate the length of time each series is to be maintained. It may include retention in office areas, off-site storage, as well as when and if such a series may be destroyed or transferred to another entity, such as archives.”
These series should represent similar business processes or activities that are retained for the same amount of time after which they can be properly dispositioned.
To give a more concrete example, let’s consider records related to applicants who do not end up being hired. According to SHRM, the minimum amount of time that you should keep records of this type is one year. This means those application records should be grouped into a record series with other HR records that need to be kept for a minimum of one year, after which they should be destroyed.
Grouping records like this is commonly known as the Big Bucket approach to building your retention schedule.
What is a “Big Bucket” Approach to Retention Schedules?
The Big Bucket approach focuses on having fewer retention buckets or series in order to support consistency and compliance while avoiding confusion.
When you have fewer large buckets that are grouped by similar activities or processes, it is possible to keep the number of possible buckets to a manageable size. For instance, if every department was creating a set of policies and procedures and the organization has 30 departments, you would end up with a retention schedule that is not only unwieldy but confusing. End-users would have no idea which bucket a particular record belongs to. This can cause all sorts of headaches down the road. At Access, we advocate the big bucket approach because it is far more functional.
To go back to our previous example of policies and procedures, when you organize groups by business processes, you are able to consolidate those buckets into one record series for policies and procedures across the entire organization.
As Brenda Barnhill noted during Retention Schedules from A-Z, “we always think more is more. it isn’t always the case. Bigger buckets actually make it easier for auto-classification tools and humans to assign correction retention.”
From the Box and Beyond: Retention Schedules from A-Z Part 1
There’s rarely a simple answer to the question ‘How long should you keep a record. ’In fact, your decisions around retention can be challenged by privacy regulators who hold you accountable to keep your records retention schedule up to date….
How to Create a Record Retention Schedule for Your Business
Now that we’ve outlined the approach, it’s time to start building or updating your RRS.
- Start with research. Consider that a domestic-only, US company in a highly regulated industry can be subject to as many as 15,000 to 20,000 regulations. While creating your RRS, you should consider:
- Existing laws
- New laws
- Laws at every jurisdictional level (local, state, federal)
- New laws being considered
- Use what’s already there – leverage relevant company policies, records inventories, and/or retention schedules – Andrea shared that her best tip for researching your information is to include your company’s website. Never underestimate what you can learn from your company’s website. It’s a treasure trove of information.”
- Focus on the back-office functions first. Those operations will make up 80% of the big buckets and are likely to cover most of the records generated at your organization.
- Shift to specific needs – Once you’ve created the more common back-office functions, focus on creating the next set of new record series for industry/company specific records.
- Review Your project team should take a look at the first draft classification scheme first and then have relevant sections reviewed by SMEs across the organization.
All told, it should take about 12-16 weeks and you should end up with somewhere around 100 to 150 buckets.
Updating Your RRS
Creating or updating your Record Retention Schedule has never been a one-and-done sort of project. Today, the stakes are higher than ever and the risks of non-compliance are exceedingly expensive.
With this constant change, it’s important that you update your retention policies regularly in order to remain compliant. If your team is struggling to keep up with the rapid pace, there’s a tool that can help you streamline your privacy and retention policy updates with continuously updated legal research covering 220+ jurisdictions around the world.
To learn more, watch our recent webinar, Retention Schedules from A-Z, or click on the following link to get a free trial of Virgo – our retention schedule management software.