“Most companies manage retention very well,” said Omero Banuelos Esq., Sr. Counsel at Access. “The problem is, they don’t do the last step – disposition – very well.”
It wasn’t too long ago that holding onto records indefinitely (if you had the space) was a simple solution to the question, “how long should I keep these records?” Now, disposition is under closer scrutiny as part of the information lifecycle because of the increasing amount of privacy laws that exist and the fines that go along with them if you’re not compliant.
During a recent webinar hosted by ARMA, Omero was joined by William Basinger II, CRM, VP eRecords, PNC, to discuss everything from disposition and deletion to archiving and legal holds.
It was a popular event, but if you missed it, no worries – we’ve got your back. Following is a summary of the major topics discussed during the session:
What is Disposition?
In the world according to GARP (the Generally Accepted Recordkeeping Principles, that is), disposition is defined as follows:
“An organization shall provide secure and appropriate disposition for records that are no longer required to be maintained by laws and organizational policies.”
In a more straightforward definition, Basinger noted that this essentially means that “once the record has been retained long enough, it should be dispositioned as defined by your policies.”
Therein lies a challenge, however.
Many people think of disposition as destruction or, in the case of electronic records, as deletion. There are exceptions. For instance, if this record was of historical significance, the record should be archived rather than destroyed. Likewise, if your organization divests itself of those records (as part of a merger or acquisition), disposition procedures would likely not involve simply destroying them.
What’s to be done in those cases, Omero said, is “going to be driven by contractual obligations or risk to make sure you’re complying with the deal or there’s not a breach in the obligation. Usually, these cases are covered in a retention schedule. You’re going to have a bucket that addresses that point.”
How Long Should We Keep This Record?
It’s impossible to disposition a record properly if you don’t know how long to keep it.
This is an all-too-common situation that many organizations find themselves in.
The first step to understanding how long you should keep the records seems simple: you need to know what records you have, what format they’re in, and where they are.
This is obviously far easier said than done. As organizations dig deeper into the records they have, there are so many factors that add to the complexity, including:
- Length of time the organization has been in business
- Number of locations the organization has
- Whether the records are stored onsite, offsite, or both
- Number of systems of record there are and what formats they’re in
Still, conducting an audit is the first, most important step in understanding how long you need to retain the records.
Survey Report: ARMA International’s 2021 Information Governance (IG) Maturity Index
ARMA International’s 2021 Information Governance (IG) Maturity Index Survey and Report, sponsored by Access, aligns with the organization’s Information Governance Implementation Model (IGIM). It was designed to be a simple and repeatable assessment of IG maturity across the seven key…
How to Create a Basic Records Retention Schedule
With the audit, you need to ensure that the records have the proper metadata attached to them. At a bare minimum, a records retention schedule should answer the following questions:
- Who is responsible for managing the retention schedule?
- What’s in the records?
- How long should this record be kept?
- Where is it being kept?
One thing you should consider is a phased approach. “If you’re starting from scratch,” said Omero, “you’re not going to get it all done at once. It’s simply not possible.”
Instead, you’re going to want to lean on the rest of your organization to help out. The most knowledgeable people, who know what is stored where and how long a record needs to be kept, are the ones who are in charge of managing that record in the first place. As you get more information, you’ll be able to ask better questions and get better feedback as you build your inventory.
Then, as your schedule and inventory get more mature, there’ll be a cascading effect and you’ll have a more complete inventory intact and a more robust record retention schedule. This brings us to the last point.
You Need to Record your Disposition Policies and Procedures
Once you have a robust records retention schedule and inventory, there’s still one final step: outline your policies and procedures on what you do with which kinds of records.
This might sound duplicative but keep in mind that procedure is separate from your retention schedule.
Procedure tells you how to go about disposition in a systematic fashion. Your organization has to be consistent on this point and it needs to be documented. This protects and mitigates the risks to your organization from courts, auditors, and other sources.
Collaborating with your organization’s privacy and legal counsel can make this part easier and ensure it’s covering all necessary bases.
4 More Tips about Records Retention and Disposition
The conversation between William and Omero was packed with useful information and insights. Other topics discussed included:
- The Biggest Risk of Over-retention
- Keeping up with Laws and Legislation for Retention
- Measuring Success of your Disposition Program
Here are four more tips that the pair shared during their conversation:
- Always have a reason if you’re keeping something. Reason being, “if you’re over retaining, it should be for business purposes. It should also be recorded as part of your retention schedule and assigned a retention period”.
- Privacy laws are vital to this process. “Learn the privacy laws that affect the industry or area that you’re in. If there aren’t laws now, rest assured…they’re coming.”
- Follow your plan and “make sure you’re not over retaining or have inconsistent disposition, especially when responding to discovery or audit requests. If these things show up, it undermines your credibility and you have to explain why you’re not following your schedule.”
- Beware the cost of retaining digital records because “[physical record] storage might be cheap. eDiscovery isn’t.”
If you want to hear the full conversation between Omero and William, watch the on-demand presentation of Archive vs. Destroy, Holds Revisited – presented by ARMA.
