Legal Technology Journal

A unified strategy for managing all of your firm’s records could boost its profitability in more ways than you might think.

One could be forgiven for thinking that the corporate world is obsessed with records and information management. One may also be forgiven for thinking that it has good reason to be, with the large volume of legislation (such as Sarbanes-Oxley in the US and the forthcoming EU Markets in Financial Instruments Directive) that has sprung up in the wake of a succession of high-profile scandals and prosecutions in which record-keeping and information management have been cited as playing a significant role. This has led to the growing importance in business of good corporate governance both at public and investor level.

One result of this apparent obsession has been a marked change in attitude to the management of information, within and outside organisations, and this has been particularly noticeable with respect to an old discipline that now has a major new role to play – records and information management.

This article provides an overview of records and information management today, positions it within the broader information life cycle, looks at the standards that govern the discipline and reviews the main drivers behind the decision to implement enterprise records management systems. It then covers the situation found in many law firms today, deals with the consequences of current practice, and presents a view of what your firm could look like with information managed in the right way.

There are a number of key drivers as to why organisations implement records and information management solutions, and it is clear that their levels of (perceived) importance are changing. For a number of years the factors of fear, uncertainty and doubt have driven the uptake of records management, but whilst those broad compliance drivers are still there, it is undoubtedly the more positive ones, such as process quality, efficiency and costs savings, that are really coming to the fore at present (see box, ‘Records management drivers’).

The rationale goes something like this: why not implement sound records and information management to improve the quality and efficiency of our firm and lower our costs? At the same time, by the way, we tick a number of the big boxes on the regulatory and legislative compliance checklist as well.

Types of information

The premier professional body in this area, the Association for Information and Image Management (AIIM), has defined the component parts of the information life cycle. By way of clarification, we are not referring to document life cycle management, as it is currently being sold by a number of the storage vendors.

Business records come in many shapes and sizes, and the first important distinction to make is between structured and unstructured information. Structured information is that which sits in a database application and contains the key information required for any organisation to do business. Such applications are often called line-of-business systems, and in a law firm this equates to the practice management and accounting system containing, broadly, client contact information, matter information, and current and historic billing records. Whilst structured information does, of course, contain vital business records, they are, by their very nature, in a format that facilitates interrogation and reporting (notwithstanding data quality issues).

Unstructured information, on the other hand, relates to the information generated, received and used in the course of performing business, and includes a variety of media such as paper files, word-processed documents, spreadsheets and e-mails, as well as voicemail and SMS text messages. Moreover, it is this unstructured information (letters, reports, attendance notes and e-mail content) as well as the actual work product itself (such as contracts and advice) that provide the basis of the billing information which ends up in the practice management system and, consequently, forms the audit trail. It is for these reasons that records and information management is primarily concerned with unstructured data.

Standards

There are a number of definitions of records and records management currently in use, ranging from those of the UK National Archives to the US Department of Defense. The following, from the ISO Standard on Records Management BS ISO 15489-1:2001, is particularly useful:

‘[A good record is] information created, received and maintained as evidence and information by an organisation or person, in pursuance of legal obligations or in the transaction of business… [and] records should be:

• Authentic: what they claim to be, created or sent by the person claimed to have created them and at the time claimed
• Reliable: trusted to be full and accurate representations of the business transactions
• Integral: complete and unaltered
• Usable: locatable, retrievable, presentable and interpretable.’

Furthermore, a records system is an ‘information system which captures, manages and provides access to records through time’. It should be noted that this records system need not be electronic – it may be a series of manual files and indices – but best practice dictates that it generally is.

The key aspect here is that records and information management is about content and not about form. The standard does not mention paper files or electronic files but simply refers to ‘information’. This is a vital point and demands that a consistent records management strategy should be applied to all business records, regardless of format. For example, an incoming client communication on a particular matter should be dealt with in a similar way regardless of whether it is a hard-copy letter that was sent through the post, a PDF attached to an e-mail, text in the body of an e-mail, or even a voicemail or text message. Furthermore, the information should be carefully tracked and managed throughout its life cycle.

The information life cycle

It is worth spending a short amount of time on the information management life cycle. The diagram (see box below) shows the five key phases.

Create/capture

All of the information assets in use within a firm, either on a particular matter or as part of its back-office infrastructure, will either have been created within the firm or will enter from an external source. The create-and-capture phase of the life cycle is concerned with getting this information, whether it is hard-copy or electronic, into a firm’s repositories. Technologies to enable this include document creation tools such as word processors and database software, any document scanning and indexing systems, and also the methods by which hard-copy information is created and filed.

Store

This refers to the storage of an information asset during its active lifetime or, in case and matter terms, whilst the matter is open. This will include all paper repositories within the firm such as personal filing, local filing and managed filing, as well as the off-site archive. For electronic and digital information, this will include file servers, databases and shared drives, as well as e-mail stores and document repositories.

Manage

For hard-copy information this will be the method by which paper repositories are managed (including filing and retrieval). It is also the stage where electronic document management (EDM) sits with check-in/check-out, version control and the application of retention schedules. Indeed, management of electronic documents and records can become much more sophisticated as workflow (or business process management, as it is now known) and other technologies are layered onto the core document management system to provide features such as automated document approval cycles.

Preserve

This stage involves the appropriate retention of those information assets deemed to be business records, ie the long-term archival of your firm’s essential information. For both paper and electronic records this involves understanding your information, building the right classification schema, and applying retention and disposition schedules appropriate to satisfy both legal and commercial requirements. Technologies supporting the preserve phase are electronic records management systems (ERMSs), which are concerned only with paper/hard-copy records, and electronic document and records management systems (EDRMSs), which support both paper and electronic information management.

Deliver

Technology services in this area are web content management, print auditing and management of output devices (which involves dealing with the trade-off between local printing, multi-function devices (MFDs), print rooms and off-site print).

Solution components

Records and information management permeates all the phases of the life cycle, and it is the creation of a coherent and consistent strategy in this area that will deliver key benefits. This strategy is not merely about technology, but rather the correct combination of people, processes and technology to provide a framework within which to deliver against the drivers outlined above.

Staff

The single most important factor in good records and information management is to have the service run by professionally trained staff who:

• primarily have a commercial awareness and ability to communicate with senior management in order to shape the service to meet the firm’s commercial requirements as well its regulatory obligations;
• understand the principles of good information management;
• understand the information life cycle as set out above;
• extract maximum value from technology not only by setting it up and using it correctly from an operational perspective, but also by being able to extract and interpret the management information and use it to control the future shape of the service;
• make professional decisions to move the service forward as the goalposts move (eg the introduction of new information formats such as voice, video and SMS) – the important thing here is to deal with any new situations based on good records and information management principles; and
• can provide an ongoing consultative service to end-users.

The strategy will fail without the right people in place on the ground. Unfortunately, they are a relatively rare breed at present. For many years records management has either been associated with managing an outsourced archive contract or with an overly academic approach, most notably in the public sector, with a much greater emphasis on the minutiae of classification than on the commercial realities of records management. We have hitherto had the choice between box-shifters and librarians.

But this is now beginning to change. Through trade associations like AIIM and ARMA (the American Records Management Association) and, to a lesser extent, the UK Records Management Society, records managers are slowly beginning to change and to embrace the characteristics outlined above.

Given the current furore around the area of records management, there really ought to be senior-level sponsorship already in place for these sorts of initiatives. If this is not the case, then putting a business case forward ought to do the trick (see below).

In terms of getting on the management radar, where records management should sit within a business is often an issue, more so now that the discipline has become a hybrid one, dealing with both paper and electronic documents. In this writer’s view, records management professionals have the same reporting line as the heads of IT and facilities management (FM), perhaps to a head of administration or risk. It is noticeable that several professional services firms are creating a ‘central business services’ group (or similar), which has a single reporting line able to draw on IT, FM and records and information management.

Having said all of this, for any records programme to work it is crucial that you have a well-informed user base. That can be achieved by running awareness sessions and making information available in the most appropriate way, whether that is classroom training, computer-based training, on-line guides or a combination of all three. Again, it will be the records and information professionals driving this programme and providing a consultative service to end-users.

Processes

The key elements of the process side are:

• a clear information management policy;
• a well-constructed information inventory (or file plan) based on a commercially relevant taxonomy;
• appropriate retention schedules; and
• clear procedures for how all these are to be combined.

Once a professional team is in place, the process side becomes much more straightforward. However, whilst records and information professionals can write new policies, design new procedures and work to implement new technology, the real challenge is in taking what you have now and getting to where you want to be – a change management issue. Driving this change should be the records team or experienced third-party organisations.

It may also be worth considering outsourcing records management. This, though, brings its own issues – in particular, there is a lot of work still to be done regarding risk in order for this to be an attractive proposition, and to date there are few UK law firms that have gone down this route.

Technology

On the IT side, the key point is, in the words of Xerox CEO Anne Mulcahy, ‘big "I" and small "t"’. Most of the technology works, and works well; it is the quality of the information itself that, in general, needs some attention. Therefore, every effort should be made to leverage existing IT investments for records and information management before going down the procurement route. At this stage it is worth reiterating the difference between ERMSs and EDRMSs. ERMSs manage only paper records, and will generally utilise barcodes and, in some instances, RFID (radio frequency identification) to track and trace at the box, file or even document level. They will deal with electronic records by linking to the major document management systems. EDRMSs, in contrast, have a fully integrated approach in that they will manage both the paper and electronic documents and records, although, until recently, they provided little functionality for physical paper-file management. However, most of the leading EDM vendors have addressed, or are addressing, this issue, and the first truly integrated EDRM products are beginning to appear. Indeed, some appear to do a very good job, having taken the right approach to this area.

Records management in law firms today

For most law firms, records are paper records and records management is about managing the service contract with the offsite storage vendor. Records (paper and electronic) are managed by form rather than function. In the case of paper, it is stored locally whilst there is space around the lawyers’ desks or on the shelves. For electronic records the constraints are server space, mailbox quotas, back-up capability and the age profile of files. All of which means that when the storage buffers are hit, the information is moved or deleted (paper tends to be moved, electronic files and e-mails deleted) to solve a short-term problem. Very little consideration is given to content and this, of course, is the big issue. Just to reiterate, management of records should always be based on content, regardless of age, size, location or format.

Furthermore, all too often there is fragmented ownership of records within law firms, with the lawyers owning the current client records, FM owning inactive and non-client records (HR and personnel records are always an issue) and IT owning electronic records including e-mails. This means there is very little chance of a unified or integrated records and information management strategy being put together, especially when there are very few formal policies and procedures in place, and many systems are spreadsheet- or even paper-based. There is one firm in The Legal 500’s top 40 where files are checked out by writing the requester’s name in pencil alongside the file name in a logbook and then when it is returned, rubbing it out. Suffice to say, the audit trail for file access would make interesting reading.

Consequences of poor information management

There are a number of issues which arise as a consequence of the abovementioned approach to records and information management, and they can be split into creation of new records, management of active records, archiving and retention and disposition (see box, ‘Potential records management issues’).

Without labouring the point, the situation in many law firms today is that records tend to be poorly created, badly managed during their active life, randomly archived and sporadically destroyed, if at all. Even if we accept that this is the case, it begs one major question: so what? So what if we have multiple copies of our business records? So what if we don’t share our information? So what if we don’t know exactly where all our business records are? So what if we keep some things we should have, and could have, destroyed? So what if we destroy some things we should have kept?

Here’s what. In 2002 senior Arthur Andersen staff shredded paper business records relating to the activities of Enron at the time when there was a distinct possibility of the indictment of senior Enron executives. To all intents and purposes, Arthur Andersen no longer exists.

And here’s what else. In 2005 Morgan Stanley was fined $1.5bn for being unable to produce e-mails in the Ron Perelman Sunbeam case (Coleman v Morgan Stanley). In the absence of these e-mails, which Morgan Stanley said would have proved its innocence, the judge ordered jurors to assume the company was guilty. Another example of the consequences of poor information management.

Despite the enormity of what happened to Arthur Andersen and Morgan Stanley, it is important to state that fear, uncertainty and doubt should not be the main drivers for the application of appropriate records and information management. Issues such as the existence of multiple, untracked copies and lack of sharing are depressingly common, and it is the failure to deal with these simple issues that is costing firms a lot of money every day, both in terms of executing business poorly and, perhaps, not even winning the business in the first place.

Practical records management

As with all other projects, it is important to build a business case for information and records management initiatives. There is an oft-heard assertion from many records and information professionals that records management is ‘like health and safety – you’ve just got to have it and it is a cost to the business’. This is simply not true. It is entirely feasible to build an effective and persuasive business case for the introduction of an appropriate records and information management infrastructure – people, process and technology – based on real costs savings. Whilst the detail of this will vary from firm to firm, these are commonly achieved through means both obvious (eg the consolidation and control of off-site paper storage contracts and the ability to expand fee-earning staff into areas previously used for storage) and not so obvious (improved search and retrieval, and a reduction in dispute resolution costs). The table opposite shows a summary of a real-life business case that has been used to justify budgetary allocation for a records management solution in a 3,000-user organisation. Whilst a net benefit of £1.6m over ten years is relatively modest, the important point is that there is a real saving in costs, and this was taken on board by senior budget-holders.

So what would the ideal firm look like and how would it work? Let us assume that records professionals are in place, policies and procedures are all ship-shape and the EDRM is set up in such as way as to reflect the designed procedures.

Looking just at the area of matter management, when new matters are set up, there will be an automatic creation of paper files, folders, barcodes and labels and, similarly, the automatic creation of the relevant electronic information repositories. Whilst the matter is active, records will be created, captured and stored and managed through the EDRMS. Appropriate retention and disposition information will be added either during its active life (folders within the EDRMS can have records management properties associated with them to be inherited by all contents) or on matter closure. On matter closure, cut-off occurs (and the disposition clock starts ticking), paper records are boxed and archived, and electronic records are moved to cheaper, near-line storage. As the retention periods (which will, of course, be different for different record types even within the same matter) expire, disposition lists will be produced for the designated authority, not necessarily the information owner, to authorise destruction. Once this is done, the business record, in whatever form it exists, is deleted – shredded if it is paper and wiped if it is digital.

The above process will provide a compliant and efficient records and information management infrastructure that adheres to the key principles of ISO 15489-1:2001. More crucially, it should actually make day-to-day life easier, not harder, for the end-users.

Summary

Even though law firms may not yet be as obsessed with records and information management as the rest of the corporate world, there are, as we have seen, good reasons why they should be. The benefits of efficient, effective and compliant records and information management are many and varied (see the table above for a breakdown) – and they should convince you that a solid, workable strategy in this area is demonstrably worth the investment of your firm’s time and money. 

Josef Elliott is a director of records and information management consultancy Oyster IMS.