On 12/10/06, Hugh Smith <[log in to unmask]> wrote:
>
> Has anyone calculated the cost of losing a box of records and having to
> recreate the information?



=)  Okay. where's the hidden camera?  I KNOW this is one of those trick
questions like:

 "which weighs more, a pound of feathers or a pound of lead?"  or
"If God is so powerful can he make a rock so heavy that even HE can't lift
it?"

In the Diversified Case, the Judge established values from $11,000 per
> box to $167.00 per box based on different articles.  I think the
> overall average came out to $350.00 per box but that is a judge
> establishing a value.


Actually, the judge demanded that the plaintiffs establish a value to
recreate the information, or demonstrate what they would be liable for (or
lose) if they didn't have the information that was contained in those boxes.

A lot of what Mobil Oil lost were records related to their underground gas
station storage tanks that EPA requires them to inspect and report on, and
then to retain the records for a specified period of time.  Their estimate
of $24M in losses was for what it would cost to redo those surveys and
regenerate the records to allow them to comply with Federal law... they were
awarded a total of $20.7M. $9M was for the loss of 67,000 boxes; $8M for
lost tax deductions.

First Union estimated the cost to recreate their records at $22M to $37M,
most of these were trust and student loan records and they would have to go
back to the other financial institutions, lien holders, microfilm and other
sources to recreate the paperwork.  The majority of their costs were related
to research... and they were awarded $20.5M.

If I walked into your office Tuesday  (I am busy Monday doing Christmas
> decorating, so I am unavailable for the theft on that day.) and I
> walked out with a box of records.  What would it require in staff time,
> research, time to reprint, etc. to recover the records?


Hmmm... well, in MY situation, not too easy to do.  In most offices, it
might take awhile before anyone knew something was gone.  Not suggesting
organizations are lax, but you don't know something is missing until you
perform an audit and find it missing, or until you go looking for it and
can't find it.  THEN you spend countless hours trying to locate it in any
other potential locations it could be before you're convinced it's actually
"missing".  And unless the contents were indexed, how would you know what
was missing?  And once you identified what was missing, you'd start looking
for alternate sources to replace the content from.

By this time, a considerable amount of labor will have been spent by any
number of people, and a lot of face will have been lost, along with a good
deal of trust.  In many cases, the trust will be the most expensive thing
lost, because its not easy to gain it back.

If the box contained 1,250 documents per box on average, that needed to
> be recovered, what would it cost to recover this one box.
>
> If you have to go to your Business Continuity Insurer and make a claim
> for the loss of these documents and the associated recovery time to
> restore your records, what would you ask for in compensation?


This might only come into play  if they were a box of vital documents... and
if they were, and you're worth your weight in salt as a RIM, you will have
multiple copies in multiple locations and you'll be inconvenienced, but it
won't impact your Business Continuity.  The loss may, however, impact your
ability to respond to a request to produce records for an audit, or to
represent a client, or to support your organizations claim against a
lawsuit.  Or, it may just be a serious inconvenience to day-to-day
operations because you can't find a copy of a purchase order or a travel
report to respond to a business request.

Would you look for contingent liability because you are no longer doing
> the work you normally do?  Would you factor in losses for idled
> departments waiting for this information?


Again, I'm thinking not.  The things that might cause an organization to
come to a grinding halt like this would essentially be "rights and
obligations records" and would be part of the aforementioned vital records
program, supported by multiple copies in disparate locations.

If you had to list things that effected this estimate, what would they be?
> 1) Panic in the office
> 2) Research to discover what is missing
> 3) Research to recreate the information or to find the duplicate copy
> 4)  The time for IT to recreate documents by recalling tapes from storage
> 5) Search of corporate archives
> 6) Delays in billing or accounts receivable due to uncertainty
> 7) Lost business due to failure to meet deadlines.


All of the above, unless the records were supported by duplicates stored
elsewhere (maybe by a practice of routine dispersal).

What else is impacted.


Trust
Future relationship with the impacted clients
Inability to perform day-to-day work until they are located
Having to inform management of the loss
Potentially having to inform a State or Federal Agency of the loss
Potentially having to inform any number of clients of the loss

Also with litigation holds, you would need legal to determine if any of
> the missing documents will impact the litigation.


Or, IF they were documents already subject to a legal hold and were lost,
explain how this could have happened and determine the impact of their loss
to a case.

What else might we be concerned with for a future disaster recovery
> plan for lost document boxes.


Well, every time I see one of the stories like Diversified, or Brambles
(Chicago), or IM (New Jersey, London, Canada), or others that have occurred
more recently with the loss of data that wasn't sufficiently protected
during transfer,  I think it's time to dust off the contracts and service
agreements and take another look.  But again, in my case, this isn't as big
an issue... as we manage the majority of our own storage.  Still, we do
review our policies, procedures and practices regularly and ensure we aren't
taking any shortcuts.

Personally, I think every organization should spot check their holdings at
least twice a year, visit facilities at least annually, verify their access
lists annually, and find out what the service providers you AREN'T STORING
WITH have to offer.  No telling if there's a better deal out there.

You should also be "exercising" your BCP/DRP regularly and making sure it
works as designed, that all of the contact people are still in the positions
they were in when it was written and still performing the same duties, that
facilities are still configured the same way, that emergency supplies are
still whole, etc.

Maybe someone in the UK might respond
> since I am sure this is more than a drill for you at this time.


Or maybe someone should do a post-mortem with organizations whose
information assets were lost in one of the earlier mentioned events, or
during Katrina and Rita and ask what they're doing different.

But shouldn't some estimate of what these records are worth exist.  Maybe
> with the value, this will also benefit the image management has of
> records management.


Part of the problem here is management EXPECTS RIM to do things right,
because in most cases, it does.  Everything is viewed as "mundane" and
"routine" and when they need something, they ask for it and its provided.
But when this DOESN'T HAPPEN, the fur really flies.

Larry


-- 
Larry Medina
Danville, CA
RIM Professional since 1972

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance