I agree. A policy should be high level - "We are going to do our best to
manage information responsibly, wisely, professionally, and according to
laws and regs". A procedure is how exactly we are going to do it - "print to
paper, store in Outlook.pst until archived, etc". For every high level
policy that is seldom re-written, there could be 25 different procedures on
what exactly to do in 25 different cases. Unfortunately, the term policy is
often used interchangeably with the word procedure.
It should be relatively a bit easier to write initial high level policies,
but specific procedures may not be easily completed until an ERM is
implemented enough to understand pretty detailed operational parameters. One
could certainly write a general policy and a draft procedure before and
during ERM implementation.
****************************
John Phillips
Information Technology Decisions
www.infotechdecisions.com
865-966-9413
-----Original Message-----
From: Records Management Program [mailto:[log in to unmask]] On Behalf
Of Peter Kurilecz
Sent: Wednesday, August 25, 2010 12:52 PM
To: [log in to unmask]
Subject: Re: Voice mail & texting
On Wed, Aug 25, 2010 at 12:11 PM, John Phillips
<[log in to unmask]>wrote:
> Re:" I could do an interim policy that would apply in the absence of an
> ERMS, but I don't want to roll that out and then have to roll out another
> policy after the ERMS is in place."
>
> This is a good example that happens with every ERM implementation.
>
An even better example of the confusion between a policy and a procedure. In
my mind a policy is similar to the law that the legislature passes. A law
will say who it applies to and what it they must do. A policy does the same
thing. For example an email policy will simply state that the organization
will retain emails in accordance with the applicable laws, regulations and
business needs. A good policy shouldn't take up more than one or two pages
at most. So a policy then tells you what you do but not how you will do it,
that leads up to procedures
A procedure is much like a regulation, it tells you how you will do
something. To continue with the email analogy if you don't have an ERMS in
place you still need to publish procedures on how employees will reach
compliance with the policy taking into account the current technological
limitations.
Records management is iterative, it is undergoing constant evolution.
Imagine that the Wright Brothers had taken such an attitude ie can't publish
policy because we don't have an ERMS, with regards to the development of the
airplane. Can't try our airplane design because it can't carry 300 people
for 1500 miles, we would still be riding the rails.
years ago at a different employer I publish an email policy even though we
didn't have an ERMS in place, but I did publish procedures that showed
employees how they could come into compliance
--
Peter Kurilecz CRM CA
[log in to unmask]
Richmond, Va
http://twitter.com/RAINbyte
http://tech.groups.yahoo.com/group/RAINbyte/
Information not relevant for my reply has been deleted to reduce the
electronic footprint and to save the sanity of digest subscribers
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present,
place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]
|
