Hi Earl,

Please find my responses, embedded, below...

> I've searched the Listserv archives to find comments about instant
> messaging, and am wondering what ya'll are doing with them in terms of
> developing policy?  If you have an IM policy, is it an IT policy, or a
> RM policy?  

RM is always a business requirement, driven by business constraints, not an
IT policy.  IT implements a solution to facilitate those requirements and
they might even be given the trust to own and manage those requirements for
the enterprise, however, it's really a requirement put on the firm by
external factors (the SEC, the FDA, etc.).  A well educated IT staff might
be able to help you understand those external requirements, as they become
the common point of implementation for the firm (and possibly for other
firms they've worked for).


> IM in our organization right now is limited to a few people in IT and
> Tech Services, but may be rolled out to the rest of the company soon.  I
> used Lotus Notes Sametime at my last job and while it was very useful,
> I've always wondered about what was being captured and by who, whether
> they were records or not, and how they were being managed.  Truth is, I
> did screen prints and cut & pasted some "conversations" but not
> necessarily to keep as a record, but more so as supporting documentation
> for an issue.  I like Pat Cunningham's earlier comments per the Listserv
> Archives, about these probably being more transitory in nature, and if
> you want to create a record then you should use a more formal way of
> doing so given the difficulty in authenticating IM transcripts.

The way we've implemented IM retention for other firms is to simply create
backups of the conversations.  Good IM systems will allow you to turn on
persistence of all conversations, which will dump such data to file or
database logs.  From there, you can back them up and/or recall them, as
needed.


> Despite that, I see these as potentially discoverable-record or not, and
> that brings up other issues of course.    We're developing our RM policy
> right now and I'd like to address this in light of the upcoming rollout.
> I'm going to bring it up at our next RM Team meeting for discussion and
> input from the others.  I'm so glad that I'm establishing a good
> relationship with our IT group as they are approaching me with
> questions, concerns, and issues on these kinds of things.

They are definitely discoverable records if any single conversation has
anything to do with the part of your business that's under RM constraint by
external drivers.  So, for example, if someone is talking about a Product
(in any way) that has any external regulation by the FDA, chances are that
such conversations are "auditable".  The problem is that you can't easily
filter out one line and/or it's relevant conversation from all of the other
garbage that's going on, over IM.  Nor, can you manually scan all
conversations on IM to find out what you should or shouldn't retain (it just
doesn't scale, not to mention that it's loaded with human error).  So, in a
case like this, you usually have to have blanket coverage for all
conversations, because you know there's always a chance that someone "might"
have a conversation over IM that can put your firm at risk.

Anyhow, I hope this helps.

My Best,

Frank

Frank Guerino, CEO 
TraverseIT
908-294-5191 Cell
http://www.TraverseIT.com



List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]