>I recently posted a question regarding e-mail retention practices and I
>appreciate the feedback.  However, I would like to expand my question a bit.
>I understand that the practice of grouping emails as a whole and having them
>set up on a "mass" retention basis is not the preferred way to manage e-mail,
>however, I have to believe that many financial institutions are doing just
>that.  In the absence of evaluating content and declaring e-mails as records,
>how are other financial institutions handling their e-mail retention?  Any
>other records managers from financial institutions out there who will provide
>feedback?  Thank you!

Sure, you're right that the proper way of applying retention to 
records isn't always done with e-mails because it isn't easy to do 
and it takes both time and effort to properly accomplish,. and worst 
yet, it takes involvement of the individuals both sending and 
receiving the messages to work.

So, what's the "next best thing"?   Well, a lot of the answer here 
depends on how heavily regulated your organization is, and the 
financial services industry is EXTREMELY heavily regulated... and the 
rest of it depends on how risk tolerant versus risk averse your 
organization is.

There are risks related to retaining information too long, and there 
are risks related to not retaining it long enough.   If you discard 
it before you're allowed to (by regulation, law or statute), then you 
can get in trouble with the regulators- how much trouble and the 
impact it has on your ability to operate (or your executives wearing 
orange jump suits) depends on why they're looking for the information 
and if it can be proven that it was purposefully discarded.  Worse 
yet, is if you have a documented policy or procedure requiring people 
to discard information in time frames shorter than the required 
retention, or if (a'la Arthur Andersen) there is a smoking gun 
directive from someone telling people to destroy information.

The opposite is if you retain it longer than required.  The worst 
thing that happens here is your organizations spends a little extra 
money for storage and management of unnecessary information, and in 
the event o fa legal action, if you have information you could have 
legitimately destroyed in compliance with your retention schedule- 
you will have to produce it.  There could be information here that 
would be damaging to your case, or a client of yours, and the fact 
that it wasn't discarded in the course of normal business and in 
keeping with the retention schedule could be costly.  Also, retaining 
it longer than required increases the scope of the effort to produce 
information because you have a larger than necessary universe of 
information to search through.

Again, a'la Arthur Andersen... they had an approved retention 
schedule allowing them to discard work papers 5 years after an audit, 
but got lazy and just "kept them hanging around".  When they found 
out there was a pending lawsuit and this information could be 
potentially damaging to their client, an attorney of the firm 
notified managers to "ensure they were complying with the retention 
schedule and only retaining information as long as required".  This 
resulted in large volumes of information that was pertinent to a 
lawsuit being purposefully and intentionally destroyed, and we all 
know the outcome of this.

So, someone has to determine the potential negative impacts of 
keeping information longer than required, and then make a decision if 
ALL E-MAIL should be retained for the LONGEST REQUIRED retention 
period... or conversely, the negative impacts of not retaining it 
long enough, and make a decision to discard ALL E-MAIL after some 
arbitrary time period.   The most important thing is whatever 
decision is made, ensure EVERYONE FOLLOWS IT TO THE LETTER, because 
if some e-mail is being destroyed too early or other e-mail is being 
held too long, the whole thing ends up casting a bas light on the 
organization's ability to comply with even their own stated policies 
and practices, and regulators REALLY don't like that.  Selective 
application of policy reeks of wrongdoing.

Larry
---
Larry Medina
A RIM Professional since 1972


List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]