Records Management Program Deliverables Session 1 – October 11, 2017

Records Management Program Deliverables Policy File Plan / Record Schedule Procedure Work Instructions Training Compliance Controls

Policy Policy Statement – Simple and Memorable – Think Elevator Speech Captures the intent of the organization to meet necessary records management requirements Objectives – Essence of What & Why Scope / Responsibilities / Ownership of the Records Management Program Authorities / Regulations / Legislation Sub-Policies, i.e. Vital Records, Personal, Litigation Statement on Services – Communication, Training, Internal Consulting/Oversight, etc Examples http://www.arma.org/docs/sample-forms/records-management-policy-components.RTF https://my.gwu.edu/files/policies/RecordManagementFINAL.pdf https://www.informationstrategy.tas.gov.au/Records-Management- Principles/Document%20Library%20%20Tools/Advice%2050%20Developing%20a%20Records%20Management%20policy.pdf

File plan / Record Schedule List Record Categories – Types of records Describes unique record identification scheme (numbering / coding) Owners/Custodians Authority / Controls: Regulation, Legislation, Industry Standard Retention Period / Disposition Example https://www.faa.gov/about/initiatives/records/tools/toolkits/filecode/ https://compliance.gwu.edu/sites/compliance.gwu.edu/files/univ_records_sched_branded.pdf

Procedure Describes what the organization needs to do to satisfy the records management policy It is the who / what / why for an organizational process Audit Scanning Records Filing / Transferring / Destroying Physical Records Filing / Transferring / Destroying Electronic Records Certifying a Storage Provider Signatures / Authentication Business Continuity / Disaster Recovery Procedures specific to record categories Records Review, i.e. Periodic Review Examples rm.depaul.edu/Forms/DePaul_RM_Manual.pdf https://compliance.gwu.edu/sites/compliance.gwu.edu/files/Records_Mgmt_Procedures_branded.pdf https://www.bcit.ca/files/pdf/policies/6701-procedures.pdf

Work Instructions Optional - may simply be incorporated into a procedure Prescriptive about how a procedure, or step in a procedure, is executed Usually extremely detailed Example https://www.nasa.gov/sites/default/files/atoms/files/ivv_06-4_-_ver_b.doc https://www.nwcg.gov/sites/default/files/ibc_imt_instructions.pdf

training Train on Policy, Procedures, and Work Instructions Annual and Just In Time In-line with the procedure execution (help) Partner with other training efforts to reinforce records management requirements Formats In-Person Webinar Self-directed Read documents and sign Integrated into applications Example http://www.who.int/ihr/training/laboratory_quality/16_b_content_doc_rec.pdf?ua=1

Compliance Controls Controls provide the external drivers and requirements for implementing and maintaining a Records Management Program Example - 36 CFR 1236.10 - What records management controls must agencies establish for records in electronic information systems? The following types of records management controls are needed to ensure that Federal records in electronic information systems can provide adequate and proper documentation of agency business for as long as the information is needed. Agencies must incorporate controls into the electronic information system or integrate them into a recordkeeping system that is external to the information system itself (see § 1236.20 of this part). (a)Reliability: Controls to ensure a full and accurate representation of the transactions, activities or facts to which they attest and can be depended upon in the course of subsequent transactions or activities. (b)Authenticity: Controls to protect against unauthorized addition, deletion, alteration, use, and concealment. (c)Integrity: Controls, such as audit trails, to ensure records are complete and unaltered. (d)Usability: Mechanisms to ensure records can be located, retrieved, presented, and interpreted. (e)Content: Mechanisms to preserve the information contained within the record itself that was produced by the creator of the record; (f)Context: Mechanisms to implement cross-references to related records that show the organizational, functional, and operational circumstances about the record, which will vary depending upon the business, legal, and regulatory requirements of the business activity; and (g) Structure: controls to ensure the maintenance of the physical and logical format of the records and the relationships between the data elements.

Take aways Example Policy Documents Example Procedures / Manuals Example Work Instruction Example File Plan / Retention Schedule Example Control Products http://www.ironmountain.com/Services/Information-Governance/Retention-Policy-Management/Policy-Center.aspx https://commoncontrolshub.com/overview/ Example of Audit self-reporting https://www.archives.gov/records-mgmt/agency/sao-reporting-2016 RM Resources in the left-hand navigation bar are very handy Interesting to note who completed the survey as it’s a window into what department is leading the RM Program Example of an Assessment Report https://sites.lib.byu.edu/recordsmanagement/.../Sample-Records-and-Informatin-Mana... Questions? Want the take aways? Email me Christine Adcock, cadcock@tsgrp.com