Electronic Records as Documentary Evidence Standard (CAN-CGSB 72.34) A Case Study from The University of Calgary By Regina Landwehr © University Archives Presented at ARMA Canada Conference, Winnipeg, 6 June 2007

Agenda Reasons for choosing the standard Reasons for choosing the standard Overview of standard Overview of standard Applying the standard Applying the standard Assessment findings and recommendations Assessment findings and recommendations Future steps Future steps Comments on the standard Comments on the standard

NOT MY JOB!

Reasons for choosing standard Who’s responsibility is it? Who’s responsibility is it?  Continuum of Care model at UofC The issue: e-records replaced paper records in the admissions process The issue: e-records replaced paper records in the admissions process Can e-records take the place of paper records? Can e-records take the place of paper records? Legislative research: Electronic Transactions Act (ETA), Alberta Evidence Act Legislative research: Electronic Transactions Act (ETA), Alberta Evidence Act

Reasons for choosing standard The Acts: The Acts:  UofC must always be prepared to produce its records as evidence  Core requirements for admissibility:  Authenticity of the record  Integrity of the information system  Truthfulness of the record’s content

THE VOTING MACHINE

Reasons for choosing standard The Acts: The Acts:  Follow national standard(s) Microfilm and Electronic Images as Documentary Evidence Standard (CAN/CGSB ) Microfilm and Electronic Images as Documentary Evidence Standard (CAN/CGSB )  Conversion from paper to scans only Surprise: more than scans – Surprise: more than scans –  and EDMS record annotations

Overview of standard (GGSB 72.34) Published in 2005 Published in 2005 Applies to public and private sectors, to profit and not-for profit activities Applies to public and private sectors, to profit and not-for profit activities Purpose: Purpose:  To ensure records can provide reliable support for business decisions  To maximize admissibility and weight of records  To protect the value of e-records in documenting the content and accountability of decisions and transactions

Overview of standard Provides structure and principles for developing a comprehensive e-records management program Provides structure and principles for developing a comprehensive e-records management program Defines best practices Defines best practices Sections 5-8 are the ‘meat’ of the standard Sections 5-8 are the ‘meat’ of the standard  Legal requirements for e-records as evidence  Components of an e-records management system program incl. system requirements  QAP  Audit trail requirements

Overview of standard Technology neutral Technology neutral ISO and 2, ‘Records Management’ standard (2000) is its foundation ISO and 2, ‘Records Management’ standard (2000) is its foundation  References:  Fisher, Paul. Electronic Records as Evidence: The case for Canada’s new standard (Information Management Journal, March/April 2004)  Gurushanti, Vigi. e-Evidence Standard: Proving the integrity, reliability and trust of electronic records (ARMA/CIPS conference, 2002)

Key records concepts Records in whatever format serve as evidence of activities Records in whatever format serve as evidence of activities Characteristics of records to act as evidence Characteristics of records to act as evidence  Trustworthy-stand for the facts a record is about  Trustworthy over time-not altered, falsified, substituted  Authoritative-capable of generating consequences

Records are trustworthy if…. Contain complete information Contain complete information  Date written and/or received  Author and title of author  Sender and title of sender  Recipient and title  Type of record  Body of text  Content description-re: subject  File code/classification #  Comments/notes on record  Attachments  Stamp for copy/draft  Signature(s)

Records are authoritative if… Authority given through permission Authority given through permission Permission is defined by position Permission is defined by position Positions reflect competence for a function/activity Positions reflect competence for a function/activity Functions are mandated in business plan Functions are mandated in business plan

Records are trustworthy over time if… Placed and kept in a file that relates to the matter (classification) Placed and kept in a file that relates to the matter (classification) Access to file remains privileged Access to file remains privileged Track whereabouts of files if removed Track whereabouts of files if removed Check for completeness upon return Check for completeness upon return Keep records only as long as required by retention authority Keep records only as long as required by retention authority

Check list-requirement 1: authenticate the source of a record Identify/verify the author of record Identify/verify the author of record Identify/verify the operator of the system Identify/verify the operator of the system Identify/verify the system/software from where record originates Identify/verify the system/software from where record originates

Check list-requirement 2: ability to capture IT metadata System design architecture System design architecture Entity and attribute definitions Entity and attribute definitions Description of how to use the operating system and program application Description of how to use the operating system and program applicationBeware! Issue of proprietary systems preventing effective testing and maintenance Issue of proprietary systems preventing effective testing and maintenance

Check list-requirement 3: ability to create audit trails Record of all historical activities/events performed on the records and the records system Record of all historical activities/events performed on the records and the records system System and operator generated logs System and operator generated logs  Initial capture  Changes to access privileges  Nature of processing events  Changes to record formats  Destruction/erasures and their attempts Audit trails must be kept as long as records exist and stored separately from system Audit trails must be kept as long as records exist and stored separately from system

Check list-requirement 4: security features a. Ability to assign permissions must be protected a. Ability to assign permissions must be protected b. Processing verification must be available b. Processing verification must be available c. Safeguarding of communication and transmission lines c. Safeguarding of communication and transmission lines d. Maintenance of backup copies of records d. Maintenance of backup copies of records e. Business continuity plan for system and records e. Business continuity plan for system and records

Check list-requirement 5: quality testing Quality Assurance Program (QAP) Quality Assurance Program (QAP) Regular testing of: Regular testing of:  System operability  Completeness of records Documentation that testing took place Documentation that testing took place Independent audit of QAP Independent audit of QAP

Check list-requirement 6: non- alterable official record Records are locked: Records are locked:  Scans: unchangeable format-pdf  correspondence sent is fixed  Annotation records-no overwrite

Check list-requirement 7: support records retention and disposition Schedule records Schedule records Notification of destruction readiness Notification of destruction readiness Generate disposition lists Generate disposition lists Log dispositions completed Log dispositions completed

Check list-requirement 8: record annotations/instructions Capability to create legible annotations Capability to create legible annotations Associate annotation with record Associate annotation with record Inseparability of annotation from record Inseparability of annotation from record Unalterable annotation Unalterable annotation

THE FIRST IT HELP DESK

Assessment findings No satisfactory back-up procedures No satisfactory back-up procedures No system’s maintenance/testing plan No system’s maintenance/testing plan No scheduling and disposition function No scheduling and disposition function No audit trail is kept of record deletions No audit trail is kept of record deletions No business continuity plan No business continuity plan

Assessment recommendations Paper records where exist will remain the official record Paper records where exist will remain the official record E-records in Synergize will be reference copies E-records in Synergize will be reference copies Annotations and records as yet unresolved Annotations and records as yet unresolved Develop a Procedures Manual for this system Develop a Procedures Manual for this system Develop a vital records system plan Develop a vital records system plan Develop a disposition tool with vendor Develop a disposition tool with vendor

Outlook Record making systems are difficult to convert into record keeping systems Record making systems are difficult to convert into record keeping systems DoD compliant enterprise wide ERS in its pilot phase DoD compliant enterprise wide ERS in its pilot phase Strengthen the policy framework around system security and quality assurance Strengthen the policy framework around system security and quality assurance Continue assessing other record making systems using this standard Continue assessing other record making systems using this standard

Comments on standard Strengthen significance of business process analysis Strengthen significance of business process analysis Add system requirement for annotations Add system requirement for annotations Add system requirement to specify a retention for audit trail of destruction Add system requirement to specify a retention for audit trail of destruction Clarify some definitions and terms Clarify some definitions and terms  Records vs. information vs. data