Records Inventorying Steps
7. Learn where the agency’s [or business’] fi les are located , both phys- ically and organizationally
8. Conduct the inventory .
9. Verify and analyze the results .” 10 (bold added for emphasis) Goals of the Inventory Project
The goals of the inventorying project must be set and conveyed to all stakeholders.
At a basic level, the primary goal can be simply to generate a complete inventory for compliance and reporting purposes, and to update the Retention Schedule. It may focus on a certain business area or functional group, or the enterprise as a whole. An enterprise approach requires segmenting the effort into smaller, logically-sequenced work efforts, such as by business unit. Perhaps the organization has a handle on their paper and microfi lmed records, but e‐records have been growing exponentially and spiraling out of control, without good policy guidelines or IG controls. So a complete inventory of records and e‐records by system is needed, which may include e‐records generated by
the completed records inventory contributes toward the pursuit of an orga- nization’s Ig objectives in a number of ways.
application systems, residing in e‐mail, created in offi ce documents and spreadsheets, or other potential business records. This is a tactical approach that is limited in scope.
The goal of the inventorying process may be more ambitious: to lay the ground- work for the acquisition and implementation of an electronic records management (ERM) system that will manage the retention, disposition, search, and retrieval of re- cords. This will require more business process analysis and redesign, some rethinking of business classifi cation schemes and fi le plans, and development of an enterprise‐wide taxonomy. This will allow for more sharing of information and records; faster, easier, and more complete retrievals; and a common language and approach for knowledge professionals across the enterprise to declare, capture, and retrieve business records.
The plan may be still much greater in scope, and involve more challenging goals, that is, the inventorying of records may be the fi rst step in the process of implement- ing an organization‐wide IG program to manage and control information, by rolling out ERM and IG systems and new processes; to improve litigation readiness and pre- pare for e‐discovery requests; and to demonstrate compliance adherence with business agility and confi dence. This involves an entire cultural shift in the organization, and a long‐term approach.
Whatever the business goals for the inventorying effort are, they must be conveyed to all stake- holders, and that message must be reinforced periodically and consistently, and through multiple means. It must be clearly spelled out in communications and presented in meetings as the overarching goal that will help the organization meet its business objectives. The scope of the inventory must be appropriate for the business goals and objectives it targets.
Scoping the Inventory
“With senior‐level support, the records manager must decide on the scope of the re- cords inventory. A single inventory could not describe every electronic record in an or- ganization; an appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame. ” 11 Most organizations have not deployed an “enterprise‐wide records management sys- tem,” which makes the e‐records inventorying process an arduous and time‐consum- ing task. It’s just not very easy to fi nd where all the electronic records reside—they are scattered all over the place, and on differing media. But impending (and inevitable) litigation and compliance demands require that it be done. And, again, sooner has been proven to be better than later. Since courts have ruled that if lawsuits have been fi led against your competitors over a certain (industry‐specifi c) issue, your organiza- tion should anticipate and prepare for litigation—which means conducting records inventories and placing a litigation hold on documents that might be relevant. Simply doing nothing and waiting on a subpoena is an avoidable business risk.
A methodical, step‐by‐step approach must be taken—it is the only way to accom- plish the task. A plan that divides up the inventorying tasks into smaller, accomplishable
Whatever the business goals for the inventorying effort are, they must be conveyed to all stakeholders, and that message must be reinforced periodi- cally and consistently, and through multiple means.
pieces is the only one that will work. It has been said, “How do you eat an elephant?”
And the answer is, “One bite at a time.” So scope the inventorying process into seg- ments, such as a business unit, division, or information system/application.
Management Support: Executive Sponsor
It is crucial to have management support to drive the inventory process to completion.
There is no substitute for an executive sponsor. Asking employees to take time out for yet another survey or administrative task without having an executive sponsor will lose steam and will likely not work. Employees are more time‐pressed than ever, and they will need a clear directive from above, along with an understanding of what role the inventorying process plays in achieving a business goal for the enterprise, if they are to take the time to properly participate and contribute meaningfully to the effort.
Information/Elements for Collection
“During the inventory you should collect the following information at a minimum:
■ What kind of record it is— contracts, fi nancial reports, memoranda, etc.
■ What department owns it
■ What departments access it
■ What application created the record (e-mail, MS Word, Adobe PDF)
■ Where it is stored, both physically (tape, server) and logically (network share, folder)
■ Date created
■ Date last changed
■ Whether it is a vital record (mission‐critical to the organization)
■ Whether there are other forms of the record (for example, a document stored as a Word document, a PDF, and a paper copy) and which of them is considered the offi cial record
Removable media should have a unique identifi er and the inventory should include a list of records on the particular volume as well as the characteristics of the volume, e.g., the brand, the recording format, the capacity and volume used, and the date of manufacture and date of last update. (Italics added)” 12
More Comprehensive Approach
NARA provides a more detailed list of “the data elements that should be collected in the inventorying process: 13
Date prepared
The date the inventory was prepared.
An appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame.
Office maintaining the files
The name and symbol of the office maintaining the records. If the office received this series from another office, also indicate the name and symbol of that office and designate it as the “creating office.”
Person conducting the inventory Name, office, and telephone number.
Series location
Give the precise location of the series. If the series is located in more than one office, indicate multiple locations.
Series title
Give each series a title for brief reference or include the generally accepted title.
Inclusive dates
The earliest and most recent dates of the records in each series. These are needed to schedule records, and to determine when to cut off, or break them and trans- fer them to records centers or agency storage facilities.
Series description
A clear description of the series is basic to the success of the inventory and the schedule. It may also be needed to clarify the series title and should contain enough information to show the purpose, use, and subject content of the re- cords.
Medium
Indicate whether the record medium is paper, microform, electronic, audiovisual, or a combination of these.
Arrangement
Indicate the arrangement, or filing system, used.
Volume
Express the volume of records in cubic feet, where possible. When inventorying audiovisual, microform, cartographic, and related records, also provide an item count (e.g., 1,200 prints, 3,500 negatives) where appropriate. Sampling may be necessary for large series or collections. NARA requires agencies to give volume figures for records proposed for permanent retention, as well as for nonrecur- ring records proposed for immediate destruction.
Annual accumulation
Based on information from the files custodian, estimate the annual rate of accu- mulation for each series if the records are current and continuing. If the records no longer accumulate, indicate “none.” NARA requires agencies to furnish the rate of accumulation of those records proposed for permanent retention.14 Cutoff
To cut off records means to break, or end, them at regular intervals to permit their disposal or transfer in complete blocks to permit the establishment of new files.
Indicate how often the records are cut off and when the last cutoff occurred. If they are not cut off, explain how inactive records are separated from active ones.
Reference activity
Rate the reference activity of a paper record series, after the regular cutoff, by placing it in one of three categories:
■ Current, or active (used more than once a month)
■ Semicurrent, or semiactive (used less than once a month)
■ Noncurrent, or inactive (not used for current operations) Vital records status
If the records qualify as vital records, specify whether they would be needed in an emergency (emergency‐operating records) and whether they are needed to document legal or financial rights, or both. Also indicate whether they are the originals or duplicates. (See 36 CFR Part 1236 for requirements in managing vital records).
Duplication
Indicate duplication in form or content. It can exist in the following ways:
■ Copies may be in the same organizational unit or elsewhere in the agency.
The copies may contain significant differences or notations.
■ Similar data or information may be available elsewhere in the agency, either physically duplicated or in summarized form.
Finding aids
Note the existence of any finding aids for the series, especially if the records are to be proposed for permanent retention. Indicate where the finding aid is located and note if it covers more than one series.
Restrictions on access and use
Indicate any restrictions on access to, and use of, the particular series. Such restric- tions may result from statutes, executive orders, or agency directives. Common types of restrictions are:
■ Privacy Act restrictions
■ National security restrictions
■ Freedom of Information Act restrictions
■ Other applicable restrictions that may be specific to the agency Condition of permanent records
During the inventory, take note of the physical condition of records that are actu- ally or potentially permanent, especially those stored off‐site. Identify threats to their preservation and security.
Disposition authority
If the series has an approved disposition authority, list the schedule and item num- ber and then the retention period. If the series has no such authority, list the files as ‘unscheduled,’ make sure they are preserved, and ask the program office to recommend a suitable retention period.”15
Additional Information Needed for E‐Records Inventorying
[NARA recommends that] “besides the inventory information listed above, include the following in an inventory of electronic records and electronic re- cords systems:16
■ Name of the system
■ Program or legal authority for creation of the system
■ System control number
■ Agency program supported by the system
■ Purpose of the system
■ Data input and sources
■ Major outputs
■ Informational content (include where applicable):
■ Description of data
■ Persons, places, or things that are the subject of the system and the in- formation maintained on those subjects
■ Geographic coverage
■ Time span
■ Update cycle
■ Date that the system was initiated
■ Applications that the systems supports
■ How data are manipulated
■ Key unit of analysis for each fi le
■ Whether a public‐use version is created
■ Description of indexes, if any
■ Hardware and software environment
■ Name, offi ce, telephone number, and location of the system manager
■ Name, offi ce, telephone number, and room number of the person with the documentation needed to read and understand system, including
■ Codebooks
■ File layouts
■ Other (specify)
■ Location and volume of any other records containing the same information” 17
The IT Network Diagram
Laying out the overall topology of the IT infrastructure in the form of a network diagram is an exercise that is helpful in understanding where to target efforts, and to map information fl ows. Creating this “map” of the IT infrastructure is a crucial step in inventorying e‐records. It graphically depicts how and where computers are con- nected to each other and the software operating environments of various applications that are in use. It should be a high‐level diagram and it need not include every device, but rather, each type of device, and how it is used.
The IT staff will usually have a network diagram that can be used as a reference;
perhaps after some simplifi cation it can be put into use as the underpinning for inven- torying electronic records. It does not need great detail, such as where network bridges
Additional information not included in inventories of physical records must be collected in any inventory of e‐records.
and routers are located, but it should show which applications are utilizing the cloud or hosted applications to store and/or process documents and records.
In diagramming the IT infrastructure for purposes of the inventory, it is easiest to start in the central computer room where any mainframe or other centralized servers are located, and then follow the connections out into the departments and business unit areas, where there may be multiple shared servers and drives supporting a network of desktop personal computers or workstations.
Microsoft’s SharePoint is a prevalent document and records management portal platform, and many organizations will have SharePoint servers to house and process electronic documents and records. Some utilities and tools may be available to assist in the inventorying process on SharePoint systems.
Mobile devices that are processing documents and records should also be repre- sented, which may include tablets, smartphones, and other portable devices, including BYOD. And any e‐records residing in cloud storage should also be included.
Creating a Records Inventory Survey Form
The form must suit its purpose. Do not collect data that is irrelevant, but be sure to collect all the needed data elements in conducting the survey. You can use a standard form but some customization is recommended. Table 5.1 shows a sample records sur- vey form that is wide‐ranging, yet succinct, that has been used successfully in practice.18 If conducting the e‐records portion of the inventory, the sample form may be somewhat modified, as shown in Table 5.2.19
Table 5.1 records Inventory survey Form Department Information
1. What is the reporting structure of the department?
2. Who is the department liaison for the records inventory?
3. Who is the It or business analyst liaison?
Record Requirements
4. Are there any external agencies that impose guidelines, standards or other requirements?
5. Are their specific legislative requirements for creating or maintaining records? Please provide a copy.
6. Is there a departmental records retention schedule?
7. What are the business considerations that drive record keeping? regulatory requirements? legal requirements?
8. does the department have an existing records management Policy? guidelines? Procedures?
Please provide a copy.
9. does the department provide guidance to employees on what records are to be created?
10. How are policies, procedures and guidance disseminated to the employees?
11. What is the current level of awareness of employees their responsibilities for records management?
12. How are nonrecords managed?
13. What is the process for ensuring compliance with policies, procedures, and guidelines?
When an employee changes jobs/roles or is terminated?
14. does the department have a classification or file plans?
15. Are any records in the department confidential or sensitive?
16. What information security controls does the department have for confidential or sensitive records?
17. does the department have records in sizes other than letter (8 ½ × 11) 18. What is the cutoff date for the records?
Fiscal year calendar year other 19. Have department vital records been identified?
20. Is there an existing Business or disaster recovery Policy?
21. Is the department subject to audits? Internal? external? Who conducts the audits?
22. Where and how are records stored?
online? near line? offline? on‐site? off‐site? one location? multiple locations?
23. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Technology and Tools
24. Are any tools used to track active records? spreadsheets, word documents, databases, and so forth?
25. Are any tools used to track inactive records? spreadsheets, word documents, databases, and so forth?
26. does the department use imaging, document management, and so forth?
Disposition
27. Are there guidelines for destroying obsolete records?
28. What disposition methods are authorized or required?
29. How does disposition occur? Paper? electronic? other?
30. What extent does the department rely on each individual to destroy records? Paper? electronic?
other?
Records Holds
31. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
32. How is the hold or freeze communicated to employees?
33. How are records placed on hold protected?
Table 5.2 electronic records Inventory survey Form Identifying Information
1. name of system?
2. Program or legal authority for system?
3. system identification or control number?
4. Person responsible for administering the system. Include e‐mail, office address, and phone contact info.
5. date system put in service.
6. Business unit or agency supported by system.
7. description of system (what does the application software do?).
8. Purpose of system.
System Inputs/Outputs 9. Primary sources of data inputs.
10. major outputs of system (e.g., specific reports).
Table 5.1 (Continued )
(continued )
11. Informational content (all applicable): description of data; applicability of data (people, places, things); geographic information; time span; update cycle; applications the system supports; how data are manipulated; key unit analysis for each file; public use or not?
12. Hardware configuration.
13. software environment, including revision levels, operating system, database, and so forth.
14. Indices or any classification scheme/file plan that is in place?
15. duplicate records? location and volume of any other records containing the same information.
Record Requirements
16. Are there any external agencies that impose guidelines, standards or other requirements?
17. Are their specific legislative requirements for creating or maintaining records? Please provide a copy.
18. Is there a departmental records retention schedule?
19. What are the business considerations that drive record keeping? regulatory requirements? legal requirements?
20. does the department have an existing records management Policy? guidelines? Procedures? If so, please provide a copy.
21. How are nonrecords managed?
22. Are any records in the department confidential or sensitive? How are they indicated or set apart?
23. What information security controls does the department have for confidential or sensitive records?
24. What is the cutoff date for the records?
Fiscal year calendar year other 25. Have department vital records been identified?
26. Is there an existing Business or disaster recovery Policy?
27. Is the department subject to audits? Internal? external? Who conducts the audits?
28. Where and how are records stored?
online? near line? offline? on‐site? off‐site? one location? multiple locations?
29. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Disposition
30. Are there guidelines for destroying obsolete records?
31. What disposition methods are authorized or required?
32. How does disposition occur? Are electronic deletions verified?
33. What extent does the department rely on each individual to destroy e‐records?
Records Holds
34. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
35. How is the hold or freeze communicated to employees?
36. How are records placed on hold protected?
Adapted from: www.archives.gov/records‐mgmt/faqs/inventories.html and charmaine Brooks, Imerge consulting.
Table 5.2 (Continued )