NARA’s guidance on how to approach a records inventory applies to both physical and e-records.
The steps in the records inventory process are:
1. Defi ne the inventory’s goals. While the main goal is gathering information for scheduling purposes, other goals may include preparing for conversion to other media, or identifying particular records management problems.
2. Defi ne the scope of the inventory; it should include all records and other materials.
3. Obtain top management’s support , preferably in the form of a directive, and t keep management and staff informed at every stage of the inventory.
4. Decide on the information to be collected (the elements of the inventory). Ma-d terials should be located, described, and evaluated in terms of use.
5. Prepare an inventory form , or use an existing one.
6. Decide who will conduct the inventory, and train them properly.
7. Learn where the agency’s s [or business’s] fi les are located , both physically and d organizationally.
8. Conduct the inventory.
9. Verify and analyze the results. s18 Goals of the Inventory Project
The goals of the inventorying project must be set and conveyed to all stakeholders. At a basic level, the primary goal can be simply to generate a complete inventory for compli- ance and reporting purposes. It may focus on a certain business area or functional group or on the enterprise as a whole. An enterprise approach requires segmenting the effort into smaller, logically sequenced work efforts, such as by business unit. Perhaps the organization has a handle on its paper and microfi lmed records but e-records have been growing exponentially and spiraling out of control, without good policy guidelines or IG controls. So a complete inventory of records and e-records by system is needed, which may include e-records generated by application systems, residing in e-mail, created in offi ce documents and spreadsheets, or other potential business records. This is a tactical approach that is limited in scope.
The goal of the inventorying process may be more ambitious: to lay the ground- work for the acquisition and implementation of an ERM system that will manage the retention, disposition, search, and retrieval of records. It requires more business
The completed records inventory contributes toward the pursuit of an organi- zation’s IG objectives in a number of ways.
process analysis and redesign, some rethinking of business classifi cation schemes or fi le plans, and development of an enterprise-wide taxonomy. This redesign will allow for more sharing of information and records; faster, easier, and more complete retrievals;
and a common language and approach for knowledge professionals across the enter- prise to declare, capture, and retrieve business records.
The plan may be still much greater in scope and involve more challenging goals: That is, the inventorying of records may be the fi rst step in the process of implementing an orga- nization-wide IG program to manage and control information by rolling out ERM and IG systems and new processes; to improve litigation readiness and stand ready for e-discovery requests; and to demonstrate compliance adherence with business agility and confi dence.
Doing this involves an entire cultural shift in the organization and a long-term approach.
Whatever the business goals for the inventorying effort, they must be conveyed to all stake- holders, and that message must be reinforced periodically and consistently, and through multiple means. It must be clearly spelled out in communications and presented in meetings as the overarching goal that will help the organization meet its business objectives. The scope of the inventory must be appropriate for the business goals and objectives it targets.
Scoping the Inventory
“With senior-level support, the records manager must decide on the scope of the re- cords inventory. A single inventory could not describe every electronic record in an organization; an appropriate scope might enumerate the records of a single program or divi- sion, several functional series across divisions, or records that fall within a certain time frame. ” [emphasis added.] 19 Most organizations have not deployed an enterprise-wide records management system, which makes the e-records inventorying process arduous and time-consuming. It is not easy to fi nd where all the electronic records reside—they are scattered all over the place, and on different media. But impending (and inevitable) litigation and compliance demands require that it be done. And, again, sooner has been proven to be better than later. Since courts have ruled that if lawsuits have been fi led against your competitors over a certain (industry-specifi c) issue, your organiza- tion should anticipate and prepare for litigation—which means conducting records inventories and placing a litigation hold on documents that might be relevant. Simply doing nothing and waiting on a subpoena is an avoidable business risk.
Whatever the business goals for the inventorying effort are, they must be con- veyed to all stakeholders, and that message must be reinforced periodically and consistently, and through multiple means.
An appropriate scope might enumerate the records of a single program or division, several functional series across divisions, or records that fall within a certain time frame.
A methodical, step-by-step approach must be taken—it is the only way to ac- complish the task. A plan that divides up the inventorying tasks into smaller, ac- complishable pieces is the only one that will work. It has been said, “How do you eat an elephant?” And the answer is “One bite at a time.” So scope the inventorying process into segments, such as a business unit, division, or information system/
application.
Management Support: Executive Sponsor
It is crucial to have management support to drive the inventory process to completion.
There is no substitute for an executive sponsor. Asking employees to take time out for yet another survey or administrative task without having an executive sponsor will likely not work. Employees are more time-pressed than ever, and they will need a clear directive from above, along with an understanding of what role the inventorying pro- cess plays in achieving a business goal for the enterprise, if they are to take the time to properly participate and contribute meaningfully to the effort.
Information/Elements for Collection
During the inventory you should collect the following information at a minimum:
■ What kind of record it is—contracts, fi nancial reports, memoranda, etc.
■ What department owns it
■ What departments access it
■ What application created the record (e-mail, MS Word, Acrobat PDF)
■ Where it is stored, both physically (tape, server) and logically (network share, folder)
■ Date created
■ Date last changed
■ Whether it is a vital record (mission-critical to the organization)
■ Whether there are other forms of the record (for example, a document stored as a Word document, a PDF, and a paper copy) and which of them is considered the offi cial record
Removable media should have a unique identifi er and the inventory r should include a list of records on the particular volume as well as the characteristics of the volume, e.g., the brand, the recording format, the capacity and volume used, and the date of manufacture and date of last update.20 (Emphasis added.)
Additional information not included in inventories of physical records must be collected in any inventory of e-records.
IT Network Diagram
Laying out the overall topology of the IT infrastructure in the form of a network diagram is an exercise that is helpful in understanding where to target efforts and to map information fl ows. Creating this map of the IT infrastructure is a crucial step in inventorying e-records. It graphically depicts how and where computers are connected to each other and the software operating environments of various applications that are in use. This high-level diagram does not need to include every device; rather, it should indicate each type of device and how it is used.
The IT staff usually has a network diagram that can be used as a reference; per- haps after some simplifi cation it can be put into use as the underpinning for inventory- ing e-records. It does not need great detail, such as where network bridges and routers are located, but it should show which applications are utilizing the cloud or hosted applications to store and/or process documents and records.
In diagramming the IT infrastructure for purposes of the inventory, it is easiest to start in the central computer room where any mainframe or other centralized servers are located and then follow the connections out into the departments and business unit areas, where there may be multiple shared servers and drives supported a network of desktop personal computers or workstations.
Microsoft’s SharePoint® is a prevalent document and RM portal platform, and many organizations have SharePoint servers to house and process e-documents and records. Some utilities and tools may be available to assist in the inventorying process on SharePoint systems.
Mobile devices (e.g., tablets, smartphones, and other portable devices) that are processing documents and records should also be represented. And any e-records re- siding in cloud storage should also be included.
Creating a Records Inventory Survey Form
The record inventory survey form must suit its purpose. Do not collect data that is ir- relevant, but, in conducting the survey, be sure to collect all the needed data elements.
You can use a standard form, but some customization is recommended. The sample records survey form in Figure 9.1 is wide ranging yet succinct and has been used suc- cessfully in practice.
If conducting the e-records portion of the inventory, the sample form may be somewhat modifi ed, as shown in Figure 9.2 .
Who Should Conduct the Inventory?
Typically, a RM project team is formed to conduct the survey, often assisted by re- sources outside of the business units. These may be RM and IT staff members, business analysts, members of the legal staff, outside specialized consultants, or a combination of these groups. The greater the cross-section from the organization, the better, and the more expertise brought to bear on the project, the more likely it will be completed thoroughly and on time.
Critical to the effort is that those conducting the inventory are trained in the survey methods and analysis, so that when challenging issues arise, they will have the resources and know-how to continue the effort and get the job done.
Department Information
1. What is the reporting structure of the department?
2. Who is the department liaison for the records inventory?
3. Who is the IT or business analyst liaison?
Record Requirements
4. Are there any external agencies that impose guidelines, standards or other requirements?
5. Are there specifi c legislative requirements for creating or maintaining records? Please provide a copy.
6. Is there a departmental records retention schedule?
7. What are the business considerations that drive recordkeeping? Regulatory requirements? Legal requirements?
8. Does the department have an existing records management policy? Guidelines? Procedures?
Please provide a copy.
9. Does the department provide guidance to employees on what records are to be created?
10. How are policies, procedures and guidance disseminated to the employees?
11. What is the current level of employees’ awareness of their responsibilities for records management?
12. How are nonrecords managed?
13. What is the process for ensuring compliance with policies, procedures, and guidelines?
When an employee changes jobs/roles or is terminated?
14. Does the department have a classifi cation or fi le plans?
15. Are any records in the department confi dential or sensitive?
16. What information security controls does the department have for confi dential or sensitive records?
17. Does the department have records in sizes other than letter (8½×11)?
18. What is the cutoff date for the records?
Fiscal Year Calendar Year Other 19. Have department vital records been identifi ed?
20. Is there an existing business or disaster recovery policy?
21. Is the department subject to audits? Internal? External? Who conducts the audits?
22. Where and how are records stored?
Online? Near Line? Offl ine? On-site? Off-site? One location? Multiple locations?
23. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Technology and Tools
24. Are any tools used to track active records? Spreadsheets, word documents, databases, and so forth?
25. Are any tools used to track inactive records? Spreadsheets, word documents, databases, and so forth?
26. Does the department use imaging, document management, and so forth?
Disposition
27. Are there guidelines for destroying obsolete records?
Figure 9.1 Records Inventory Survey Form
(continued )
Identifying Information 1. Name of system.
2. Program or legal authority for system.
3. System identifi cation or control number.
4. Person responsible for administering the system. Include e-mail, offi ce address, and phone contact info.
5. Date system put in service.
6. Business unit or agency supported by system.
7. Description of system (what does the application software do?).
8. Purpose of system.
System Inputs/Outputs 9. Primary sources of data inputs.
10. Major outputs of system (e.g., specifi c reports).
11. Informational content (all applicable): Description of data; applicability of data (people, places, things); geographic information; time span; update cycle; applications the system supports; how data are manipulated; key unit analysis for each fi le; public use or not?
12. Hardware confi guration.
13. Software environment, including revision levels, operating system, database, and so forth.
14. Indices or any classifi cation scheme/fi le plan that is in place?
15. Duplicate records? Location and volume of any other records containing the same information.
Record Requirements
16. Are there any external agencies that impose guidelines, standards, or other requirements?
17. Are their specifi c legislative requirements for creating or maintaining records? Please provide a copy.
18. Is there a departmental records retention schedule?
19. What are the business considerations that drive recordkeeping? Regulatory requirements? Legal requirements?
20. Does the department have an existing records management policy? Guidelines? Procedures? If so, please provide a copy.
28. What disposition methods are authorized or required?
29. How does disposition occur? Paper? Electronic? Other?
30. What extent does the department rely on each individual to destroy records? Paper? Electronic?
Other?
Records Holds
31. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
32. How is the hold or freeze communicated to employees?
33. How are records placed on hold protected?
Figure 9.2 Electronic Records Inventory Survey Form Figure 9.1 (continued )
Source: Charmain Brooks, IMERGE Consulting, e-mail to author, March 20, 2012.
Determine Where Records Are Located
The inventory process is, in fact, a surveying process, and it involves going physically out into the units where the records are created, used, and stored. Mapping out where the records are geographically is a basic necessity. Which buildings are they located in?
Which offi ce locations? Computer rooms?
Also, the inventory team must look organizationally at where the records reside (i.e., de-y termine which departments and business units to target and prioritize in the survey process).
Conduct the Inventory
Several approaches can be taken to conduct the inventory, including three basic methods:
1. Distributing and collecting surveys 2. Conducting in-person interviews 3. Direct observation
21. How are nonrecords managed?
22. Are any records in the department confi dential or sensitive? How are they indicated or set apart?
23. What information security controls does the department have for confi dential or sensitive records?
24. What is the cutoff date for the records?
Fiscal Year Calendar Year Other 25. Have department vital records been identifi ed?
26. Is there an existing business or disaster recovery policy?
27. Is the department subject to audits? Internal? External? Who conducts the audits?
28. Where and how are records stored?
Online? Near line? Offl ine? On-site? Off-site? One location? Multiple locations?
29. How does the department ensure that records will remain accessible, readable, and useable throughout their scheduled retention period?
Disposition
30. Are there guidelines for destroying obsolete records?
31. What disposition methods are authorized or required?
32. How does disposition occur? Are electronic deletions verifi ed?
33. What extent does the department rely on each individual to destroy e-records?
Records Holds
34. What principles govern decisions for determining the scope of records that must be held or frozen for an audit or investigations?
35. How is the hold or freeze communicated to employees?
36. How are records placed on hold protected?
Figure 9.2 (continued )
Source: Adapted from: www.archives.gov/records-mgmt/faqs/inventories.html and Charmaine Brooks, IMERGE Consulting.
Creating and distributing a survey form is traditional and proven way to collect e-records inventory data. This is a relatively fast and inexpensive way to gather the inventory data. The challenge is getting the surveys completed in a consistent fashion.
This is where a strong executive sponsor can assist. The sponsor can make the survey a priority and tie it to business objectives, making the survey completion compulsory. The survey is a good tool, and it can be used to cover more ground in the data collection pro- cess. If following up with interviews, the survey form is a good starting point; responses can be verifi ed and clarifi ed, and more detail can be gathered.
Some issues may not be entirely clear initially, so following up with scheduled in- person interviews can dig deeper into the business processes where formal records are create and used. A good approach is to have users walk you through their typical day and how they access, use, and create records—but be sure to interview managers too, as managers and users have differing needs and uses for records. 21
You will need some direction to conduct formal observation, likely from IT staff or business analysts familiar with the recordkeeping systems and associated business processes. They will need to show you where business documents and records are created and stored. If there is an existing ERM system or other automated search and retrieval tools available, you may use them to speed the inventorying process.
When observing and inventorying e-records, starting in the server room and working outward toward the end user is a logical approach. Begin by enumerating the e-records created by enterprise software applications (such as accounting, enterprise resource planning, or customer relationship management systems), and work your way to the departmental or business unit applications, on to shared network servers, then fi nally out to individual desktop and laptop PCs and other mobile devices. With to- day’s smartphones, this can be a tricky area, due to the variety of platforms, operating systems, and capabilities. In a bring-your-own-device environment, records should not be stored on personal devices, but if they must be, they should be protected with tech- nologies like encryption or information rights management.
There are always going to be thorny areas when attempting to inventory e-records to determine what fi les series exist in the organization. Mobile devices and removable media may contain business records. These must be identifi ed and isolated, and any records on these media must be recorded for the inventory. Particularly troublesome are thumb or fl ash drives, which are compact yet can store 20 gigabytes of data or more. If your IG measures call for excluding these types of media, the ports they use can be blocked on PCs, tablets, smartphones, and other mobile computing devices. A sound IG program will con- sider the proper use of removable media and the potential impact on your RM program.22 The best approach for conducting the inventory is to combine the available inventorying methods, where possible. Begin by observing, distribute surveys, collect and analyze them, and then target key personnel for follow-up interviews and walk-throughs. Utilize whatever automated tools are available along the way. This approach is the most com- plete. Bear in mind that the focus is not on individual electronic fi les but rather, the fi le series level for physical records and the fi le series or system level for e-records (preferably the latter).
There are three ways to conduct the inventory: surveys, interviews, and observation. Combining these methods yields the best results.