Copyright © Jordan Lawrence 2012 | All Rights Reserved
Industry Insights
Broker Dealers: Steps to Defensible Records Management
Establishing and enforcing a best practices records management program will help companies eliminate the most common privacy problems, cut e-discovery risks and dramatically reduce records volumes and costs.Jordan Lawrence | www.jordanlawrence.com 1
Introduction
Establishing and enforcing a records management program reduces both costs and risks. Your company can cut records storage volumes by 50% or more on all media (offsite storage, email and others). Production obligations and costs can be reduced significantly. Obligations to reconstruct, review and produce obsolete electronic information can be slashed.
Legal adversaries are now leveraging poor records practices to extract settlements. Remember, if records are available, they are subject to discovery even if they could have been previously disposed of under a defensible program.
Records-related regulations aren’t just limited to “retention periods” anymore. Many are tied to identification and protection of sensitive information, media usage requirements, onsite versus offsite storage and other issues.
The following provides a framework for successful records management and how to get there quickly and cost-effectively. There are few things that will have a greater impact on operating costs and on protecting the legal and financial interests of your company.
Key Components
1. Build a Records Inventory. A records inventory provides baseline information and is the foundation of the legally defensible program. The inventory has to be derived from direct input from the business areas that create, manage and control your records and applications. A well-developed inventory includes dozens of insights about:
All record types used across the entire organization
Media used for every record type (including email and corporate applications) Internal and external parties that control all record types
Source of origin for all record types
Movement, both internal and external, for all records
Storage for all record types including personal email accounts and mobile devices Current business needs for reference
Jordan Lawrence | www.jordanlawrence.com 2 2. Include Regulatory Tagging in the Records Inventory. The development of the records inventory
provides the opportunity to collect detailed information about which regulations and other requirements apply to each record type. There are two primary types of regulatory tags that are needed today:
Privacy. These requirements spell out the legal obligations tied to the identification, protection and secure disposal obligations for all record types.
Retention. These requirements determine the total time records must be retained past a specific trigger point (when the clock starts). Appropriately setting and strictly enforcing retention rules will have the greatest positive impact on every records-related cost and risk. Retention requirements are rapidly changing due to information privacy concerns and the way many privacy laws are written. Most companies are now moving away from the archaic retention practices traditionally implemented in the United States (retention requirements were considered “minimum” periods) to the more appropriate international position citing retention requirements as “maximum” periods.
3. Business Records and Non–Essential Information. Not all information is a record. A “record” is information that memorializes a business transaction or otherwise maintains a history of a company’s activities.
A record probably needs to be retained to meet a governmental, legal, or business obligation. However, once retention obligations are met, records cease to be company assets and can become maintenance and legal liabilities. Their appropriate and timely disposal is a business necessity. Non-Essential information has limited usefulness and can be a greater liability than actual business records. It is imperative to identify both types of information and set appropriate and enforced retention standards.
4. Set Retention Standards with Best Practices. Most broker dealers, regardless of size, have fewer than 250 unique record types that fall under 30 retention considerations. There is no need and no value in research that promises to pour through thousands of citations. This kind of costly research will yield non-implementable binders of non-applicable requirements. In fact, most record types don’t fall under any retention requirements at all and only need to be retained as long as the valid business need for reference.
Jordan Lawrence | www.jordanlawrence.com 3 Remember that the CRITICAL issues in defensible retention are simple to understand:
Clearly know what record types and applications your company uses Set retention periods based on good-faith retention rules
Require all records to be retained, with appropriate security, for as long as your published schedule mandates
Dispose of all eligible records as soon as the retention period has been satisfied (and litigation hold obligations have been met)
5. Establish Clear Policies and Expectations. Best practice standards for program documentation already exist for broker dealers. In fact, there are fewer than ten routine communications that comprise a complete, legally defensible and cost/risk-controlling records management program. Most companies publish a separate email policy and a separate corporate records policy.
Additionally, the retention schedule is published and supported by the Scheduling Logic (reporting that details the regulatory and industry standard retention periods cited on the retention schedule). Program compliance and defensibility is supported and maximized by four to six policy enforcement reminders and directives.
If done correctly, and for maximum compliance and defensibility, all communications are calendared for automatic distribution (proves consistency) to preset distribution lists (proves non-selectivity) and leverage automation that demands compliance verification from each recipient (the audit trail). 6. Involve Key Players. Records management has far-reaching benefits within a company and there
are several significant stakeholders who will want to be aware of the benefits they can take advantage of once the program is launched properly:
Legal. They benefit from the ability to produce a valid Discovery Datamap (a valuable by-product of the records inventory), defensible retention schedule, provable policy compliance and volume correction that lessens discovery obligations.
Technology. They benefit from the ability to begin the appropriate disposal of email and other electronic records (generally over 45% immediately). The records inventory is the foundation for an electronic record file plan that can be easily integrated into an ECM platform like SharePoint for consistent application of retention for electronic content.
Facilities. An implemented program will cut offsite volumes by 50% or more. This immediately relieves space requirements, vendor costs and unnecessary privacy risks.
Finance. The routine (and appropriate) enforcement of the records policy will cut storage costs, reduce new server expenditures and the shocking costs of unexpected litigation, e-discovery, settlements and privacy breaches.
Jordan Lawrence | www.jordanlawrence.com 4 The impact potential of establishing and enforcing the records program has clear and measurable benefits. The action items are easy to understand, provide predictable results and cuts costs and risks within days of implementation.
7. Get Rid of Unnecessary Records (Appropriately). When the records program is initially
launched, it will become apparent that over-retention is a massive issue. You must consistently and non–selectively dispose of obsolete information. There are best practice steps to complete this volume correction (called the Initial Cleanup Effort) that are proven, reliable and safe. 8. Train Employees. Being proactive is the best approach to effective records management. Most
companies now use web-based training for all new employees and implement periodic reviews. Without training, your program will fail, because there is a tendency for people to inappropriately name, store and retain records (habit–based retention).
9. Audit to Ensure Compliance. As with any other legally mandated requirement, a records program requires a proactive shift of responsibility to the people who control compliance with the policy. A company must clearly communicate its policy to employees, properly train employees,
systematically enforce its policy and regularly audit the policy. Auditing compliance is the best way to catch any poor practices, legacy thinking or outright rogue behavior that could eventually (and unnecessarily) cost the company millions of dollars.
10. Simplify Program Maintenance. Through practical automation and leverage of shared resources, the costs to maintain every aspect of the records program should be minimal – certainly a fraction of the cost of full-time staffing and an even smaller fraction of the direct, measureable savings that the program enables.
Records management is a legal obligation that is not difficult or expensive to fix.
The standards for every component have been established for broker dealers, just like the standards that exist for other areas of corporate governance and control. Our standards have all been created, tested, proven reliable, safe and of high impact. Complexity is the enemy of a company’s checkbook and specifically the enemy of the effectiveness and defensibility of the records program.
About Jordan Lawrence
Jordan Lawrence has worked with industry leaders like Raymond James, Scottrade and many others. We are the company that broker dealers come to for the technology, benchmarking and best practices needed to develop, implement and enforce records programs that work.
Jordan Lawrence | www.jordanlawrence.com 5
14567 North Outer Forty Drive, Suite 300 Chesterfield, MO 63017
636.821.2222
