How to Establish Best Practices for Document Management

In today’s digital world, concerns over the information contained in documents are increasing. Issues such as privacy and the security of personal information are putting a spotlight on the document management practices used by both governmental agencies and businesses.

Every organization stores some private information, even if it’s simply private information about its employees. Following best practices is something every organization needs to address. Smaller companies may assign one senior manager to monitor best practices; larger organizations may have senior management in multiple departments reporting to an executive that has overall responsibility for coordinating document management activities.

Where to Find Best Practices for Document Management
ARMA International is the organization that publishes best practices. Originally, the organization was called the Association of Records Managers and Administrators (ARMA). However, the role of records management became an integral part of information governance. The acronym was dropped and the name was changed to ARMA International, often shortened to ARMA, to reflect the expanded role of records management professionals.

ARMA publishes the Generally Accepted Recordkeeping Principles®. The Principles are similar to the Generally Accepted Accounting Principles (GAAP). While ARMA isn’t a regulatory agency, the Principles are considered industry standards. They are often referenced in case law when determining if an organization is using industry-standard records management practices.

The Principles have been written to apply to organizations of any size, and in any industry or country. Therefore, while different organizations will implement the Principles differently, they are generally applicable to all.

How to Establish Best Practices for Document Management
ARMA has identified eight principles that describe best practices for records management. In addition, they have published a Maturity Model that gives examples of an organization’s journey from Level 1 (sub-standard practices) to Level 5 (transformational practices).

A brief description of each appears below. “Early Stages” describes where an organization may start at Level 1 or 2. “Advanced Stages” identify the goals reached at Level 4 or 5:

1. Accountability
This principle requires that a senior executive oversee the information governance program and that there are policies and procedures in place that allow for auditing the program.

Early Stages: An organization has separate silos in records management and information technology, the focus is on paper documents, and information isn’t stored systematically.
Advanced Stages: A senior-level records manager and a chief information governance officer work together to manage the records and information governance program.

2. Integrity
Information governance needs to produce a reasonable guarantee of the authenticity and reliability of the organization’s records.

Early Stages: Organizations usually start with no formal identification (or metadata) for documents to ensure their authenticity. Metadata assigned to a document will vary for each organization, but may include the type of document, author’s name, preparation date, approval date, and other identifiers that will assist in locating specific documents.
Advanced Stages: Organizations introduce a central system for assigning reliable metadata, along with regular audits.

3. Protection
It’s critical to protect information that is private or confidential.

Early Stages: An organization may not have centralized privacy controls.
Advanced Stages: As the organization matures, it establishes protection systems, audits are regularly completed and unplanned disclosure of sensitive information is uncommon.

4. Compliance
Virtually every organization needs to comply with requirements from any number of authorities.

Early Stages: Organizations lack a clear understanding or definition of the information it is obligated to keep.
Advanced Stages: As the organization continues to pursue best practices, it will identify all compliance requirements, train its employees, and establish an audit process and procedures to achieve continuous improvement.

5. Availability
Records and information need to be quickly accessible to maintain efficient operation.

Early Stages: Before establishing an effective program, an organization may waste valuable time looking for a final record, or the signed version of a document, for example.
Advanced Stages: More sophisticated organizations will have systems in place to ensure integrity, a central approach for identifying and categorizing records and an inventory of records that makes retrieval fast and accurate.

6. Retention
Retention rules need to account for legal, regulatory and operational or historical requirements.

Early Stages: Organizations often complicate storage by keeping records far past when they would be needed, or by being unable to produce documents when required.
Advanced Stages: As an organization matures, it will have a centralized process for classifying records and an employee-training program in place.

7. Disposition
All records and information need to be disposed of based on protection and organizational requirements. It’s also necessary to have procedures in place to stop disposition in situations where it may be legally required to produce certain types of documentation.

Early Stages: An organization may not have procedures that define the proper disposal for specific types of records or information, and there may be no way to systematically stop disposal when it’s required.
Advanced Stages: Procedures are in place, for both disposal and halting disposal, and are used consistently throughout the organization. Technology is used and integrated into all applications and data warehouses.

8. Transparency
The processes and procedures used in an organization’s information governance program need to be well documented and available to all personnel and outside parties where necessary.

Early Stages: In the early stages, an organization isn’t able to respond easily to requests for information such as discovery for litigation or requests for compliance audits. Information management processes aren’t well defined or documented.
Advanced Stages: The organization has software tools that provide transparency, they regularly update information management documentation and requests for information are managed easily using routine procedures.

The overriding requirement for effective document management is for senior officers to recognize the importance of the issue. Once that happens, they’re in a position to create an organizational structure that supports managing information whether it’s in paper form, stored on a desktop computer or uploaded to a central server.

Document management involves personnel throughout the organization. For example, stakeholders include information technology, legal, security, risk, compliance, internal audit and the business units that create records that need to be managed.

Conclusion
Best practices for document management require creating the senior-level positions that facilitate effective document management. Once management oversight is in place, it’s possible to create the necessary policies and procedures, train employees across the organization and manage records as a part of the organization’s standard operating procedures.