Records and Information Management in the Banking Industry

Records and Information Management in the Banking Industry Ensuring your Records and Data are ready for the post-bailout world Part 1 John C. Montaña, J. D. The Pelli. Group

What is a record retention schedule? It’s a list of records or record types, followed by dome indication of how long they should be kept l There may be additional information, such as media types, locations, etc l

How does it work? Why do we need one? A retention schedule is a policy document. Personnel are supposed to use it as guidance when destroying records l In electronic records systems, a retention schedule may be used as a template l A retention schedule provides guidance to ensure the orderly disposition of records and data l

Records retention is a heavily regulated area: l l l l l Banking Commissioner OSHA EEOC SEC Do. L IRS FDIC EPA Etc. , etc. State analogues of the above

Other Standards and Authority Industry Associations l ANSI (American National Standards Institute) l AIIM (Association for Information and Imaging Management) l ARMA (Association of Records Managers and Administrators) l

Jurisdictional and Preemption Issues: Potential concurrent state and federal jurisdiction l Potential concurrent jurisdiction by different agencies l Different regulatory regimes for different business processes l Cross-border issues of regulation l

Issues with statutory and regulatory language l l l Vague or outdated statutory language Poor match between records contemplated by law and those actually found No or few implementing regulations when the statute calls for them Unreasonable retention requirements Verbatim state adoption of federal requirements – What if federal requirements change? l Conflicting or inconsistent requirements

Some Basic Rules

Records retention must be “in the normal course of business” l Destruction must be done in good faith l Mens rea is important –the goal cannot be to deprive other known parties of information

Retention activities must conform to controlling law e. g. , destruction prior to expiration of statutory retention period is presumptively bad faith destruction

Retention Periods When There is No Law l Factors: – Business judgment – Risk management – Cost – Administrative efficiency – Statutes of limitation inform. , but do not control the discussion

Legal Holds l l l Disposition activities must halt upon notice of actual or impending litigation Records responsive to litigation must be preserved That does NOT mean that all disposition activities must cease until the litigation is concluded The hold must be effectively communicated to stakeholders, and attorneys must exercise due diligence in follow-up The hold should be released at the conclusion of the matter

Some Basic Tools

Policies and Procedures l Employees and technology implement rules l No rules means no consistency l No consistency means problems l Problems mean costs

Indexing and Data Structures In order to manage a record, you must be able to accurately identify it l Indexing, data structures and metadata are the key to identifying records l Many repositories are poorly indexed, or not indexed at all; metadata is poorly chosen or left to default l Keyword searching or auto-classification is only partially effective l

Records Management Success l Written Policy l Low-level Nuts & Bolts – Indices – Data Structures – Metadata – Training l Know the Failure Points

Common Failure Points l Poor understanding of what the organization actually needs l No implementation strategy l No enforcement mechanism l Inadequate resources l Poor employee training l Blind reliance on technology solutions l Poor technology implementations

Problems with Technology Solutions l Buy first, vet later l Poor policy and procedural structure l Poor implementation – Lack of structured indexing – Lack of consistent file names – Poor metadata selection

When Considering a Technology Solution l Buy software LAST! l Before that: – Develop policies and procedures – Develop indices, data structures and metadata standards – Develop a FULL functional spec – Make sure the software can implement the above

The Number 1 Reason for Failed Technology Solutions is Poor Configuration No hard-coded indices or data structures l Poor or no metadata capture l Badly configured user interface l Poorly thought-out workflow expectations (e. g. , too many buttons to click) l Usually Because Software Purchase was Step 1

The Problem with People l People manage electronic data very poorly – Poor file names – Poor data structures – Aversion to management – Aversion to purging – Disgruntled employees

Culture l Organizational culture may foster bad records and information management – My records are “mine” – I/my department makes its own rules – We don’t tell our people what to do – We don’t carry a big stick

How to Change Things What’s in it for me? – Personnel need to see a tangible benefit l Breaking bad habits – Takes time, takes nagging l Good new habits are quickly lost if not reinforced l Get a big stick – No penalties means no reason to change l

Compliance l Make compliance easy l If compliance is annoying or interferes with work, people will actively defeat the plan l Plan on: – Intensive initial training to break old habits – Ongoing lower-level reinforcement

Where’s Your Data? l Outside the U. S. ? l In the hands of third party service providers? – Financial or HR service providers – Commercial storage facilities or data vaults – Outside counsel – The Google cloud l It’s all discoverable!

Records Management Responsibility is Non-Delegable l You are responsible for failings of service providers – Retention – Availability – Privacy and confidentiality – Discovery

They Should be Able to: l Apply your retention periods l Enforce your privacy and confidentiality obligations l Safeguard your records and data l Give you back your records and data, and its metadata, back to you at the end of the relationship

You should: – Include appropriate language in contracts – Inspect policies and procedures – Inspect facilities – Audit compliance – For electronic systems (e. g. , external vaulting or backup), have your IT folks vet the provider’s technology

Questions ?