The Business Case for Records Management
How to get a real return on your investment
Bill Neale
Pop Quiz
In the history of business …
this has never happened before …
it was caused because a company failed to
consistently adhere to it’s records
destruction policy.
A company went out of business.
Blunders are Expensive … and Embarrassing
•
•
•
•
5 firms fined $8.25 million for failing to preserve email communications.
Banc of America fined $10 million for document production failures.
Schering Plough fined $500 million for noncompliance in 2002.
… alleges in its $280 billion racketeering suit that tobacco companies
destroyed documents …
• Too many to list.
“How much do we need to
pay you to screw
Netscape?”
Bill Gates
Microsoft
Presentation Overview
• Brief overview to industry trends.
• The impact of doing nothing.
• How to reduce the future cost of compliance and records and
information management (RM).
• How business process management (BPM) within a records
program builds true business value and guarantees cost
effective enterprise-wide record policy enforcement.
•
How an effective electronic records management generates a
strong return on investment (ROI).
•
•
Why you should care about ROI.
Where to look and how to calculate electronic records ROI.
From The Basement to The Boardroom
• Records management has forever changed. Now a “C” level
business issue … it’s Y2K without the 2K.
•
New compliance regulations are more about the business
process around records then the records themselves.
•
•
Explosion of content and mandated storage requirements.
•
Desire for cost reduction … emergence of Six Sigma and ISO
standards.
•
New business cases are enabled.
Landmark litigation has created a legal feeding frenzy
combined with rising electronic discovery costs.
What’s Happening Right Now?
•
•
•
•
Fortune 1000 spent more than $2.5 Billion in 2004 on SOX compliance alone.
Average company spent 4.5 Million on SOX Section 404 alone.
More than 90% are engaged in projects now and business process is the key.
Companies cannot continue to spend with auditors … process automation is
key.
Case Study: $3 Billion Retailer
6 Divisions, 2000 Stores
SOX 1st Year Spend = $5.6 Million
Ongoing Projected = $ 2.1 Million
Sources: Financial Executives International, META Group and Ovum and Protiviti
Stages of Compliance
Corporate Governance
(SOX, Turnbull, Tabaksblat)
Achieve Compliance
Industry Regulatory
(Basel II, CFR 21Part 11)
Geopolitical Driven
(SEC, Patriot Act, FOIA)
Privacy Driven
(PIPEDA, HIPAA)
Operational Risk
Management
Prove Compliance
• Establish controls,
reports, documentation
and processes.
• Develop ability to enforce
policies and defend
compliance program.
• Realization that
compliance is expensive
and not going away.
• Realization that records
management, evidence
and proof are critical.
Maintain Compliance
• Ongoing monitoring,
tracking and reporting.
• Realization that
compliance requires
automation.
Optimize Performance
• Focus on business
improvement and cost
reduction.
• Opportunity for modeling,
analysis, simulation and
optimization.
Good Policy Isn’t Enough
87% have formal records
management programs
but 35% do not include
electronic records.
29% do not regularly
follow own RM policy.
• Policies aren’t clear, well communicated or
supported by training.
• Records don't get declared by business
users and/or are incorrectly classified.
99% do not have formal
process for holds.
93% believe outcome of
future litigation based on
electronic records policy.
49% doubt they could
defend own records
70% doubt own IT
department understands
RM policy
• Records aren’t getting destroyed at all.
• Records are lost or destroyed too soon.
• Records are kept too long.
• RM and compliance policies not enforced.
Source: Cohasset Associates, AIIM and ARMA 2005 Survey, A Renewed Call to Action
Lack of Policy Enforcement Leads to Court
Enron
Arthur Andersen
WorldCom
Microsoft Antitrust
Bureau of Indian Affairs
Wal-Mart Stores
Dell Computer
Prudential Insurance
General Nutrition
Trigon
UBS Warburg
AH Robins
Freddie Mac
Proctor and Gamble
The White House
Tyco
• Common among all landmark lawsuits.
• Guilty until proven innocent …
• Opposing council attacks the process and makes
spoliation claims.
• Repercussions are staggering whether
appearance of or actual malfeasance is present.
•
•
•
•
•
Government officials are being held in contempt.
Stock prices go down and trust is destroyed.
Huge penalties and fines are levied.
Companies have dissolved, careers have been
destroyed and people are going to jail.
Exploding electronic discovery costs.
Rely on Business Users?
Large organizations lose
a document every 12
seconds
67% of data loss is
directly related to user
blunders
Business workers
typically misfile 2-7% of
all records
•
•
•
•
•
•
Business workers make mistakes.
Process information not captured.
Process not auditable.
RM policy inconsistently applied and not enforced.
Little visibility into program effectiveness.
Significant loss of worker productivity.
Law of Small Numbers
• Average of 10-15 seconds to declare a record.
10 seconds X 72 records per day.
= 720 seconds per day or 12 minutes per day.
= 60 minutes per week or 1 hour per week.
1 hour per week is 2.5% of worker productivity
User Controlled Records are the Problem
• Many previous attempts
•
Most have failed.
• Recent NARA Study
•
•
•
•
6+ month study
Significant user dropoff
after training period
56% found technology
“Extremely Burdensome”
or “Burdensome” to use
6% declared zero records
Source: National Archives and Records Administration
1
2
3
4
5
6
7
What Are My Options?
•
•
•
•
Manage the users or manage the process?
Spending choices.
• Do nothing?
• Add staff?
• Deploy technology?
Future cost of compliance and RM.
• Increasingly complex requirements.
• Process itself needs to be managed and audited.
• Volume and types of records will increase.
• Storage requirements will increase.
The carrot and the stick.
• Risk reduction – the negative stuff
• New business value (ROI) and improvement – the positive stuff
Simple Rules for Risk Reduction and ROI
•
Sounds complicated but not really …
•
•
•
•
Don’t rely on business users. Don’t rely on systems that rely
on your users. Rely on your process instead.
Capture the process info (and data).
• It’s required now anyway.
• Retain what you need to, for only as long as you need to, as determined
by law, regulatory statute and/or sound business policy.
Only destroy (delete) records at the right time, for the right
reason as managed by the right process.
Enforce RM policy consistently and uniformly.
The Stick
Know Your Risk or Total Cost of Failure
•
Consider the following areas of exposure:
•
•
•
•
Likelihood
• Likelihood of experiencing a given information management failure?
Frequency
• How often would your organization experience such a failure?
Magnitude
• What would the magnitude of the failure be?
Potential Costs
• What would the impact be on legal costs, fines, company and
professional reputation, investor confidence, stock price, cost of
reconstruction, etc.
Sources: Information Nation by Randolph Kahn, Esq, and Barclay Blair and Records and
Information Management by William Saffady
Basel II
Risk
HIPAA
Patriot Act
SOX
Essential to Compliance | Records and Process
Policies, Controls and Process
Business Applications
Records Management
“Business Process Management
is key to Enforcing
Records Management Policies”
Evidence and Proof
Compliance Process | Spans the Entire Organization
•
Retail
Banking
Wholesale
Banking
Securities
Mortgage
Banking
Insurance
Entire
Enterprise
Statements
Letters of
Credit
Regulatory
Reporting
Underwriting
Portfolio
Mgmt
Policy
Mgmt
Compliance
Asset
Mgmt
Funds
Transfer
Clearing/
Settlement
Loan
Origination
Stock
Transfer
Claims
Processing
Payables
Consumer
Lending
Lockbox
Investment
Mgmt
Collections/
Disputes
Trade
Order
Tracking
Underwriting
Call
Center
Payments
Systems
Cash
Mgmt
Electronic
Payments
Consumer
Lending
Regulatory
Reporting
Collections
Human
Resource
Trust
Records are everywhere.
•
•
Obtain ROI with your compliance and RM initiatives.
Enforce your RM policy in these processes.
The Carrot - It’s About YOUR Process
• The media centric active - inactive records model has changed.
Time
User Process:
RM Process:
•
•
•
•
•
•
•
•
•
•
Create
Edit
Use
Publish - Transact
Search - Request
Retain - Store
Migrate
Defend - Produce
Audit
Expunge - Archive
About 95% are supposed to be destroyed
• Compliance is content centric and the line between documents and
records is very fuzzy … it’s the actual process that matters most.
• Manage the process not just the users.
Where ROI and Value Can Be Found
•
Within the Business Process
• Lots of people make records …
• Fewer people administer records.
•
At the Point of Records Capture
•
•
During the Rest of the Records Lifecycle
•
•
•
It takes time to manually declare and classify records.
Records departments aren’t growing … automation is
crucial.
Litigation and storage is costly … and often unnecessary.
The Ongoing Cost of Compliance
Electronic Records Management
and Business Process Management
Electronic
Records
Management
System
File Plan
•
•
•
•
Ensures accurate classification and productivity.
Zero burden placed on business users.
Policies consistently enforced and audited.
Enables proof of compliance.
Stop Manually Declaring Records
ROI is found in Business Process Management
• Savings per user is 10.2 cents per record declared and classified.
• Assumes 15 seconds per record, $50K annual burdened salary and 235
days per year.
• Annual savings or cost avoidance:
Number of Records Declared and Classified per Day per User
Number of Users
1
50
100
200
250
1
$24
$1,214
$2,428
$4,827
$6,071
50
$1,214
$60,712
$121,424
$242,849
$303,561
100
$2,428
$121.424
$242.849
$484,698
$607,122
250
$6,071
$303,561
$1,517,805
500
$12,142
$607,122
* $1,214,244
$1,214,244
$2,428,489
$3,036,611
1,000
$24,285
$1,214,244
$2,428,489
$4,856,978
$6,071,222
* Law of Small Numbers Example
$607,122
Electronic Records Management
with Document Lifecycle Events
Electronic
Records
Management
System
Business Users Create Records
Not All Records Come From Business Process
•
•
•
•
Ensures accurate classification and productivity.
No extra steps for business users.
Policies consistently enforced and audited.
Enables proof of compliance.
File Plan
Electronic Records Management
with Email Records
Electronic
Records
Management
System
Business Users Use Email
Partially for Transport, Partially for Content
Email Server
•
•
•
•
Ensures accurate classification and productivity.
No extra steps for business users.
Policies consistently enforced and audited.
Enables proof of compliance.
File Plan
Stop Declaring Records
ROI is found with Document Lifecycle Events
• Savings per user is 15.3 cents per record declared and classified.
• Assumes 10 seconds per record, $75K annual burdened salary and 235
days per year.
• Annual savings or cost avoidance:
Number of Records Declared and Classified per Day per User
Number of Users
1
5
10
15
20
1
$36
$182
$364
$546
$729
50
$1,821
$9,107
$18,214
$27,320
$36,427
100
$3,643
$18,214
$36,427
$54,641
$72,855
250
$9,107
$45,534
$91,068
$136,602
$182,137
500
$18,214
$91,068
$182,137
$273,205
$364,273
1000
$36,427
$182,137
$364,273
$546,410
$728,547
Enterprise Information Explosion
How will Records Managers Keep Pace?
1,800
Stored information
increases by 30% each
year
Over 90% of all records
are born electronic
Over 85% of information
used is in unstructured
documents
Over 600 billion emails
are sent each year
As much as 65% of all
information is subject to
records retention
95% of all records are
subject to destruction
1,600
1,400
Storage
Demand
Petabytes
1,200
1,000
800
600
400
200
0
2001
2002
Fixed “Unstructured” Data
Dynamic “Structured” Data
2003
2004
2005
2006
Automating Records Administration
Records Departments are Shrinking, Not Growing
Transfer / Disposition
50% have less then 5
RM Full Time Employees
(FTEs)
86% have less then 12
RM FTEs
81% view current levels
of staffing as inadequate
- ARMA Study
Destruction / Disposition
• Ensures timely disposition.
• Policies consistently
enforced and audited.
•
Enables proof of
compliance.
Review / Disposition
Automation of Records Administration
No Longer Optional
•
Process based automation will increase RM staff
productivity by 20-50% by automating low value
repetitive tasks.
•
•
Assumes $60K annual burdened salary.
Annual savings or cost avoidance:
20%
Number of
Staff
30%
$ Savings
FTEs
Saved
5
$1,821
10
15
40%
$ Savings
FTEs
Saved
1
$90,000
$120,000
2
$180,000
3
50%
$ Savings
FTEs
Saved
$ Savings
FTEs
Saved
1.5
$120,000
2
$150,000
2.5
$180,000
3
$240,000
4
$300,000
5
$270,000
4.5
$360,000
6
$450,000
7.5
Reducing Electronic Discovery Costs
DuPont Presentation 2002 MER Example
1990 – 1994 Study at DuPont
Key findings for legal discovery for 9 legal cases:
Total # of pages reviewed
=
75,450,000
Total # of pages responsive
=
11,040,000
% of pages past retention period =
•
50%
For 9 cases studied, from 20 to 92% of records
reviewed were past the retention period.
Reducing Electronic Discovery Costs
DuPont Presentation 2002 MER Example
Pages reviewed past retention *
=
37,725,000
Cost to review at 20 cents per page
=
$7,545,000
Total # of pages responsive
=
11,040,000
Total # of pages past retention
=
5,520,000
Cost to review at 80 cents per page
=
$4,416,000
Unnecessary Cost
=
$11,961,000 *
* Only 9 cases studied. Does not include the cost to the corporation of information discovered that
should not have been (copy, scan, redact, review, number, etc.)
Reducing Electronic Discovery Costs
Potential Costs and Savings
Pages Searched
1,000,000
5,000,000
10,000,000
20,000,000
50,000,000
75,000,000
100,000,000
Cost/page = .20
$200,000
$1,000,000
$2,000,000
$4,000,000
$10,000,000
$15,000,000
$20,000,000
150,000
750,000
1,500,000
3,000,000
7,500,000
11,250,000
15,000,000
Cost/page = .80
$120,000
$600,000
$1,200,000
$2,400,000
$6,000,000
$9,000,000
$12,000,000
Total Cost
$320,000
$1,600,000
$3,200,000
$6,400,000
$16,000,000
$24,000,000
$32,000,000
$32,000
$160,000
$320,000
$640,000
$1,600,000
$2,400,000
$3,200,000
$64,000
$320,000
$640,000
$1,280,000
$3,200,000
$4,800,000
$6,400,000
$96,000
$480,000
$960,000
$1,920,000
$4,800,000
$7,200,000
$9,600,000
$128,000
$640,000
$1,280,000
$2,560,000
$6,400,000
$9,600,000
$12,800,000
$160,000
$800,000
$1,600,000
$3,200,000
$8,000,000
$12,000,000
$16,000,000
Responsive Pages
Savings:
10% over retention
Savings:
20% over retention
Savings:
30% over retention
Savings:
40% over retention
Savings:
50% over retention
Reduced Storage Needs
Immediate and Over Time
• Increased content growth = increased storage needs.
• Almost all records need to be destroyed (95%) and process
management enforces destruction.
• Process inflow management captures data.
• ROI can be found by calculating retention periods, content inflow
and storage requirements.
Reduced Storage Costs Metrics
• Instant Benefit Metrics
•
Bulk conversion of existing electronic files enables immediate
identification of records past retention date. These can records
can immediately be destroyed.
• Long-Term Benefit Metrics
•
•
•
•
•
Current input volumes.
Projected % of reduced input due to better classification.
Projected % of documents misclassified for retention period
(usually longer than needed).
Projected % of documents that can be destroyed on time.
Impact of this reduction on system components should be to
lower overall storage requirements and cost.
Electronic Delivery of Records
•
•
•
•
•
•
Migration of records is costly.
Cost and legal exposure of lost records is high.
Handling costs are high.
Shipments are costly.
Physical storage facilities are costly.
Multiple requests for same records are impossible and
take time.
Process Management Enables New RM Capabilities
• Enforce RM policy to individual process and tasks.
• Complete audited record of all users and tasks.
• “Real-time” view and status of everything.
Versioning Enables New Controls and Cost Reductions
How much are you paying your
auditor to tell you whether you
are in compliance or not?
Can you afford to continue it?
•
•
•
•
Design compliance processes and identify procedures and controls.
Accurately reproduce historical processes.
Model and test new processes prior to deployment.
Provide controlled change management through validation.
Is Electronic Records Software Too Expensive?
• Most professionals recognize the need and don’t see electronic records
as being too expensive.
Yes
11%
Yes
15%
No
85%
No
89%
IT
Yes
41%
Business
• IT is in the driver’s seat for making key decisions..
Source: ARMA Electronic Records Initiative with Forrester Research
No
59%
RM
ROI Heads the List in ARMA Study
1. Cost / benefits models (ROI).
2. Risk and cost of legal discovery and audits.
3. Role of electronic records in compliance.
4. The relationship between collaboration, document
management and electronic records.
5.
The relationship between message archiving and electronic
records.
6. The role of electronic records in WCM implementations.
7. Collaboration between RM, IT, legal and business
professionals.
Source: ARMA Electronic Records Initiative with Forrester Research
Why You Should Care How IT Dollars Get Spent
•
IT controls the budget but wants results.
•
•
59% want payback within 18 months of which 1/3 want
payback within 12 months.
Business case is required to get funding.
• Company size has only small effect.
• 90% if over 500k
• 70% if over 100k
• 44% if under 50k
Source: The ROI Dilemma, 2004 Best Practices Study by Kotler Marketing Group and Software & Information Industry Association
Which Type of ROI is Important?
•
67% use ROI as basis to evaluate IT investments and
many also look at payback period (35%).
•
•
NPV (20%) and IRR (18%) not as widely used.
Know what financial metrics are going to be used to
evaluate your electronic records project.
Source: The ROI Dilemma, 2004 Best Practices Study by Kotler Marketing Group and
Software & Information Industry Association
Anatomy of a Business Case
or Cost / Benefits Analysis
• Situation analysis.
• Scope, stakeholders and purpose.
•
Methodology and research details.
• Include other options with pros/cons.
• Justification (both carrot and stick).
• Compliance risk reduction (TCF).
• Intangible business improvement benefits.
• Tangible business improvement benefits (ROI).
• Implementation.
• Start small but think bigger.
•
Recommendations.
• Don’t forget to measure the results.
What You Can Do About it
• Help educate about the value of the records in the business
process not just the records themselves.
• Retain what you need to, for only as long as you need to.
• Enforce RM policy consistently and uniformly through process,
not people … wherever possible.
•
Know the business case for electronic records … it’s both
carrot and stick.
•
•
•
Risk reduction = TCF (total cost of failure).
Business improvement = ROI (multiple areas).
Measure and document your results.
•
Will lead to increased funding and results.
Good Web ROI Stuff
www.valuebasedmanagement.net
Explanation of all financial ratios and cost/benefit best practices.
www.cio.gov/documents/TheValueof_IT_Investments.pdf
Guidance from Federal CIO Council on value measurement methodology (VMM) for
Section 300.
www.whitehouse.gov/omb/circulars/a11/current_year/s300.pdf
OMB Circular A-11, Section 300.
http://www.archives.gov/records_management/
policy_and_guidance/cpic_guidance.html
Guidance for coordinating the evaluation of Capital Planning and Investment Control
(CPIC) proposals for electronic records applications.
http://www.dir.state.tx.us/eod/qa/intro.htm
Useful templates and checklists for business case and cost/benefit analysis.
Thank You