The Business Case for Records ManagementHow to get a real return on your investment

Bill Neale

Pop QuizPop Quiz

In the history of business …

this has never happened before …

it was caused because a company failed to consistently adhere to it’s records

destruction policy.

A company went out of business.

Blunders are Expensive … and EmbarrassingBlunders are Expensive … and Embarrassing

• 5 firms fined $8.25 million for failing to preserve email communications.

• Banc of America fined $10 million for document production failures.

• Schering Plough fined $500 million for noncompliance in 2002.

• … alleges in its $280 billion racketeering suit that tobacco companies destroyed documents …

• Too many to list. “How much do we need to pay you to screw

Netscape?”

Bill GatesMicrosoft

Morgan Stanley to Pay …

$1.45 Billion

Presentation OverviewPresentation Overview

• Brief overview to industry trends.

• The impact of doing nothing.

• How to reduce the future cost of compliance and records and information management (RM).

• How business process management (BPM) within a records program builds true business value and guarantees cost effective enterprise-wide record policy enforcement.

• How an effective electronic records management generates a strong return on investment (ROI).

• Why you should care about ROI.

• Where to look and how to calculate electronic records ROI.

From The Basement to The BoardroomFrom The Basement to The Boardroom

• Records management has forever changed. Now a “C” level business issue … it’s Y2K without the 2K.

• New compliance regulations are more about the business process around records then the records themselves.

• Explosion of content and mandated storage requirements.

• Landmark litigation has created a legal feeding frenzy combined with rising electronic discovery costs.

• Desire for cost reduction … emergence of Six Sigma and ISO standards.

• New business cases are enabled.

What’s Happening Right Now?What’s Happening Right Now?

• Fortune 1000 spent more than $2.5 Billion in 2004 on SOX compliance alone.

• Average company spent 4.5 Million on SOX Section 404 alone.

• More than 90% are engaged in projects now and business process is the key.

• Companies cannot continue to spend with auditors … process automation is key.

Sources: Financial Executives International, META Group and Ovum and Protiviti

Case Study: $3 Billion Retailer

6 Divisions, 2000 Stores

SOX 1st Year Spend = $5.6 Million

Ongoing Projected = $ 2.1 Million

Stages of ComplianceStages of Compliance

Corporate Governance(SOX, Turnbull, Tabaksblat)

Industry Regulatory(Basel II, CFR 21Part 11)

Geopolitical Driven(SEC, Patriot Act, FOIA)

Privacy Driven(PIPEDA, HIPAA)

Operational Risk Management

Achieve Compliance

• Establish controls, reports, documentation and processes.

• Realization that compliance is expensive and not going away.

Maintain Compliance

• Ongoing monitoring, tracking and reporting.

• Realization that compliance requires automation.

Prove Compliance

• Develop ability to enforce policies and defend compliance program.

• Realization that records management, evidence and proof are critical.

Optimize Performance

• Focus on business improvement and cost reduction.

• Opportunity for modeling, analysis, simulation and optimization.

Good Policy Isn’t EnoughGood Policy Isn’t Enough

• Policies aren’t clear, well communicated or supported by training.

• Records don't get declared by business users and/or are incorrectly classified.

• Records aren’t getting destroyed at all.

• Records are lost or destroyed too soon.

• Records are kept too long.

• RM and compliance policies not enforced.

87% have formal records management programs but 35% do not include electronic records.

29% do not regularly follow own RM policy.

99% do not have formal process for holds.

93% believe outcome of future litigation based on electronic records policy.

49% doubt they could defend own records

70% doubt own IT department understands RM policy

Source: Cohasset Associates, AIIM and ARMA 2005 Survey, A Renewed Call to Action

Lack of Policy Enforcement Leads to CourtLack of Policy Enforcement Leads to Court

EnronArthur AndersenWorldComMicrosoft AntitrustBureau of Indian AffairsWal-Mart Stores Dell ComputerPrudential Insurance General Nutrition TrigonUBS WarburgAH RobinsFreddie MacProctor and GambleThe White HouseTyco

• Common among all landmark lawsuits.

• Guilty until proven innocent …• Opposing council attacks the process and makes

spoliation claims.

• Repercussions are staggering whether appearance of or actual malfeasance is present.• Government officials are being held in contempt.• Stock prices go down and trust is destroyed.• Huge penalties and fines are levied.• Companies have dissolved, careers have been

destroyed and people are going to jail.• Exploding electronic discovery costs.

Unable to Produce

Corporate Email Records

Rely on Business Users?Rely on Business Users?

• Business workers make mistakes.

• Process information not captured.

• Process not auditable.

• RM policy inconsistently applied and not enforced.

• Little visibility into program effectiveness.

• Significant loss of worker productivity.

Large organizations lose a document every 12 seconds

67% of data loss is directly related to user blunders

Business workers typically misfile 2-7% of all records

Law of Small Numbers• Average of 10-15 seconds to declare a record.

10 seconds X 72 records per day.= 720 seconds per day or 12 minutes per day.= 60 minutes per week or 1 hour per week.1 hour per week is 2.5% of worker productivity

User Controlled Records are the ProblemUser Controlled Records are the Problem

• Many previous attempts• Most have failed.

• Recent NARA Study• 6+ month study• Significant user dropoff

after training period• 56% found technology

“Extremely Burdensome” or “Burdensome” to use

• 6% declared zero records 1 2 3 4 5 6 7

Source: National Archives and Records Administration

What Are My Options?What Are My Options?

• Manage the users or manage the process?

• Spending choices.• Do nothing?• Add staff?• Deploy technology?

• Future cost of compliance and RM.• Increasingly complex requirements.• Process itself needs to be managed and audited.• Volume and types of records will increase.• Storage requirements will increase.

• The carrot and the stick.• Risk reduction – the negative stuff• New business value (ROI) and improvement – the positive stuff

Simple Rules for Risk Reduction and ROISimple Rules for Risk Reduction and ROI

• Sounds complicated but not really …• Don’t rely on business users. Don’t rely on systems that rely

on your users. Rely on your process instead.• Capture the process info (and data).

• It’s required now anyway.• Retain what you need to, for only as long as you need to, as determined

by law, regulatory statute and/or sound business policy.• Only destroy (delete) records at the right time, for the right

reason as managed by the right process.• Enforce RM policy consistently and uniformly.

The StickKnow Your Risk or Total Cost of FailureThe StickKnow Your Risk or Total Cost of Failure

• Consider the following areas of exposure:• Likelihood

• Likelihood of experiencing a given information management failure? • Frequency

• How often would your organization experience such a failure?• Magnitude

• What would the magnitude of the failure be?• Potential Costs

• What would the impact be on legal costs, fines, company and professional reputation, investor confidence, stock price, cost of reconstruction, etc.

Sources: Information Nation by Randolph Kahn, Esq, and Barclay Blair and Records and Information Management by William Saffady

Essential to Compliance | Records and Process Essential to Compliance | Records and Process S

OX

SO

XS

OX

SO

X

Pa

trio

t A

ct

Pa

trio

t A

ct

Pa

trio

t A

ct

Pa

trio

t A

ct

HIP

AA

HIP

AA

HIP

AA

HIP

AA

Ris

kR

isk

Ris

kR

isk

Ba

sel

IIB

as

el II

Ba

sel

IIB

as

el II

Business Applications Business Applications Business Applications Business Applications

Records ManagementRecords ManagementRecords ManagementRecords Management

Policies, Controls and ProcessPolicies, Controls and Process

Evidence and ProofEvidence and Proof

“Business Process Managementis key to Enforcing

Records Management Policies”

Payables

Compliance

CallCenter

HumanResource

Statements

AssetMgmt

ConsumerLending

PaymentsSystems

Letters ofCredit

FundsTransfer

Lockbox

CashMgmt

Regulatory Reporting

Clearing/Settlement

Investment Mgmt

ElectronicPayments

Under-writing

LoanOrigination

Collections/Disputes

ConsumerLending

PortfolioMgmt

Stock Transfer

Trade Order

Tracking

RegulatoryReporting

PolicyMgmt

Claims Processing

Under-writing

Collections

RetailBanking

WholesaleBanking

SecuritiesMortgageBanking

Trust InsuranceEntire

Enterprise

Compliance Process | Spans the Entire OrganizationCompliance Process | Spans the Entire Organization

• Records are everywhere.• Obtain ROI with your compliance and RM initiatives.• Enforce your RM policy in these processes.

• The media centric active - inactive records model has changed.

• Compliance is content centric and the line between documents and records is very fuzzy … it’s the actual process that matters most.

• Manage the process not just the users.

The Carrot - It’s About YOUR ProcessThe Carrot - It’s About YOUR Process

User Process:

• Create

• Edit

• Use

• Publish - Transact

• Search - Request

RM Process:

• Retain - Store

• Migrate

• Defend - Produce

• Audit

• Expunge - Archive

About 95% are supposed to be destroyed

Time

Where ROI and Value Can Be FoundWhere ROI and Value Can Be Found

• Within the Business Process• Lots of people make records …• Fewer people administer records.

• At the Point of Records Capture• It takes time to manually declare and classify records.

• During the Rest of the Records Lifecycle• Records departments aren’t growing … automation is

crucial.• Litigation and storage is costly … and often unnecessary.

• The Ongoing Cost of Compliance

Electronic Records Managementand Business Process ManagementElectronic Records Managementand Business Process Management

File Plan

ElectronicRecords

Management System

• Ensures accurate classification and productivity.• Zero burden placed on business users.• Policies consistently enforced and audited.• Enables proof of compliance.

Stop Manually Declaring RecordsROI is found in Business Process ManagementStop Manually Declaring RecordsROI is found in Business Process Management

Number of Records Declared and Classified per Day per User

Number of Users 1 50 100 200 250

1 $24 $1,214 $2,428 $4,827 $6,071

50 $1,214 $60,712 $121,424 $242,849 $303,561

100 $2,428 $121.424 $242.849 $484,698 $607,122

250 $6,071 $303,561 $607,122 $1,214,244 $1,517,805

500 $12,142 $607,122 $1,214,244 $2,428,489 $3,036,611

1,000 $24,285 $1,214,244 $2,428,489 $4,856,978 $6,071,222

• Savings per user is 10.2 cents per record declared and classified.• Assumes 15 seconds per record, $50K annual burdened salary and 235

days per year.

• Annual savings or cost avoidance:

*

* Law of Small Numbers Example

File Plan

ElectronicRecords

Management System

Electronic Records Managementwith Document Lifecycle EventsElectronic Records Managementwith Document Lifecycle Events

Business Users Create Records

Not All Records Come From Business Process

• Ensures accurate classification and productivity.• No extra steps for business users.• Policies consistently enforced and audited.• Enables proof of compliance.

File Plan

ElectronicRecords

Management System

Electronic Records Managementwith Email RecordsElectronic Records Managementwith Email Records

Business Users Use Email

Partially for Transport, Partially for Content

• Ensures accurate classification and productivity.• No extra steps for business users.• Policies consistently enforced and audited.• Enables proof of compliance.

Email Server

Stop Declaring RecordsROI is found with Document Lifecycle EventsStop Declaring RecordsROI is found with Document Lifecycle Events

Number of Records Declared and Classified per Day per User

Number of Users 1 5 10 15 20

1 $36 $182 $364 $546 $729

50 $1,821 $9,107 $18,214 $27,320 $36,427

100 $3,643 $18,214 $36,427 $54,641 $72,855

250 $9,107 $45,534 $91,068 $136,602 $182,137

500 $18,214 $91,068 $182,137 $273,205 $364,273

1000 $36,427 $182,137 $364,273 $546,410 $728,547

• Savings per user is 15.3 cents per record declared and classified.• Assumes 10 seconds per record, $75K annual burdened salary and 235

days per year.

• Annual savings or cost avoidance:

Enterprise Information ExplosionHow will Records Managers Keep Pace?Enterprise Information ExplosionHow will Records Managers Keep Pace?

Storage Demand

Petabytes

0

200

400

600

800

1,000

1,200

1,400

1,600

1,800

2001 2002 2003 2004 2005 2006

Dynamic “Structured” Data

Fixed “Unstructured” Data

Stored information increases by 30% each year

Over 90% of all records are born electronic

Over 85% of information used is in unstructured documents

Over 600 billion emails are sent each year

As much as 65% of all information is subject to records retention

95% of all records are subject to destruction

Automating Records AdministrationRecords Departments are Shrinking, Not GrowingAutomating Records AdministrationRecords Departments are Shrinking, Not Growing

Destruction / Disposition

Transfer / Disposition

Review / Disposition

50% have less then 5 RM Full Time Employees (FTEs)

86% have less then 12 RM FTEs

81% view current levels of staffing as inadequate

- ARMA Study

• Ensures timely disposition.

• Policies consistently enforced and audited.

• Enables proof of compliance.

Automation of Records AdministrationNo Longer OptionalAutomation of Records AdministrationNo Longer Optional

• Process based automation will increase RM staff productivity by 20-50% by automating low value repetitive tasks.

• Assumes $60K annual burdened salary.

• Annual savings or cost avoidance:

20% 30% 40% 50%

Number of Staff $ Savings

FTEs Saved $ Savings

FTEs Saved $ Savings

FTEs Saved $ Savings

FTEs Saved

5 $1,821 1 $90,000 1.5 $120,000 2 $150,000 2.5

10 $120,000 2 $180,000 3 $240,000 4 $300,000 5

15 $180,000 3 $270,000 4.5 $360,000 6 $450,000 7.5

Reducing Electronic Discovery Costs DuPont Presentation 2002 MER ExampleReducing Electronic Discovery Costs DuPont Presentation 2002 MER Example

1990 – 1994 Study at DuPont

Key findings for legal discovery for 9 legal cases:

Total # of pages reviewed = 75,450,000

Total # of pages responsive = 11,040,000

% of pages past retention period = 50%

• For 9 cases studied, from 20 to 92% of records reviewed were past the retention period.

Reducing Electronic Discovery Costs DuPont Presentation 2002 MER ExampleReducing Electronic Discovery Costs DuPont Presentation 2002 MER Example

Pages reviewed past retention * = 37,725,000

Cost to review at 20 cents per page = $7,545,000

Total # of pages responsive = 11,040,000

Total # of pages past retention = 5,520,000

Cost to review at 80 cents per page = $4,416,000

Unnecessary Cost = $11,961,000 ** Only 9 cases studied. Does not include the cost to the corporation of information discovered that should not

have been (copy, scan, redact, review, number, etc.)

Pages Searched 1,000,000 5,000,000 10,000,000 20,000,000 50,000,000 75,000,000 100,000,000

Cost/page = .20 $200,000 $1,000,000 $2,000,000 $4,000,000 $10,000,000 $15,000,000 $20,000,000

Responsive Pages 150,000 750,000 1,500,000 3,000,000 7,500,000 11,250,000 15,000,000

Cost/page = .80 $120,000 $600,000 $1,200,000 $2,400,000 $6,000,000 $9,000,000 $12,000,000

Total Cost $320,000 $1,600,000 $3,200,000 $6,400,000 $16,000,000 $24,000,000 $32,000,000

Savings:

10% over retention $32,000 $160,000 $320,000 $640,000 $1,600,000 $2,400,000 $3,200,000

Savings:

20% over retention $64,000 $320,000 $640,000 $1,280,000 $3,200,000 $4,800,000 $6,400,000

Savings:

30% over retention $96,000 $480,000 $960,000 $1,920,000 $4,800,000 $7,200,000 $9,600,000

Savings:

40% over retention $128,000 $640,000 $1,280,000 $2,560,000 $6,400,000 $9,600,000 $12,800,000

Savings:

50% over retention $160,000 $800,000 $1,600,000 $3,200,000 $8,000,000 $12,000,000 $16,000,000

Reducing Electronic Discovery CostsPotential Costs and SavingsReducing Electronic Discovery CostsPotential Costs and Savings

Reduced Storage NeedsImmediate and Over TimeReduced Storage NeedsImmediate and Over Time

• Increased content growth = increased storage needs.

• Almost all records need to be destroyed (95%) and process management enforces destruction.

• Process inflow management captures data.

• ROI can be found by calculating retention periods, content inflow and storage requirements.

Reduced Storage Costs MetricsReduced Storage Costs Metrics

• Instant Benefit Metrics• Bulk conversion of existing electronic files enables immediate

identification of records past retention date. These can records can immediately be destroyed.

• Long-Term Benefit Metrics• Current input volumes.• Projected % of reduced input due to better classification.• Projected % of documents misclassified for retention period

(usually longer than needed).• Projected % of documents that can be destroyed on time.• Impact of this reduction on system components should be to

lower overall storage requirements and cost.

Electronic Delivery of RecordsElectronic Delivery of Records

• Migration of records is costly.

• Cost and legal exposure of lost records is high.

• Handling costs are high.

• Shipments are costly.

• Physical storage facilities are costly.

• Multiple requests for same records are impossible and take time.

Process Management Enables New RM CapabilitiesProcess Management Enables New RM Capabilities

• Enforce RM policy to individual process and tasks.

• Complete audited record of all users and tasks.

• “Real-time” view and status of everything.

Versioning Enables New Controls and Cost ReductionsVersioning Enables New Controls and Cost Reductions

• Design compliance processes and identify procedures and controls.

• Accurately reproduce historical processes.

• Model and test new processes prior to deployment.

• Provide controlled change management through validation.

How much are you paying your auditor to tell you whether you

are in compliance or not?

Can you afford to continue it?

• Most professionals recognize the need and don’t see electronic recordsas being too expensive.

• IT is in the driver’s seat for making key decisions..

Is Electronic Records Software Too Expensive?Is Electronic Records Software Too Expensive?

Yes11%

No89%

Yes15%

No85%

Yes41%

No59%

IT Business RM

Source: ARMA Electronic Records Initiative with Forrester Research

ROI Heads the List in ARMA StudyROI Heads the List in ARMA Study

1. Cost / benefits models (ROI).

2. Risk and cost of legal discovery and audits.

3. Role of electronic records in compliance.

4. The relationship between collaboration, document management and electronic records.

5. The relationship between message archiving and electronic records.

6. The role of electronic records in WCM implementations.

7. Collaboration between RM, IT, legal and business professionals.

Source: ARMA Electronic Records Initiative with Forrester Research

Why You Should Care How IT Dollars Get SpentWhy You Should Care How IT Dollars Get Spent

• IT controls the budget but wants results.• 59% want payback within 18 months of which 1/3 want

payback within 12 months.

• Business case is required to get funding.• Company size has only small effect.• 90% if over 500k• 70% if over 100k• 44% if under 50k

Source: The ROI Dilemma, 2004 Best Practices Study by Kotler Marketing Group and Software & Information Industry Association

Which Type of ROI is Important?Which Type of ROI is Important?

• 67% use ROI as basis to evaluate IT investments and many also look at payback period (35%).

• NPV (20%) and IRR (18%) not as widely used.

• Know what financial metrics are going to be used to evaluate your electronic records project.

Source: The ROI Dilemma, 2004 Best Practices Study by Kotler Marketing Group and Software & Information Industry Association

Anatomy of a Business Caseor Cost / Benefits AnalysisAnatomy of a Business Caseor Cost / Benefits Analysis

• Situation analysis.• Scope, stakeholders and purpose.

• Methodology and research details.• Include other options with pros/cons.

• Justification (both carrot and stick).• Compliance risk reduction (TCF).• Intangible business improvement benefits.• Tangible business improvement benefits (ROI).

• Implementation.• Start small but think bigger.

• Recommendations.• Don’t forget to measure the results.

What You Can Do About itWhat You Can Do About it

• Help educate about the value of the records in the business process not just the records themselves.

• Retain what you need to, for only as long as you need to.

• Enforce RM policy consistently and uniformly through process, not people … wherever possible.

• Know the business case for electronic records … it’s both carrot and stick.• Risk reduction = TCF (total cost of failure).• Business improvement = ROI (multiple areas).

• Measure and document your results.• Will lead to increased funding and results.

Good Web ROI StuffGood Web ROI Stuff

www.valuebasedmanagement.net

Explanation of all financial ratios and cost/benefit best practices.

www.cio.gov/documents/TheValueof_IT_Investments.pdf

Guidance from Federal CIO Council on value measurement methodology (VMM) for Section 300.

www.whitehouse.gov/omb/circulars/a11/current_year/s300.pdf

OMB Circular A-11, Section 300.

http://www.archives.gov/records_management/

policy_and_guidance/cpic_guidance.html

Guidance for coordinating the evaluation of Capital Planning and Investment Control (CPIC) proposals for electronic records applications.

http://www.dir.state.tx.us/eod/qa/intro.htm

Useful templates and checklists for business case and cost/benefit analysis.

Thank You