The Business Case for Records Management How to get a real return on your investment

1. The Business Case for Records ManagementHow to get a real return on your investment Bill Neale

2. In the history of business … this has never happened before … it was caused because a company failed to consistently adhere to it’s records destruction policy. Pop Quiz A company went out of business.

3. Morgan Stanley to Pay … $1.45 Billion “How much do we need to pay you to screw Netscape?” Bill Gates Microsoft Blunders are Expensive … and Embarrassing • 5 firms fined $8.25 million for failing to preserve email communications. • Banc of America fined $10 million for document production failures. • Schering Plough fined $500 million for noncompliance in 2002. • … alleges in its $280 billion racketeering suit that tobacco companies destroyed documents … • Too many to list.

4. Presentation Overview • Brief overview to industry trends. • The impact of doing nothing. • How to reduce the future cost of compliance and records and information management (RM). • How business process management (BPM) within a records program builds true business value and guarantees cost effective enterprise-wide record policy enforcement. • How an effective electronic records management generates a strong return on investment (ROI). • Why you should care about ROI. • Where to look and how to calculate electronic records ROI.

5. From The Basement to The Boardroom • Records management has forever changed. Now a “C” level business issue … it’s Y2K without the 2K. • New compliance regulations are more about the business process around records then the records themselves. • Explosion of content and mandated storage requirements. • Landmark litigation has created a legal feeding frenzy combined with rising electronic discovery costs. • Desire for cost reduction … emergence of Six Sigma and ISO standards. • New business cases are enabled.

6. Fortune 1000 spent more than $2.5 Billion in 2004 on SOX compliance alone. Average company spent 4.5 Million on SOX Section 404 alone. More than 90% are engaged in projects now and business process is the key. Companies cannot continue to spend with auditors … process automation is key. Case Study: $3 Billion Retailer 6 Divisions, 2000 Stores SOX 1st Year Spend = $5.6 Million Ongoing Projected = $2.1 Million What’s Happening Right Now? Sources: Financial Executives International, META Group and Ovum and Protiviti

7. Achieve Compliance Prove Compliance • Establish controls, reports, documentation and processes. • Realization that compliance is expensive and not going away. • Develop ability to enforce policies and defend compliance program. • Realization that records management, evidence and proof are critical. Maintain Compliance Optimize Performance • Ongoing monitoring, tracking and reporting. • Realization that compliance requires automation. • Focus on business improvement and cost reduction. • Opportunity for modeling, analysis, simulation and optimization. Stages of Compliance Corporate Governance (SOX, Turnbull, Tabaksblat) Industry Regulatory (Basel II, CFR 21Part 11) Geopolitical Driven (SEC, Patriot Act, FOIA) Privacy Driven (PIPEDA, HIPAA) Operational Risk Management

8. Policies aren’t clear, well communicated or supported by training. Records don't get declared by business users and/or are incorrectly classified. Records aren’t getting destroyed at all. Records are lost or destroyed too soon. Records are kept too long. RM and compliance policies not enforced. Good Policy Isn’t Enough 87% have formal records management programs but 35% do not include electronic records. 29% do not regularly follow own RM policy. 99% do not have formal process for holds. 93% believe outcome of future litigation based on electronic records policy. 49% doubt they could defend own records 70% doubt own IT department understands RM policy Source: Cohasset Associates, AIIM and ARMA 2005 Survey, A Renewed Call to Action

9. Common among all landmark lawsuits. Guilty until proven innocent … Opposing council attacks the process and makes spoliation claims. Repercussions are staggering whether appearance of or actual malfeasance is present. Government officials are being held in contempt. Stock prices go down and trust is destroyed. Huge penalties and fines are levied. Companies have dissolved, careers have been destroyed and people are going to jail. Exploding electronic discovery costs. Unable to Produce Corporate Email Records Lack of Policy Enforcement Leads to Court Enron Arthur Andersen WorldCom Microsoft Antitrust Bureau of Indian Affairs Wal-Mart Stores Dell Computer Prudential Insurance General Nutrition Trigon UBS Warburg AH Robins Freddie Mac Proctor and Gamble The White House Tyco

10. Business workers make mistakes. Process information not captured. Process not auditable. RM policy inconsistently applied and not enforced. Little visibility into program effectiveness. Significant loss of worker productivity. • Law of Small Numbers • Average of 10-15 seconds to declare a record. • 10 seconds X 72 records per day.= 720 seconds per day or 12 minutes per day.= 60 minutes per week or 1 hour per week. • 1 hour per week is 2.5% of worker productivity Rely on Business Users? Large organizations lose a document every 12 seconds 67% of data loss is directly related to user blunders Business workers typically misfile 2-7% of all records

11. User Controlled Records are the Problem • Many previous attempts • Most have failed. • Recent NARA Study • 6+ month study • Significant user dropoff after training period • 56% found technology “ExtremelyBurdensome” or “Burdensome” to use • 6% declared zero records Source: National Archives and Records Administration

12. What Are My Options? • Manage the users or manage the process? • Spending choices. • Do nothing? • Add staff? • Deploy technology? • Future cost of compliance and RM. • Increasingly complex requirements. • Process itself needs to be managed and audited. • Volume and types of records will increase. • Storage requirements will increase. • The carrot and the stick. • Risk reduction – the negative stuff • New business value (ROI) and improvement – the positive stuff

13. Simple Rules for Risk Reduction and ROI • Sounds complicated but not really … • Don’t rely on business users. Don’t rely on systems that rely on your users. Rely on your process instead. • Capture the process info (and data). • It’s required now anyway. • Retain what you need to, for only as long as you need to, as determined by law, regulatory statute and/or sound business policy. • Only destroy (delete) records at the right time, for the right reason as managed by the right process. • Enforce RM policy consistently and uniformly.

14. The StickKnow Your Risk or Total Cost of Failure • Consider the following areas of exposure: • Likelihood • Likelihood of experiencing a given information management failure? • Frequency • How often would your organization experience such a failure? • Magnitude • What would the magnitude of the failure be? • Potential Costs • What would the impact be on legal costs, fines, company and professional reputation, investor confidence, stock price, cost of reconstruction, etc. Sources: Information Nation by Randolph Kahn, Esq, and Barclay Blair and Records and Information Management by William Saffady

15. Policies, Controls and Process “Business Process Managementis key to Enforcing Records Management Policies” Evidence and Proof Essential to Compliance | Records and Process Risk Basel II SOX Patriot Act HIPAA Business Applications Records Management

16. Compliance Process | Spans the Entire Organization RetailBanking Wholesale Banking Mortgage Banking Entire Enterprise Securities Trust Insurance Statements Letters of Credit Regulatory Reporting Under-writing Portfolio Mgmt Policy Mgmt Compliance Asset Mgmt Funds Transfer Clearing/ Settlement Loan Origination Stock Transfer Claims Processing Payables Consumer Lending Lockbox Investment Mgmt Collections/ Disputes Trade Order Tracking Under- writing Call Center Payments Systems Cash Mgmt Electronic Payments Consumer Lending Regulatory Reporting Collections Human Resource • Records are everywhere. • Obtain ROI with your compliance and RM initiatives. • Enforce your RM policy in these processes.

17. User Process: Create Edit Use Publish - Transact Search - Request The Carrot - It’s About YOUR Process • The media centric active - inactiverecords model has changed. • Compliance is content centric and the line between documents and records is very fuzzy … it’s the actual process that matters most. • Manage the process not just the users. RM Process: • Retain - Store • Migrate • Defend - Produce • Audit • Expunge - Archive Time About 95% are supposed to be destroyed

18. Where ROI and Value Can Be Found • Within the Business Process • Lots of people make records … • Fewer people administer records. • At the Point of Records Capture • It takes time to manually declare and classify records. • During the Rest of the Records Lifecycle • Records departments aren’t growing … automation is crucial. • Litigation and storage is costly … and often unnecessary. • The Ongoing Cost of Compliance

19. Electronic Records Managementand Business Process Management ElectronicRecords Management System File Plan • Ensures accurate classification and productivity. • Zero burden placed on business users. • Policies consistently enforced and audited. • Enables proof of compliance.

20. Stop Manually Declaring RecordsROI is found in Business Process Management • Savings per user is 10.2 cents per record declared and classified. • Assumes 15 seconds per record, $50K annual burdened salary and 235 days per year. • Annual savings or cost avoidance: * * Law of Small Numbers Example

21. Electronic Records Managementwith Document Lifecycle Events ElectronicRecords Management System File Plan Business Users Create Records Not All Records Come From Business Process • Ensures accurate classification and productivity. • No extra steps for business users. • Policies consistently enforced and audited. • Enables proof of compliance.

22. Electronic Records Managementwith Email Records ElectronicRecords Management System File Plan Business Users Use Email Partially for Transport, Partially for Content Email Server • Ensures accurate classification and productivity. • No extra steps for business users. • Policies consistently enforced and audited. • Enables proof of compliance.

23. Stop Declaring RecordsROI is found with Document Lifecycle Events • Savings per user is 15.3 cents per record declared and classified. • Assumes 10 seconds per record, $75K annual burdened salary and 235 days per year. • Annual savings or cost avoidance:

24. Enterprise Information ExplosionHow will Records Managers Keep Pace? Stored information increases by 30% each year Over 90% of all records are born electronic Over 85% of information used is in unstructured documents Over 600 billion emails are sent each year As much as 65% of all information is subject to records retention 95% of all records are subject to destruction Storage Demand Petabytes Fixed “Unstructured” Data Dynamic “Structured” Data

25. Automating Records AdministrationRecords Departments are Shrinking, Not Growing Transfer / Disposition 50% have less then 5 RM Full Time Employees (FTEs) 86% have less then 12 RM FTEs 81% view current levels of staffing as inadequate - ARMA Study Destruction / Disposition • Ensures timely disposition. • Policies consistently enforced and audited. • Enables proof of compliance. Review / Disposition

26. Automation of Records AdministrationNo Longer Optional • Process based automation will increase RM staff productivity by 20-50% by automating low value repetitive tasks. • Assumes $60K annual burdened salary. • Annual savings or cost avoidance:

27. Reducing Electronic Discovery Costs DuPont Presentation 2002 MER Example 1990 – 1994 Study at DuPont Key findings for legal discovery for 9 legal cases: Total # of pages reviewed = 75,450,000 Total # of pages responsive = 11,040,000 % of pages past retention period = 50% • For 9 cases studied, from 20 to 92% of records reviewed were past the retention period.

28. Reducing Electronic Discovery Costs DuPont Presentation 2002 MER Example Pages reviewed past retention * = 37,725,000 Cost to review at 20 cents per page = $7,545,000 Total # of pages responsive = 11,040,000 Total # of pages past retention = 5,520,000 Cost to review at 80 cents per page = $4,416,000 Unnecessary Cost =$11,961,000 * * Only 9 cases studied. Does not include the cost to the corporation of information discovered that should not have been (copy, scan, redact, review, number, etc.)

29. Reducing Electronic Discovery CostsPotential Costs and Savings

30. Reduced Storage NeedsImmediate and Over Time • Increased content growth = increased storage needs. • Almost all records need to be destroyed (95%) and process management enforces destruction. • Process inflow management captures data. • ROI can be found by calculating retention periods, content inflow and storage requirements.

31. Reduced Storage Costs Metrics • Instant Benefit Metrics • Bulk conversion of existing electronic files enables immediate identification of records past retention date. These can records can immediately be destroyed. • Long-Term Benefit Metrics • Current input volumes. • Projected % of reduced input due to better classification. • Projected % of documents misclassified for retention period (usually longer than needed). • Projected % of documents that can be destroyed on time. • Impact of this reduction on system components should be to lower overall storage requirements and cost.

32. Electronic Delivery of Records • Migration of records is costly. • Cost and legal exposure of lost records is high. • Handling costs are high. • Shipments are costly. • Physical storage facilities are costly. • Multiple requests for same records are impossible and take time.

33. Process Management Enables New RM Capabilities • Enforce RM policy to individual process and tasks. • Complete audited record of all users and tasks. • “Real-time” view and status of everything.

34. How much are you paying your auditor to tell you whether you are in compliance or not? Versioning Enables New Controls and Cost Reductions • Design compliance processes and identify procedures and controls. • Accurately reproduce historical processes. • Model and test new processes prior to deployment. • Provide controlled change management through validation. Can you afford to continue it?

35. Is Electronic Records Software Too Expensive? • Most professionals recognize the need and don’t see electronic recordsas being too expensive. • IT is in the driver’s seat for making key decisions.. IT Business RM Source: ARMA Electronic Records Initiative with Forrester Research

36. ROI Heads the List in ARMA Study • Cost / benefits models (ROI). • Risk and cost of legal discovery and audits. • Role of electronic records in compliance. • The relationship between collaboration, document management and electronic records. • The relationship between message archiving and electronic records. • The role of electronic records in WCM implementations. • Collaboration between RM, IT, legal and business professionals. Source: ARMA Electronic Records Initiative with Forrester Research

37. Why You Should Care How IT Dollars Get Spent • IT controls the budget but wants results. • 59% want payback within 18 months of which 1/3 want payback within 12 months. • Business case is required to get funding. • Company size has only small effect. • 90% if over 500k • 70% if over 100k • 44% if under 50k Source: The ROI Dilemma, 2004 Best Practices Study by Kotler Marketing Group and Software & Information Industry Association

38. Which Type of ROI is Important? • 67% use ROI as basis to evaluate IT investments and many also look at payback period (35%). • NPV (20%) and IRR (18%) not as widely used. • Know what financial metrics are going to be used to evaluate your electronic records project. Source: The ROI Dilemma, 2004 Best Practices Study by Kotler Marketing Group and Software & Information Industry Association

39. Anatomy of a Business Caseor Cost / Benefits Analysis • Situation analysis. • Scope, stakeholders and purpose. • Methodology and research details. • Include other options with pros/cons. • Justification (both carrot and stick). • Compliance risk reduction (TCF). • Intangible business improvement benefits. • Tangible business improvement benefits (ROI). • Implementation. • Start small but think bigger. • Recommendations. • Don’t forget to measure the results.

40. What You Can Do About it • Help educate about the value of the records in the business process not just the records themselves. • Retain what you need to, for only as long as you need to. • Enforce RM policy consistently and uniformly through process, not people … wherever possible. • Know the business case for electronic records … it’s both carrot and stick. • Risk reduction = TCF (total cost of failure). • Business improvement = ROI (multiple areas). • Measure and document your results. • Will lead to increased funding and results.

41. Good Web ROI Stuff www.valuebasedmanagement.net Explanation of all financial ratios and cost/benefit best practices. www.cio.gov/documents/TheValueof_IT_Investments.pdf Guidance from Federal CIO Council on value measurement methodology (VMM) for Section 300. www.whitehouse.gov/omb/circulars/a11/current_year/s300.pdf OMB Circular A-11, Section 300. http://www.archives.gov/records_management/ policy_and_guidance/cpic_guidance.html Guidance for coordinating the evaluation of Capital Planning and Investment Control (CPIC) proposals for electronic records applications. http://www.dir.state.tx.us/eod/qa/intro.htm Useful templates and checklists for business case and cost/benefit analysis.

42. Thank You