Fully Compliant Cloud Based Repository Lessons along the way

1. Fully Compliant Cloud Based Repository Lessons along the way Mark Ellis, Electronic Records Management Consultant April 8th, 2014

2. Agenda • Who I am • Industry Statistics • Records Management widgets • 10 lessons I’ve learned along the way • Where to start

3. Mark Ellis • Who am I • 20 years in an industry that generated the mountains of paper • 5 years working on opposite side of the fence: • The taste of the paperless office • Trying to get rid of those same paper records • Been lucky • Some very successful ECM deployments • Worked with talented people

4. Records Management Industry “Over 50% of organizations have either zero OR more than 3 content management systems implemented.”  • “60% of organizations still use network file shares as a primary records management solution.” “More than 50% of organizations cited excess litigation costs or damages resulting from poor record keeping as the largest risk relating to information governance.” “More than 40% of organizations cited getting to grips with electronic records management the biggest cause for concern relating to information governance this year.” - AIIM Industry Watch, 2013

5. Records Management Widgets Achieving a compliant repository extends far beyond the technology.

6. Lesson #1: Team effort • There is no single person with all the answers. • Key Resources • Solution’s Architects • Legal and compliance experts • Subject matter experts (internal) • Business Analyst • IT

7. Lesson #2: The Ideal ECM system Is one that you never ever have to touch and works well other systems.

8. Integration Application Programming Interface's Many vendor do not honor API’s for ever. Our system is unusual in that since it start 17 years ago they have never abandoned and API call.

9. Lesson #3: Scanning alone will not fix the problem Scanning Project are one piece in a large puzzle. The go forward process is key

10. Lesson #4: Compliance cannot be outsourced Technology is only a part of the overall solution.

11. Compliance • Industry Leading Technology • Highest Certifications Available • Compliant – and Setting the Standards • GOA IMT A000013 – Digitization Technical Requirements, & GOA IMT A000015 – Digitization Process • CAN/CGSB-72.11-93Canadian Government Standards Board Microfilm and Electronic Images as Documentary Evidence • CAN/CGSB-72.34-2005 Canadian Government Standards Board Electronic Records as Documentary Evidence • ANSI/AIIM/ARMA TR48-2004 Technical Report Framework for Integration of Electronic Document Management Systems and Electronic Records Management Systems • AIIM TR31-1992 Technical Report Performance Guideline for the Legal Acceptance of Records Produced by Information Technology Systems

12. Lesson #5: Multiple way to find items One Repository One Record Multiple ways

13. Lesson #6: Chain of custody • Chain of Custody applies to both: • Physical Records being converted • Electronic records (eForms) • Audit Trails

14. Lesson #7: When data is not data Metadata and Index data are not the same thing. It’s not the data that gets tested. It’s the entire system that gets tested.

15. Metadata Capture- Index Data VS. Metadata • Metadata Capture is The Automated Method of Documenting The Conversion Process From Paper to Electronic Records • Provides Security and Audit Trails to The Process In order to meet CAN/CGSB Compliance West Canadian capture’s 160 different metadata fields (in addition to any index field values captured)

16. Lesson #8: Not all vendors are equal • Vendor’s need to prove they can, not just say can • If a physical collection is not fully compliant the vendor is generally not the one that ends up dealing with the problem. • Having a vendor provide CGSB/IMT compliant records does not mean they maintain their compliance • ECM Repository vendor needs to understand compliance. • This needs to go beyond the configuration. • Needs to understand the entire system as a whole.

17. No Black Box - an example from an eFormsworkflow project The client here has the option: Building there own forms or get West Canadian to do it for them The client has the power not West Canadian

18. Lesson #9: Living in the Cloud • All cloud based security is not equal. • You will want to ensure you data is hosted in a T3+ facility. • Location • Is your data in Alberta or even Canada?

19. Data Center Tier Rating Chart

20. Lesson #10: Understand the Business Process Tackle Process In Phases

21. Key to success: Planning Discover Design Deploy Optimize • Consult • Shared Vision • Defined Goals • Increase efficiencies • Drive Productivity • Solve Initial Pain • Records Electronically Captured • Secure • Highly Accessible • Continuous Improvements

22. ECM Solution: Question to ask? • Is it mobile ready? • Where is the data kept? Is it always in Alberta? • What is the data center rating? Is it T3+? Are they compliant with SOC2 or greater? • Do the eForms workflow need a client plug to work? • Is there an extensive API guide? • How long do you honor your API’s for?

23. Thank you! mellis@westcanadian.com