Future Proof – Protecting our digital future

http://www.flickr.com/photos/forresto/8956688/

We have been having some really interesting conversations with a  range of organisations about their business systems and the types of records they are making and keeping about their business systems.

In particular we have been talking to one organisation that is decommissioning a major business system. This business system contained personal information about clients andwas used to provide a single view across the organisation of personal client data. The actual business information in the system about clients is duplicate information that is replicated in client files. There is therefore no recordkeeping requirement to keep the information input into the system as this is all being effectively managed in the client files, and to create an additional reference copy would create unneccesary duplication and data management responsibilities.

What does need to be managed as an official record, however, is information about the system itself. Because the system was a portal for providing necessary business access to sensitive personal information, in this situation it is important that records be kept to show how the system operated and the system rules that were in place to protect and manage security and information access.

A large amount of money was also invested in creating this large, complex and successful system, and so it is also important that records about system design are kept in the short to medium term as reference for future large-scale system projects in the organisation.

The retention of these types of system-specific records can however be overlooked by records staff, and can be disregarded by ICT staff once a system is decommissioned. These records about systems, however, can be just as important as the information that the systems contain.

In the digital business world, records need to increasingly be seen as data in context. The information we input into systems is the data, the system itself provides the context. We need to look at maintaining information about both the data and the system if we are going to have full, accurate, useful, evidential and meaningful information in both the short and long term. This need to account for the system and management frameworks that were used to create and transact business operations is only going to increase in the future and so we really need to be proactive about the creation and management of this type of information now. Essentially business systems themselves are records of how organisations perform their business operations and increasingly we will need to keep good and accountable records of them. 

All organisations deploying business systems for key and high risk business operations should consider what system documentation and system specifications will need to be kept as necessary context and accountability for their business operations, as well as what records the system will need to generate about the business transactions it performs. We would love to hear your views and experiences if you have been working in this fascinating area.