Future Proof – Protecting our digital future

In recent weeks we have been sharing our current thoughts about email management but in this post we want to go back in time!

Way back in 2008, State Records developed some advice on email management. We have reproduced this advice below and we would love to receive your feedback on it.

Which of our recommendations from 2008 failed dismally when you tried them? Alternatively, did any of our advice help you to win some email battles? Does any of this advice stand the test of time or have you come up with new and improved ways for managing your corporate email? Are any examples below still useful, or what extra advice or case studies or scenarios would be helpful to include in new cutting edge email advice ?

We are currently trying to revise and update our advice on email management and we want to draw on all the advice and expertise we can. Please do share your thoughts – any and all views are very, very welcome! Now, let’s go back in time…(and warning, we were no less verbose back in 2008…).

Managing email

Large amounts of corporate information and corporate risk are tied up in your email system. Email therefore needs special treatment in your organisation and specific requirements and systems need to be in place to ensure that email can be managed.

Quantifying the email problem

Quantifying the cost of looking for information

Information contained in email messages is notoriously difficult to find. If 50 people in an organisation waste just 15 minutes each, each day, looking for information, at an average salary of $60 000, then that organisation wastes one and a half person years and $93 750 per annum. [1 – note: all references are listed at the bottom of this page] Email management strategies can help to control information and minimise this waste.

Quantifying the risks of not capturing information

75% of NSW government organisations capture between 0% and 40% of business emails. Extrapolating from these figures, it is estimated that, in the government sector, 119 million email messages are not being captured each year.[2] In the university sector it is estimated that 850 million email messages are not being captured. [3] This failure to capture information puts organisations at risk and affects daily business operations. Again, implementing email management strategies can help to control information and mitigate this risk.

How to manage email

To effectively manage your corporate email you need to have:

• an appropriate technical solution in place
• clear policy and procedures, and
• ongoing staff training in email management.

The following table outlines a number of strategies to help you implement these requirements. These strategies can also be applied to the management of other messaging formats, such as instant messaging or SMS, which might also be used in your workplace.

Technical issues

We need a technical solution to help us with our email management problem

The best and most appropriate technical solution may be an electronic document and records management system (EDRMS).

This solution is scalable, provides a secure and controlled environment for email management, provides universal and integrated access to information across your organisation and can be integrated with a variety of messaging platforms.

Technical solutions that are not appropriate for managing email records include message management:

• within the email system
• within the corporate network
• within email vault /extended storage systems
• on backup tapes.

Our staff use their email accounts to manage their email messages

This approach means:

• only the individual can access this valuable corporate information – important corporate knowledge is virtually inaccessible to other staff
• messages are not protected, they are simply stored
• message management is at the discretion of the individual.

This approach does not allow the informational value of email to be leveraged and does not mitigate the risks of email management.

We use shared folders in our email system to store and provide access to messages relating to different projects

This strategy at least allows broader access to the project and other information that is contained in corporate email messages. It is not, however, an ideal approach. This is because:

• it does not allow access to all different types of records that may be relevant to the project. Users still need to access other information sites to gain all the details that they need
• it does not protect or manage the records, it just provides a storage area for them.

We use the network for email message management

Again, this approach allows broader access to messages, but it is not ideal because:

• unless tight controls are put in place, it can be difficult to ensure that no one can alter emails and other records stored on the network
• it does not work in all business environments – some email systems do not allow for the easy storage of emails outside of the email system.

We use backup tapes to manage our email

Back up is used for disaster management. Its use for email management is very problematic. This is because:

• email messages stored in backup systems are not easily accessible. Searching for specific information in these systems can be very time consuming, particularly if you have a number of email servers. If backup tapes are used as a management system, doing a search across all servers to find necessary information is incredibly time consuming and expensive.
• backup tapes are generally subject to regular overwriting at predetermined intervals. Email messages often have long term business value. Overwriting all messages at a standard point in time without consideration of the specific business value of different messages is a significant business risk. Keeping email messages in an EDRMS allows them to be kept for their different legally required retention periods.
• keeping backup tapes indefinitely to mitigate the risks described above is itself a significant risk and escalates the search and discovery costs associated with trying to find information.
• when stored in a backup system emails are not available in their business context. This minimises their usefulness and means the information used as the basis for a decision may not be comprehensive.

We use an email vault system

These systems allow broad access but:

• generally only the individual can access their email messages in the vault system meaning that important corporate knowledge is inaccessible to other staff
• vault systems can result in the retention of all emails, not just those of ongoing business value
• vault systems keep the system manager locked into the system by requiring the purchase of ever bigger storage devices to cope with the ever accumulating volume of emails, because vault systems do not provide a comprehensive and systematic means of actually managing email messages. They effectively allow the basic email management problem to persist, rather than actually solving it
• it can be difficult to ensure that all messages are kept for their necessary legal retention periods
• it is important to take the time to deploy any classification, disposal and management functionality they might have.

Policy and procedural issues

We don’t have a corporate policy on email

A corporate email policy is a necessary step in the management of your email. A corporate email sets out the rules for email management that everyone in your organisation must follow and helps staff to identify which messages should and should not be captured.

In your policy you should:

• identify that the email system is a business system and should be used for the conduct of official business
• specify that records sent and received by a government employee in the course of official duties are official records under the State Records Act
• identify that email messages contain vital business information necessary to support daily business operations and may be required for legal processes, such as discovery orders, GIPA Act applications, subpoenas or needed by auditors, courts or Royal Commissions
• specify that email messages which have business value must be captured as official records in your nominated system (preferably an EDRMS)
• specify that remote/home use of corporate email is subject to the same rules and recordkeeping requirements
• identify which email messages should be captured as records in your system and who should do the capturing.

How do we identify which email messages should be captured?

To decide whether a message should be captured as a business record you could encourage staff to ask the following questions. If the answer to any of these questions is yes, then the message should be saved into your nominated system:

• does the message approve or authorise actions?
• is it a formal communication between staff relating to work?
• does it signify a policy change or development?
• does it commit the organisation to an arrangement or to a business deal?
• does it contain advice, provide guidance or constitute formal communications with people inside or outside the organisation?
• am I required to act upon it?
• is it external correspondence I have received relating to work?
• is it something that I have sent for a business purpose?
• is it something I have used at work to make a decision?
• if I left this job tomorrow, would my successor need the information in this message to continue with this matter?
• is the matter to which the message relates one which may be reviewed or audited later?

How do we identify who should capture email messages?

You don’t want multiple people capturing the same email message.

Rules to identify who should captured email messages could include simple guidance such as:

• if you sent it, capture it
• if you were the only one who received it from someone outside the organisation, capture it
• if lots of you received it from someone outside of the organisation, the main recipient or the person with prime responsibility for the business documented in the email captures the message
• if in doubt, check with other recipients about who is capturing the message.

How do we identify when email messages should be captured?

You could recommend requirements such as:

• users should capture relevant email messages when they are received or when the flow of correspondence documented in a series of messages has ceased
• alternatively, for project based work, you could specify that all relevant email messages must be captured at a defined point in a business process. This may be at existing project review points, the completion of a tender process etc. Be aware though that this approach may limit information access because the email is not captured immediately. The risks associated with this approach must be fully considered.

Staff training issues and strategies

We need to get staff to recognise that email management is a significant corporate problem

Email management is a significant issue for all government bodies.

To draw attention to the problem, points to emphasise include:

* email management is a necessary business process, not a separate records management process. The email management requirements you are implementing are directly related to organisational efficiencies and the business bottom line

* email management is not an overhead. Properly managing email means you can get more work done and actually get better quality work done. Email management can save money, mitigate risk and increase efficiency

* try to quantify the problem as it specifically applies in your organisation. In a 2005 State Records survey, 60% of public sector bodies reported that they could not easily access relevant emails in response to discovery orders, subpoenas or GIPA requests. Calculate specifically what responding to discovery or other requirements has cost your organisation. Or use a calculator like the Stever Robbins calculator to calculate what poor email management strategies could be costing your organisation

* based on conservative State Records estimates, across the government sector more than 119 million business related email messages each year are not captured into recordkeeping systems by State government agencies. This is a tremendous risk and one that could have huge financial costs to your organisation

* Microsoft has calculated that in 2008, the average office worker will spend more than 15 hours a week reading and sending email while costing the organisation approximately $28,000 per year analysing and searching email.[4] Any efficiencies that can be gained by improving this process will have a direct bearing on the office bottom line.

We need to get Management on board to help us address our email management issues

Quantify the scale of the problem as it applies to your organisation and identify exactly what you will need to solve it. Don’t just tell Management that there is a problem that needs fixing. Identify the problem, flag its actual and potential costs, outline specifically the steps you will take to rectify the problem and then identify the complete cost of your proposed solution.

Factors to emphasise are that with standard email management practices:

• valuable corporate information is locked away in hundreds of generally inaccessible data silos, and
• valuable corporate information has to rely on the vagaries of individual practice for survival.

To management, it is important to clearly explain the risks associated with current email management practices. Good business is reliant on good risk management. Emphasise too the financial benefits of what you are doing. You are trying to save your organisation money by working smarter and by minimising risk.

You need to make it clear that you can’t just throw a technical solution at this problem. Ongoing training and support is necessary.

Management may also need to be convinced that email management is not all overhead. You should emphasise the significant returns on investment that can be achieved through effective management of your email systems.

We can’t get staff to actually manage their email

You can try numerous different strategies to get staff to manage their email.

* Have a good policy in place that clearly identifies the email management rules in your workplace.

* Before you develop your email requirements, interview the staff you want to adhere to email standards. Ask them why they don’t capture messages in official systems. What are the barriers they see? What do they prefer about the ad hoc approaches they have developed? What can you learn from their preferences and approaches? People may be more prepared to follow procedures and requirements that they feel they have had a hand in developing.

* Try to automate email capture as much as possible – most of the EDMRS tools on government contract enable an interface between your email and EDRMS systems and can link email inbox folders with specific record containers in your EDRMS

* Start by targeting the sections of your organisation where the most important or high risk transactions take place. Educate these users and establish firm policies and procedures. By following this method you will deal with your most high risk sections first and establish good policies and procedures that have been tested and which can then be applied elsewhere.

* Get senior management support. Have senior management send out an email announcing the importance of email management and listing the schedule of necessary upcoming training courses.

* Invest in training and support. You may think you have no time or money for training but proactive training is, in the long term, so much more cost effective than retrospectively fixing problems caused by poor adherence to your email management rules.

* Have senior managers stress that email management is a necessary business requirement.

* Identify the specific problems in your organisation that have been caused by poor email management. Frame your email requirements around these problems and how they can be rectified.

* Try to make your email management strategy as easy as you can. Try to make it deviate as little as possible from current work practices and allow filing in ways that make sense to users. If you have to create an extra layer of ‘invisible’ translations behind this to translate business language into recordkeeping language (such as your business classification scheme), then do this but try to make it invisible to the users. You want to impose as little extra learning and requirements on them as possible.

* Try the 5 minute rule. If you can’t explain your email procedures in 5 minutes, then they are too complicated and not sufficiently automated.

* Make learning fun and offer incentives – have quizzes on email management with small prizes, like a free coffee.

* Make email management part of job contracts so that people make an official record of their willingness to follow email policy.

* Continually revise and redevelop your email requirements until you get them right.

* Demonstrate that what you are trying to achieve through email management is support specific business projects, budgets and timeframes – make what you do about their business, not your business. It is not about records management, it is about good business.

* Have an email policy launch party – create a buzz and make everyone aware of what you’re doing. Really emphasise why the changes you are making are good and necessary – how they contribute to the bottom line and to individual efficiencies.

* Target managers and issue a punchy, concise summary of what you are doing and why.

* Keep track of who is and who isn’t capturing email. You don’t have to target individuals, rather calculate how many people in each business unit are actually using the systems you’ve put in place. You should be able to determine approximately how many emails your organisation receives. On very conservative estimates, 30% of emails received are official business records. Based on these figures, are all business units capturing adequate numbers of emails? You may want to target high risk or key business areas and set a higher benchmark capture rate for them. If people aren’t achieving the required rates organise a meeting with the appropriate managers and discuss the reasons why. You could develop targeted training for specific business areas, or guidelines developed around their specific work practices. You could utilise specific workflow technology in their business area to further automate the capture of messages.

* Some people will immediately see the benefit of what you are trying to achieve. Use these people, ‘power users’, to help educate other users.

* Do some benchmarking both before and after you implement your changes. Can you demonstrate improved efficiencies in information retrieval? Have you saved money when responding to discovery orders? What are the daily efficiencies you can report on? Do people feel more prepared in their daily work – do they have greater amounts of more relevant information more easily at their fingertips?

* You could automatically delete all emails from inboxes 60 days after receipt or restrict the size of inboxes so that only a limited number of messages can be stored there long term. These more radical measures require that a good, alternative system is in operation to store email messages and require staff to have the knowledge to use the alternate system.

* You may find it effective to develop specific local solutions for individual workgroups. If an organisation-wide strategy is too complex, roll out tailored, smaller scale solutions at the workgroup or project level. You could design your own database or deploy small scale records management software solutions to achieve this. This solution could be appropriate for large organisations with decentralised structures and broad business interests. Solutions of this type could be trialled as prototypes or models for corporate-wide email strategies. [5]

We are capturing email messages but they are still very difficult to find

A recent survey in New Zealand showed that 37% of electronic records were completely inaccessible due to poor titling or other forms of poor metadata application. [6]

Adequate titling of email messages is critical to their ability to serve immediate business needs and long term accountability purposes.

All staff need to be made aware of the value of attaching clear, meaningful and unambiguous titles to their messages.

For example, a recipient should be able to receive a message and, from its title alone, determine what the message is about and the specific area of business that it relates to. Having titles that meet these requirements immediately simplifies business processes and contributes to efficiency.

For example, don’t title a message ‘A few extra points’, or ‘Workplan’. Instead, titles such as ‘Additional comments in response to Retail section planning meeting, 19/9/08’ or ‘Education Services workplan, 2007’ make recipients immediately aware of the message contents. These titles will also have meaning longer term in the records system and provide adequate search terms to enable users to successfully search for information.

It is important to emphasise that good, basic email titling will save your organisation significant amounts of time and money by simplifying searching. Spending time and money on educating staff about the importance of email titling will ultimately save you considerable money.

You could try to:

• make it impossible to send a message in your system if the title field is blank
• encourage users to retitle messages when the content of a thread of messages changes over time
• encourage users to have one main point per email message, or adequately title messages to give an indication of the range of topics covered. Again, information searching and reuse becomes difficult if email titles are inadequate
• send around a summary of inadequate file titles that you have found in the records system. Highlight the differences between the title and the actual content of the message. Providing real examples of the problem that are relevant to their business needs can help people understand how this problem relates to their daily information requirements.

It can be useful to establish clear rules for the content of email messages too. Such rules can encourage staff to send clear and specific messages and thereby eliminate the need for multiple follow-up messages. This can save your organisation time and money. A survey by the Institute of Chartered Accountants showed that 65% of email messages fail to provide the recipient with enough information to act on. Reintroduce traditional business rules for communications – make sure all messages are properly titled, contain a defined action and a timeframe. [7]

We need to ensure that deleted messages are actually deleted

Even though it may have been deleted, most information is regarded as discoverable unless it is completely erased from computer and backup systems.

When it is appropriate to do so, email messages that are no longer required for business purposes should be destroyed. To minimise the costs associated with searching though vast stores of data (for either internal or legal purposes) and the inadvertent discovery of messages long thought deleted, organisations need to establish:

• complete and thorough means for destroying digital records, including email messages
• documented procedures and retention requirements for back-up tapes and servers (in all locations), to ensure that email caches are not retained indefinitely. Further guidance on the management of backups is contained in the section on recordkeeping systems.

In relation to legal discovery orders, US courts have frequently required complex and costly discovery orders and have required that the plaintiffs should not have to pay these discovery costs, because the defendants should have foreseen the need to appropriately manage their email records when designing and implementing their email systems. One agency, for example, had to bear the costs of reviewing ten years worth of backup tapes, in response to a discovery order, at a cost of over $3 million. An email management strategy combined with an effective backup management procedure could have significantly minimised these costs and the required scale of the search.[8]

For more information, see State Records’ Destruction of records.

(Apologies if the references below no longer work…We will update them if we use them in our revised guidance!)

[1] Calculation performed using the assessment tool at < http://www.steverrobbins.com/email-overload/company-email-overload-assessment.htm#explanation>.
[2] State Records Authority of NSW, Report on the 2005 Information survey on digital recordkeeping

[3] State Records Authority of NSW, Report on the 2005 Information survey on digital recordkeeping

[4] Research by Microsoft, quoted in Institute of Chartered Accountants press release, Lack of email management costing business, viewed December 2008, <http://www.charteredaccountants.com.au/A121361856>.
[5] Many of the recommendations in this section are based on advice provided by Robert Green in his CAD Manager Column, particularly CAD standards, Part 5: Enforcement (8 August 2007), viewed September 2008, <http://management.cadalyst.com>.
[6] Research New Zealand, Report on the government recordkeeping survey 2007, viewed December 2008, < http://continuum.archives.govt.nz/files/file/Survey/2007%20Government%20Recordkeeping%20Survey%20Report.pdf>.
[7] Institute of Chartered Accountants, Press release: Lack of email management costing business, 22 April 2008, viewed June 2008, <http://www.charteredaccountants.com.au/A121361856>.
[8] Managing electronic records seminar, the University of Texas at Austin Graduate School of Library and Information Science, Technical Summer Camp, 1997, Managing email as records: fundamental legal issues, viewed June 2008, < http://www.ischool.utexas.edu/~scisco/lis389c.5/email/legal.html>.