Future Proof – Protecting our digital future

http://www.flickr.com/photos/rmgimages/4660273582/

As mentioned in our last post, State Records is researching the ways in which NSW public offices manage their email. This research is part of a review of our advice in this area, some of which is more than ten years old. One of the aims of the review is to ensure that our advice on email management is informed by the perspectives and experiences of public offices, and reflects and addresses the email management issues that public offices want advice on.

As part of our research State Records recently invited NSW public offices to complete a short survey on email management practices in their organisations. The results confirm some of our suspicions, but also challenge some long held assumptions.

Email value

Recent anecdotal reports from NSW public offices suggest that email systems are one of the core business systems in use across the NSW public sector. Significant evidence of corporate decision making is therefore likely to be captured in email messages, and messages are therefore likely to have ongoing value to organisations (both to support current business and as evidence that may be required beyond the immediate business needs for the information).

The survey sought to test these assumptions by asking respondents to indicate the extent to which they agreed with five statements about the value of email messages to their organisations. The results indicate that:

• email systems are a core business system for many organisations, but evidence of corporate decision making and approvals is also stored in other systems (e.g. electronic document and records management systems (EDRMS), business systems etc.) Equal numbers of respondents agreed with one of these propositions, with almost one third of respondents agreeing with both.
• email messages have business value, but their ongoing value as evidence is disputed. 62.8% of respondents considered that email messages have business value to their organisations, but only 49% considered that messages need to be kept long term.
• email messages with corporate value are stored only in personal email accounts and are therefore at risk of loss or premature destruction. 81% of respondents agreed that this is the case in their organisations.

Respondents were able to make general comments about email management in their organisations. These suggest that while recordkeeping professionals understand that email messages have business value, this is not necessarily understood more widely within their organisations:

It is hard to convince people that your emails may be required at a later time.”

I find it hard to get anyone (management included) to understand that emails need to be captured. Memos and directives have been sent and yet they still think it’s only the ‘paper’ documents that need to be captured. They also like to hoard their emails in relation to any business they are doing in case they ‘need’ them for future use.”

Most people think that they do not have to do it and it is not part of their job as the GM has stated that they capture all emails on the incoming server.”

Email will always be problematic as it encourages informal correspondence. It also necessarily creates a space where staff can store and manage their own records apart from corporate systems. It’s impossible to ensure full compliance without imposing draconian solutions. The best common sense approach is to rely on staff to decide what needs to be kept and hope that any transgressions are minor.”

Email capture

State Records advises NSW public offices to capture email messages that are sent or received in the course of official business into a corporate recordkeeping system. State Records suggests two principle methods for capturing messages:

• capturing messages into an EDRMS
• printing messages and capturing them on paper files.

Anecdotal reports from NSW public offices suggest that many employees fail to routinely capture messages using one of these methods, so the survey sought to assess the extent to which messages of corporate value are being captured as records. The results indicate that:

• in the majority of organisations employees routinely capture messages of corporate value using traditional methods. 23% of respondents advised that employees in their organisations capture messages to an EDRMS and do not print and file; 19% advised that employees print and file messages and do not capture them to an EDRMS; and 26% advised that employees both capture messages to an EDRMS and print and file them.
• in almost one third of organisations employees do not routinely capture messages of corporate value using traditional methods. 33% of respondents advised that employees in their organisation neither capture messages to an EDRMS nor print and file them.
• respondents who think that employees in their organisations fail to routinely capture messages of corporate value are also likely to think that important corporate records are at risk of loss or premature destruction because they are only stored in personal email accounts. Of the respondents who advised that employees in their organisation neither capture messages to an EDRMS nor print and file them, 79% consider that important corporate records are only stored in personal email accounts and are therefore at risk of loss or premature destruction.

Comments from respondents indicate that there are still significant barriers to comprehensive capture of messages of corporate value:

Some staff understand the importance of work related emails as records and register them correctly in our RM system; others just register all their emails in the RM system because their email account is full with no regard as to their value (i.e. personal, NAP records captured).”

We have policies in place concerning staff responsibility for capturing business related emails and most staff will capture clearly defined business items. However the issues arise from the volume, the length of ‘string’ emails and lack of understanding of what is a business related email. Concern is not only restricted to capturing emails but also breach of privacy particularly with ‘string’ emails circulating in and out of the organisation.”

Even when emails are captured in our EDRMS users focus on capturing emails from their inbox (i.e. email received) and forget about the need to capture sent emails. While it is easy to set up automated links between email folders and the EDRMS, a set and forget method, users fail to save their sent emails to the linked folder. I have failed to find an elegant, non-intrusive method to achieve the capture of the whole ‘story’.”

Alternative capture strategies

Some archives and records professionals have suggested that traditional methods for capturing messages have failed, with employees generally disinclined to move messages of corporate value from their email applications. These professionals have suggested that it may be necessary to develop new methods for capturing emails, such as capturing entire email accounts for core business managers and accepting that the messages sent and received by other employees will not be captured.

The survey sought to assess whether organisations have investigated any such alternative capture strategies, and if so, what alternative strategies have been investigated. The results suggest that few organisations have investigated such strategies. However one respondent did suggest that an effective alternative strategy is on the horizon:

Email is now THE business information circulation system. The paper paradigm does not work in the email world due to the volume and velocity of email. Having email auto-classified is the only viable solution although we are not there yet. That solution will come.”

Email archiving solutions

Email archiving solutions are software products which enable the capture and transfer of copies of all emails from an organisation’s email server to a separate storage location. Anecdotal reports from NSW public offices suggest that these types of solutions are increasingly common across the sector, with organisations relying on these solutions as default records storage systems. The survey sought to test this assumption, and to gather information about the types of email archiving solutions being implemented. The results indicate that about half of the responding organisations have implemented an archiving solution, with two products (Symantec Enterprise Vault and Quest Archives Manager) being the most commonly implemented.

A number of email archiving solutions have retention and disposal functionality (e.g. the ability to set retention periods and disposal actions on messages and to destroy messages when retention periods have expired). However the results of the survey suggest that organisations with email archiving solutions are not actively managing the retention and disposal of messages using this functionality.

Comments from respondents indicate that email archiving solutions are being relied on as recordkeeping solutions:

We are a large department with a mature EDRMS which easily facilitates capture of email. However significant users generally do not consider email capture to be a priority, and consider the vault a sufficient record keeping/management tool.”

Email-related ‘disasters’

State Records advises NSW public offices that failing to capture email messages of corporate value into a recordkeeping system can expose an organisation to risks and financial penalties. The survey sought to assess the extent to which the inability to find email messages when required has exposed organisations to specific risks and penalties (e.g. being forced to settle or losing a legal dispute, financial penalties such as fines etc.)

The results indicate that few organisations have incurred specific risks or penalties as a result of being unable to find email messages when required, with the majority of respondents (83%) advising that their organisation has not experienced an email-related ‘disaster’. Very few respondents advised that their organisation had suffered a particular set back or penalty as a result of being unable to find email messages when required:

• 11% of respondents advised that their organisation has suffered a financial penalty, e.g. a fine
• 3% of respondents advised that their organisation has been forced to settle a legal dispute
• 3% of respondents advised that their organisation has lost a legal dispute
• 3% of respondents advised that being unable to find email messages when required has had a bearing on its legal proceedings
• 3% of respondents advised that their organisation had to retrieve all messages that mentioned a particular word from backup tapes to satisfy a Standing Order 52 for papers.

Respondents’ comments in relation to email-related ‘disasters’ were mixed, with some acknowledging that there are no real penalties while others expected that a disaster would eventually occur and would lead to changes in email management practices:

Records Management (including emails) is given a low priority and minimal respect as there is little risk to the CEO as it is common knowledge that no audits are conducted and no penalties for non compliance are applied.”

I don’t think there is a focus on email management being an issue here. When we have a ‘disaster’ then something will be done.”

State Records would like to thank all of those who took the time to respond to the survey. If you have any comments about email management practices in your own organisation, please leave a comment below.