Future Proof – Protecting our digital future

Here are some of the interesting questions we were asked in January and February about a whole host of digital recordkeeping issues. If you have any feedback for us on our advice, please don’t hesitate to let us know.

• How can I apply metadata to social media records?
• We used the government’s online recruitment tool Taleo to manage all aspects of our recruiting operations. The applications received for each position advertised are kept and managed in Taleo and not kept on the recruitment files.  Can you please advise if this is acceptable? Also, can you please advise what other type of documents are to be kept on the recruitment file, knowing that we use Taleo?
• We have a new business system – how do I know if it needs to be compliant with the Standard on digital recordkeeping?
• Are there any issues if I buy an off-the-shelf software package and then customise it a lot?
• Should my organisation use Google Groups as an official business communication tool?
• We scan in black and white, but a member of our legal team has said that for some of their work, different coloured pens or stamps have important meaning. What should we do?
• Are your podcasts available via iTunes, or downloadable to a mobile or other device?
• We are implementing a new electronic business system to manage financial transactions and property management. Records about these processes will be made and managed in the system. Under the Standard on digital recordkeeping, do we need to do a metadata mapping for this system?

How can I apply metadata to social media records?

A lot of the third-party systems listed in State Records draft guideline Managing social media information that are capable of exporting records out of social media systems will not automatically apply a lot of metadata to these records.

Metadata is critically important for any record, including social media records. When developing a social media strategy, it’s important to not just think of the records you will need, but to also think of the metadata or contextual and descriptive information you will need about your social media records to make them as useful as possible.

To identify the records and the metadata you might need, it’s really important to:

• think long term
• think of likely business use
• think of what you will need into the future to make best and most effective business use of your information

Ask questions like:

• what information will you need to make sense of your business information now and in the future?
• what information will you need to trust your business information now and in the future?
• what information will you need to reuse your business information now and in the future?

You may find that your current recordkeeping strategies do not provide you with a lot of metadata about your social media records and, depending of the business value of this information, you may need to develop alternate strategies and work out ways in which social media recordkeeping can really contribute to valuable and useful information to business, rather than simply being a compliance exercise.

Example: Using RSS to capture Twitter updates

State Records uses RSS feeds as one strategy to capture information about our tweets and responses to them. We receive an email each time we tweet and each time someone retweets or mentions one of our tweets. This is captured in our EDRMS as an email with the auto generated title ‘State Records of SA (@StateRecordsSA) mentioned you on Twitter!’:

RT “@FutureProofNSW: Future Proof: Assessing information risks in business systems … #archives” great post! – @StateRecordsSA
https://twitter.com?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+21
https://twitter.com?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+21                              Future Proof, �
You were mentioned in a Tweet!     �
HYPERLINK “https://twitter.com/FutureProofNSW?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+22“Future Proof                  �
https://twitter.com/scribe/ibis?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+20
�
HYPERLINK “https://twitter.com/StateRecordsSA/status/304063029291667456?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+246“State Records of SA              HYPERLINK “https://twitter.com/StateRecordsSA/status/304063029291667456?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+248“State Records of SA   �
HYPERLINK “https://twitter.com/StateRecordsSA/status/304063029291667456?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+247″@StateRecordsSA  �
�
RT “HYPERLINK “http://twitter.com/FutureProofNSW?uid=73039281&iid=de1b1e66-8e89-4ea2-875d-96de08e0de74&nid=4+255″@FutureProofNSW: Future Proof: Assessing information risks in business systems …

The date of the tweet is automatically captured.

While the record in this form can serve evidential purposes, to make the information it contains more useful we could consider manually adding more information to the auto generated metadata title to provide more context to the record. We could also consider alternative recordkeeping strategies, such as exporting PDF reports of tweets and mentions, or running tweet reach reports to get more useable forms of business information.

We used the government’s online recruitment tool Taleo to manage all aspects of our recruiting operations. The applications received for each position advertised are kept and managed in Taleo and not kept on the recruitment files.  Can you please advise if this is acceptable? Also, can you please advise what other type of documents are to be kept on the recruitment file, knowing that we use Taleo?

State Records has published some advice on managing recruitment records the Taleo e-Recruitment tool. This advice includes a section which lists different types of recruitment records (e.g. job advertisements, applications, records of the selection panel etc.) and makes suggestions regarding their management (e.g. whether they can be maintained in e-Recruitment or should be exported to an organisation’s recordkeeping system).

With regard to applications, records for unsuccessful applicants have a minimum retention periods of 2 years after recruitment finalised (GA28 15.10.1) so can be retained as ‘read only’ within e-Recruitment.

However records for successful applicants need to be kept for at least 75 years from date of birth or 7 years after employment ceases (GA28 15.4.3). These records should be exported out of Taleo and into to a recordkeeping system so they can be managed long term.

We have a new business system – how do I know if it needs to be compliant with the Standard on digital recordkeeping?

As outlined in our Checklist for assessing business systems, ask a few questions about the system:

• Does the system cover a high risk area of your business?
• Is the information in the system unique – ie not duplicated or published elsewhere?
• Are there any legislative or business requirements to make and keep records of the business the system supports?
• Does the system relate to a business activity for which there is an identifiable disposal class in a General Retention & Disposal Authority or your organisation’s Functional Retention & Disposal Authority?
• Did this system replace a previous system or systems? If yes, were records kept of the business supported by the previous system?

Basically, if the system relates to a high risk business area and if you are going to need evidence and information of the business that is being performed in this system then yes, the system does need to be compliant with the Standard.

Being compliant with the Standard basically means:

• the system can capture read only versions of the digital records you require
• the system can retrieve and present the defined digital records in human readable form
• the system restrict or permit access to defined records if required
• the system can make and keep metadata that allows information to be used, managed and understood
• the system can export records and their metadata when required.

If it is too costly or too difficult to make business systems themselves compliant with the Standard, you can do regular exports of necessary business records out of the business system and capture them into your corporate electronic records and document management systems, as a way of ensuring you have the records you need to support your business operations.

Are there any issues if I buy an off-the-shelf software package and then customise it a lot?

Lots of people customise EDRMS or other off-the-shelf systems to better meet their business needs, and this can be a very valid approach, but do be aware of some of the problems that this can cause:

• in the recent administrative change in NSW government, it proved difficult to move information between some organisations because of different software configurations. Even organisations using the same software had difficulty exchanging information because each organisation had designed and configured their systems differently.
• system upgrades can be very difficult, time consuming and costly if your software has been extensively modified
• if your system is extensively modified and it is hard to upgrade, maintaining backwards and forwards compatibility with other systems in your organisation can be very challenging. Maintaining a customised solution will cost more than maintaining a non-customised solution, so you should weigh up these costs over time
• if your system is highly modified and cannot be upgraded, when their system advances, the system vendor may drop support for your older version of the system
• due to the costs involved, customising software tends to commit your organisation to this software for long periods of time.
• you will likely be very dependent on software vendors to develop and maintain your system.

Back in 2010, Gartner warned of the costs associated with bringing all corporate ICT systems up to the latest versions – the ‘backlog of maintenance’ as it defined it. It estimated that this ‘global IT debt’ would be $US1 trillion by 2015.

Customisations contribute to this backlog of maintenance and so you should only undertake customisations when there is a real business driver to do so.

Should my organisation use Google Groups as an official business communication tool?

Most social media applications are easy, simple and very valuable for business purposes and community engagement, but they not very clear, simple and easy from a recordkeeping perspective.

According to State Records draft guideline Managing social media information, to manage any form of social media information you need to:

• be aware of the types of business that are moving to social media environments
• be aware of the different risk levels that apply to these business areas
• know how long your organisation will need the information that is moving to social media environments for.

If:

• you identify that what is moving to social media is important or risky business, and
• you determine that you will need to keep this information for a significant period (probably 2-3+ years),

then you can’t rely on the social media application to manage the information for you.

You need to develop a strategy to actively capture and manage the social media information you need. That is, you have to work out how to export the information out of the social media system it is in (which are third party owned and located in the cloud) and bring it into corporate systems.

The good news with Google Groups, however, is that its communication is online or email based. Therefore it may be fairly simple to integrate with your current email management processes and may be easy to integrate with your current recordkeeping processes and systems.

Like all social media applications, information shared through Google Groups is located online in the cloud and so you need to make sure that the business you are performing via Google Groups is appropriate to be stored in the cloud.

We scan in black and white, but a member of our legal team has said that for some of their work, different coloured pens or stamps have important meaning. What should we do?

If it is essential for your legal team to have colour reproductions in order to understand the records or preserve their evidential value, then you need to digitise in colour. See our digitisation guidelines for further advice.

Recordkeeping must support your business. Business requirements will differ across your organisation and so how you make and keep records may need to differ too.

It is really important to talk to the different business areas in your organisation and make sure that together you are making and keeping the records that the business actually needs.

Are your podcasts available via iTunes, or downloadable to a mobile or other device?

Sorry! Not yet! We are working on it.

We will be restructuring the podcast section of our website to provide a single source for downloading podcasts as mp3s which can then be manually uploaded to iTunes on your computer or mobile device. Unfortunately though, with all the other work we do, it is going to take us several months to convert all our existing content and then set up the processes whereby we can upload all necessary metadata and content descriptions to iTunes. But we will get there!

We will make an announcement when this work is complete, but in the meantime thank you to everyone who regularly listens to our podcasts via their computers.

We are implementing a new electronic business system to manage financial transactions and property management. Records about these processes will be made and managed in the system. Under the Standard on digital recordkeeping, do we need to do a metadata mapping for this system?

Yes you do.

Requirement 3.2 of the Standard requires you to map core recordkeeping metadata elements (i.e. unique identifier, title, date of creation, who/what created the record, the business function/process it relates to, the creating application and record type, as well as metadata documenting the identified recordkeeping processes) to the corresponding elements in business systems being used to maintain records.

The easiest way to perform such a mapping is to list the Standard’s required metadata elements and then note for each element how your system generates/maintains this metadata. There is an example in the Standard on digital recordkeeping.