Recordkeeping FAQs – keeping records in systems that aren’t EDRMS July 27, 2017

We have recently received a number of enquiries about managing records in specific systems used to support various business activities. These systems range from fleet management systems to child care management systems to fundraising support systems.

These systems contain a mix of data input by users, data imported from other systems and scanned documents (e.g. reports, invoices etc.)

Each of the organisations that contacted us also has a dedicated recordkeeping system (EDRMS) in their organisation. Their question for us boiled down to “What can we manage in our fleet management/child care management/fundraising support system and what do we need to extract and manage in our EDRMS?” In making this decision, there are a number of factors that need to be considered.

Key among these is: What is the value of the records to the organisation?

If the records are of short term value to the organisation then it may be appropriate to manage them in the specific business system. For example, customer management records generally have short term value to an organisation and are often authorised for destruction when administrative or reference use ceases – these types of records could potentially be kept in a CRM system for as long as needed by the organisation.

On the other hand, if the records are of long term value to the organisation or have been identified as State archives in an approved retention and disposal authority, the organisation will need to consider whether the recordkeeping capabilities of the system are sufficient.

Systems such as fleet management systems, child care management systems and fundraising support systems are designed to support specific activities and facilitate transactions between an organisation and its clients or stakeholders. They are not DESIGNED to be recordkeeping systems, although they may have certain recordkeeping functionality. Several questions can be asked which, if answered in the affirmative, may mean that the system is suitable for the retention of short-term records:

  • Can the system prevent unauthorised modification of records and metadata?
  • Can the system prevent unauthorised deletion of records and metadata?
  • Can the system secure/restrict access to records (if required)?

Conversely, if the records are of long term value to the organisation or document high risk business, and the recordkeeping capabilities of the system are poor (the above questions are answered in the negative), it may be advisable to capture them in a dedicated recordkeeping system as their long term survival may be more assured.

It’s also really important to consider whether there is an exit strategy for the system. System acquisition in many organisations is decentralised – we know of some agencies where business units are able to purchase systems without IT oversight provided that their cost is below a certain threshold. When deciding whether to keep records in a particular system, organisations need to consider the export capabilities of the system and its likely longevity:

  • Can the system export records and associated metadata, e.g. to another system or to an external storage device?
  • If so, does the export process retain record relationships and metadata, and provide the records is a useful format?
  • What arrangements to ensure continued access to information in the system are included in the contract?
  • How reputable and well established is the provider? How likely are they to continue providing support for the system?

Manage in place, integrate or export

There are three general options for recordkeeping in business systems:

    1. Manage in place
      The records can stay in the system and the organisation will rely on the system as its system of record for that particular area of business. The organisation will need to be confident that the system can maintain the records for as long as the organisation needs them.
    2. Integrate
      Integrations between business systems and EDRMS are commonly developed for high risk, high value and high volume systems where it is worth the time and effort to get the integration right. For example, we have published a case study of the integration between NSW Police’s financial management system (SAP) and EDRMS.
    3. Manual capture
      The organisation commits to periodically extracting records from the system and saving them in its EDRMS. This option is necessary if an integration is not appropriate AND:
      – the system cannot keep adequate records of the business for as long as required, or
      – there are concerns about the longevity or stability of the system.

Checklist for assessing business systems

We have published a checklist for assessing business systems – organisations can use this to assess existing or new systems to determine what recordkeeping capabilities they need, what capabilities they have, and what strategies can be implemented to plug any gaps.

We are currently reviewing this checklist – if you have any feedback about using the checklist we’d love to hear from you!

Leave a Reply

You must be logged in to post a comment.