Is the email and texting culture jeopardising your company?
12th September 2005 In recent weeks, FSN has brought you news around a swathe of regulatory requirements in Europe, and the US that affect financial reporting systems, i.e. formal communications. This week, with the help of a special feature commissioned by FSN from the Enterprise Content Management Association, we examine how informal communications in financial transactions and a lack of electronic records management can expose companies to significant reputational, financial and compliance risks.
We are all exposed to the e-mail deluge, and alongside the spam and the chatty personal exchanges are more and more important business transactions - contract negotiations, employee communications, customer responses, legal exchanges and official returns. The audit trail of these legally-binding exchanges is in danger of being rendered inaccessible by haphazard policies that fail to identify those e-mails that should be retained as formal records. Technology advances are creating further issues with hand-held e-mail devices, text messaging and instant messaging.
•
E-mails are being used for contract negotiations, HR letters, responses to authorities, legal commentaries and financial transactions in over 70% of UK organisations. In the US , numbers approach 90%.
•
Less than 45% of companies have policies on the length of time e-mails are retained and how or by whom they are stored.
•
Of those that do have policies, less than half are selecting retained e-mail by content (as opposed to storing all of it).
•
Business use of instant messaging and text messaging is increasing rapidly with little thought to the recording of what was said, by whom, when and in what context.
All of these factors could hamper a legal investigation or action by a regulatory authority. In the US a number of major court cases have hinged on the ability of organisations to produce a full history of e-mail exchanges. In one case the fines and damages have approached $1.5bn. The judge's decision against that firm was largely based on their inability and incompetence with regard to producing e-mails as evidence.
E-mails as records
To understand just how an e-mail might be considered to be a record, we need to consider what the definition of a record is. The following is useful: "A record is evidence of a business decision or action. Records are classified by their administrative, financial, legal, operational or historic value. Many different laws, regulations, standards and business practices include requirements about how records are retained. Organisations must comply with the record-keeping requirements defined by regulators, their industry, and by legal precedents."
This, of course, raises the problem of how to recognise which e-mails are records. In the past, a paper document carrying important information might carry with it a number of clues - high quality paper, an impressive letterhead with legal information about the sending company, a hand-written signature, a set of terms and conditions on the back. E-mails on the other hand tend to be rather flat and are becoming increasingly informal - despite the potential importance of the content. Some e-mail management systems endeavour to automatically detect and route important mails using a filter technique similar to that used for spam-detection, but human intervention is generally still required - at least until the system has been "trained".
E-mail policies
In the AIIM survey, over 75% of organisations did have policies about the acceptable use of e-mails, although monitoring of this can cause further issues regarding employee privacy. In some European countries, judges have ruled that it is unacceptable for employers to screen office e-mails. Meanwhile, some 60% of organisations have set a maximum mailbox size. Yet only 45% have a policy on how long e-mails should be retained, dropping to just 39% who know where, how and by whom they will be stored.
You can confirm for yourself the effectiveness of most organisations' retention policies by asking any group of people how they archive their e-mails at work. Offer the following choices:
•
Use Outlook Archive?
•
Use Outlook Archive with a folder structure?
•
Print to paper and then file in a cabinet?
•
Delete after 3 months - with server back-up tapes as "archive"?
•
Selective capture into a document management system?
You are almost certain to receive the full spectrum of answers, and more worryingly, this is likely to be true even if all of the group work at the same company!
For those that use the archiving facility in Outlook, it can be interesting to ask if they know where the Archive.pst file is stored and if it is therefore backed-up. Shared access by others to these archived e-mails is almost never available. Many will admit that if employees leave the company new e-mails may be re-directed, but their historic e-mails are deleted.
Even in those organisations who have implemented document capture of e-mails, an interesting follow up question to ask is about the criteria used to select which mails go into the system, and who has set it - or who should set it? The IT department is not necessarily best placed to determine what the company's record retention policy should be.
Over and above the normal record-setting criteria, there are some e-mail specific issues involved. Should an attached document be stored with the e-mail (which sets its original context) or merely be treated as a stand-alone document to be filed in the most appropriate document area? If an e-mail has threaded its way through multiple replies and forwards should previous versions be saved or only the last and longest one?
Multi-channel Problems
The AIIM survey found that around 50% of organisations are using instant messaging, but only 28% have a policy for its use. Some 63% of organisations make use of text messages and e-mail enabled phones for business use, but only 22% have any usage policies. It is easy to see that in, say, a financial or share-dealing environment, all of these devices could be used for exchanges that might be of interest to the regulatory bodies. There are further implications for HR departments - including the notorious cases of staff being dismissed by text message.
Document Protocols and Practices
E-mail and other messaging technologies have been rapidly adopted for all types of business and public sector communication, replacing protocols and practices that have been in place for many years. The filing cabinet has long been the traditional icon of the office, holding as it does the essential records and history of all incoming and outgoing correspondence. Although space-consuming and slow to access, the filing cabinet was understood by all and provided relatively safe, long-term storage for the company's history.
A competently implemented e-mail management system with well thought out and secure storage can replicate the filing cabinet - or in fact many, many filing cabinets. As part of an enterprise wide content and records management system, it will bring major improvements in staff efficiency and collaboration as well as ensuring ongoing compliance.
The author of this article for FSN is Doug Miles, a director of content management association AIIM Europe.
We are all exposed to the e-mail deluge, and alongside the spam and the chatty personal exchanges are more and more important business transactions - contract negotiations, employee communications, customer responses, legal exchanges and official returns. The audit trail of these legally-binding exchanges is in danger of being rendered inaccessible by haphazard policies that fail to identify those e-mails that should be retained as formal records. Technology advances are creating further issues with hand-held e-mail devices, text messaging and instant messaging.