News & Insights

Get Your Records Retention Schedule Under Control — And Keep It That Way: A Case Study in Global Retention Scheduling

Zasio, Your Complete Information Governance Partner, in white over a purple-tinted city skyline

Developing an international retention schedule is a major challenge, but for Zasio it’s what we do every day. During this co-sponsored webinar with ARMA International, our presenters will walk you through a case study on global retention scheduling involving a major pharmaceutical contract organization, PRA Health Sciences. 

You’ll see the step-by-step process used, and see how we overcame challenges from global harmonization, expanding coverage to new jurisdictions, optimizing the number of record categories, managing citations and changes, and much more. You’ll learn how to manage your retention schedule and keep it that way!

Audio-described version
Transcript: A Case Study in Global Retention Scheduling

Duration: 1:08:20 · Recorded: 2020-12-10

Speakers: Ann Snyder, Manager of Content Development, ARMA International (host and moderator); Warren Bean, CRM, Senior Sales Engineer, Zasio Enterprises, Inc.; Jennifer Chadband (slide: Jenn Chadband Masingill), CRM, IGP, ECMp, Senior Analyst/Licensed Attorney, Zasio Enterprises, Inc.; Greg Dinklenburg, Associate Director of Records and Information Management, PRA Health Sciences

Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.

Ann Snyder: Welcome to ARMA International's webinar, Get Your Records Retention Schedule Under Control and Keep It That Way: A Case Study in Global Retention Scheduling. Is everyone seeing my screen okay? I am. Awesome. Today's webinar is sponsored by the great folks at Zasio Enterprises, Inc. I'm Ann Snyder, Manager of Content Development at ARMA International, and I will be your host and moderator for this webinar.

For those of you who have attained your IGP, the Information Governance Professional certification, today's webinar counts toward one continuing education credit in the information management category. If you have questions during the webinar, feel free to ask in the Q&A box. We're unlikely to get to all questions, but we'll respond to remaining questions received after the webinar has concluded. Before we get started, I have a few housekeeping items I need to take care of. First up is professional membership.

[Slide: Value of ARMA: "To empower the community of information professionals to advance their careers, organizations, and the profession." Over 5500 members internationally; peer network of IM/IG professionals; benefits of membership: local and international community, education and certifications, career and job resources. Visit us at www.arma.org.]

If you haven't checked out your membership benefits lately, we are excited to offer online and virtual opportunities to get connected and resourced through your membership. If you aren't an ARMA International member yet, as you can see, there are a lot of great resources to take advantage of, and it's an affordable way to get resourced as an information professional. Information about ARMA membership and getting started can be found on our website at ARMA.org. Please take a few minutes to participate in ARMA's second annual IG Maturity Index Survey. In March this year, ARMA International published the Information Governance Maturity Index Report 2020.

That's quite a mouthful, presenting the results of the IG Index Maturity Survey that we conducted in the last quarter of 2019. The survey aligns with ARMA's IG implementation model, the IGIM, and is designed to measure IG program maturity overall and across the seven key areas of that model. This year, we're collecting our first year-over-year comparison data. Help us to build a useful benchmarking resource for your organization and the IG profession by completing the online survey and sharing it with your colleagues. Everyone's constantly asking for this kind of benchmarking research, so please help us build it.

Jen, would you add the survey link in the chat box? I encourage everyone to please take this, share this with your colleagues. Don't take it now, though, because we're about to open with some great panelists.

[Slide: Panelists: Warren Bean, CRM, Senior Sales Engineer, Zasio Enterprises, Inc.; Jenn Chadband Masingill, CRM, IGP, ECMp, Senior Analyst/Licensed Attorney, Zasio Enterprises, Inc.; Greg Dinklenburg, Associate Director of Records and Information Management, PRA Health Sciences. Moderator: Ann Snyder, Manager of Content Development, ARMA International.]

And without further ado, let me introduce them. We are joined today by two subject matter experts from our business partner, Zasio. We have Warren Bean and Jen Chadband Masingill. If you guys can just say a quick shout out, hello. Jen's not on video, I think, so.

Warren Bean: Yes. Hi, Ann. Hi, Greg. And yes, I'm Warren Bean. You can see my title there on the slide deck, but basically, I help out with the sales process here at Zasio and also with the development side.

So I help to manage the development products or projects and kind of guide where we take those projects. And I've been with the company for 20 years now, hard to believe, but it has gone by quickly. And I think I've known Greg for a good chunk of those years as well. So welcome, Greg.

Greg Dinklenburg: Thank you.

Ann Snyder: And so thanks for that introduction to Greg. We're joined by Greg Dinklenburg. He is the Associate Director of Records and Information Management at PRA Health Sciences. Greg is going to share with us some of his experience in tackling one of the harder kinds of retention schedules, a global retention schedule. Greg, could you just tell us a little bit more about PRA Health Sciences and your role there, just to give us some context?

Greg Dinklenburg: Sure. We're a global healthcare intelligence partner and consistently ranked among the top contract research organizations and best employers worldwide. We have developed life-saving and life-improving drugs with our comprehensive clinical development services, including data management, clinical trial management, medical writing, and regulatory and drug development consulting. Just to give you a little bit of scope, we have about 19,000 plus employees with 75 plus global offices in over 80 countries.

[Slide: Agenda. Overview of the process: 1) Intake/Assessment; 2) Creating a Roadmap; 3) Delivery (interviews, legal research, application of research to schedule, retention adjustments, harmonization, schedule consolidation/expansion); 4) Maintenance/Auditing; 5) Operationalizing. Deeper dive into common challenges: schedule outdated/refresh needed, jurisdictional issues, privacy concerns, schedule too complicated, maintenance/auditing, operationalizing.]

Ann Snyder: Great. Thank you so much for that, to give us that context for this discussion.

Speaker: [inaudible] as well.

Ann Snyder: Oh, I'm sorry. I thought you were going to. Yes, Jen, you can say hi, you're not on camera.

Jennifer Chadband: Hi. Yeah, I'm not on camera. Hi, everybody. Jennifer Chadband here. I am a senior analyst and licensed attorney.

I've been with Zasio nearly nine years in the consulting department, and I've had the pleasure of working with Greg and PRA, and we're going to talk a little bit more about that project here. But it's great to be here, and thanks for joining us, everybody.

Ann Snyder: Great, thanks. So let's go to the agenda here. If you are the person at your organization who's tasked with developing and maintaining your organization's records retention schedule, you know that this can seem, feel like a daunting task, but you can successfully tackle this challenge and get your records retention schedule under control and keep it that way. Today we're going to walk through the steps to tackling this challenge. And I think of it, I had a mentor who said when you're tackling this kind of problem, it's like eating an elephant: you take it one bite at a time.

Whatever visual works for you. Again, this is a piece-by-piece process, so we're going to begin first with an overview of the process. If you're working with an outside consultant, there's going to be an intake process, but regardless, you're doing some kind of initial assessment: what's your starting point? Then you'll have to create a roadmap. Most people can't tackle all of their challenges all at once; they have to prioritize and figure out the order of operations they're going to tackle them in.

Then there's the delivery. This is either an internal delivery or a delivery from a consultant of those things that you've mapped out as priorities over time. And then of course you get to maintenance and auditing, that's keeping your retention schedule up to date after all that good work you've done, and then operationalizing. We mean getting that out to your end users and also connecting it up to systems, if you want to take it to that level. Then we're going to move into a deeper dive into some of the common challenges that people face: schedules need to be updated or a refresh is required, there are jurisdictional issues or privacy concerns, and obviously there are some overlaps within those issues. You might be expanding into a new jurisdiction, and that creates some privacy issues.

The schedule's too complicated, and you see a repeat here, maintenance and auditing and operationalizing. We're going to do a deeper dive into them within the common challenges section, and we'll give them just a quick overview as we go through the overview of the process. But we promise that we're going to be doing a little bit of a live demo of the Zasio Versatile Retention tool to show you how this can be done using the services that Zasio offers. So let's start with this, our first, the intake process. It's okay. Warren, so let's start at the beginning here. A prospective client is coming to you and asking for help with their organization's records retention schedule, and I imagine you're seeing a wide range of clients.

Can you tell us a little bit more about what that intake and assessment looks like?

Warren Bean: Sure. So people come to us with all different levels of starting points, not only with experience but just where they're at in that journey of trying to get their records in place. In some cases they're very sophisticated; they know exactly what they need, they just need maybe some specific legal research. In other cases, maybe they're brand new in the role; they don't know where to start. They just know they've got to get compliant, but they don't know what that means. And so we've got to really, first of all, assess where is the client in that process. It is kind of a path, and so there's certain steps you've got to take; some come before others. We have to figure out where they're at in that journey, so to speak.

Ann Snyder: And I guess a sensible place to start is with that retention schedule itself, so starting with a look at that.

Warren Bean: Absolutely.

Ann Snyder: What are some common challenges you see when you begin that process?

Warren Bean: They come in a lot of different forms, but you're right, it is really good to start with the retention schedule. And sometimes we'll ask, can we see a copy of the retention schedule, and there's kind of a little, well, yes, we've got this Word document that was developed in 1982, and yeah, we'll send it to you, but it's not much. We have that level. In other cases it's very well thought out, very well reviewed, but maybe it just hasn't been updated in a long time. Sometimes it's really complicated. Sometimes it's oversimplified. So it is all over the map as far as the different things that we see with regard to the retention schedule.

Ann Snyder: So Greg, can you tell us a little bit more about your intake process, what challenges or what brought you to Zasio in the first place?

Greg Dinklenburg: First of all, I've been using Zasio Versatile Retention, which is their software that we'll see later, for about 15 years, and I decided to bring Zasio's product and services in when I came on board with PRA about four years ago. Not only do I know the software and I worked with it, but it made sense to utilize their consulting group in conjunction with the software, since I was really a one-man team at the time. So my bandwidth was pretty limited, and I had other pressing schedules to be created for GDPR.

Ann Snyder: So what I'm hearing is this is the way you were using this outside consulting service, as a way to augment your staffing limitations.

Greg Dinklenburg: Right, they were an extension of my staff.

Ann Snyder: Excellent. Exactly. So let's move on. There's this initial intake and assessment of your schedule. The next part of it is then, based on that intake and assessment, you have to plan a process of how you're going to tackle it.

And this is also not just making a roadmap overall, because sometimes this is a multi-year, multi-phase project, but also then digging into the specific statements of work for each of those parts of the process. Warren, can you tell us just a little bit more about how you help clients build that roadmap, and particularly how you help them prioritize? So you found all kinds of issues with the retention schedule; how do you help them decide what to start with first and how to phase that in?

Warren Bean: Yeah, I think that it mainly starts with looking at those pain points and the priorities that they have. So if the pain point is that they know they're not compliant with certain laws, then we've got to start there. If the pain point is that they really don't even know what records they have to apply the retention schedules to, then obviously we've got to start with maybe some kind of a data inventory. And so again, we kind of know what the path is and what steps people need to take, and so we can kind of develop the roadmap based on, maybe they've already done a data inventory, so we don't need to do that. Maybe they've already done interviews with stakeholders; we don't need to start there, but they really need to review their current schedule or have some different research. And so we have to customize that depending on the needs, but also the priorities, the budget. All of those issues come into play when you're trying to develop a strategic roadmap to get someone from point A to point B and make sure you fill in all the gaps. And obviously, fires first: if there's a major compliance gap, you want to put that out, rather than just something that's more cosmetic or about delivery and things like that.

Ann Snyder: So Jen, can you just share with us some common challenges that your clients face at this stage?

Jennifer Chadband: Yeah, absolutely. So I think some common challenges that we see is, first of all, just being realistic about your timeline. For instance, when you're getting into the research, if you're a multinational corporation, you might be looking at 50 plus jurisdictions or more, and those jurisdictions have hundreds of laws. So just be really realistic about the time that will be required to kind of go through all of that in relation to your retention schedule. And then I would say one of the biggest things, and this just gets more complex because there are so many moving parts, is the review aspect: lining up your resources, who's going to be reviewing, making sure that you're communicating with them on the front end and that you are able to effectively get time from them as part of that process. So I think those are some of the bigger challenges that we see our clients run into.

Ann Snyder: And I've encountered that as a practitioner: getting those, one, identifying and getting those resources lined up, but also just getting their time, because as streamlined as you can make it, this is still a fairly intensive process and requires sign-off and review. So, Greg, I understand that your organization took a multi-phase, multi-year approach to addressing its retention schedule updates. So at a really high level, can you just give us a sense of what your approach was and why you addressed it in phases like this?

Greg Dinklenburg: Sure. What we had in place was a little antiquated, so I decided to do three stages and committed to five years. So first we established the RIM program framework, which was creating our policy, and all the document life, involving the document life cycle, and then writing the process documents, including training, to support that policy. Next, which is what phase we're in now, is building the records retention schedules. That's the biggest part.

And then hopefully by the end of next year we will be completed with that, and then be able to get an educational training program together and then start auditing in 2022.

Ann Snyder: All right, let's move to the next phase here, delivery. So this is the phase where you do the actual work that you scoped out in the step we just saw. Again, of course, this is going to be an iterative process for multi-year, multi-phase projects, and there are certainly specific deliverables that are going to vary depending on what your pain points are. But at a high level, Warren, would you tell us what this process is like? What does this look like for a typical client?

Warren Bean: Yeah, so it can vary quite a bit as far as the process that you take. But essentially, the delivery involves those steps that have already been mentioned, as far as, in some cases, doing interviews, if you don't have an inventory of your records already. So we'd have to be able to talk to the stakeholders, find out what records they're keeping. And if they already have that in some form, then we can bypass that step in some cases and just go right to the retention schedule. But basically we take the records that they're keeping; from that we know what kind of legal research needs to be done, so we start the legal research depending on jurisdictions, depending on the scope that's needed. Then once we've done that legal research, then we have to apply that to the schedule, or actually, in some cases, build the schedule first, again depending on where they're starting from.

Ann Snyder: Right, so you have the extremes, someone's coming in without one or a minimal schedule. Okay.

Warren Bean: Exactly. So it might be that a draft schedule is created based on the inventory or the interviews that are done. That's shared with the client to make sure that we're on the right track. If that structure looks good, we don't have to adjust it too much, then we dive into the legal research side. Do all of the citation gathering. And then we have to apply or map those citations to the schedule, so that way you map the laws, the requirements, to the schedule itself.

And then that may lead into adjusting those retention periods. So you might find that you're over-retaining or under-retaining, and so you have to adjust, and you always want to bring it up to at least a minimum baseline. Oftentimes we'll divide out the process of making sure that people are keeping things for the minimum time. It might be a separate task to analyze if they're over-retaining, only because that's a more involved process, getting more into what operations they have on the business side that might require things to be kept longer. So that's part of that process. And then harmonization is a big step there as well, whether it's harmonizing different jurisdictions that might have competing requirements or harmonizing issues with privacy versus long-term retention. There's always going to be conflicts that you have to work out and find some compromise with. And we'll dig into that a little bit as we go into some of those specific problems as well. So again, very...

Ann Snyder: So what we're seeing is really client specific, depending on the specific challenges. And I think it's interesting that there's even a phased approach at these lower levels. It's not just a phased approach in terms of big swaths of the updating of your schedule, but even down at the level of the retention periods themselves. Jen, what are some common challenges that your clients are facing at this phase?

Jennifer Chadband: Gosh, I hate to go back to it, but I'm going to have to say kind of the human factor. So scheduling the interviews and making sure that you're getting people's time and getting responses from surveys, I think that's something that we see. I think there's some ways to mitigate that, for sure: making sure that you're really communicating clearly and letting people know what to expect, and kind of having a clear communication campaign with people that you're engaging with on the project. That's always really, really super helpful. And then it kind of goes back to this review aspect, and making sure that you're getting people to truly sit down and look at what you're presenting and think about it and provide any thoughtful feedback, and getting that buy-in.

So I would say those are some of the major challenges that we see during this phase.

Ann Snyder: Greg, can you tell us about your experience with the delivery phase? I know you said you're in your second sort of phase of this. Can you share any challenge that you faced when you were working with this outside partner, and what you did to ease the process? Or even if that went well, did you encounter this sort of internal challenge getting people lined up? Was that something you experienced?

Greg Dinklenburg: Yeah, the internal challenges we kind of faced, it was trying to, like Jen mentioned earlier, trying to keep our stakeholders on task, right, to review these things. Working with Zasio was rather smooth. We came in with a records inventory and provided that to Zasio. They did initial research and applied citation baseline retention periods, and then we went through the review process with our stakeholders, and then bounced the changes back to Zasio. What's really nice and what's really slick is the way the software works, being able to do a change request, and they actually apply all the citations to the records retention schedule I designed within Zasio's software.

Ann Snyder: Right, and we're going to do a deeper dive. We'll actually get a chance to do a little bit of a teaser; Warren is going to walk us through this so you can see what it looks like when we're using a tool to get these citations and updates to you, either to make the changes to your schedule or also that sort of ongoing maintenance and auditing part of it. Of course you can strong-arm it and do it using an Excel spreadsheet. Those techniques work if you're... Yeah, I see Greg's face there. I think we've all done that, and it works, but it's really difficult, and it doesn't give you the kind of visibility. But I don't want to jump the gun on that too much. I want to move to the next item here, which is maintenance and auditing. We're just going to zip through this again, because we're going to do a deep dive in the section. So once you've done all this work, once you've updated your records retention schedule, you want to keep it fresh. And whether you're pushing out, once you're actually pushing out this to your users and things like that, that's the next thing here we're looking at, which is the operationalizing. But you're going to want to do that on some regular basis, and you want to be able to keep at least the citations and updates coming in with some frequency. And you can do this on essentially an evergreen approach there again, where your policy is updated continuously throughout its life.

All right, let's move to the first item here on our deeper dive. A common challenge that's encountered by many organizations is that their retention schedule is outdated. It hasn't been updated in a while. You've already talked about this a little bit, Warren. It needs a refresh. Would you talk a little bit about this process, the kinds of typical challenges that you're encountering with clients?

Warren Bean: Yeah, again, it comes in all different shapes and sizes, but I would say a pretty common scenario is just that it's just been too long since the legal citations have been reviewed. There have been cases where people haven't assigned any kind of legal requirements, and maybe they inherited a schedule that was some time ago, not been vetted against actual legal citations. And so sometimes it's just a matter of saying, hey, can you look at this and tell us if we're up to date or not. You're really just kind of validating what's there. In other cases, it might be that there are new jurisdictions that a person or an organization is working in, whether that's new states within the US or new countries, and so they're not sure what the laws are in those different jurisdictions.

There also can be mergers and acquisitions, where because of a merger they've got new products, they've got new types of records that they didn't have before, maybe new operations. Maybe they're doing production now where they were only doing sales or something, so it's kind of a whole new realm. And so they need to update not only the citations, the research in that case, but also the actual schedules and the actual records.

Ann Snyder: And you're harmonizing in that case too.

Warren Bean: Yeah, the two schedules. Often if you have two organizations that are coming together, whatever the path to that is, they theoretically have been operating with a retention schedule on their own, hopefully, right? And then you need to merge those two into a cohesive whole and also just, again, keep track of how that process went.

Ann Snyder: So can you tell us a little bit more about identifying the gaps in the records retention schedule? You were talking about sort of an industry-specific look as well. Obviously there are common records retention categories that might be missed generally, but we had talked a little bit about industry-specific gaps.

Warren Bean: Sure. Yeah, so oftentimes on the consulting team, Jennifer has a lot of experience with this, they've seen enough retention schedules, they've seen enough research that they know pretty much right away what's missing. They can kind of look at something and say, oh, where are those hazardous materials records, or something along those lines. So you can have gaps with respect to just records that pretty much any standard organization, or maybe a pharmaceutical-specific organization, probably has but maybe they haven't accounted for. It might be gaps because it is an older schedule, so it might be technology gaps: they're now having to cover social media records that they weren't covering before.

Or again, new laws, GDPR, privacy laws, where it can create a gap and you have compelled destruction requirements that weren't being considered before. So those are all definitely concerns. I know with pharmaceutical, and Greg, you can probably speak to this more, but there's a difference between whether you're doing the direct research yourself as an organization or if you are contracting that out. That makes a difference with regard to how long you keep the records. There's an EU law that says you have to keep them for 25 years if you're the sponsor, but it's different if you're not the sponsor. And so those kinds of things can be sometimes misaligned or not caught, depending on what you know about the specific laws that govern that industry.

Ann Snyder: Yeah, and I know we're going to get into this again on the maintenance, but I just want to raise it here as a teaser too, that you can be delivering, so if you're refreshing this schedule, there are different ways that you could be delivering this information to the client. You can either be doing it in a very manual way using spreadsheets and things like that, or, again, we're going to talk about this a little bit, delivering it through a tool, like the Versatile Retention tool or something similar, so that people can track what's going on, and it's a little bit more manageable and auditable as well. So I just want to tease that. We do have a quick question, and I normally table these to the end, but somebody did ask a question in the chat of what do we mean by interviews. And my understanding is just basically this is the sort of excavation of the retention schedule and the types of records with the people at the organization, if that's not fleshed out. Is that correct?

Warren Bean: Yeah, that's a really good question. It's something we just kind of take for granted, but any time that you're going to, especially, build a retention schedule from scratch, you have to talk to the stakeholders and find out what they're actually keeping. And so we say interviews, but it can often be a combination of surveys and interviews, where the surveys might be sent out electronically to say, what records are you keeping, where, how long? There's a number of different questions you can ask, and you try to make that not too long, because then you don't get as much response. Try to hit that sweet spot.

But then, based on those responses you get from the surveys, you typically need to go back and then do follow-up interviews with the stakeholders or with the managers to say, okay, well, I'm not sure exactly what you meant here. Can you fill in the gaps? Can you help me understand what records you're actually keeping? And so the interviews really help to drill down into the specifics of what they're keeping and how long and all of those details.

Ann Snyder: All right, let's move on to jurisdictional issues. We've talked about this; this is one of the reasons that you might need a refresh, and arguably there's a little bit of overlap between the refresh needed, jurisdictional issues and privacy concerns. But this is, I think, a specific enough area. Certainly with organizations I've worked with, we've taken sort of a jurisdictional rollout based on the organization's needs, so say a proposed expansion or planned expansion into another jurisdiction, and getting ourselves compliant for that jurisdiction on an appropriate timeline. So can you just tell us some of the types of jurisdictional challenges that you typically see? Obviously privacy is one of them, but that's the next item on the list here, so separate from privacy specifically.

Warren Bean: Yeah, I think the biggest issue that people run into is when there are wide gaps between requirements of one jurisdiction and another. I mean, ideally, you try to look at, if you're in a dozen jurisdictions, and maybe some have four-year retention, some have five, some have six, you might say, well, it's easy to say, let's just go ahead and keep things for six years, so we just kind of cover all of those different bases. But what if one of those is 20 years or 30 years or 50? You see a lot of those, say, in China or Russia, where those retention periods are quite long and quite different than some of the other standards in the US, the EU, et cetera. And so what do you do? You don't want to keep all of your records for 30 or 50 years. So you have to find some way to either harmonize that or separate out some categories, or you simply create jurisdictional exceptions, where you say our baseline is X, but for these countries, or maybe the specific country, we're going to keep it longer.

And so you create that exception. And it's kind of a judgment call, because it depends on a lot of factors as far as the kind of records, how you destroy them, their confidentiality levels. All of those things can play into that.

Ann Snyder: And can you give us just an idea of the sort of magnitude of the challenge? I think we talked about the number of citations.

Warren Bean: Oh yeah. So in the US right now, in our database, we have over 80,000 citations just for the US alone. And sometimes you've got multiple citations referencing the same laws; that's why it tends to grow like that. And then worldwide we have around 128,000 citations overall. And so, as you can imagine, trying to sort out, if you're in every country, obviously that's a lot of data to sift through and to try and figure out.

Ann Snyder: And it's not just, obviously there's a language challenge. You have to be able to speak the language of that jurisdiction, and you need that sort of level of expertise. So in theory, unless you're geographically tightly defined, limited, limited geographically, and maybe not a heavily regulated industry, you can quickly get into these jurisdictional challenges, and then once it expands outside of the United States, it's a fairly daunting task to keep up with that as a full-time job, and it's a lot of man-hours. Right. So just to talk to Greg about this a little bit: as a global organization, I know that this was part of your refresh, was connected to some jurisdictional issues. Can you tell us more about how jurisdictional issues were part of your challenges and how you worked those into the roadmap?

Greg Dinklenburg: Sure. With about 80 countries, one of the most challenging records retention schedules we did was the human resources records retention schedule, in part due to the fact that we had to do research in 80 different countries, but also data privacy considerations as well. And this schedule actually has the most jurisdictional exceptions. And so what we did was we worked with the regional HR reps to manage language barriers and clarification on citations. Unfortunately, we don't have that sort of network with a lot of our other business units, so that's why we had reached out to Zasio's consulting group, because trying to do it ourselves would be very daunting, and they actually filled in as our subject matter experts.

Ann Snyder: All right, let's move on. You alluded to this: privacy challenges, privacy concerns. This is, again, obviously a hot-button topic for everyone right now. What's interesting, I think, is that historically you used to talk in, we even talked about it here, the minimum retention periods. And now we're getting into something that's cutting in the opposite direction: maximum retention periods, needing to get rid of your retention, excuse me, your records, in a timely fashion. Warren, how has the changing privacy legal and regulatory landscape added to the challenge of keeping your records retention up to date and also compliant?

Warren Bean: Quite a bit, because what I noticed when I was kind of starting off in this process, many years ago, is that it was pretty common for someone to say, well, I know the baseline for this type of record is seven years, and maybe I'm going to keep it 10 years, maybe I'll keep it permanently, just because I can, maybe I've got space. And so to say, oh, are you in compliance, you basically have the mindset that, well, as long as I've got the minimums, I'm okay. So shame on me if I'm not destroying things and saving that cost, that's great, but I'm not going to get in trouble legally. But now, if you have a compelled destruction requirement, especially for things like HR records or customer [inaudible], then that kind of baseline mentality just doesn't work anymore. You have to make sure that you know where the data is so you can identify it if it's requested, and you have to make sure that, if you can only keep it for one year, or worse, if it's only as long as needed, then you have to have those triggers in place, the ability to measure and quantify how long do you actually need it, and be able to identify those records after that period of time to ensure that they are destroyed on schedule and you're not violating that maximum.

Ann Snyder: And we're going to turn to the situation of schedules being too complicated, but I think touching on it here, there's also been a push for the big bucket approach, having a few categories, and it seems like with privacy, again, that's cutting in the opposite direction. It's pushing people to add more granularity out of necessity.

Warren Bean: Yeah, it used to be common to see schedules that were 1,000, 2,000 records long, and then with the big bucket approach that got minimized down to usually 100 or so. Some even went as far as saying, oh, I'm going to have seven or 12. Right. But when privacy started hitting, then they realized, okay, well, that big bucket contains some things that have to be destroyed sooner, and so you have to carve out or at least make exceptions. And that's always the rub: do you make an exception, or do you actually carve that out as a special record category?

Ann Snyder: Greg, can you tell us just a bit about how the recent changes in privacy have impacted your organization, and particularly with respect to keeping your retention schedule compliant?

Greg Dinklenburg: Sure. Well, we basically started by building our records retention schedules with privacy in mind. Back in like 2010, I could see that RIM and the data privacy disciplines were converging, right? That big bucket aspect was going away, or wasn't effective [inaudible]. And so now, with GDPR in full swing, it's imperative that your records group works very closely with your data privacy group.

Actually, ours is within the same functional organization, so that we share the same director. So yeah, we right away went in with the idea that we were going to have certain exceptions based on data privacy law.

Ann Snyder: Great. Let's move on to the schedule being too complicated. We sort of have already hinted at this. This is a situation where you have just way too many categories. And Warren, when we were preparing for this, you told me about how you encountered some real doozies. What's the worst you've seen?

I'm remembering a number, and I just want to make sure I have it right, or if my recollection is that it's worse than it really was.

Warren Bean: Yeah, the number that I told you earlier was 98,000 record types. And to be fair, it was really a much smaller set of the same record types, just duplicated over and over again every time a new property was purchased. They were replicated, and they had a lot of redundancy in the middle. They kind of had a three-tier structure then, and we needed to carve out the entire middle tier because it was just redundant. And so, redundancy, not actually real necessary... Well, I mean, I would suspect there would be some of that if you're up to 98,000. But it wasn't just granularity, it was duplicative categories and just a poor structure. So that one, we were able to gain a lot of simplicity, or a lot of efficiency, with that one by reducing it quite a bit.

Ann Snyder: So talk to us a little bit about... Okay, so not everybody has that kind of disaster. I'm sorry, that was a little judgy, that extreme of a condition. But we have sort of ranges in between, as we've talked about: the seven buckets, which seems too simplistic, but something that's less unwieldy than the 98,000 but still hard to manage. One, what do you think is the sweet spot generally for categories? And then also, can you tell us a little bit about what that process is about, paring that down and reconciling it?

Warren Bean: Yeah, I would say there's no perfect number that you're trying to attain, but it seems like the sweet spot is right around 100, 150. And again, that depends on the industry; it depends on how many jurisdictions you're in, things like that. But from my experience and seeing things, that seems to be kind of a nice middle ground, so to speak. And then, I'm sorry, you were saying another question there, and I've already forgotten the...

Ann Snyder: Oh, it's just, the other question is sort of, okay, so I came to you with, I'm somewhere out of that spot, I'm in a couple hundred more. What's that process look like? How do you help people pull those together? So I've come to you with this slightly unwieldy, hard-to-manage schedule. How do you help me eat that elephant?

Warren Bean: Yeah, the first step in that is obviously looking for redundancies. If you've got the same types of records covered by multiple categories, but they're all the same retention period, can you pull that together and say, really, you're going to destroy these at the same time, so why don't we pull those together into the same record type and simply put the detail, or the granularity, into the examples? So oftentimes, you have a lot of different record categories because each one is a different type of document or different type of record, but you can lump that into one group and then put the names of those different record types into a field that can be searchable, so that if someone's searching for their invoices, vouchers, work orders, whatever they might be, they can still find them. They just find it by searching the keywords, and they find it as part of that. So you're pulling those, like, common types of documents together into that one category, instead of having an individual line for each one.

And also it can be done by normalizing the retention periods themselves. So if you've got a lot of different variations, 10 years, seven years, three years, 20 years, a lot of times you can normalize those as well, so that you have maybe three, seven, or maybe three, 10 and permanent, or some scheme like that, where it's only always going to be one of those three or four retention periods. That can help to simplify the schedule also.

Ann Snyder: And can you tell us about the term harmonization? I think we may have said that a couple times here.

Warren Bean: Yeah, so we talked about global harmonization, and I mentioned that you can have different jurisdictions with different requirements, and it's a matter of either coming up with something that covers all of those or dealing with exceptions. But in terms of complex schedules, I would say one of the really common things that we see also is that if you have your schedule in, well, usually not a database but a spreadsheet, you might have replicated the retention schedule in its entirety for every jurisdiction. So if you take an example like Greg, you're in 75, 80 countries, and so you're really talking about 75 or 80 schedules. And so you can greatly simplify the complexity if you say, okay, we're going to have our [inaudible] 150 record types, and we're going to come up with a baseline wherever possible and then just call out exceptions where needed. You can reduce your schedule tremendously just by reducing that per-country complexity.

Ann Snyder: Just to build on this a little bit, I think it's important to emphasize how operational requirements can actually be the driver for retention periods. I think it's a common misconception, at least I've encountered this with stakeholders at organizations: they think it's all laws and regulations that are setting the specific retention period. Can you talk a little bit about that?

Warren Bean: Yeah, I was actually surprised to learn that as well, as I began working more with our consulting team. It varies, again, by industry. But if you take a typical retention schedule, maybe 40 to 60% of that is governed by specific laws, and the rest of it is operational requirements or just typical audit requirements, things like that, but not specifically regulated by some jurisdictional law.

Ann Snyder: And I think building a little bit on that is knowing what's driving it, that only part of this is legal and regulatory. You can establish the longest retention periods that are required and use this as kind of a recommendation for not keeping beyond that. So very often it's operational, the business is pushing to keep something longer. If you can go to them saying there's really no actual legal reason to do this, do you really need to keep it that long? It's a pretty good tool to make the argument. Do you agree with that?

Warren Bean: I do. And sometimes you see the number seven come up, like seven years is a magic number for some reason, and people just think that's the rule of thumb, which works in a lot of cases but can mean that you're over-retaining things. And I think it also emphasizes the call-out for the interviews, because those interviews are also where we learn about those operational requirements. What do you have for audits? What do you have for document reviews? When do your policies come up for review and updates? All of those things can affect those operational requirements.

Ann Snyder: And those business requirements and operational requirements are certainly important, whether or not there's a legal and regulatory one. I don't want to suggest otherwise, but I think sometimes people are arguing that I need this forever and kind of pushing a little bit too far beyond the actual requirement, from either a legal and regulatory perspective or even a legitimate business perspective. So I think it's good to say we don't need to sometimes. And Greg, I understand that harmonization was an issue that you addressed in your roadmap. Can you tell us a little bit more about that?

Greg Dinklenburg: Sure. When we're completed, we will have roughly 21 total records retention schedules, based on either a functional or a process level. Each might contain an average of seven to eight different category types, so we're right in that sweet spot, 170 or so. Some schedules which deal with our core business, which is heavily regulated, might have upwards of 12 categories, but others might only have four or five, based on that process. We have used baseline retention where we can, outside of the privacy aspects. We use the baseline retention with country jurisdictional exceptions, like Warren had alluded to.

We've eliminated redundancy by creating a separate records retention schedule, which is just general records. So there's like about three or four record types that are on everyone's records retention schedule: administrative, project management, what have you. So we can cut a lot of redundancy out by just pointing people there.

Ann Snyder: All right, now, as promised, we're actually going to go back to maintenance and auditing. So we're returning to this topic: once you've invested all this time, the resources and money to update and fix your retention schedule, you're going to want to maintain it. And the other part of this, the second half of this, is auditing: track the changes. And again, there are different ways that you can do this. I think everyone on this call, on this panel, has dealt with the situation of doing this in a very manual way, through an Excel spreadsheet, tracking changes and updates to it, and also the review process. But I'm going to hand this over in a second to Warren, and he's going to show us what this looks like in terms of the tool and how you can have this delivered to you in a more streamlined fashion.

I just want us to show you what this can look like in real time, if you're managing, again, the number of citations that we just talked about. Doing that in a process via a spreadsheet is incredibly complicated. We're also then going to just move right into sort of operationalizing as well, as we look into the Versatile Retention tool, because this is a way to push out the documents to your end users. At the end of the day, again, you can push it out as an Excel spreadsheet or a PDF of that. That's also a way people have done it, but there are tools that allow you to present this in software that's searchable and has some other functionalities, and we'll look at that.

So Jen, can we hand it over to Warren so we can have a quick walkthrough of Versatile Retention?

Warren Bean: And I'm already stealing the screen from you, so no.

Ann Snyder: By the way, sorry, I do see a bunch of hands raised. We are going to have some time to get to questions, so please bear with us; we're not ignoring you.

Warren Bean: Yes. And one quick note about just one other point in that last discussion, and that is simplifying can also be done by doing a really good job of analyzing the event triggers. That sort of ties into operationalizing as well, but it's something that we should really think about, as far as the more event-based retention you have, the more complicated your schedule is and the more difficult it is to actually put it into place. So, something we can touch on more. So I'm going to just show you real quickly here, just within a few minutes, the tool that we're talking about, just so you can kind of get a visual on it. I'm not trying to do a demo here, but we're talking about this tool called Versatile Retention.

We have it here as a desktop application or as a SaaS tool, that is, software as a service. I'm going to go ahead and use the software-as-a-service version just because it's just kind of cool. So I'm just going to my browser, launching it here. We can do single sign-on and so forth, but I'm going to go ahead and log in manually. And in terms of keeping your retention schedule evergreen, one of the things I always like to point out is this little pop-up here, because it's really kind of a minor thing as far as the software goes, but it's really important for keeping you up to date. And that is, we're constantly publishing new citations, the legal research team is, and so this little pop-up is just reminding me that I've got a bunch of batches that I haven't reviewed and processed into my database yet.

[Slide: Versatile Retention demo, Citation Updates screen: batches titled "United States 2020 Updates" with date published (September to November 2020), country name, and counts of new citations, updated citations and linked schedules.]

And I'm not going to go into great detail here, but you can see that we've got a number of jurisdictions that are being published multiple times per month. A lot of new citations, a lot of updated citations, and we also even give you details about things like, oh, we've got some of these updated citations that actually affect some schedules that those are linked to. So that would be one where I'd probably want to go into the batch details, look at them in particular, see if I've got discrepancies where maybe the retention period has changed and I need to update that schedule. So this is a really important piece of the program in terms of just keeping things up to date, and really being able to manage the ongoing maintenance of the schedule. So once you have that baseline established, you want to be able to keep it evergreen, so you're not going back to the problem that you started off with.

So the other thing I think that's important here is that all of these things that we've been talking about, as far as the building of the schedule, the legal research, the maintaining, publishing, managing changes, that's really sort of represented here by these four main icons. So obviously we talked about doing the legal research. We talked about doing interviews; this is a place to track that information if you need it. And then obviously a place to maintain the schedule and keep it yourself. And then when you review the schedule with your stakeholders, these change requests are where you can do that. In fact, one of the really cool things about this piece here is that it's not only the ability for, say, Greg to propose changes to his internal team and circulate that for review and comments and approval, but it's also a chance for him to actually push the schedule to Jen here at our office, have her apply research and send it back, so he can then review and approve that with the internal teams. It's actually a conduit between the software and the legal research team here.

Ann Snyder: So now, not every citation... So can you tell us a little bit about the frequency with which these citation updates are coming, and then also just, can you clarify that not every citation is necessarily going to lead to a change request or change in the retention period?

Warren Bean: Yeah, absolutely. In fact, in that screen we saw a moment ago about the citation updates, you can see, just sorting here by date published, that we're publishing these multiple times per month, depending on the size of batches and what updates we're doing. So these are coming on a regular basis. People are getting a feed, not only through this but also through email, so they'll be able to see those. And as I mentioned, you can dive into these batches and see which ones actually apply to the schedule, if they apply to your industry, to your business activities, all those kinds of things, to help you know exactly what that's about.

Ann Snyder: Now, there's actually a question in the chat here. Someone's asking, as a matter of best practices, how often should your schedule be reviewed? And I just want to say that what we're seeing here is that these things are being reviewed in real time, right? So this is an evergreening approach that is available. It doesn't mean that you have to push out an updated retention schedule every two seconds or something like that, but you might do that yearly. But do you have any sense of what is the, is there, again, I think it depends on your industry, and it depends on what kinds of changes you might want to push through pretty quickly, but is there a best practice out there, or a common practice at least, that you're seeing out there in the industry?

Warren Bean: It's interesting, because I would say the most common is an annual or bi-annual refresh, but we do have some customers who need a guarantee that they can get updates every 30 days when laws come out. And so getting those really timely updates is extremely important in those cases where it is a heavily regulated industry.

Ann Snyder: And Greg, just to bring you back into this conversation, I understand that you use Versatile Retention as part of your program, right?

Greg Dinklenburg: Yes, yes. And it's very efficient. With the weekly citation updates, you can set them for however long you want them, monthly, weekly; we get them weekly. And they get pushed to our database, and then we're able to go through them, like Warren's shown. We then can basically update our schedules on the fly. So although we use the desktop, the on-prem version, with our process, what we do is we consider Versatile Retention as a living, fluid entity.

So once we have a records retention schedule that is approved by our stakeholders, which includes legal and data privacy and others, we use the reporting output to convert that to a PDF, which I then digitally sign, and we upload that into our quality management system. That is our record, that is our records retention schedule. So then we have a two-year refresh on that, unless of course there's something that needs to be done right away. So with these updates coming in, we can then go in, and if there is a change in retention period, we can update the schedule and record the changes in the change request module. And then that way, when we go to look at this two years later, it's done. We don't have to do any further research, unless of course we've added countries too.

[Slide: Versatile Retention demo, Schedules module: company tree (Zasio; Accounting, Finance, Payroll & Tax; Administration; Banking, Securities and Investment and Insurance Services; Human Resources; Sales & Marketing) and a list of schedules with retention rules and status, e.g. General Accounting: Creation Date + 7 Years, Approved.]

Ann Snyder: And to get to that, thank you for that. To get to the sort of second half of it, I just want to make sure we have some additional time, there are a lot of questions, to get to the second half of this, maintenance and auditing. So can you tell us a little bit more about that, Warren? One of the things that's important is understanding, not just keeping your schedule fresh and current, but also making sure that you understand what changes were made when, because there are going to be point-in-time questions that can be asked, for example in e-discovery, and for other reasons too.

Warren Bean: Yeah, excellent question. So one of the things that the software does really well is it keeps track of all those changes. So if I just take one schedule as an example, these are all of the changes that I've done over the course of time for this one item, and so each one of those I can open up and see the specific details of, and see exactly what happened at each point, highlighting the differences, whether there were differences in citations, differences in retention periods. And so each one of these is basically a snapshot of what that record looked like at any given time. Or I might go further and say, well, I want to know what was changed by a person or for a department over time, and so I can just basically go and choose someone here and do a search on all the changes, maybe for a specific time period, maybe for a specific department, and get everything that's been done during that time frame. So if I need a report of that change management process, or that audit control, it's really easy to reproduce. In fact, one of the things that's sort of a side benefit of keeping that snapshot is that when it comes to producing the schedule, you've got the current version, but I can also go back and say, well, what did my schedule look like as of some point in the past? Just pick a date and recreate that point in time. Exactly. And so it basically picks up all of the retention periods as of that time, the statuses, descriptions and so forth, and you can easily just report that as well, as Greg was mentioning that he does whenever he's publishing the schedule officially.

And again, that is certainly something that can theoretically be managed through a manual process, but it's a lot more difficult.

Ann Snyder: Yeah, you can, especially multiple spreadsheets. And yeah. So let's just, I want to keep this moving. The next piece is operationalizing your retention schedule. So you've refreshed it, you've filled the gaps, et cetera.

Your schedule is refreshed, and now you have to get it out to your end users. And the other sort of next part of that is not just getting it out to your end users, but getting it out to the systems within your organization. Everyone is talking about digital transformation, which requires the sort of connectivity in our technology ecosystem, but this is one way that you're going to talk in a couple seconds about, how we do that with a retention schedule.

Warren Bean: Yeah, so like you said, it can be initially just distributing or publishing it to your users. So it could be like Greg was talking about, where he generates a report of anything that's current, puts that into a PDF, maybe posts it on a shared drive or SharePoint, something like that. Or you can have a live, sort of interactive system. So we have an option here where that same schedule can be accessed by an end user just in read-only mode. You can have a landing page where you have instructions about your particular records program, and maybe allow them to search and say, oh, where are all of our accounting records?

What does that look like? And they can quickly find everything related to accounting, get the details, retention periods.

[Slide: Versatile Web Retention, read-only Schedule Details: General Accounting; Company: Zasio; Function: Accounting, Finance, Payroll & Tax; Description: records documenting the financial transactions of the company; Retention: Creation Date + 7 Years; Status: Approved. Countries tab: Australia, Creation Date + 10 Years; Canada, Current Year + 4 Years.]

And as they click on any of those, they can see more specifics, including things like those citations that have been linked to the record category, or the country exceptions. So they know that, okay, in this case, Australia has a 10-year retention instead of the baseline seven years, for example.

Ann Snyder: One of the things I like about this is there's a single and clear... Well, one, it's searchable in a different way. I mean, you can do a Control-F in a static document, of course, but it's searchable in a different way; the user interface is a little bit more accessible than just a static document. But I like the idea also of a single point of truth. I think, Greg, you're handling it, I think, by having a quality system where people know where the single source of truth is and go there and get it. But a problem that I've encountered with people is the download of the retention schedule: someone's relying on something that's, yes, it is an accurate copy of a retention schedule from five years ago or something like that, because they've downloaded it, and they're not using the current one. So I'm sure you've followed the schedule, yes, [inaudible] the schedule's out of date.

Can you talk for two seconds? And we may run over time; if people can stay on, we're going to do some Q&A quickly. There's some great questions. So if people can hang on, that would be great. So can you quickly, for just two seconds, talk to us about this sort of next arm of it, a little bit about how you can take it to the next level and connect to your systems? So connect these updates to your systems where you're actually executing on your records and retaining your records.

Warren Bean: Sure, and that is a huge challenge, because obviously you've got a retention schedule like I'm showing here, and you have to be able to take those rules and those requirements and put those into the various platforms where you're actually storing records. And so some systems have that capability built in. In some cases they don't. But if you've got a handful of systems, it's probably pretty easy to just go ahead and manually update those as they come through, especially if they're just annual. But if you've got 200, 300, or in some cases 1,000 systems that you've got to manually update, it's just totally impossible. So you'll never be compliant unless you actually get the schedule into the systems that have the records. And that can be done through APIs, through integrations; there's a number of different tactics. I've got a blog post I wrote about this a couple months ago.

So there's a lot of different strategies you can take, but that really is kind of the final step to really becoming not only compliant, but getting it out there and actually automating the process of applying it to those repositories.

Ann Snyder: And again, that's one of those things. It's not uncommon for your technology ecosystem to involve hundreds of different systems where documents are being retained, and if you're doing a manual update on that, even if it's yearly, that's quite a bear. I'm going to take back the screen, if I may.

Warren Bean: All right. I will stop sharing. Thank you.

Ann Snyder: One second. And we're just going to open this up now to questions. And again, if people can stay on a little bit longer, that would be great. Is everyone seeing a screen that says Questions on it? I can't always see this [inaudible].

Excellent. All right, so let's look at some of these questions we have. [audience question] The first one here is: what tips do you have for companies that have combined retention schedules? So they're merging or doing that sort of merger-acquisition kind of scenario. Do you have any tips for people in that scenario?

Warren Bean: Yeah, I would say that when we've dealt with that, what often happens is that you can maintain both retention schedules, like in our software at least, have them both running, and then you basically, over time, can merge those together. So kind of that same process of consolidation that we talked about before. But basically you have both schedules in play; maybe the different groups that you're bringing together both use the ones that they're comfortable with until you get that harmonization process going, and then you come up with essentially either a third one, or you merge maybe the smaller or the less up-to-date one into the more current one, kind of depending on where they both stand.

Ann Snyder: [audience question] I think this next one is a quick yes/no, but: are archives part of the stakeholders in the interview and research process? I would hope that if you have an archives group, they are part of the stakeholders who are involved in this. Do you typically see them included, Warren?

Warren Bean: Yes. So obviously archives are going to be kept permanently, so it's not necessarily coming up with a retention schedule, but it is important in terms of considering when something is considered an archive, where it goes, who handles it. It gets managed like all the other records in many cases, but just with a permanent retention.

Ann Snyder: [audience question] Here's an interesting one. So how do you know if your retention schedule is too complicated or oversimplified?

Warren Bean: Can anyone figure out how to use it? Are they coming to you with questions?

Ann Snyder: Right. I think that's obviously, if it's unmanageable, if it's impossible to find stuff, you're getting an excessive amount of questions, those kinds of things. If you, as the person responsible for it, can't manage it effectively, I think that's a good sign too. Greg, do you have any thoughts on that?

Greg Dinklenburg: Yeah, I agree with both of you on that one. Yeah, and I think the other side of it, the big bucketing approach, I think one of the things would be, you're noncompliant, that you can't respond to some of the privacy concerns, for example.

Ann Snyder: Absolutely. Let me see what's the next one here. [audience question] How many countries? A specific question for Zasio: how many countries do you cover, what jurisdictions are you in?

Warren Bean: We have, I believe it's around 130 jurisdictions, and keep in mind that some of those break out into multiple. So like Australia, Canada and a few others, we break them out into their states or provinces. But overall, right around 130 jurisdictions was the last count I saw.

Ann Snyder: [audience question] Quick question here: do the citations, the legal research, include GDPR, CCPA, and ISO?

Warren Bean: All the above. Well, if they pertain to retention or to handling. So we have a whole section of our research that deals with privacy, signature requirements, cross-border requirements, what format the records have to be in, and so all that's considered part of the handling requirements. So that falls into GDPR, CCPA. Some of that would be ISO. I'd have to think about ones that would be specifically in that category.

Ann Snyder: So here's a pretty specific one, and then I'm going to wrap this, just because we're out of time, and maybe we'll do one or two more. [audience question] This is a question from an anonymous attendee: "We have historical paper records that relate to a function now handled by another company. They include private information. It's been suggested that we send them to the new company, as it relates to their organization's inception and history. Is it acceptable to send them to the new company to vet and destroy, even though they predate them?" This is pretty specific. I don't know if anyone wants to weigh in on that.

Speaker: You're right, that is pretty specific. I think a number of things come to mind, at least off the top of my head, which is: who is the true custodian of the records? What kind of information are we talking about? How secure are they? Probably not an easy question to answer right off, but maybe something we can follow up with.

Speaker: Yeah, and I certainly think it presents concerns for you. This is a common scenario, I think, that we encounter in any of these kinds of organizational transformations. It's, what are you retaining? And so obviously something here has been kept that maybe should have gone to the other organization, and now it's, I mean, again, this is just a suggestion, is to look to those documents that involve the reordering of your company.

Speaker: Yeah, we've seen some pretty ugly scenarios where there are splits, and you have to go box by box, folder by folder, and separate documents. It can be very, very time consuming.

Ann Snyder: So here's one. Well, I'll just close with one more here. [audience question] Is it possible to manage a global retention schedule on your own? And I have some specific thoughts on that, but I'm curious, Greg, as a practitioner who's doing this, would it be possible for you to manage that schedule on your own?

Greg Dinklenburg: No, it's really difficult. And like I said, HR we were able to do because we had representatives in each region that we're in, but there's other aspects of the business that we don't. And although we may, like for human resources, we could have people in the country but not an office, that country then has to be researched for jurisdictional purposes. So no, I truly believe that it takes a village to manage something like this.

Ann Snyder: And I know, Warren, you probably don't want to do too much of a pitch, but I think that, again, from a practitioner's perspective, I can say that I would think it's nearly impossible, again, if it's an unusual circumstance, if you're geographically defined and not an especially regulated industry. But once you get outside of, once you start even expanding within the United States, or you get outside of that, you're in multi-jurisdictions. It's not just the challenge of a language barrier, it's also the challenge of the expertise within that jurisdiction. So it's specialized skills on top of the language skills, and I think rapidly you get out of a manageable scenario, for example, if you're just in the EU. Do you agree with that generally?

Warren Bean: Yeah, I do. And I think it's not only an issue of expertise and the language issues and so forth, but just, if it were your only job, just to manage the retention schedule, that's all you had to do, eight hours a day, it might be feasible to at least keep up with it. But most people are doing multiple jobs; they've got multiple responsibilities. And so usually people just don't have that bandwidth.

Ann Snyder: All right, I want to wrap this up. We have a lot of unanswered questions, so we're going to try to follow up, either in a written format or maybe an alternative, we can do a live Q&A. Let's see if that's a possibility. I just want to thank all of our panelists today in today's webinar, Get Your Records Retention Schedule Under Control and Keep It That Way. I'd like to thank everyone here for their continuing service to this community and for sharing their knowledge with us.

Our next webinar will be announced very soon, so keep your eye on your inbox. And before we close, I'd like to remind you about becoming a professional member of ARMA International. Take some time to invest in yourself. Also, again, remember ARMA has an array of resources available: white papers, training, articles, our magazine and much more. And I also want to remind you to please, please, please be sure to take the survey. We need your input to create a really awesome resource. And on behalf of our speakers, the wonderful folks at Zasio, who give their time and money to sponsoring programs like the webinar today, and all of us at ARMA International, I want to thank you for joining us today and wish you the best in all your information endeavors. Have a great holiday season, stay safe and stay well.

Speaker: [multiple speakers] Thank you, Ann. Thanks, Greg. You as well. Thank you, Warren. Bye-bye.

We had so many great questions and comments after the webinar, we decided to add a bonus session dedicated to answering your questions and comments!

Transcript: A Case Study in Global Retention Scheduling — Bonus Q&A

Duration: 0:42:31

Speakers: Ann Snyder, Manager of Content Development, ARMA International (host and moderator); Warren Bean, Senior Sales Engineer, Zasio Enterprises; Jennifer Chadband (slide: Jenn Chadband Masingill), Senior Analyst, Zasio; Greg Dinklenburg, Associate Director of Records and Information Management, PRA Health Sciences

Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.

Ann Snyder: We're back today for some follow-up questions from the webinar Get Your Records Retention Schedule Under Control and Keep It That Way: A Case Study in Global Retention Scheduling. We're joined again by subject matter expert Warren Bean. He's the senior sales engineer at Zasio Enterprises. And Jenn Chadband Masingill, who's a senior analyst at Zasio, as well as Greg Dinklenburg, who's the associate director of records and information management at PRA Health Sciences. Welcome back, everyone.

Speaker: Nice to be here. Thanks, Ann. And happy new year.

Ann Snyder: So let's get right into the questions. We have quite a few to get through. And again, thank you so much for being here to do this. Question one is: how do you know your retention schedule is too complicated or overly simplified? So both ends of the spectrum there. Warren, do you want to get us started with this one?

Warren Bean: Sure, be glad to. I think the best way to answer that is simply: does it work? Can you find the record categories you're looking for? Do you get a lot of questions? Do you have users calling or emailing you a lot to find out where does this fit in the schedule?

If you get a lot of that, it's probably not quite sufficient. Either you've made it too broad or too granular. So it's mainly a functional question, I would say, is the best way to describe it.

Ann Snyder: Okay. And Greg, just as a practitioner working in the field, is that your sense as well?

Greg Dinklenburg: If you make it too complicated, then it won't be followed. Or you're barraged with questions every single day.

Ann Snyder: Right, exactly. The RIM person or IG. So we talked about this a little bit in the webinar last month. What is the sweet spot for the number of record categories? Roughly, every organization is, of course, different. But is there a rough sweet spot range?

Warren Bean: Yeah, it's obviously subjective, and it depends on your organization and depends on your industry. But typically, I'd say that that 100 to 200 range is pretty well accepted as where you want to head. Jennifer, you probably have a lot more experience with that as far as what's worked for you in terms of actually creating those schedules. But that seems to be what I've seen, anyway. Does that sound right, Jen?

Jennifer Chadband: I think that sounds right, Warren. Yep.

Ann Snyder: So our next question is related to this number of categories and different types of approaches. What is your opinion on the so-called big bucket approach and setting a retention period that covers the most jurisdictional requirements? I know that for a while there has been a push for some very big bucketing. So I'd like you to touch on both of those points, if you would. Can you talk about that a bit, Jen?

Jennifer Chadband: Yeah, absolutely. So we are really of the mindset that big bucket is kind of best practice for the industry, and that kind of circles back to this idea of the simpler, the better. So with a bigger bucket, functionally designed retention schedule that covers most of the jurisdictional requirements, the benefit is that there is more administrative ease for the retention schedule, and then a plethora of benefits also for end users. It's just easier for them to use and understand.

Ann Snyder: Can buckets get too big, though? Can you oversimplify and try to...

Jennifer Chadband: Sure. Yeah, there definitely has to be a balance struck there. Some of the things that we're always thinking about are event triggers, the natural lifecycle of records. They really kind of speak to unique event triggers, and those really do have to be taken into consideration. And then also something we're thinking about is kind of striking the right balance with retention periods.

If you go super big bucket, what you're going to end up doing is going with really long retention periods, and there could be too much over-retention there, exposing the company to too much risk. And then there's also privacy considerations. So I think it's definitely striking the right balance for each client.

Ann Snyder: Okay. That's great. Here's a curious one. Any tips when your IT department asks for 10 to 12 retention policies or periods when automating an electronic platform, something like SharePoint, when a user can choose an applicable schedule and they only want to present, say, 10 to 12 choices? Any thoughts on that, Warren? Do you want to lead with that one?

Warren Bean: Sure. I think from the outset, my thought when I saw that one is: is IT driving your retention schedule, or is it the policy? And I think that's an important consideration. But thinking about some of the interactions I've had with our customers, I think what's really driving that is that someone in IT is probably aware that if you give users too many options, they will likely choose the wrong one, or it's just going to get complicated. So they're really trying to just narrow the choices, which is really what is the driver behind departmental schedules. You want to say, well, for this department, here's all you need to know about.

And that helps the user. And so it's, again, finding that balance between the functionality and the administration of the schedule and how you implement it for the users.

Ann Snyder: And realistically, that might be possible if you've streamlined your schedule. Within a single SharePoint environment, you might be able to restrict that much.

Warren Bean: Yeah, we have seen hybrid situations where you have a functional schedule that has everything, but then in certain contexts you can say, well, we're only going to display these record categories for this group, if that's all that they need.

Ann Snyder: But I think, again, another takeaway, just to emphasize the point that you started with, is that it should be the policy that's driving it, not IT. That seems a little backwards. So, our archives. I think this is one we asked actually during the session, but just for completeness, let's get it in here. Are our archives part of the stakeholders in the interview and research process?

I would think hopefully they should be. You don't want them to feel left out, for sure.

Speaker: Yeah, absolutely. Part of that interview process is really making sure that you have an understanding of what records your company is keeping, kind of where they are, how they're being maintained, etc. So certainly archives should be part of that process, and it's always changing, so their records are always changing as well.

Ann Snyder: A related one to this is: how is historical defined? Jen, can you talk about this a little?

Jennifer Chadband: Sure, sure. So as part of that kind of formal appraisal process with records, I think what our clients are looking for when they're trying to decide whether something is historical, really it's looking towards these original source records that are really important to kind of the identity, the brand, the evolution, the story of the company. So maybe it's like an original patent, or maybe a kind of a landmark marketing campaign, for example. So it really is kind of during that appraisal process, and their value really is kind of intrinsically that it is historical. It's not business, it's not operational, there's not a legal basis for keeping those.

It's just really important for the company's story.

Ann Snyder: So this next one is interesting too, related to the types of schedules you see. Are you seeing any variable structure schedules? And they're explaining this as where the record type numbers are assigned on the fly, based on specific characteristics, such as a combination of numbers, that they're very high, and it says, but only a small set of categories need to be maintained. Have you seen... I haven't seen this anywhere I've worked, personally. I can't say that I have, but I'm intrigued. I'm interested.

I think on its face, it sounds more complicated than simple, but I'd probably want to get more familiar with it. But I can't recall anything. Warren, does this ring a bell for you at all? Have you seen anything like this?

Warren Bean: It sounds, in a way, like a file plan structure in more of the older form, where you had, say, open filing, open shelving, where you had to perhaps color code the files so that you can easily retrieve them and locate them. And so the numbering scheme would refer to their location or their content or the year. It's in the same vein as that. It's not as necessary these days with the ability to do searches on a computer, and so we don't find that as prevalent, even in the filing realms, as much anymore.

Ann Snyder: So you're seeing this as a carryover more from the physical record?

Warren Bean: I think, yeah, it seems to relate to that.

Ann Snyder: So the next question is: could you please define the evergreen approach and provide an example? And I think I was the one who used the term evergreen. What I meant was, instead of waiting for your retention schedule to get out of kilter, to get out of date, to continually update it. That's what I meant by that. And that doesn't necessarily mean what you're publishing to people, but keeping the references, the citations up to date, making sure, you know, anything that's going to affect one of your categories and your retention periods for your next publication. But Warren, can you talk a little bit about this?

Warren Bean: Yeah, I think I understand that term just in the sense that you're always keeping it up to date, versus saying, well, we're going to create a schedule and it's going to be static for a year or two. It's a matter of just always keeping up to date with regulations, with changes that are requested from users. It's just keeping it as a living document, rather than thinking of it as a distinct publication point that you do maybe on an annual or semi-annual basis. And those things can be separated: keeping the material up to date so that you're on top of it, aware of anything that's relevant to your organization, and then the separate publication, the operationalizing it. So those things can be two distinct steps.

Ann Snyder: So, how often... I think this varies for every company, but a general question of how often should a schedule be reviewed as best practice. And so, leading off of that last one, I think that if you have the capability to have a kind of service that is continually giving you updates on citations, I think that's, in my mind, the highest level of maturity an organization can be at, so that they're on top of it all the time. But certainly I think there are acceptable, good practices somewhere that aren't as continuous as that. Jen, would you like to comment on that one?

Jennifer Chadband: I'm sorry, Ann, can you repeat your question?

Ann Snyder: So it's just how often should... sorry, I did ramble in there into an answer. So, how often should a schedule be reviewed as best practice? So I think there's a range of what is really good practice, then there's optimizing. So I think I was saying that doing it continuously, taking an evergreen approach, is more like that optimizing spectrum.

Jennifer Chadband: Okay, yeah, absolutely. So I think, first of all, this is kind of governed by your organization's policy. And I think when they're looking, our clients, internally, and they're looking at what's an appropriate period of time as far as refresh goes, they're thinking about things such as: what jurisdictions are we operating in? What's the regulatory nature of those jurisdictions? Do they have really aggressive oversight? Also just the industry in general: how heavily regulated is the industry? So I think we find that our clients that are really heavily regulated are refreshing on a more frequent basis, and that really fits their risk profile. So I think typically what we see is annual, every one to three years, three years being on the longer side. [Ann Snyder: Right.] Of course, for some really minimally regulated clients, we will see five years, so it just kind of depends.

Ann Snyder: So it's a combination of their risk profile, but also internally, but also externally, with respect to the kind of market that they're in. [Jennifer Chadband: Correct. Yeah.] Can someone give an example or two of state laws limiting a retention period for a type of record? Jen, I have you tagged on this.

Jennifer Chadband: Yes, yes, I would love to provide some examples. So these are always kind of, I think, with what we do, and without, you know, I'm a little nervous to sound super nerdy here, but we love finding these types of requirements. So I'll just provide a couple examples. What we're seeing is, of course, we see a lot of them internationally, but let me just share... Oh yeah, the question was about state laws anyway. So a great one, I think, is the Illinois law that we've seen. So it's a maximum kind of retention period, no longer than three years after kind of last contact with the individual, with regard to like biometric information. So there's actually been class action lawsuits based on this, for example, collecting fingerprints for individuals checking in for their job and keeping those for too long.

So there's an example right there, and we do have clients that have made decisions for the retention schedule based on this law. I think another good example would be, and this is kind of a sneaky one, but Utah has a law which requires recruitment records collected to be retained for no longer than two years after that hiring decision or last contact with the individual that was applying for a position. So that's kind of a sneaky one there. And similarly, we've had clients that have made retention schedule decisions based on that law. So there's a lot of them, actually.

Ann Snyder: All right. No, that's great. Can we elaborate a little bit on what we talked a little bit about, this interview process, to understand what your current situation is? Can you elaborate a little bit more on that interview process, Warren, and then also tell us what are some of the important questions that you'd like to ask stakeholders when you do that?

Warren Bean: Sure. Yeah, so we're obviously not referring to an interview for a job, but it's more about interviewing stakeholders. So if you are developing a retention schedule or revising this retention schedule, it's important to find out from the source what records are being kept, what the nature of them are, how they're being managed, how long they're being kept currently, who's generating, who's storing, etc. So it involves a lot of different metadata points about the records that are being kept. And so there's a lot of decision making that goes into the process of developing a retention schedule when it comes to, well, who do we interview, and how many people do we need to talk to in order to make sure that we get a good cross-section of information?

Do we talk to just managers? Do we talk to the individual record holders? And so that's a really important process, and it can be a combination of not only interviews but also surveys. So you might send out surveys, say in a spreadsheet or a web form, to ask questions about what records they're keeping, and then follow up with interviews to fill in gaps or get clarification and so forth.

Ann Snyder: Yeah, I would imagine that is an iterative process, because you don't know what you're going to encounter before you do that first round of interviews. The next one is: how many countries do you cover? And I think I have a broader question, sort of how many jurisdictions generally, not just countries.

Warren Bean: Yeah, so I did just check in our system today, prior to this call, and we currently have 139 countries for which we have citations. That's broken out to 163 jurisdictions outside of the U.S., meaning that some countries will have provinces or states, and we break those out in some cases, not in all cases, because it's not always necessary. But that just gives you an idea of the breadth of the coverage that we currently have, so thanks to our legal research team, which Jen is a part of as well.

Ann Snyder: Great. And this one's for Jen. Do the citations, the legal research that you can have done as a service, do they include GDPR, CCPA and ISO recordkeeping requirements? I think I know the answer to the first two, and...

Jennifer Chadband: Yes, absolutely. So definitely GDPR, not only at the supranational level for the European Union, the GDPR itself, but also all of the kind of iterations that the member countries have implemented. Those are laws that we're capturing. CCPA, definitely. ISO, yes.

It's kind of one of those circumstances, I think. ISO as well is proprietary in nature, but it does have some recordkeeping requirements. And we've kind of had clients come to us and say, hey, here it is, can we get this, can you enter it in, and can you consider it, provide recommendations based on that? So we have captured some of those ISO requirements, and we do consult on those as well.

Ann Snyder: Okay. This one's an interesting one, I think, that shows an underlying common misconception about retention schedules: in a comprehensive schedule, would all schedules have a legal citation, or can you have schedules without a legal requirement, was the question. Warren, do you want to take this one?

Warren Bean: Sure, and that's actually a pretty interesting one. You know, the numbers that I've heard is somewhere around 40 to 60 percent of the items in a schedule can have an actual legal requirement. So as you can tell from that, sometimes the majority of your records actually are just based on business requirements, your own internal requirements for audits, or just keeping things for your own records. [Ann Snyder: So, operational considerations.] Yeah, exactly. So it's often thought that the majority have some sort of legal requirement, or maybe everything is just seven years, but that's usually not the case.

In fact, I'd be curious to know, Greg, from your field experience, how that plays out in your particular environment, because I'm just kind of throwing out some random numbers. Not random, but average numbers. So curious if that rings true in your world.

Greg Dinklenburg: To a certain extent. We are pretty heavily regulated in most of what we do, so we do have citations, but there are some that we actually use industry best practice for. So we'll create a citation that we can track, and it would be more for best practices, you know, what the business wants.

Ann Snyder: And I guess on those, too, you would have some more wiggle room from the perspective of bucketing a little bit more easily as well.

Greg Dinklenburg: Right, I would think so. Yeah.

Ann Snyder: So once you have... this one's for you again, Warren. Once you have a simplified and managed schedule, how do users apply the schedule to documents and to automate deletion?

Warren Bean: Yes, this is the operationalizing part. That's the $64,000 question, or maybe it's a million now, I don't know. But yeah, some of that will depend on the size of your organization, the number of applications you have in play. I would say, by and large, most people right now are just applying them manually. So they are developing the retention schedule in either a tool like ours or in a spreadsheet, and then once it's published or approved, they will manually go update various systems that have retention capabilities. And that's the typical way that it's done. But outside of that, what we're trying to do is elevate the level of automation for our customers, in the sense that through APIs or through database integrations, we want to basically make it so you have one place to manage the schedule. And then when you publish that, the other systems are automatically updated through these APIs or these connectors, essentially. So if the tool that you have documents in has retention capabilities, then let's try to automate that retention update so you're not having to manually do it. Because as you can imagine, if you are not pushing those retention schedules out to the various systems, then your level of compliance is really in question. How effective is the update? How often is it being done? Are you checking in on it? All those factors can really reduce the level of compliance if you're not getting all those updates out in a timely manner.

Ann Snyder: And if you're doing it manually, that can be an incredibly heavy lift.

Warren Bean: Sure, yeah. If you've only got 10 applications, that's not too much of a problem. But if you've got 100 or 200... I've got customers who have 2,500 to 3,000 applications that they're managing. So not all of those, of course, will have retention capabilities, but if even a third of them do, that's a lot to manage. That's a lot. And it's also a lot to take off your plate if you can.

Ann Snyder: So that actually, I think you've covered two of the next questions, which were about those connectivities. So, is there anything you can do with the schedule... sorry, to help people. This is, I think, operationalizing from a personal perspective, communications and change management: how to help people bridge the gap between recognizing the categories in the schedule that relate to their data in their system. So do you have any tips, basically, on how best to educate the end users?

Warren Bean: Yeah, there's really a mapping process that has to happen there. And part of that is a matter of going back to how you design the schedule. In other words, does it functionally match what people recognize, and are they able to search on the right terms in order to find it? But I would also say that part of that goes back to maybe one of the fundamental things, which is, in the very beginning, it's often a good practice to do a data inventory and be able to map the inventory of all your systems and your repositories back to the retention schedule. And if you can create a link in that retention schedule to those systems, that's even better. So if you look up those employment applications, you'd be able to have a reference in your retention schedule to say, oh, well, we store those in these three different systems, or on the shared drive, wherever it might be. That makes it a lot easier for people to know where and how to apply those retention policies.

Ann Snyder: So some more targeted educational training for the specific users, and some additional metadata points. So the next one is: do you recommend setting up a master set of retention schedules to capture retention periods by function and then break those down by program? And I think with this, we were trying to figure out specifically what this question was getting at, but I think it's the discussion of what's the best approach: a functional approach, or a department or program approach. And again, some of those terms may be different within a specific organization. Jen, can you tell us what your thoughts are, what you've seen out there?

And if you have any particular thoughts on perceptions of which is easier, from what perspective.

Jennifer Chadband: Yeah, absolutely. So I think what we have seen is, as some of our clients are kind of getting up to speed and coming to us and asking for help, they're saying, we want to transition from this massive departmental schedule to functional. We go through that process, and of course there is a huge kind of learning curve for end users. This is a completely new kind of concept; it's organized differently. There's definitely a training component to make that retention schedule successful. But what we've also seen, as a way to kind of bridge that gap, is that there's kind of methods, I think, to provide some extra end user guidance, while we don't want to kind of revert back to departmental and break anything out or duplicate anything within the schedule. There's definitely, for example, fields within our software.

We can tag different business areas where a record series is relevant or a function is relevant. You can limit views so that people in different business areas, for example, can only see accounting, tax and HR, because those are the only areas that are relevant for them. So I think that there's some different approaches. We can still keep that functional schedule, but provide some guidance that will kind of be specific for those business areas and help them really hone in on the areas of the retention schedule that are relevant for them.

Ann Snyder: And Greg, I was wondering if you had any thoughts on this, from a practitioner perspective. What works best from your sense? I mean, both as a practitioner applying this schedule, but also in terms of questions you receive, do you find one approach or another better?

Greg Dinklenburg: We decided to go by function and, in some cases, process. So a records retention schedule could contain more than just one department, right? So I find that by doing it by process and/or function, you can kind of find where the records are generated easier than just by a department, so to speak.

Ann Snyder: Okay. And this one, while I have you on the hook here, this one also is for you. Is it possible to manage a global retention schedule on your own? So you have a big one to manage, or several, I think, right? So do you think, can you do it on your own? Is this a one-man operation?

Greg Dinklenburg: Well, I know we couldn't. Doing business in over 80 countries would be pretty crazy. And I guess it depends upon what you mean by on your own, right? Does that mean no tools, like, for instance, like a Zasio, right? If that's the case, and all you have is the internet: I put in a search that said how long to retain employment records in Brazil, right? So, you know, what's your retention period for employee records?

I came back with 203 million hits. So imagine one title for one function, and having to parse through all that, what's legitimate, what's not, what have you, and then keeping it up to date, and then do your day job, right? So that's many, many people's full-time day jobs, right? Right. Yeah, so unless you have an army of folks doing this for you, no, you need some kind of tool to work through this.

Ann Snyder: Yeah, that has been my personal experience, that it rapidly gets out of hand for one person to do it. And it's not just a question of the expertise in that particular jurisdiction, but language barriers as well. Right. So here's an interesting one that I think some of us... I'm sure you've encountered this with clients who are doing this, and I've encountered it myself.

If you have to work off of an Excel spreadsheet, any tips to be sure you stay up on top of departmental updates when doing an inventory for the enterprise? Or, how do you manage your records retention schedule basically in Excel? Warren, thoughts on that?

Warren Bean: Well, we chuckle, but I would say 90% of the... [Speaker: Yeah, certainly helps.] Yeah. Really, 90% of the organizations that we work with start that way, or they're still doing it that way, even if they're global international companies, just because it's a simple format that everybody understands. It's recognizable. And to be honest, it works quite well if you have a relatively small schedule. It's easy to sort and search and function and filter and so forth. But once you get into those international scopes, it becomes just so unwieldy, because trying to cross-reference the various record types with the different exceptions, you end up with multiple spreadsheets, or at least multiple worksheets, and trying to navigate between those becomes just very unwieldy.

It can be done, it's done all the time; it's just not very efficient. And you have issues with being able to share the spreadsheet. Does it get corrupted? Does somebody update it when they're not supposed to? Which version is the correct version?

Do you have an audit trail of who changed what? All of those things, when you start to look at it, become very problematic when it comes to being compliant, facing audits, all of those issues that you deal with as a multinational organization, or even a small organization.

Ann Snyder: So our next two questions are about specific retention periods. So: does anyone have a record retention on social media or texting? How long do you keep? And how long do you need to keep hard copies and digital? So my immediate thoughts on this are that it shouldn't be based on the medium but the content, and what is it. Does anyone else have any thoughts on that?

Speaker: [inaudible] Jen, I think you've probably dealt with it more than I have, at least in terms of the retention periods.

Jennifer Chadband: Yeah, I think that fundamentally you go to that question about what is the content. I think more so, what we see our clients doing, and we recommend, is really try to control this by policy as much as possible. You really want to keep kind of substantive business records off of social media or texting or your BYODs or your collaboration, sharing platforms. So policy really, I think, provides really great guidance for end users. And then really the idea is that anything that would be subject to the retention schedule is kind of saved separately and in accordance with the records retention schedule, going back to that content.

Speaker: So keeping some of those chat functions and things like that for the chatting capability that they're meant to be; don't conduct business on them. And then enforce that, so that you would be able to deploy a shorter retention period. I think that goes also with the hard copy and digital. One of the issues there is, what is that hard copy? There may be instances in which you can get rid of it if you've made an appropriate conversion to digital, but in other cases you might need to keep it. But again, I think it depends on the content of the record and what your policy is, why you're keeping that record.

Ann Snyder: So the next question here is: does anyone know where I could find an example of a retention schedule for financial services and credit unions? And I'll just make a quick point on that: there are often industry groups out there. Certainly for the pharmaceutical and biotech industry there are groups, and I believe there are some for the financial services industry. And we also have, at ARMA, industry groups that you can join, and there is one in financial services, so you might want to check that out. I know that there's pretty good collaboration amongst people within the same industry.

Jen and Warren, do you have any thoughts on that?

Warren Bean: I know that we've often had customers or prospects ask us about just industry standard templates and so forth, and the idea always sounds good, but it's really difficult to nail down a standard, so to speak, because every business is different, depending on where you have operations, what kind of operations you have. Are you a dealer broker? Are you a bank? Are you an insurance company? All of those different things will affect how you keep records and where you keep them and who has jurisdiction, and so on. And it's certainly never one-size-fits-all. It's a good, maybe, start-off point. Right, right, and then you have to tailor it, certainly, to the specifics of your organization, including all those other categories that have nothing to do with specific requirements. And sometimes what happens is, when there is a template, an attempt at a template, in order to cover the legal aspects of that, you have to make the coverage so broad that you really have many more categories than you want. And so you still end up having to pare that down to just, you know, what's necessary.

Jennifer Chadband: Yeah, I think that we, I mean, we often get this question. We have clients asking for templates, and in some instances, depending on the business, there's a way, I think, there. But ultimately, we always kind of work with them to really tailor it to their organization. That's kind of where we always end up.

Ann Snyder: So, let's see, we're almost done with these questions. Wow. So, does anyone know where I could find an example... I'm sorry, I did that one. I'm sorry, I apologize.

If we have a retention requirement that runs counter to compelled destruction requirements, which takes precedence? Jen, do you have thoughts on that one?

Jennifer Chadband: Yeah, that's a really great question. So one thing that we note in most of the compelled destruction requirements is they have kind of a carve-out for other legal requirements. For example, that Utah requirement I mentioned earlier, there's a carve-out for that. Same thing for the Illinois biometrics. Like FINRA, for example, requires fingerprints to be retained for broker-dealers for a certain amount of time, so that would be a carve-out if it needs to be kept longer.

So I think that's one thing we always look to first: is there kind of, does it grant exceptions for other legal requirements? And generally they do.

Ann Snyder: Does anyone else have anything to add to that?

Warren Bean: I know from what I've seen, sometimes those compelled destructions end up breaking down some of the big buckets into a little bit smaller buckets because of those exceptions. We have seen some of that as a trend.

Jennifer Chadband: Yeah, I think that's a really good point, Warren. And to that point, more and more we're seeing biometric record series in client schedules, because it is highly sensitive personal information and it's being so strictly regulated, and not only internationally, but now we're seeing more and more in the states too. So it really makes sense to kind of break that information out.

Ann Snyder: All right, here's the next one: should a retention program prioritize the deleting of documents after they have expired, or the retaining of documents per their legal requirements? In other words, is there more risk of deleting too soon or keeping too long? And I think that's an interesting question. It's about striking the balance. I think it also really depends on the nature of the records, I think, specifically that we're talking about. Jen, do you have any thoughts on that?

Jennifer Chadband: Yeah, I think that the safest bet is really to make sure you're following your policy, and that your policy is being refreshed on a periodic basis, taking into account all of those legal requirements as well as the business operational requirements of the business. I think as long as you're really kind of on top of that and maintaining your policy, really just stick to your policy as much as possible.

Speaker: Okay, I would add that it kind of depends on what you're worried about. Are you more worried about what someone will find, or are you worried about what you might lose?

Ann Snyder: Right. I think, again, that really hits heavily on the nature of the record you're talking about specifically, and obviously you want a policy that's developed around those specific record types. So I think there are some types of records that create more risk when they're over-retained than others, and vice versa, potentially. I think, going back to the social media and text messages and so forth.

Speaker: And I would put email in that category too. That's one of those things where, especially email, the trend years ago was just to keep it all, just in case. Then they realized that there were a lot of litigation issues over that, because it was being used against them. And so now it's more like, okay, let's get rid of that as soon as we can. And some of that I think about just as a risk from a volume perspective. You've hung on to this potentially negligible value record for a longer period than you need to, and then litigation hits, and now you have to go through that.

So it just can be voluminous, and also, depending on the media type, too difficult to review and piece together the conversation. So I think we've evolved pretty well in email, in putting together threads of a communication and in streamlining that process, but I don't think we've integrated as well all of the newer modes of communication, so they're difficult to get through if you have to.

Ann Snyder: This is our last question: with the collection of sensitive information, such as biometrics, in response to the COVID-19 pandemic, have organizations been forced to review their retention schedule to address privacy considerations? I'm just curious too, if you have any thoughts or comments on the retention of all of these new records that we're creating with regard to COVID. So every, you know, I think every place you go now, people are either asking for a temp or doing a temperature check, or asking to do some kind of questionnaire: have you traveled here, been exposed to X, and so on, upon entry to buildings. Any thoughts on, one, the first part of this question: has it forced people to review their retention schedules a little bit more carefully, about those privacy considerations? And then any thoughts you might have on the retention of that information.

Jennifer Chadband: Yeah, I can kind of speak to that. We started this Virtual Coffee series, and it just kind of happened to align with the start of the pandemic, and we spent several series talking about COVID records. Right. And I don't think in my RIM career I've really had the opportunity to kind of look at or deal with something as substantial as this, where it's like introducing a completely kind of new type of almost like medical record, or record, to the retention schedule to this degree. I guess there's always things that come up with different laws, but there was definitely a sense of urgency surrounding this. They're like, we're creating all these and collecting all these records. And I think that people were definitely mostly worried about it because of the privacy implications, so they wanted to make sure they were getting it right. And there are definitely some nuances. We had these conversations about the records. So, for example, taking COVID tests: what type of record is this? Is it a medical record? And then we talked about the nuances. Well, if somebody is exposed while they're at the workplace, and they have a test to confirm an exposure or disconfirm, then does that rise to the level of an OSHA exposure record, because it is a biological agent? But what if we have somebody who's been working off-site for the past five months, now they want to return to work, and as part of their return to work they have to have a negative test? That's not really an exposure record, right, because they haven't been in the workplace. And so the importance there is, exposure records have a really long retention period.

Ann Snyder: Isn't that... that's very long, right? It's decades long after.

Jennifer Chadband: Exactly. [Ann Snyder: Okay.] Yeah, it's like 30 years or so. [Ann Snyder: 30 years.] Yeah, yeah. So it really forced people to think really hard about it, and want to make sure that they were only keeping these records as long as necessary per the legal requirements or other reasons, and kind of minimize that risk with over-retention. So I think that has been really kind of fascinating, and really kind of a test to how much organizations and people are thinking about privacy with regard to the records they're collecting, and how they're categorizing them in the retention schedule, and making sure that they're not over-retaining. So yeah, it's been really interesting. We still get a lot of questions, too.

Ann Snyder: So I think we're at the end of our questions. Do any of you have any final thoughts, last words, before we end the recording?

Warren Bean: It's just been a really interesting session, great questions. Really great to see all the participation, so I've enjoyed the process. And I just want to thank everyone again for coming. Anybody else?

Ann Snyder: Greg, Jen, thank you so much for being here. Warren, thank you for being here. And we'll get these questions out to everyone really soon. And stay safe, stay well.

Speaker: Thanks. Thanks so much. Thank you, everybody. Bye.

During this session, the experts from ARMA and Zasio address a variety of topics; learn more about the “evergreen approach” to records management, find out what the sweet spot is for the number of record categories, how often you should review your records retention schedule, and more!