Revamping Your RIM Program:

Duration: 0:59:05 · Recorded: 2025-02-18

Speakers: Jerry Manter, Zasio (moderator; introduces the presenters and advances the slides); Jennifer Chadband, CRM, IGP, CIPP/E, Licensed Attorney, Senior Consultant / Consulting Co-Manager, Zasio; Rick Surber, CRM, IGP, Licensed Attorney, Senior Consultant / Consulting Co-Manager, Zasio

Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.

[Slide: Title slide: Zasio, "Your Complete Information Governance Partner". Kickstart 2025: Revamp Your RIM Program! February 18, 2025.]

Jerry Manter: Good morning, everyone, and welcome to the first Virtual Coffee with Consulting of 2025. We're really excited to kick off another year of information governance and RIM-related conversations, so thank you again for registering and joining us today. A friendly reminder that today's presentation should not be considered legal advice, and if you have any questions during the session, please submit them via the chat window. At the end of the presentation and in your email, you'll be asked to take a quick survey, including suggestions for future topics covered in Virtual Coffee. We would love to hear your feedback, so thank you in advance for taking that.

[Slide: Meet Our Presenters (Records & Information Management Experts): Jennifer Chadband, CRM, IGP, CIPP/E, Licensed Attorney; Rick Surber, CRM, IGP, Licensed Attorney; both Senior Consultant / Consulting Co-Manager.]

Leading off today's Virtual Coffee is Jennifer Chadband and Rick Surber. They are senior consultants and co-managers of the consulting team here at Zasio. And with that, I will let Jennifer kick things off. Jen?

Jennifer Chadband: Great. Thanks, Jerry. Appreciate it. Thanks, everybody, for joining our Virtual Coffee this year, our first one of the year. This is a really great topic, I think, and Rick and I were kind of brainstorming for the year and wondered if it would be too dry or not interesting enough.

We're really going back to the fundamentals, but surprisingly, we've had a ton of interest, great attendance numbers. So we're extra excited, I think, to present on this topic, because honestly, there's always kind of new things to think about. So with that, we'll go to our next slide. And just a reminder, Virtual Coffee is kind of, I'd say, a casual forum. We always encourage people to bring their coffee, other beverage of choice.

I think we had a guest once who brought Diet Coke and a cigar. So whatever floats your boat, please feel free to imbibe accordingly. We want to kind of converse about this loosely, but I think it's great to have slides. We all like visuals, we all like takeaways too. But it is really supposed to be kind of a discussion format. And Rick and I will kind of go over some of the ideas and the content and everything, but also just have conversations and discuss common practice and things that we're seeing.

So if you're not familiar, because I have seen quite a few new names signed up for today's presentation, just be aware. And we always welcome questions. You'll see there's the questions at the end, but you can submit questions for us and we'll go ahead and get back to you on those. So with that, roadmap for today's discussion: we'll get into the why. Why are we conducting kind of assessments and re-evaluating programs? What's the driver behind that?

We'll go on to talk about fundamental program components and introduce that, because I think it really does lay the foundation for some of these other conversations and building on that. What does it look like to conduct assessments, and how it might vary depending on your organization and your goals and what's driving the assessments. We'll also just kind of talk about common findings, practical tips and some of these other aspects I think that are really helpful, especially when you're kind of boots on the ground and you're the one who's driving the initiative or even conducting an assessment, full assessment or part of an assessment, yourself. So I think that there's a lot of really handy tips that we can pass down. So with that, why don't we go to our next slide?

[Slide: Why? Robust RIM Program Benefits: Legal & Regulatory Compliance; Risk Mitigation & Liability Reduction; Increased Operational Efficiency & Cost Savings; Protection of Sensitive, Confidential, Proprietary Information; Enhancement of Business Continuity & Disaster Preparedness; Supports Informed Decision-Making; Facilitates Digital Transformation & Information Governance.]

So talking about the why, I think there's definitely some... if you look down these bullet points, this will all look pretty familiar. But these are really just the common drivers for RIM assessments. And I'll say this can evolve over time. We recommend, especially if your goal is full maturity, that you're assessing on a periodic basis. Even if it isn't full maturity, you still should be checking in in different aspects and seeing how things are working, how they're not working.

What are the strengths, what are the weaknesses, et cetera. But these are typically the different drivers for building a robust records management program. First, we're seeing legal and regulatory compliance that's ever evolving. We're looking at GDPR, HIPAA. In fact, I think there's recent changes that are coming down with HIPAA.

So it really helps to kind of identify gaps in compliance and helps protect against legal risks or penalties. Also mitigating risks and reducing liability. We all know poor records management can lead to various risks: data breaches, non-compliance fines. You don't have to search too hard to find what's going on in that realm. I know it's been a really rough couple of years, for example, for some financial services companies with regard to the SEC.

I think those have been the most sensational in the headlines, and privacy and data breaches and things like that that are still ever occurring. So certainly one of the primary drivers would be that risk mitigation factor. Optimizing operational efficiency and cost savings, that's always a consideration as well. We know inefficient records management leads to wasted resources, excessive storage costs, loss of productivity and a whole other host of issues. So it's really about, I think, thinking about modernization too and moving your program forward. You're looking for opportunities for automation and technology enhancements.

And I think that's really something that more and more is an important consideration in RIM, because all of these automation and enhancements can really help improve your information governance program. Also, protecting information of the organization, one of its most valuable assets. So sensitive, confidential information, proprietary information: all of these things really are the benefits from implementing a robust RIM program. And I'll let Rick kind of highlight some of these other ones too. I don't want to take the whole page from you, Rick, if you want to talk about these last few on here.

Rick Surber: Thanks, Jen. Yeah, so the next one is making sure your organization is prepared for unforeseen events like disasters and that you have a plan for business continuity. Those are risk mitigation approaches and things that assessments can help plan for and help promote and justify: identifying critical records, making sure that they're recoverable in case of a disaster, whether that be a natural disaster or something that seems like it's more frequent these days, a cyber attack; identifying weaknesses, backup plans, those types of great things. Next on the list is making sure your decisions relating to RIM are informed. I think that the ultimate goal of an assessment is to kind of come up with a strategic roadmap of where you want your RIM program to go, what you want to prioritize, things that you want to do.

And all of these things will help improve decision making, enable quick retrieval of records, make sure that records are being stored properly, make sure that everything is being disposed of defensibly, which are all the great things that we're looking for. The last one there: facilitate digital transformation and information governance. AI-driven records management is something that we've had a couple of pre-submitted questions about. We're going to touch on that here every once in a while in this. I think we'll have a more dedicated session on AI later in the year, but essentially we're helping to integrate records management into broader enterprise content management, digital transformation strategies, ensuring that all technologies are being leveraged efficiently while maintaining compliance and being efficient.

So if you could move to the next slide, please.

[Slide: RIM Program Components: Governance; RIM Practices; Work Culture & Behavior; Technology; Risk Management & Security; Compliance.]

So here are the key components and factors that Zasio looks at when we're doing these types of assessments. The first and foremost is program governance and structure. So we're looking for things like policies, RIM policies. The retention schedule is usually kind of a foundational thing to this. But also, more importantly, or just as importantly, making sure that senior leadership is on board with what you're doing, making sure that RIM is part of a broader information governance program that is holistically looking at governance of information.

A dedicated steering committee is great. Defined roles and resources are a good foundation to a proper RIM structure. Records management practices: there we're looking for progress in implementing the program objectives, which includes the policies, procedures, records retention schedule. But it's just practices, workflows, procedures, processes designed to responsibly manage records, and make sure that these things are followed through and that the record life cycle is being followed appropriately, including especially the disposition aspect, and that it's defensible. Work culture and behavior is a big one. It's a crucial one, because you can have the best governance in the world, and if people aren't on board and don't care about it, it's not going to go very far.

Jennifer Chadband: Yeah, wouldn't you say, Rick, I feel like this tends to be like the biggest speed bump, when we hear from our clients and we're in these assessments or whatnot. I feel like a lot of feedback is, okay, we have all the pieces, but it's just not... people, we can't get it properly implemented, or people to follow. How can we reinforce this? How can we create awareness? How can we communicate? I think we hear that often.

Rick Surber: We do. And we'll talk some strategies there today. We'll talk about some things that can really help promote enthusiasm in RIM for companies, which can be a difficult thing. But one thing that helps, and this isn't kind of the more in-depth thing, but training, of course, and boosting awareness. But we'll talk more in depth about that in a little bit.

Technology is next: the use of technology to support records management processes. It's the ability of existing technology to provide visibility and control of electronic and physical records. It's kind of understanding different repositories and applications and their limitations in achieving RIM objectives, potential workarounds, those types of things. We'll get into that more. Risk management and security: so we talked about business continuity and disaster recovery already, cybersecurity, those types of things.

And then finally, compliance auditing and monitoring. These things are really things that need to be happening to ensure that compliance is there, to ensure that key metrics are being met, and to ensure that, if needed, corrective action is being taken.

Jennifer Chadband: And I think I'll just kind of maybe note, too, this technology part is, I think, playing a larger and larger role all the time. A lot of our findings and takeaways from our assessments end up having recommendations to adopt certain technologies to enhance or even facilitate the actual implementation of your project goals. AI being a major factor. So I just want to point out, too, as part of this presentation, there's not going to be a heavy emphasis on AI. It's just kind of the bigger picture. But we are planning another Virtual Coffee here down the line where we're really going to focus on AI and technology and how that can be leveraged to really modernize and kind of build your RIM program, take it to the next level.

So we'll talk about that, just as an FYI. Next slide, Jerry.

[Slide: Benchmarking & Industry Common Practice: ARMA (Principles: Generally Accepted Recordkeeping Principles; ARMA Maturity Model); ISO (15489-1:2016: RIM; 24143:2022-05: IG); Others; Identify gaps; Prioritize areas for improvement (first priorities should align or address your "Why" and purpose for assessment).]

All right. So benchmarking and industry common practice. So this really just is kind of thinking about what's our yardstick? What are we kind of measuring our current status, or the current structure of our program, against? Surprisingly, there's a lot of different resources to look at, or unsurprisingly, I guess, if you're just really in the RIM world, we know about several of these.

But one of the major ones: Generally Accepted Recordkeeping Principles, GARP, eight principles there: accountability, transparency, integrity, protection, compliance, availability, retention and disposition. Don't say that too fast. But I think, yeah, so this really kind of helps the organizations measure maturity and compliance, is the idea behind that.

Rick Surber: And speaking of ChatGPT, I asked AI to give me a mnemonic for that, the GARP. And first it got it wrong. It said that GARP is General Association for Records Practitioners. And I used the acronym there instead of spelling out the Generally Accepted Recordkeeping Principles. But then it actually gave me a good mnemonic, and I tweaked it slightly, but I like it.

A trusted information professional complies and reviews records diligently. So thanks, AI, for that one.

Jennifer Chadband: That's handy. I wish I would have had that while studying for the CRM or the IGP, honestly.

Rick Surber: Yeah, me too.

Jennifer Chadband: Oh, that's great. Also, the ARMA Maturity Model. So there's kind of five levels of maturity that you're measuring against, whether the program is described as initial, developing, defined, managed, transformational. Of course, the goal being that it's transformational in the respect that the program is fully proactive, rather than just being reactive, which I think is the state that most people could probably relate to at this point in time. And it encourages continuous improvement. So it's like identifying the weaknesses, the retention compliance practices.

A lot of these kind of focus on the weaknesses, but I also find just as helpful, when we're going through these assessments, focusing on strengths. What's actually working? I think it's really not uncommon that you'll find disparities within the organization where, oh, in this area, they really have it together. It tends to be kind of finance, accounting and HR, in our experience, tend to be really kind of on top and maybe even more developed or mature in certain regards. So that's kind of not an uncommon finding, honestly. But the ISO standards for RIM and IG: there's ISO 15849, which is more focused on core principles for designing and implementing RIM systems, versus ISO 24143, which is focused more on IG concepts and principles for a structured approach.

And it really kind of emphasizes that IG approach, which is the cross-functional aspects across the organization, between legal, IT, et cetera. And so there's also others. Like Rick kind of touched on, Zasio, we have our own model that's kind of proprietary in nature, but it takes certain aspects, similar aspects, into consideration. But there's also an industry common practice that we've kind of pulled into it, based on our years of conducting assessments. And so what you're doing here is comparing your program to whatever this yardstick is, and you're looking for what are the gaps. Honestly, common gaps that we see: still kind of lack of formalized policies or procedures, or policies or procedures that can easily be followed.

That's kind of another nuance to that. Maybe you've got a super complicated retention schedule. People don't understand how to use it. You have a policy. It's just not easily followed.

Inconsistent retention and disposition practices across the organization is very common. And also just kind of like poor integration of RIM and IG with IT and security policies is something as well. So really, those gaps will help you highlight and justify resource allocation and support, I would say, to move forward and get what you need to further develop your RIM program. And so from that, you're really going to try to prioritize the areas for improvement and, as Rick kind of touched on, gain executive buy-in for the improvements that need to be made, and really focus on going back to that why: why are we doing this? And if it's, for example, legal regulatory compliance, that might be the low-hanging fruit and the first kind of risk to address.

So there's some prioritizing there with the takeaways and next steps. All right. We'll go to our next slide.

[Slide: General Assessment Approach, Risk & Maturity: Starting from scratch (general risk approach); Minimally developed (general risk approach & some maturity); Substantive maturity (primarily maturity & targeted identified risks).]

Rick Surber: So let's dive even deeper into this and talk about the risk priorities and then maybe some maturity milestones. The way that I see it, if you're a more immature program or just starting out, it's going to take more of a risk priorities approach. And the more mature you get, the more you can rely on those maturity milestones and kind of be working towards those already established goals and different measurements. And so when you're starting from scratch, you're not going to have any governance, usually. You might have a records retention schedule, because it seems like that's the first thing that everyone gets, which I think is good because it's a foundational thing.

It's something that's absolutely necessary. But so is the RIM policy. You may not have an actual program for RIM or someone that's dedicated to it. And so it's going to be kind of a general risk approach there. And I think that an assessment and a strategic roadmap is actually a great place to start for an organization that's brand new to RIM, because it really lines out a path to maturing in a strategic way and working towards goals that everyone agrees with and everyone is on board with.

Jennifer Chadband: So I would say, wouldn't you say, Rick, some of our clients, or people who might come to us, and they're saying, "Hey, we need a records management program. I just can't kind of get that buy-in, and I can't get the support that we need." I would say that in our experience, we've helped build business cases, but you don't have to be a lawyer to build a risk-based business case. There's resources out there: Google, AI. You can kind of gather different enforcement actions, different legal cases that are relevant to your industry or just records management in general.

And so there are ways, I think, to kind of pull together, when you're just starting out and it's really like, we just need to focus on the risk to our organization so we can just get started and get buy-in and resources and whatnot. I think that anybody would be capable of kind of pulling something together that would be persuasive as part of that first, really risk focus.

Rick Surber: Yeah, there's an abundance of horror stories. We actually did a previous Virtual Coffee or webinar on spooky Halloween-themed horror stories, but they're everywhere. And there are newer ones than that webinar, but that webinar kind of highlights some of the classics, so it might be worth a watch. I think it's still on our website.

Jennifer Chadband: Yeah, there was a skeleton on that one, I remember.

Rick Surber: Yeah. For minimally developed, you're kind of a balance of risk and maturity aspects. You're using the roadmap to justify additional resources and technology, hopefully, towards meeting objectives. Once you hit substantial maturity, once you're a fairly mature program, you're going to have senior sponsorship. You're going to have a steering committee. You're going to hopefully have well-established key performance indicators and continuous improvement objectives.

And you're really going to be honing in on the things that you already know are hurdles for you, and being strategic about how to meet those and identify and kind of overcome those. Internal audit findings and continuous improvement are really good ways for mature programs to continue to work to get even better. Next slide, Jerry.

[Slide: Assessment Planning & Considerations, Objectives & Scope: Why is it being conducted? (risk, compliance, efficiency, modernization, adverse audit finding, all the above?); What will be assessed? (policies, procedures, retention schedules, technology, practices, compliance, etc.); Identify the scope of outreach & assessment (organization-wide, specific business area, electronic v. physical records).]

Jennifer Chadband: All right, so talking about assessment planning and different considerations, we'll want to think about being, I think, very concise in plotting it out and kind of planning: what will this look like? So the first question is, why is this being conducted? And that really kind of helps form the scope and what that reach-out might look like, whether it's risk management, regulatory compliance kind of focus, or whether your main objectives are to improve operational efficiency, modernization, digital enhancements or transformation. Or maybe the organization has had an audit finding or litigation exposure that's kind of really prompting this assessment. Or maybe it's just the regular check-in that your organization is conducting to just make sure that things are working how they should be.

But part of that is also just looking at, okay, what are we going to assess? And I think that's an extra important component. It's not always the case that it's necessary, or the objective is, to kind of survey the entire organization. It might be just certain areas, depending on how your program is organized, whether it's centralized, decentralized, whether you're aware that there's areas that are quite mature versus others that are just developing. So I think that it's really important to think about that. And oftentimes maybe people kind of underestimate really the effort and timeline that might be involved with a complete enterprise-wide reach-out.

But what we're looking at: we're gauging policies and procedures and looking at whether policies are being, for example, regularly, or I should say updated on a regular basis. Retention schedules, compliance aspects: are the retention schedules regularly updated? Are they compliant? Are they reflective of the business operational needs? Are the records subject to the schedule kind of being managed properly?

And these kind of also help inform questions as part of the reach-out. And we'll touch on that here a little bit more, because there's some foreshadowing here about having to gather this information too, but we'll get into that. You're going to be thinking about technology and systems, what tools are being used, and typically gathering information on the current practices. How are employees managing records on a daily basis? Is there a standardized approach, for example?

So these are kind of some examples; training and awareness as well. And I would say that some of these aspects that are being evaluated, you will have the answers, being a stakeholder in this assessment. A lot of this stuff can be answered by RIM. Although there are several stakeholders involved, some of this will squarely fall within your realm. And so then, as mentioned, I kind of got a little ahead of myself on this, but the scope of outreach and assessment: as I said, organization-wide versus specific business area, but also, is there a focus on electronic records versus physical?

More and more, it really is about electronic, of course, and physical records play a minor role. It's a more minor consideration, but especially with everything, managing records in software and databases, and the complexities in applying retention in the cloud, et cetera. So that really tends to be a deep-dive kind of focus, getting information on those types of records. And then, of course, there's kind of geographical considerations, thinking about your organization, where is it located, because that brings into play as well the different legal regulatory compliance aspects. So generally, this kind of covers those objectives and scopes, and it's always really, I think, important to kind of go in having a good plan that really kind of is scoped appropriately to these different aspects.

We'll go to our next slide.

[Slide: Assessment Planning & Considerations, Stakeholder Engagement: Identify key stakeholders (legal, business areas, IT, records managers/liaisons, privacy); Conduct surveys & follow-up interviews; Gain executive buy-in for assessment results and recommendations for future.]

Rick Surber: So this one, I alluded to kind of: if there's a magic trick to helping with support, adherence and smooth implementation, this is really it. Involving stakeholders, getting stakeholders engaged, collaborating with them, making sure that their opinion is heard and that you're doing everything to bring their needs into the program goes a long way. And implementing and building champions and everything that is good about kind of rolling out a program. And so you may not know who your stakeholders are. And if that's the case, you can develop a survey and just shoot it out to managers, have them identify the people in their departments that are the most knowledgeable about the records on a day-to-day basis, how long they need to be retained, their business needs for them, those types of things.

And so we're usually going to be looking at some key stakeholders. Legal is going to be one. IT is going to be a major player. They're usually going to require multiple touchpoints on several different things. If there's a privacy team, we're going to want to talk to the privacy team, because they're going to be a major player.

And then representation from each of the business areas within your organization. And many times, these key touchpoints, if you haven't already established it, can be used to reinforce a sort of RIM liaison-type relationship, which we really have found useful, not only in collecting the information, but in helping to roll out things and helping with compliance and helping with training. Everything along the way: if you've got good stakeholders that are willing to continue to participate, and they have bought in based on collaboration to this approach, it just makes things so much easier going down the road.

Jennifer Chadband: I would say, too, I think one of the questions we get commonly is, okay, how many people would it be appropriate to involve in an assessment? And we always say kind of it depends. But what we do look at is just how large the organization is. We're looking at, of course, what we call like core verticals from the business perspective: some folks from HR, legal, IT, and those common kind of areas. But then also a good focus on whatever your industry-specific areas are.

And sometimes that can be tricky, because the client might say, well, we have 50 manufacturing sites, and I know we have this quality manufacturing production function in our schedule. Are we really going to reach out to all 50 of our sites and speak to individuals there? And the answer is no. Nobody really has the bandwidth to do that. But you want to get a really good sampling if there's unique aspects about products or unique regulatory considerations in certain areas.

Or there are certain sites or jurisdictions that are considered higher risk, for example. I think kind of homing in on those sites that would be optimal, as far as the information that they can provide and the value that they would add to the assessment, is something to think about. So I think this can be like a hang-up, too. It can be a little bit overwhelming, and it can also be really difficult to get people to engage. I think we can't underestimate that.

Typically, I would say the survey response success can range anywhere from 30 to 70 percent. For smaller organizations, we get 100 percent response rate, especially when, honestly, when legal is involved; that tends to like prompt more responses, I guess, as long as there's kind of that... They're recognizing the importance of the initiative, or it's at least just very communicated that this is why this is really important to our organization. That goes to kind of making sure that you're just clearly communicating the purpose of this. And I think people can appreciate that. Even if legal isn't involved, they can understand this is a policy that reduces risk for our organization.

And we really appreciate your participation, and making them feel like they're part of it. So anyway.

Rick Surber: And executive support helps, too, right?

Jennifer Chadband: Exactly. Yeah, it does. 100 percent helps.

Rick Surber: I like to talk to an executive kind of later in the information collection, so that you can report what's going on, kind of talk about the strategies that you have developed so far, and then get feedback from an executive sponsor on the approach to take going forward.

Jennifer Chadband: Yeah. Yeah. Yeah. It's not always easy to get an executive on a meeting, but we do. We get presidents of companies. It's great.

Rick Surber: We do. Yeah, that's pretty amazing.

Jennifer Chadband: Yeah. Okay. Next slide, Jerry.

[Slide: Assessment Planning & Considerations, Existing RIM Framework & Policies: Review current records retention schedule and classification structures; Assess policy documentation for clarity, accessibility, and enforcement; Evaluate RIM and disposition practices (is unnecessary data being properly destroyed? Are records being captured and maintained appropriately?).]

All right. So talking about the assessment planning and considerations, when we're thinking about the existing RIM framework and policies, kind of want to go over some of these. You're reaching out now. You're asking questions. The survey itself, I think, really, we want to keep it as straightforward and simple as possible. We can't get all the questions we want answered in that survey.

People just simply won't complete the survey. They just won't do it. I think there's a sweet spot. So it's almost like the survey sets a foundation for some of the most important aspects, like we're asking, tell us about the systems, locations of records, and kind of initially even providing a rundown of options that they can select. So it kind of facilitates that. We usually work with IT to get an idea of what that looks like.

And that can be very complex, depending on the size of the organization, too. But when we're kind of getting into the conversations and we're going down our list of things that we'd like to answer, because it helps inform where the program is in the maturity level, we're thinking about the retention schedule and asking: are there inconsistencies? Is there anything missing? Do you commonly use it? Do you have familiarity with it?

Also, looking at the policy documentation for clarity, accessibility: are the policies clear? Are they well documented? Are policies regularly updated? Again, some of these things we as RIM professionals can answer. Are policies written in a way that ensures consistent application across the organization?

Accessibility and communication: again, going back to that, I think one of the real linchpins of the program, make-it-or-break-it thing that we're thinking about: are employees actually aware of and able to find the RIM policies? And I would say even with fairly mature programs, it's not uncommon to find folks that aren't familiar with the retention schedule, who have never seen it. And usually that kind of shows that maybe there wasn't, for example, an onboarding requirement for training. So these types of questions can answer a lot and tell a lot. Are policies being enforced consistently, or at all, across the departments?

And then we're also kind of thinking about just generally going through these disposition practices. ROT is kind of a big thing: redundant, obsolete, trivial information. Is there over-retention? Is any of this being deleted at all? And you can get that just generally through questions. And even thinking about email: I don't want to gloss over the fact that email is a major consideration here.

And maybe it's not necessarily part of your strategy to evaluate email, but generally: are records being stored in email? Are emails being deleted at all? Just for example, are there backlogs of records that should have been destroyed, but they remain stored, for example? Are the disposition practices being documented? Are they auditable, I should say?

So these are just kind of some of these questions that I think, as you get into the information gathering and meeting with folks, kind of going down these lists, you can get a general sense. It's not that people have to answer every single one of these questions in every single interview. But I think as you have these conversations, which are meant to be kind of organic, you'll get more and more information that you can kind of take away and really kind of help inform what the state of things are. So just some examples.

[Slide: Assessment Planning & Considerations, Technology & Systems: Assess records management software (RMS), ECM, or other information governance tools; Assess current systems and capabilities; Identify integration gaps with IT systems (e.g., ERP, CRM, email management); Consider automation opportunities for classification, retention, and disposal; Standard for onboarding new technology conducive to retention and disposition.]

Rick Surber: All right, technology. This is a big one. There's a lot to talk about here. I'm going to do it quickly, but I'm going to start it with a user-submitted question. "How are RIM programs addressing the shift from managing legacy paper to a vast array of software repositories that all hold digital records in different ways, most without the metadata or connection to the retention schedule, or legacy staff literate in the new realm?"

I think that sums up a lot of what's going on. Technology is advancing. The prevalence of digital records is exploding. Digital information is exploding. And trying to manage it is becoming even more challenging.

And so I think a couple tips here are to kind of prioritize key systems: try to hit the areas where the most records and information are being stored initially, or the key systems that are very important to business operations. And then ask yourself, are there tools available with these systems or repositories to help manage records? I think a good example of that is Microsoft 365. Purview labels have been getting better. It wasn't built natively in it at the beginning to be designed to do it, but they've added it. And it's more robust with like an E5 license than an E3, but you can still use some of the features in E3.

So use what you've got, recognizing that better technology and more centralized management is going to make things a heck of a lot easier. So if you can move towards an electronic records management solution, it's going to make things significantly better the sooner you can get there. And then automation, to try to make things less manual, of course. It's going to help with employee burden. It's going to help with better consistency.

It's going to make things better. So next slide, Jerry.

[Slide: Assessment Planning & Considerations, Records Lifecycle & Governance Practices: Evaluate how records are created, stored, accessed, and disposed of; Identify information silos or redundant/obsolete information; Determine whether metadata and classification standards are consistently applied.]

Jennifer Chadband: All right. So kind of another component here that you are measuring during the course of the assessment and information gathering process: the records life cycle and the governance practices. And I think it's really important to get an idea of, generally across the organization, how records are being created, stored, accessed, disposed of. Maybe you already have some good insight into that. But just some typical questions, again, things that you're trying to answer or that will give you insight to kind of gauge this. And you're looking to see and determine whether records are being captured in a structured and standardized manner, whether there are policies in place to ensure proper classification at the point of creation. You're thinking about storage and access controls: where are records stored?

Whether it's physical, electronic, cloud, hybrid. Again, that's something that might be more easy to kind of answer as part of the survey question, in the survey itself, and compile that. Are storage practices aligned with security and access control requirements? And then disposition and retention compliance: are they being disposed of in accordance with the retention schedule? So a little bit of overlap, I think, in some of these components and the questions that kind of get you where you want to go.

An important thing, especially from an IG perspective: you're looking for information silos and aspects or parts of the program, or different areas, where there is redundant, obsolete information. So kind of, I'd say, getting more across to... and this is maybe even its own discipline in a way, shared knowledge, but it's just a good RIM/IG practice to kind of get rid of practices where folks are creating silos where they're just managing their information, keeping their records locally for themselves, and making it difficult to access, or just unnecessarily creating copies. We just had a meeting with some folks on an assessment, and I kept on hearing about, oh, we're keeping these copies here, these copies here, knowing that there was a centralized repository where those original records were meant to live, and it was accessible to everybody. And then come to find out that the way that the program was built is you could only view the records by downloading from that centralized repository.

So that started to explain: oh, that's why everybody's keeping copies of these records. They're forced to download it in order to actually view it. So those are things that you'll kind of catch as part of those questions, and also just kind of determining whether metadata and classification standards are being consistently applied. I think that's an important one, especially as we want to really move towards that modernization and implementation, adoption of technology and integration across the organization. Thinking about: are metadata elements consistently used across systems? Are the key attributes, like the record, whatever those are established, like the record type, owner, retention period, are they being properly tagged? Is there classification consistency? Is there kind of a universal classification scheme?

I think sometimes, especially in larger organizations, you'll kind of dig in there and figure out people actually are creating their own policies. And so that's always kind of a red flag, but a really great takeaway to address and make sure that you're aware of. Also, an important thing that can't go overlooked: audit and compliance monitoring, if your program is advanced to the point where that's actually taking place. But are there periodic audits conducted to ensure that there's classification and metadata consistency? The audits and compliance monitoring, to the extent that that's something that's taking place, can really tell a lot. If your program isn't quite there, there's nothing really telling there. That's going to be kind of a takeaway or part of a strategy that you'll want to work towards.

So just some of these categories here give you insight into overall what's happening across the organization as far as managing the record life cycle, governance practices, where things are, what the strengths are, what the weaknesses are and what could be improved.

[Slide: Assessment Planning & Considerations, Risk & Security Considerations: Identify vulnerabilities related to data breaches, loss, or unauthorized access; Assess disaster recovery and business continuity plans; Evaluate how sensitive records (e.g., confidential, PII, PHI, financial data) are protected.]

Rick Surber: Yeah, bad audit findings suck, but they can add more resources. They get the attention. It's an unfortunate way to have that happen. You'd rather, again, you want to move to being proactive rather than reactive, right?

Jennifer Chadband: Right, right. Yeah.

Rick Surber: Let's talk about risk and security quickly, because we're just slightly behind. The security team is an ally with overlapping objectives. They're probably doing phishing testing, penetration testing. It's really how RIM can help them identify vulnerabilities related to RIM practices. Also assisting on the disaster recovery, business continuity: identifying vital records, making sure that they're protected, making sure that there's a plan to be able to access those in the case of a disaster or something like that.

And then similarly, privacy teams are also allies with overlapping objectives. They can help you evaluate sensitive records, confidential personal information, how those are being protected and managed. A couple of things to work towards are accurate categorization and processes for storing and securing and protecting records. And then also implementing, and security and privacy will both be in favor of this, making sure that you're using the principle of least privilege, so that employees only have the minimum level of access necessary to perform their tasks and nothing more. That way things are cordoned off. Only people that need to be accessing things are accessing them. It just makes things a whole lot easier if a bad thing happens, like a phishing attempt is successful or something like that.

[Slide: Assessment Planning & Considerations, Efficiency & Process Optimization: Identify manual, redundant, or inefficient processes; Assess user adoption of RIM tools and adherence to policies; Look for opportunities to streamline workflows, reduce costs, or improve automation.]

Jennifer Chadband: All right. Some more assessment planning and considerations here to think about. So efficiency and process optimization. I don't know if this is always kind of a primary objective that folks come in with. Certainly it's important, though, and it's something that is a goal for organizations as part of the assessment.

And so kind of thinking about that and the different categories, what we're looking for is identifying some of these manual processes that could be potentially automated, or whether there's redundant processes, inefficient processes. And so you can kind of get into that, asking, like: how are you searching for things? How are you finding things? Are you finding difficulty looking for the records that you need on a daily basis? Try to get to the bottom of why that is. Is it based on poor indexing, or is it issues with the metadata, or is it the schedule or the classification scheme itself?

So that's kind of telling. Also, assessing how folks are using RIM tools and adhering to policies. So what are some of the challenges that people are facing with regard to adoption of different technologies? Are they using... this is a big one: are people using kind of shadow IT? Are they going off the grid and kind of doing things on their own? And, oh, well, yeah, we're not using this program.

Actually, this is how I'm doing it, just because. And you'll find out that where there's a will, there's a way. People will look for loopholes if something is too complicated or difficult to follow. And that can really key you into maybe a focus for something that needs to be further developed, I should say, or additional training is needed, or something along those lines. And so you'll kind of get some insight into potentially thinking about these best practices for improving adoption, and thinking about... I already mentioned ongoing training.

But there's some takeaways there for that change management aspect and communication enhancement across the organization. Some takeaways there, how things can be improved. And finally, you're looking for opportunities to streamline workflows, reduce costs, improve automation, and some different things that kind of fall under there: automation opportunities. We already kind of talked about this, but AI-driven classification is kind of a big thing. And again, we'll go into more depth during our next Virtual Coffee about the technology and AI and how that can enhance your program.

But machine learning for compliance monitoring, automated retention triggers is a big one, too. And you're really also kind of thinking about, in the background, taking some of your knowledge, RIM knowledge, whether it's from the IGP or the CRM. But what are some of the industry best practices for process optimization? So you're kind of, again, measuring it against that and thinking about the outcomes and what those strategies and the roadmap will look like as part of your reporting.

Rick Surber: The dreaded management side of the CRM coming back to help us out.

Jennifer Chadband: Oh, flashback. [laughter] Okay, we'll go to our next slide.

[Slide: Reporting & Recommendations: Develop a report with findings, risk areas, and recommendations; Risk based report v. maturity report; Prioritize based on risk, compliance, business impact; Consider tasks that can commence and run concurrently; Create a roadmap for implementing changes, gaining leadership buy-in, and supporting continuous improvement.]

Rick Surber: All right, so what you're going to want to have at the end of this assessment is a report. And you're going to want to have findings, risk areas, recommendations, all of those good things. Some advice: distill the important findings and pose them in an easily understandable way. You can have all your supporting information. You can have all of your risk analysis, maybe even in appendices. But your actual findings and recommendations should be very plain and very simple, both as an executive summary and as a distinct findings and recommendations section.

And so I think that's a good takeaway. Over the years of interacting with clients, we have these long assessments, and they have all of these really helpful things in them, like some risk sections on building a use case, or enforcement actions, things like that, template policies, template processes, all of those good things. But you don't want to bury the really important things, like the primary risks and the recommendations to circumvent those risks. And so make sure to keep it organized and keep the important aspects of it right up front and clear, so that your people and your executives hopefully can easily see what's going on and easily see what needs to be done.

Jennifer Chadband: I would say too, data visualization: just thinking about this is such a text-dense, it can be, type of report, don't be afraid to dress it up and make it more interesting with like colors or visuals. One tip I would say for your reach-out: when you distribute the surveys, if you can, use something, for example, like Google Forms, or Microsoft has kind of a similar format. You can formulate those questions, and it's great, because it actually takes all of those answers and can create all these really interesting visuals as takeaways from the information that you gather, whether it's like it can create pie charts or different diagrams or really, honestly, kind of fun visuals. So it's nice to kind of dress that up with different visuals, even like adding icons or pictures. So anyways, the kids these days, they're into graphic novels, and the adults, they like some pictures in their reports too.

So it's just a good way to break it up and make it more interesting, I'd say.

Rick Surber: I can honestly say that I've never seen a report of this nature that had too many graphical representations of data. It just doesn't happen. Usually there's too few. Usually it's way too text heavy. And people aren't looking at ways that they can visually represent information to make things a little easier to read and process.

And even AI can help with that. If you've got some data that doesn't have personal information in it, you can spit it in, as long as it's not proprietary or anything like that, and ask for visual representations. It's a great thing about AI: it can come up with some ideas for presenting information in ways that maybe you wouldn't think to present it.

[Slide: Developing a Roadmap Summary & Timeline (Phase / Key Focus / Timeframe / Milestone): 1, Assessment & Gap Analysis, 0–3 months, RIM Assessment Report; 2, Policy & Governance Enhancement, 3–6 months, Updated RIM Governance Framework; 3, Technology & Process Optimization, 6–12 months, Automation & ECM Implementation; 4, Training & Change Management, 12–18 months, Organization-wide Adoption; 5, Continuous Improvement, 18+ months, Future-Proofed RIM Strategy.]

Jennifer Chadband: 100%. This is kind of a representative... thinking about what would be involved in the timeline for a roadmap strategy. And I think it's important to just kind of present this as just a high-level, generalized, I guess, idea as to how this could potentially map out and how you would plan. We actually like to really create a visual roadmap. I know that each different phase will have a lot of details, and you could go into that in the report.

But there's really just kind of like one page that spells out, here's the roadmap, in a very concise way. Thinking about your audience, that's something an executive would rather see, rather than kind of getting into all the details of what all the different phases might entail. But this kind of gives you, I think, a good idea of how we could really break it out. So the assessment and gap analysis, zero to three months, and to kind of create this report. I would say that that would be potentially realistic for a really small organization.

But it could be double that for a larger organization, depending on how many people you're reaching out to, and just getting on people's calendars, too, that can kind of be a difficult part that can kind of lengthen that timeline. So always important, I think, to be on the conservative side. These things can take much longer than you might anticipate or think, especially when you're trying to kind of round up individuals to talk to them. So that can be kind of an important consideration. And then thinking about updating the governance and the framework, whether that's putting a committee in place or getting your policy reviewed: three to six months. Again, this is for a small organization. It could be much more complex or elongated if we're thinking about a larger organization.

Technology and process optimization, six to twelve months. This will vary based on the number of different solutions, everything that was involved. I know that we always kind of learn our lessons when it comes to technology, between the acquisition and procurement process for that, through the actual going active. That can be a very extensive timeline that you kind of have to think about when you're plotting things out. Training and change management: kind of similarly, that can really take a while to fully implement.

But generally it's always good to have kind of a good enterprise-wide training strategy, and then also, what is this going to look like moving forward, during onboarding, and how are we going to manage this, and maybe not even just the annual training. But how are we going to just create general awareness and keep people in the loop? And the counter to training, too, is just being available to answer questions as part of that. So that is definitely a process, and you can't really overlook what that might look like. And then there's just the after: continuous improvement. Once you've started, and maybe even it's just a pilot, you're just starting with one area and you're testing it, you're always kind of wanting to be doing these. It's a rinse and repeat: check in again. Where are we on things? What's improved? What can still improve?

Where do we have clear deficiencies? And so it really is just something that happens on a regular basis. It should be part of just regular check-ins, outside of just general auditing and monitoring. Auditing and monitoring is part of the bigger picture too. So always kind of good practice to make sure that you're striving for continuous improvement and maturity for your program.

Rick Surber: Good stuff. Oh, yeah.

Jennifer Chadband: Did I miss anything? [Rick Surber: I don't think so.]

Rick Surber: There's a lot to go over.

Jennifer Chadband: So it is a lot. And I think it's always really great to kind of set things out and think about it foundationally, and help gear up for, okay, here's the big picture. Where do we start? Get excited about it. As I mentioned, our next Virtual Coffee, I've mentioned a couple of times, but more information coming about that. It'll be later this spring, but it'll be more on the technology side for modernizing your RIM program.

So with that, I think we can go to our last slide.

Rick Surber: Yeah, and I've got a save the date. Warren has been asking me to collaborate with him on a webinar. It kind of goes back to that user-submitted question about addressing repositories. Should the retention schedule manage information or data that makes up records? Traditionally, that's been a no, but in this current environment, where applications are taking the place of records in some situations, how can this be approached?

And so we are going to be discussing "When Data Becomes a Record: Tackling the Master Data Retention Question." That's going to be on Tuesday, March 25th, at 9 a.m. Mountain Time. So I'm really looking forward to that. And yeah, I think we covered the assessment pretty well today, Jen. So yeah, great job. And we'll see everyone next time on Virtual Coffee.

Jennifer Chadband: Thanks, everybody. Send us any questions if there's anything that we could kind of further clarify or help on. Thank you. Bye.