Artikel von Martin Waldron
Martin Waldron ist als freier Berater für PCI PROJECT CONSULT International, London, tätig und hat als Ko-Autor den MoReq-Standard mit verfasst.
Bridging the gap between best practice for electronic records management and e-government/e-business strategy
There has suddenly been a realisation by organisations that their conventional paper based records management (filing) systems aren’t working. Most business processes both outward facing to the citizen, customer and supplier, and in the back office are increasingly being undertaken through electronic transactions and documents. Many organisations large and small do not have in place the controls and infrastructure to effectively manage electronic records that are being received via e-mail and accessed from the Web, as well as being generated internally. The result is documents are printed and managed as records using existing paper based systems with resulting inefficiencies and delays in access.
There are also stark warnings of poor records management accumulating with major business disasters as seen in the Enron collapse or where a company is unable to find the e-mail that has the contract attached which cost a financial group £2 million pounds. There is unfortunately a history of management not being sure of the business imperative for investing in Records Management which is generally perceived as a downstream administration system for archiving. There is chasm that has to be crossed to convince management of the key role of ERMS in implementing their e-government/e-business plans, and its vital role in an organisation’s information management strategy.
Are e-business/e-government initiatives delivering?
There are enormous challenges to take an organisation from current manually intensive service delivery to an e-business citizen (customer) driven operation. There are change management issues, financial constraints, and the need to embrace? maintaining traditional service channels.
Major strides have however been made by organisations to improve accessibility of services and information to their customers through electronic means. The Web has been a major contributor with public access to service information, forms to be printed for ordering, claiming, applying? etc and the ability to e-mail enquiries and documents. This “shovelling” of information onto the Web has improved availability of information but not tackled the core business issues of improved service levels for core business processes such as submitting applications and claims nor has it delivered any significant internal efficiencies.
This cosmetic approach to meeting e-business targets is however rampant. This is understandable as there are major cultural and skills issues in shifting to delivering services electronically. A recent report by the UK Audit Commission “Councils and e-Government” cited from a survey of 64 Councils that the three main barriers to delivering e-services were the capacity to manage the change process and lack of ICT skills and knowledge of staff. This report also identified council’s “ lack of a robust cost information on their proposed e-activities to inform these choices…”. The report also stated 40% of Chief Executives found the requirements too broad to tackle alone and 61% that it is too costly.
Role of Records Management in developing an effective e-business strategy
There are many challenges in progressing e-business but short-term low cost measures driven by limited budgets and “the need to demonstrate to the Chief Executive that you are embracing “e-business” can result in poor returns with limited real improvement in customer service and no overall internal efficiencies. There is now a realisation by companies that they need to develop a corporate strategic approach to developing e-business applications by more fully exploiting their business information repositories in such areas as a Customer Relation Management programme. Suddenly Metadata and Taxonomy are on the lips of organisations’ Information Management Directors. With 90% of business information residing in documents - Records Management, previously perceived as a tool for meeting statutory legal/audit demands, has now been more widely recognised as generic to an organisation developing an Information/Knowledge Management Strategy in support of e-business programmes.
The result is Records Management traditionally seen as a backroom (basement) activity that has traditionally been an activity at the end of the business process has had its profile raised forming a part of an organisations overall information management strategy.
Records Management disciplines provide a knowledge infrastructure to a company’s electronic document repository. In the nineties Electronic Document Management systems developed with departmental based filing with a simple index structure e.g Customer Name/Account Number and each department or service unit filing differently. If you are in Maintenance you may file by product/customer and if you are in sales it may be by Region/customer/product. Electronic Records Management provides the framework to develop a corporate fileplan that provides an intelligent assembly of documents that will give you a “corporate “ view of your customers/citizens, products, and suppliers. Documents contain the majority of corporate information and exploiting that pool of information is being recognised by both private and public sector as an essential part of the information management strategy.
International and European assistance for developing and implementing a Corporate Electronic Record and Information Management Strategy
Two significant initiatives in the last two years are providing both public and private organisations with a lifeline to support them in embracing a more cohesive and business focused approach to records management as they move towards electronic delivery of their services and products. The two programmes coming from different stables have been widely acclaimed to provide vital help in developing an information and records management strategy to support e-business programmes. They are:
The European Commission’s Model Requirements for the Management of Electronic Records – MoReq which was published in May 2001
The International Organisation for Standardisation standard – ISO 15489 Information and documentation – Records Management Part 1 General and Part 2 Guidelines (Technical Report) which was published in November 2001. The two documents address different parts of developing an Electronic Records Management programme:
MoReq
Provides a very detailed set of requirements for both functional requirements for an Electronic and Paper Records Management systems and for the related electronic process and document management systems. MoReq also includes guidelines on operational and management systems considerations. MoReq takes a major leap forward by not only embracing requirements for good record keeping of electronic records but the need to also set out the requirements for other Electronic Document Related functions such as Workflow, e-mail, electronic signatures.
ISO 15489
ISO provides management guidelines on policies and procedures for corporate records management programme and is an implementation guide for introducing records management across the organisation.
ISO 15489 part 1 is the corporate management guide. It sets out in a concise document (17 pages) advice on :
| | | |
| | · | determining what records should be created, what information needs to be included in the records, and what level of accuracy is required |
| | · | deciding in what form and structure records should be created and captured |
| | · | determining requirements for retrieving and using records and how long they need to be kept to satisfy those requirements |
| | · | deciding how to organise records to support requirements for use |
ISO 15489 Part 2 sets out the steps from the initial analysis, identification of requirements through to implementation of a Records Management system and policies. This is outlined in the diagram below.
MoReq’s Role
MoReq’s role is very much focused on developing the specification of the EDRMS system to support the records management programme developed using ISO15489 and the organisations Information Management Strategy. MoReq provides a template on setting out the requirements by describing each requirement and then giving a detailed definition statement of each function making recommendations if the function should be “mandatory” or “desirable”. Below, to illustrate this, is an extract from MoReq’s “Electronic Signature Requirement section.
10.5 Electronic signatures
Electronic signatures (sometimes referred to as digital signatures) are sequences of characters which, when used with sophisticated secure algorithms procedures and “keys” (a long string of digits analogous to a password), can be used to confirm the integrity of a record, or to authenticate the identity of the sender of a record. An example of a widely recognised electronic signature algorithm is MD5. The wide adoption by organisations of e-mail and the World Wide Web has increased the number of documents that are moved internally and most significantly externally in relatively uncontrolled environments. The use of electronic signatures for authentication and integrity confirmation is becoming widely adopted.”
Requirement
| | | |
| | · | The ERMS must be able to retain the information relating to electronic signatures, encryption and details of related verification agencies |
| | · | The ERMS should have a structure which permits the easy introduction of different electronic signature technologies. This is especially valuable given the changes occurring in this area |
| | · | The ERMS should be capable of checking the validity of an electronic signature |
| | · | The ERMS must be able to retain and preserve as metadata, details about the process of verification for an electronic signature, including: |
| | | |
| | · | the fact that the validity of the signature was checked |
| | · | the Certification Authority with which the signature has been validated |
| | · | the date and time that the checking occurred |
MoReq is the most detailed document produced to date on EDRMS and made up of 390 requirements defined and a 127 element Metadata Model in a 100-page document.
MoReq, since it was published in May 2001 has been well received across Europe in the public and private sector and I am aware of three organisations in the UK who have used it as the base for setting their statement of requirements for EDRMS.
The diagram below shows how MoReq relates to the overall business development programme of new e- business services. MoReq is the inner core of setting out the system requirements to support the e-business/e-government strategy. The outer skin identifies the various activities in implementing the corporate e-business/e-government programme
EDRMS adoption by organisations has come to the fore as we move to an e-business world that is impacting:
| | | |
| | · | the way organisations do their business |
| | · | the citizen and business methods of meeting governments statutory and regulatory requirements |
| | · | the way services are received from local and central government |
MoReq and ISO 15489 are providing a timely set of guidelines to help organisations adopt and deliver the business benefits of an EDRMS strategy. The demand by customers for EDRMS has also been acknowledged by the Document Technology suppliers with IBM, SAP and FileNet amongst the suppliers of EDRMS announcing major initiatives in the last few months in? EDRMS to meet the requirements of their large corporate customers.
MoReq Future Plans
MoReq with its wide acceptance is now being translated into all the European Union member states languages. The European DLM - Forum are planning a programme to provide an on-going update of MoReq and in Essex? in September at the DLM Conference and Exhibition DLM will be running their first MoReq Workshop.
Table 1 - The relative role of MoReq and ISO15489 in developing a corporate EDRMS programme:
| | | | |
Activity
| ISO 15489 Part 1
| ISO 15489 Part 2
| MoReq
|
Developing RM Policies
| ***
|
| *
|
Audit and Assessment of Current Practices
|
| ***
|
|
Developing Functional Requirements for EDRMS
|
| **
| **
|
Developing Non Functional Systems Requirements
| *
| **
| **
|
Developing File Plan/Classification Scheme
| *
| *
| **
|
Developing Statement of Requirement
| *
| *
| ***
|
Operational Procedures
| **
| **
| **
|
*** - main role ** - key role * - some contribution
Metadata