Continued from page 1
The principles underlying records management – creation, retention, identification and retrieval – apply equally to both electronic and paper media. This means that procedures for e-mail and other information held on shared and personal hard drives have to be as robust and detailed as those for other records.
Conflictions in Compliance
Document management systems are challenged when different data in
same document relates to both
Data Protection Act and
Freedom of Information Act, since one is geared for confidentiality,
other for accessibility.
Leading document management systems such as TokOpen, control who can view different parts of a document, meeting
conflicting needs of both pieces of legislation.
In a typical document, such as a Wire Transfer Application form, some of
information falls under
Freedom of Information Act, and other parts of
document are private meaning access must be restricted and audited in accordance with
Data Protection Act. Certain data must not be disclosed to anyone outside
bank as it is private and for internal use only.
Document management software overcomes this problem by hiding
internal information when
document is viewed by someone outside
bank. Users with authorised access are still able to view
whole document.
In
same example,
applicant’s name and address are protected by
Data Protection Act, and should therefore only be seen by
staff members dealing with that client, such as HR or Accounts. Remaining staff do not have access to these specific document details. TokOpen document management software can ensure compliance with this.
Document Management:
Way Forward
The increasingly complex demands of legislation underline
need for businesses to implement document capture and document management systems. However, even though a document management system is an important component, alone it will not ensure compliance. A wider view is needed to ensure businesses maintain their compliance with changing legislation.
In a court of law,
judge will consider
evidence based on several criteria:
•Are procedures clear and consistent, with a requirement to document procedures? This is often referred to as a document policy.
•Are
procedures enforced? This is a shared responsibility between management and
selected document management system's access and privilege controls.
•Can
claims be substantiated? This relies heavily on
document management system’s audit trail.
Compiling a Document Policy
After establishing which regulations have to be complied with, a document policy is required covering
following:
oScope of information covered oSecurity classifications oStorage media oFile format and version control oStandards (compliance and regulations) oRetention and destruction oResponsibilities
A document policy defines how information is stored, and is therefore central to ensuring compliance. It should serve these main purposes:
oEnsure everyone knows what they can do oDefine
business practice at
time oDemonstrate why a given action was undertaken, e.g. explains why a document was destroyed oReinforce documents’ evidential weight oHelp authenticate documents to increase legal weighting oImprove
court’s view of
evidence presented
Consideration also needs to be given to how long documents should be stored. This depends on
type of document and industry-specific regulations.
This raises an interesting question. What is
legal position if
original document is electronic? This can best be answered in three steps.
•Civil Evidence Act 1995
oAuthenticated copies will be accepted with equal weighting to
original oLater revisions are given greater weight than superseded revisions
•Admissibility
oDoes
court accept this evidence? oWith what weight?
•Appropriate procedures must be followed if documents are to be taken to court
Therefore, when considering compliance,
legal weight given to a document also needs to be taken into account. In addition to ensuring that documents and information are managed in accordance with compliance legislation, document management software also plays a key role in ensuring that optimised legal weighting is given to documents, should they be presented in a court.
Improving documents’ legal weighting depends on three key factors:
•Information management
oSystem management (duty of care, audits, etc.) oOperational issues (good management practice)
•Legal issues
oGeneral (e.g. Data Protection Act, invoice storage, etc.) oIndustry-specific (compliance/regulations etc.) oOrganisation-specific (internal regulations etc.)
•Need for clearance permissions
Companies therefore have a duty of care responsibility to ensure they are compliant with legislation. This is best described as information security and can be summarised with
following questions:
•Can a court be assured that information (evidence) has not been inadvertently or maliciously altered, or some of it lost?
oi.e. due care has been taken of
data
•Basic criteria can be met
oConfidentiality (who has had access?) oIntegrity (is it reliable?) oAvailability (can it be retrieved?)
Summary
Ensuring compliance with legislation is a responsibility shared between:
•The staff, following clearly defined document procedures •The management enforcing these procedures •The document management system policing and enforcing duty of care responsibilities

Tokairo is an international solution provider of electronic document management systems and education solutions.
Visit http://www.tokairo.com for further information REF=TO4GO