Continued from page 1
The principles underlying records management – creation, retention, identification and retrieval – apply equally to both electronic and paper media. This means that procedures for e-mail and other information held on shared and personal hard drives have to be as robust and detailed as those for other records.
Conflictions in Compliance
Document management systems are challenged when different data in
same document relates to both Data Protection Act and Freedom of Information Act, since one is geared for confidentiality, other for accessibility.
Leading document management systems such as TokOpen, control who can view different parts of a document, meeting conflicting needs of both pieces of legislation.
In a typical document, such as a Wire Transfer Application form, some of information falls under Freedom of Information Act, and other parts of document are private meaning access must be restricted and audited in accordance with Data Protection Act. Certain data must not be disclosed to anyone outside bank as it is private and for internal use only.
Document management software overcomes this problem by hiding internal information when document is viewed by someone outside bank. Users with authorised access are still able to view whole document.
In same example, applicant’s name and address are protected by Data Protection Act, and should therefore only be seen by staff members dealing with that client, such as HR or Accounts. Remaining staff do not have access to these specific document details. TokOpen document management software can ensure compliance with this.
Document Management: Way Forward
The increasingly complex demands of legislation underline need for businesses to implement document capture and document management systems. However, even though a document management system is an important component, alone it will not ensure compliance. A wider view is needed to ensure businesses maintain their compliance with changing legislation.
In a court of law, judge will consider evidence based on several criteria:
•Are procedures clear and consistent, with a requirement to document procedures? This is often referred to as a document policy.
•Are procedures enforced? This is a shared responsibility between management and selected document management system's access and privilege controls.
•Can claims be substantiated? This relies heavily on document management system’s audit trail.
Compiling a Document Policy
After establishing which regulations have to be complied with, a document policy is required covering following:
oScope of information covered oSecurity classifications oStorage media oFile format and version control oStandards (compliance and regulations) oRetention and destruction oResponsibilities
A document policy defines how information is stored, and is therefore central to ensuring compliance. It should serve these main purposes:
oEnsure everyone knows what they can do oDefine business practice at time oDemonstrate why a given action was undertaken, e.g. explains why a document was destroyed oReinforce documents’ evidential weight oHelp authenticate documents to increase legal weighting oImprove court’s view of evidence presented
Consideration also needs to be given to how long documents should be stored. This depends on type of document and industry-specific regulations.
This raises an interesting question. What is legal position if original document is electronic? This can best be answered in three steps.
•Civil Evidence Act 1995
oAuthenticated copies will be accepted with equal weighting to original oLater revisions are given greater weight than superseded revisions
•Admissibility
oDoes court accept this evidence? oWith what weight?
•Appropriate procedures must be followed if documents are to be taken to court
Therefore, when considering compliance, legal weight given to a document also needs to be taken into account. In addition to ensuring that documents and information are managed in accordance with compliance legislation, document management software also plays a key role in ensuring that optimised legal weighting is given to documents, should they be presented in a court.
Improving documents’ legal weighting depends on three key factors:
•Information management
oSystem management (duty of care, audits, etc.) oOperational issues (good management practice)
•Legal issues
oGeneral (e.g. Data Protection Act, invoice storage, etc.) oIndustry-specific (compliance/regulations etc.) oOrganisation-specific (internal regulations etc.)
•Need for clearance permissions
Companies therefore have a duty of care responsibility to ensure they are compliant with legislation. This is best described as information security and can be summarised with following questions:
•Can a court be assured that information (evidence) has not been inadvertently or maliciously altered, or some of it lost?
oi.e. due care has been taken of data
•Basic criteria can be met
oConfidentiality (who has had access?) oIntegrity (is it reliable?) oAvailability (can it be retrieved?)
Summary
Ensuring compliance with legislation is a responsibility shared between:
•The staff, following clearly defined document procedures •The management enforcing these procedures •The document management system policing and enforcing duty of care responsibilities
Tokairo is an international solution provider of electronic document management systems and education solutions.
Visit http://www.tokairo.com for further information REF=TO4GO
