Understanding ISO 15489

Does your company utilise a formal Records Management System for managing business data? If so, do you follow guidelines and standards to maintain your data in an efficient manner?

Understanding, interpreting and identifying relevant standards relating to the management of data (both paper and electronic) can be a laborious task! In this article, we’ve put together an outline of useful information found in the ISO 15489 standard; focusing on the recommended framework for designing a document management system.

From this article, you should be able to identify whether your cloud-based data storage system (or offline paper system) is up to scratch and meeting international standards!

Disclaimer
Standards are regularly changed and updated. While this article is up to date at the time of writing, it may not describe the standard accurately in future. Be sure to refer to the most recent version of any standard when attempting to gauge compliance.

Records Management is Critical for Business

Utilising a formal system of documents and records management in your business model is critical. Records  & information management systems aim to provide fast and efficient access to business information, operations and processes. The time it takes staff and stakeholders to access information is directly related to overall productivity in your company. Management systems will also provide you with information on key performance indicators and may be used to identify faults or shortfalls within your business activities.

Application of Standards to Records Management

ISO 15489 provides a framework for developing records management systems. While our focus is on eDRMS (Electronic Documents and Records Management Systems), the guideline will also apply to paper document management.

The standards’ step-by-step procedure and best practices for designing and implementing record management systems provide you with a solid groundwork for achieving your business records management goals.

5 Benefits that the Standard Provides are:

1. Outline of record management best practices
2. Methods for achieving up-to-date, fast and efficient retrieval of information
3. A framework to allow managers to have greater control of the design methods and tools (such as eDRMS) used for capturing and maintaining records
4. It provides the necessary steps for an efficient and seamless records management transformation
5. Insight into continual improvement through post-implementation reviews

The 8 steps for Implementing Records Management Systems

The suggested framework for designing a records management system consists of eight distinct phases. Let’s run through each of the steps as outlined by the AS-ISO 15489.2: Information and documentation – Records management – Part 2: Guidelines.

1. Preliminary Investigation

In this phase, your business strengths and weaknesses are analysed to determine the scope of requirements for a new records management project.

During this phase, take time to consider the following factors:

• The scale of required works, number of documents, size of documents, etc.
• Feasibility – cost and time for implementation and ongoing management
• Risks (High level)
• Managerial support
• High level administrative, stakeholder (collaboration and data sharing) and business operational requirements

At the end of your preliminary investigation, you should have some insight into the following items:

1. The size and scale of the records management project
2. Whether or not the scope will need to be altered to cater for changes in management structure
3. Areas of your organisation that require additional support and functionality
4. Whether a proposed or existing system needs a broad restructuring

2. Analysis of business activity

Before a records system can be integrated with existing business operations, an analysis of current business activities and processes needs to be carried out. By looking at how records affect the day-to-day activities of your business, subsequent decisions about how records need to be created, captured and stored can be made.

Analysing business processes will assist you in identifying how records should be properly managed and indexed for a specific business context.

During this phase, create a conceptual model of your business by:

• Mapping out the various processes and activities that are carried out
• Creating a hierarchical structure of business processes and how they relate to records management

From the conceptual model, you should be able to determine the following:

1. Types of security permissions to be given to record managers and staff
2. Retention periods for records
3. Metadata required for efficient data retrieval

3. Identification of requirements for records

Once you have an understanding of the conceptual business model for your records management system, you can begin to gather requirements for record-keeping best practices. The storage structure, information maintained and appropriate storage method should be clearly identified in this phase.

Focus on areas of your business where records management is particularly relevant:

1. Determine the necessary steps to achieve full system functionality – physical storage requirements or migration of data to electronic formats
2. Investigate if technologies such as a cloud-based eDRMS are suitable
3. Identify detailed requirements to meet stakeholder and business obligations
4. Ensures a detailed risk assessment is carried out to prevent oversights and potential shortfalls

4. Assessment of existing systems

Your existing records management system should be thoroughly assessed before implementing any new system. During this phase, examine what additional work will be needed to integrate or replace current systems and achieve your the desired outcomes.

To assess your existing system, simply cross-check the system’s current capabilities with the requirements that were identified in Phase 3. The assessment of the phase 3 requirements should identify if there are any gaps between what is already in place, and what has been proposed in the previous phases.

Keep a list of these gaps and issues for the next phase!

5. Identification of strategies for satisfying records requirements

Your business activities, organisational structure, technological capabilities, corporate culture and current records management systems all play a part in the formation and selection of future records management strategies. Policies, procedures, company standards, system components or different system implementations all constitute appropriate strategies that should be considered in this phase.

Well developed policies and procedures will provide you with a blueprint for the new management systems. They will address the current system’s gaps and include the system requirements identified in previous phases.

Policies, procedures and company standards should clearly address:

• Naming standards
• Business rules
• Information Security & Permissions
• Record retention and archiving rules
• Methods of storage

6. Detailed design of the records system

Once strategies and requirements have been established, you may begin system design.

Decisions that need to be made during this phase include:

• Changes in current system practices and processes
• How technologies will assist with achieving the desired outcome (i.e. Cloud Technology)
• How to effectively roll out changes across a broad range of organisational areas

A great deal of discussion with end-users of the system and the system manager’s needs to take place in order to ensure a proposed solution will meet all stakeholder needs.

During this phase, you should look at producing a project plan, including some or all of the following elements. The size and complexity of the proposed project will obviously dictate the level of detail required from the following elements.

• Design project plan; showing tasks, responsibilities and timelines
• Documentation of changes to requirements
• System business rules
• System specifications
• Diagrams representing system architectures and components
• Models representing different system views, such as processes, data flows and data entities
• Detailed specifications to build or acquire technological components such as software, hardware, IaaS and SaaS services.
• File hierarchies or structuring plans
• Plans showing how the design will integrate with existing systems and processes
• Initial training and testing plans
• A system implementation plan

7. Implementation of a records system

Once the project plan has been developed in Phase 6, you may begin a roll-out of the proposed solution. The exact steps required for implementing the solution should be carried out as in accordance with the scope of the project as determined in the previous phase. The integration of a new system with existing business processes and activities should be achieved with minimal disruption and can be completed successfully using your careful planning which you conducted in phase 6.

“New solutions should address any flaws in existing records management systems.”

Thorough system documentation, including policies and procedures developed in phase 5 should be produced. These documents provide users with reliable training information about the new system and will help to ensure business compliance standards are followed.

8. Post-implementation review

After implementation, the newly deployed system’s performance and capabilities should be analysed. It is important to ensure full system functionality is being met and any underlying faults are identified.

Identifying faults within a new system will allow you to choose an appropriate course of action to ensure your system provides an efficient method of managing data with sufficient return on your investment.

The post-implementation review will provide you with one of three potential outcomes depending on the system’s performance; each outcome will, in turn, will require some type of action.

Outcome: System operates as per design requirements
Action: continue to monitor performance for potential improvements in future

Outcome: System fails to a design requirement
Action: Return to phase 6 to redesign the system with required improvements

Outcome: System does not meet business requirements
Action: Return to phase 3 and reassess base level requirements

Summary

Designing and implementing a records management system can be a daunting task depending on the size and complexity of your business. Successful implementation requires careful planning and analysis to ensure potential solutions align with business requirements and provide a sufficient level of accountability and traceability of records.

ASIO 15489 provides a framework for achieving the successful implementation of a records management project and will assist you in deciding whether this is achieved through a change of policy and procedure or the implementation of an entirely new system.

Cloud-based solutions often provide a simple way of adopting a records management system. Take care when selecting your new records management solution as many available options may not meet all of your business requirements! Common Out of the Box (OOTB) software solutions will require you to change your business practices to suit. If this is not part of your business requirements, you may benefit from looking towards custom design cloud-based solutions.