The missing link

• Article 10 of 26
• M-iD, November 2004
• View a PDF of the original article ~ 1.2MB

Page 1 | Page 2 | Page 3 | All 3 Pages

Sarbanes-Oxley, the Data Protection Act, the Freedom of Information Act, a slew of regulatory mandates: never have organisations in both the public and private sectors been held so accountable for keeping accurate evidence of the communications and transactions that make up their day-to-day operations.

That means asking some difficult questions about how the records that provide that evidence should be managed and stored: Which should be kept - and how long for? Which should be destroyed - and at what point can this safely be done? And if required, can it be proved beyond reasonable doubt that an organisation has done what it claims it did?

A decade ago, records management was simply a matter of archiving paper documents - invoices, contracts and so on - in filing systems. “A piece of paper would do its rounds and end up with a former librarian, and they would actually be responsible for archiving in the company,” says Sol Barron, a document and record management specialist at IBM.

Now, however, the issue of records management extends way beyond paper documents to include emails, web pages, electronic calendar entries and records of customer contact made over the telephone and Internet - all of which may provide vital evidence in the event of a dispute.

In short, many of the vital records that companies need to keep track of are electronic. That has led to the emergence of electronic records management systems (ERMS) that promise to automate many of the processes that underpin the retention and deletion of electronic business records.

In particular, as enterprise content management (ECM) has evolved, vendors such as Open Text, Vignette, Interwoven, FileNet and IBM have incorporated records management into their products, primarily through acquisition of records management vendors and their technology.

However, with standards for electronic records management only at a fledgling state and many arguing over whether ubiquitous records management integration is feasible or even desirable, the decision to implement an ERMS is still a difficult decision for many organisations.

At the heart of the dilemma are the limitations of many ERMSs when it comes to data held in multiple different repositories. Most of the ECM vendors, for example, have focused on records management functions that can be applied to data held in their own proprietary ECM systems, while others maintain a separate repository for records. Few, however, enable users to apply records management principles to data held in systems from other suppliers.

A new approach is necessary, says Forrester Research analyst Robert Markham. He calls it the “linked in place” architecture. It will, he claims, provide support for additional content repositories and the integration of records management capabilities directly into business applications. “This approach not only supports applications that are directly integrated into the ECM repository but also provides open application programming interfaces (APIs) that can be used to support additional repositories.”

That is a tough challenge for vendors, but nonetheless, examples of the 'linked in place' approach are beginning to emerge, he says. “An example is IBM DB2 Records Manager, which supports a centralised policy console that can be used across repositories and allows the extension of the records management solution to additional enterprise repositories and applications,” he claims.

That kind of function is an appealing prospect for records managers, says Mark Fresko, a consultant with Cornwell Management Consultants. “One of the difficulties managers face is that records are scattered across a variety of systems and environments. You may have certain records such as correspondence in a records management system, while you'll almost certainly have financial records in a financial system and personnel records in a human resources system.”

Being able to link into all these content repositories from a records management console, leave the content in place, but apply records management criteria to its access, auditing, deletion and retention would certainly be useful for records management professionals.

Another software supplier embracing that approach is ECM vendor Interwoven. “If you look at our strategy and vision, we have a very specific repository for web content, digital assets and documents,” says Christoph Theisinger, director of technology in Europe, the Middle East and Africa at Interwoven. “All of these repositories offer unique features for their respective contents. It makes sense to unify those repositories not on a storage or technology level, but on a level higher: at the metadata level.”

But by leaving records in systems other than a records management repository, organisations face several challenges: what if the other repositories do not have the capabilities, such as record locking and security, to support either records management in general or the capabilities required by the particular records management system implemented; what if they allow users to bypass the commands sent by the records management system; what if the records management system cannot instruct the other repositories?

Adrian Foote, a marketing manager at Vignette who joined the company when it acquired document and records management specialist Tower Technology, agrees that the 'linked in place' approach can be problematic. “You run into all sorts of issues once you look at the detail. If you record in an SAP system an insurance policy that needs to be kept for 75 years, what happens when the system needs upgrading? That record must be moved to a new version and kept in another system, so you've a transfer problem immediately,” he says.

A second issue, according to Foote, is security. He argues that, in his example, standard SAP security is no longer appropriate for dictating who can access records: it has to be a records management-level security policy that dictates who has access to records. So the SAP system has to be modified to ask the records management console who is allowed to ask for the information. “To do that, the console has to understand SAP logins and who can log into the system. Once you start doing that with all your business systems and looking at the problems of upgrading from one business system to another, transferring records from one system to another, it really becomes quite a difficult approach to managing records,” he says. Moving the records into a central archive is therefore a much easier and more workable method to implement for many organisations, he adds.

There are a number of other challenges associated with trying to manage records in diverse repositories. For example, the ability to lock down all the records to make them unalterable or undeletable. This will need to be done with permissions, but another application built on top of the repository might bypass them.

Tracy Caughell, records management product manager at Open Text, says that there is still some way to go before a 'linked in place' architecture can be implemented. “What we have now is a records management console where you can work out your file plan, retention schedule and metadata. We're working on the lock-down of records in other repositories, but it's difficult for us to work through all these issues.”

Faced with the obstacles of integrating with other repositories, some vendors are choosing to take a pragmatic approach to records management architecture. David Gingell, European vice president of marketing at EMC, says that his company supports both a centralised records management repository and distributed repositories in its implementations.

“Some organisations quite like the idea of keeping the records management repository separate, so you have a live repository, decide when a piece of content becomes a record for compliance reasons and then electronically turn that content into a record and put it into the separate records management system. We also point out the benefits of a unified repository. Logically and economically, it makes the most sense. But we bought a company four months ago called Ask Once that allows you to retrieve content from other repositories, not just content management repositories,” he says.

Equally, Barron says his company's DB2 Record Manager software is a piece of middleware that stands alone from its ECM system. If customers choose to keep data in existing repositories, they can add records management capabilities to the necessary applications through Record Manager's APIs or its out-of-the-box integration tools; if the repositories do not have the necessary capabilities for records management, customers can migrate the data to an ECM. It is, therefore, up to the customer to decide just how many applications they want to records-enable.

“There are lots of applications out there that people need to records-enable: transactional applications and so on. There's some effort required but nothing too significant. The US Patents and Trademarks office embedded our engine in 75 custom applications, and ours was the only product that was able to records-enable them, because it's an embeddable engine,” says Barron.

Whether it will be possible to have the full 'linked in place' architecture envisaged by Forrester's Markham and how encompassing that architecture can be will depend on whether organisations employ applications that are capable of records management or of responding to records management applications.

At the moment, there is little likelihood of this situation changing: legacy applications will present the same problems as before; and repositories and applications that do not have the APIs necessary to integrate with records management systems are unlikely to acquire them in the future. The industry's attempt to create a standard API for opening up repositories, the Java-based JSR170, has received some backing but it is still in its infancy and offers only a small set of the features necessary for records management.

'Linked in place', rather than becoming the next obvious phase in records management architecture, is likely to become a choice for organisations with the right sets of applications, the right records management system and the money to integrate them. For everyone else, painful migrations and implementations limited to only a few systems are the only way to join this elite.

Page 1 | Page 2 | Page 3 | All 3 Pages