Enron, Morgan Stanley and the Australian Wheat Board are familiar names that may send shivers down the spine of senior managers. All these organisations have been involved in controversy over emails that have cost the company's reputation and/or large fines.
Emails are usually regarded as being primarily an IT issue, which are handled by way of backups. There wouldn't be many organisations that don't have their backup systems under control, but most senior managers haven't considered corporate governance, regulatory compliance and the risks associated with actions, such as legal discovery, to be a priority.
I believe there is a mis-match between what an organisation requires, and what its IT personnel are currently delivering.
CEOs need to be aware of the protection they need around electronic documents; no protection carries risks that the business may not be able to sustain.
While Australia doesn't have a Sarbanes-Oxley Act as in the US, there are a number of legal obligations for the retention, and destruction, of emails and other electronic records. For example, the Corporations Act (7 yrs), applications for employment (6 months) and native title documents (25 years). In addition, records created by the HR department and Occupational Health and Safety may be covered by a number of statutes, all with varying retention periods from six months to 25 years or more.
Interestingly, the Sarbanes-Oxley legislation and other compliance regulations have not been the instigators of most email archiving installations in Australasia, although companies do acknowledge the by-product of being compliant will be of benefit in the future.
Operational Archiving and Legal Discovery
By far the biggest incentive currently for implementing email archiving is for operational reasons. Many organisations are choosing to reduce their storage and other operational costs by implementing an archiving solution.
Fear is another reason: of the enormous costs involved in litigation and court discovery orders - not to mention the adverse effect on reputation and brand. Even the threat of a legal discover order, which can cost millions to complete, often sees companies settle out of court, rather than pay to have it undertaken.
There are other motivators for companies to implement an email retention and archiving solution that will see the rapid uptake of this technology.
While records retention is the first thought for most senior managers, securing the destruction of records is equally as important. There are risks associated with retaining records for longer than is legally required or retaining records in conflict with the privacy laws.
With around 80 per cent of company communication now handled via email and instant messages, "management" is one word that can help companies reduce the risks associated with emails and their attachments.
Organisations should ensure they have a central repository, where every record is protected with stored copies of any incoming and outgoing emails and their attachments, instant messages, output from enterprise resource planning (ERP) systems such as SAP, desktop documents, images and voice files. Using WORM technology, the documents can be accessed but can't be modified and are only deleted at the end of their retention period. This single archive solution also needs to have a powerful search facility that enables emails to be found in minutes. This means they are always "dispute ready" and can find evidence quickly.
New Law on Document Destruction
A new law in Victoria will see individuals or corporations convicted of intentionally destroying documents to prevent evidence being used in court, facing up to five years imprisonment. Companies in other states may find that if they have a Victorian office, or deal with a Victorian company, they will come under that legislation. And in due course, other states may follow Victoria's lead and instigate the same legislation.
The most intelligent, long-term strategic approach is to have a corporate-wide archiving capability that handles all data types consistently and automatically. This not only removes the onus from the individual, but also gives the organisation water-tight records retention.
The ability to produce evidentiary documents is a key part of corporate responsibility in court cases. Companies therefore need to protect themselves from employees who choose to flout the law.
A whole-of-company archiving solution gives peace of mind to an organisation's CEO, its directors, HR, finance and legal managers.
Proactive Monitoring
Proactive monitoring and surveillance of emails and their attachments, by searching for keywords such as "sex", "shares" and "purchase order", can provide upfront protection for employers who can then investigate anomalies before they take hold.
Proactive monitoring doesn't just benefit the employer; it provides protection for employees as well, so it works both ways.
My advice to CEOs is to take a holistic approach to archiving; don't wait until the discovery order arrives before you implement a records compliance management solution.