Compliance, risk management, and legal requirements are not the only drivers for corporate records management. When managed effectively, business records generate significant business value by enabling the capture and re-use of intellectual property and corporate knowledge. Maximising value relies on the successful adoption of an enterprise Content Services Platform (CSP) that aligns with the needs of users and the business.
In today’s digital work environment, everyone in an organisation is responsible for managing records. It is expected that all employees will use designated corporate systems to create, capture, access, use, and manage records effectively.
This devolved approach to records management is highly reliant on the availability of an enterprise platform to support an organisation’s specific records management requirements.
A recent research report by Harvard University found:
- 77% of organisations believe effective security, risk, and compliance strategies are essential; however, 61% faced challenges creating them.
- 82% of respondents said protecting information has grown increasingly difficult due to complexities in digital transformation.
Traditionally, organisations have used specialist Content Services Platforms (CSP) or Enterprise Content Management (ECM) systems with advanced records management functionality.
The landscape has changed dramatically since the combined capability of Microsoft SharePoint Online, Teams, Power Automate, OneDrive, and Azure DevOps into Microsoft 365 has matured to the point that it compares favourably with leading CSP or ECM platforms.
Fig 1. Key components of Enterprise Records Management
The evolution to Microsoft 365 means the following records management functions are now supported:
- Declaration of record can be applied by an end user or auto applied
- File Plan Manager for retention management
- Functionality to define retention and disposition
- Trigger event-based retention
- Review, validate, and proof of record deletion.
- Export of records options.
However, there are some features of Microsoft 365 records functionality that need to be considered carefully prior to implementation. For example, it supports a traditional records management model, where the end-user determines and sets retention rules, or record managers generate and maintain file plans. At the same time, records management automation capability is supported by the MS365 online records system. Automated features can be complex to manage and are only available with an appropriate license.
When considering Microsoft 365 as an RM platform, here are some aspects of functionality to consider:
- Items are managed individually and are not part of an aggregation. To find all associated items about a specific business subject in MS365, a search strategy rather than a pre-existing folder or container-based approach to aggregation is applied.
- Retention is applied to the item, not to the aggregation, so an item can be disposed of in isolation, meaning that the overall context of other records may be reduced in some cases.
- Retention labels only apply one rule to each item, although items can have more than one retention policy. For example, one based on the type of content, a procedure, and the other based on its description.
- The requirement for users and records managers to classify records, with limited automation of this function, means that MS365 requires comparable administrative effort to traditional systems.
- Artificial Intelligence and automation delivered with Microsoft 365 can be complicated to manage. For example, an administrator can configure automatic or default labels, but this can lead to challenges in assigning the correct label
- unless the use of this feature is managed carefully.
- MS365 requires third-party add-ons to manage paper records and to manage records in secondary systems.
The overall design of the RM solution in MS365 is based on the US records management model, which applies a file plan classification label to a record and does not link it to other records in context.
The Australian approach manages records as a group to make up a story. This facilitates the discovery of related sets of information, for example, in a Freedom of Information (FOI) case, or a legal discovery process, significantly improving process efficiencies.
Finally, Microsoft 365 records management requires an E5 license, or similar, so organisations that do not have this included in their enterprise license need to cover the additional cost.
Many of these challenges can be managed with appropriate RM policy and procedures, and an implementation that includes training and change management. In this respect, MS365 is no different to any other CSP or ECM platform in the current marketplace – business integration and process alignment determines how effectively the platform will perform.
Fig 2. Records management lifecycle