You are on page 1of 8

Achievingcompliancethroughgoodbusiness practice

1. Introduction
COMPLIANCEtheOxfordDictionarysaysthatcomplianceisthestateorfactofaccordingwithor meeting rules or standards. Standards Australia even has a standard covering compliance AS 3806 Compliance Programs, so it is obviously very important. In the highly regulated public sector,employeesarefacedwithcomplianceobligationsacrosstheentirespectrumofwhatthey do. Howthendowepersuadethemtocaptureandmanagerecordsinacompliantwaywhenrecords managementtendstobeviewedasabackofficemysterytotallyunrelatedtothecorebusinessor serviceprovisionfunctionswherecompliancewithbestpracticestandardsisseenasvital? Generally the approach is either stick or carrot, but in my experience both have limited success. Thebigstickapproachisdifficulttoenforceandgenerallymeetswithstrongresistance.Thecarrot approachtendstosucceedwiththosewhocanrealisethebenefitsbutfailstoengagetheresistors. Given we have probably all tried the stick and the carrot with varying degrees of success, sometimesthebestwayistomakeithappeninvisiblyasfaraspossible,sotodayIamgoingtotalk aboutathirdoptionthestealthapproach,whichembedscomplianceingoodbusinesspractice.

2. Background
FromJuly2009IworkedatWaterSecure,whichwasabulksupplierofwhatisknownintheindustry asmanufacturedwater.On1July2011WaterSecuremergedwithSeqwaterandmycurrentrole wasborn. WhenIjoinedWaterSecurein2009itwasarelativelyneworganisationofabout18monthsofage andwasagreenfieldsite.Thiswasnotnecessarilytheadvantagesomemaythinkan18month freeforallinsharedrivesisaprettymessystartforanyorganisation.Theresultwasaplethoraof duplicated documents across siloed share drives; inability to collaborate or share information effectively; virtually no way of determining a single source of truth; and large load on the email system moving documents about. One big advantage that I did see, however, was the fact that therewerenostructuredpaperfilesandtheemployeeswereusedtoworkingelectronically.

Severalconsultantshadbeenemployedduringtheprecedingyeartoprovidevariousreportson thestatusofrecordkeepingandtoproviderecommendationsonawayforward.Management, forwhateverreasons,decidednottoproceedwithanyofthem.However,itwasclearthatwe neededeitheramiracleorasystembysystemIencompasspeople,processesandtechnology, not technology alone so a Records Management Roadmap was developed to show the way fromourcurrentstatetoourdesiredfuturestateandthisincluded: Rulesandtools,includingarecordkeepingframework;taxonomies;metadataset etc. Atechnologysolution Arobustchangeapproach Thiswasendorsedbyseniormanagementanditwasgameon.

Achievingcompliancethroughgoodbusiness practice

3. Creatinganinnovativeapproachtoachievingcompliance
One of the primary requirements voiced by users during development of eDRMS functional requirements was that it must be easy to use. By this, they meant that they are not records managersanddidntwanttobeandweagreed.Yourlocallibrariansdontaskyoutocatalogueand shelveyourbookswhenyoureturnthem.Theyarethetrainedprofessionalswiththeskillsrequired todothat.Thinkofthechaosifthelibrarycustomersdidititisunlikelyanyonewouldbeableto findanythingafterafewweeksofthat. Similarly,Ihavelongheldtheviewthatrecordsandinformationcreatorsandusersshouldnotbe requiredtoclassifytheirdocumentsintoaformalclassificationschemathatisessentiallyanartificial languagewithaprettyinflexiblestructure.Weinformationprofessionalsmightunderstandtheuses andpurerecordsmanagementbenefitstobederivedfromaformalBCS,butourcustomersdont and they dont want to. As our customers they should be able to save and work with their information in an environment that nurtures and supports business efficiency and effectiveness withoutrequiringthetechnicalrecordsmanagementskillsandweshouldbeprovidingthemwith thatenvironment. Anecdotally,IthinkthesinglegreatestcauseoffailureineDRMSimplementationsisimposingaBCS onendusers.Theywillgotothemostamazinglengthstoavoidusingit,whichintheendusually means rejection of the entire system and a disconnect between what is saved in the eDRMS and what exists outside it. The end result is loss of information and the consequent exposure of the organisationtotheriskthatentails. Sowhatdidwedotogiveouruserswhattheywantedwithoutcompromisingtherecordkeeping requirements?Simplistically,wedevelopedtwotaxonomiesandmappedonetotheother.Sounds easy,doesntit,butitisnt.Itrequiresahugeamountofplanningandconsultationwithbothend usersandeDRMSimplementationpartnersalike. Thefirsttaxonomywasreallyatypeoffolksonomydevelopedincollaborationwithourusers,which allowed the formation of a folder structure which not only reflected the way people worked, but also in which they were willing and happy to work. Our original plan was to create the folder structure in the eDRMS and on day one everyone would start using it. However, knowing how wedded our users were to their own little silos of information we decided we needed to start breaking those down well in advance of introducing an eDRMS with all its inherent rules and structures.Basicallybreakthechangeintosmaller,manageablechunks. Fromthere,anewshareddrive(whichwecalledWDrive)wasbornandthefolksonomyputintoa working environment. A case was put to management outlining the benefits to be derived from creatinganew,functionallybasedsharedriveasaprecursortoeDRMSimplementation.Principally thosebenefitswere: Movingpeopleawayfromsilosandintoamoreinformationsharingenvironment Familiarising userswiththe folder structurethey wouldbeusing when theeDRMS wasimplemented

Achievingcompliancethroughgoodbusiness practice
Thefolderstructureandallitscontents(documentsandrecords)couldbemigrated into the eDRMS giving everyone immediate access to information they had been workingwithforthefewmonthspriortoeDRMSimplementation Creation of W Drive was never part of the initial project plan and was a huge piece of additional worktobeaddedtowhatwasalreadyprettyaggressiveprojecttimelines,butwemanageditand stillbroughttheprojectinontime. BecausetheWDrivefolksonomywastoformtheuserinterfacewithclassificationintheeDRMS,we hadtoensuresomerigouraroundtitlingtobetterfacilitatelatermappingtotheBCS.Tothisend, userswerepreventedfromcreatinganyfoldersoftheirownandthehierarchywasrestrictedtono more than fourorfive levels. This didcause some heartburn after theprevioustitlingfreeforall and, in some cases, fifteen level hierarchies, however, the wide consultation, flexibility and concessionsmadeonallpartsduringdevelopment,meantthatmostpeoplegotwhattheywanted andallgotwhattheyneeded. TheformalBCSwasdevelopedintheacceptedwayusingDIRKSmethodologyandthefolksonomy was linked to its functions and activities, invisibly to the endusers, within the eDRMS. Following eDRMSimplementationourusershadnoaccesstotheBCS,theydidnthavetotryanddecipherit andtheydidnthavetoworryaboutusingittoclassifyinformation.Alltheyneededtodowassave documentsintheirfolksonomyfolderstructureandwhenarecordwascreated,alittlebackground workflowintheeDRMSaddedtherecordtotherecordfolderintheBCStowhichthefolksonomy folder was mapped. The predetermined record security and disposal class were then applied throughinheritancefromtherecordfolder. In addition, users did not have to make decisions about when to declare a record as record declaration was embedded into business practice. One of our business rules when designing the eDRMS was that all major versions would be declared records, so the simple act of saving a document as a major version, had it automatically made a record in the background. We also decidedthatemailswouldbemaderecordsimmediatelyonbeingsavedintotheeDRMS,aswould incoming correspondence that was digitised and saved into the eDRMS through the digitisation process. Althoughthisinnovativeapproachmadethingsverysimpleforourusers,itwasbynomeansawalk in the park and a great deal of time and effort went into designing the eDRMS and managing the changeswewerebringingabout.

4. Acquiringtherighttechnologysolution
ItisimportanttonoteatthisstagethatnotalleDRMsolutionsareabletosupportthisapproach. Our functional requirements when calling for tenders were very specific about the solution being abletoaccommodatebothafolksonomyandaformalBCSandfacilitatethemappingofonetothe other.Youwillnotgetthisfunctionalityinyourbasicoutoftheboxproducts.Inordertobeableto implement smart and innovative ideas you have to be prepared to move away from the most commonlyusedsolutions.

Achievingcompliancethroughgoodbusiness practice
AtWaterSecurewedevelopedaframeworkofeDRMSfunctionalrequirementsfromsourcessuchas MoREQ,thewholeofGovernmentRFQsforbothQueenslandandNSWGovernmentsandgoodold fashionedknowledgeandexperience. We then embarked on a broad internal consultation process, including all our Executive ManagementTeam,todeterminewhatourusersneededfromaneDRMS.Asisgenerallythecase withthisdegreeofconsultation,someneedswereprettyfanciful(noitwontmakeyourcoffee),but weweededrequirementsdowntothemusthaves,shouldhavesandnicetohavesandcame up with a set of requirements that meet business efficiency requirements and compliance obligations.ItwasuniversallyagreedthattheeDRMSneededto: Beeasytouse Provideatleastonequickwintoboostacceptancenofussemailcapturewasthestand out Providebusinessefficiencies Supportnotonlycomplianceinrecordkeepingbutalsoothercomplianceobligationsofa heavilyregulatedindustry Evaluationoftenderswasundertakeninthreestagesbyapanelconsistingofrepresentativesfrom ICT, Records & Information Management, Procurement and endusers. The first stage was a comparison ofresponsesagainstmandatoryrequirementsonly.Each panelmember assessedthe offersindependentlythenmettocollaborativelyreachanagreedscore. It had already been agreed by the Project Board that any offer not meeting all the mandatories wouldbesetaside.Weknewthiswasaprettybigaskandwewererightnotoneoffermetthem all,butseveralwereonlytwoorthreeshortfunnilyenoughallondifferentrequirements.Itwas agreed that we would progress the top few to the next stage while dropping off those that were significantlyinferior. Stagetwoinvolvedeachpanelmemberindependentlyscoringtheshortlistedoffers,usingasystem or weighting and rating, against all the remaining highly desirable and desirable requirements, followedagainbyamoderationmeetingtoreachanagreedscoreforeachrequirement. This left two clear leaders, both of whom were invited to present their products at scripted demonstrations,followedbyprovisionofBestandFinalOffers(BAFO).Oncewehadourpreferred optionclearlyinsight,theITProgramManagerandIvisitedtworeferencesitestoobtainfirsthand userfeedbackonboththesoftwareandthevendor. AttheendofthedayweselectedtheIBMFileNetsuiteofproductsfromBlumarkPtyLtd

Achievingcompliancethroughgoodbusiness practice

5. Theimportanceofdesign
System design will beyourbiggestchallenge. Get thiswrong and your successful implementation will be threatened. Decisions madeat the design phase can impact on what you may want the eDRMStodofurther downthe trackwhen agreater levelof maturitywithin the organisationhas been achieved.Conversely, designing with the future in mind can caused immature organisations greatangstandthreatenuseracceptance.Itreallyisabalancingact.AtWaterSecureweoptedto keeptheinitialimplementationassimpleaspossibletosatisfythatmajorrequirementthatitmust beeasytouse,butdesignedtheeDRMSinsuchawaythatmoresophisticatedfunctionalitycouldbe rolledoutastheorganisationsrecordkeepingcapabilitymatured. Onesizedoesnotfitall!!NoteverybusinessunitwantstheeDRMStolookandbehaveexactlythe sameasforthenextbusinessunit.Forexample,metadatarequirementsmaybedifferent.TheHR team may need to capture metadata about birth dates or payroll numbers, whereas the property teamdoesntneedthatbutmusthavepropertyIDs,andthelegalteamneedscasenumbers.This requires tailored forms design to ensure that each area gets the forms it needs rather than presentinguserswith a generic form containing numerous and unnecessary metadata fieldstobe completed. Whilesomesystemsettingsareglobalandcannotbeturnedonoroffforindividualbusinessunits, thereareusuallymanythatcanbesetdifferentlyaccordingtotheneedsofthoseunits.Thisisvital ifyouaretoprovidetheflexibilityneededtogetgoodbuyin.Howsystemsettingsareconfigured mustbeestablishedanddocumentedinthedesignphaseaccordingtotheorganisationsbusiness rules.Thesebusinessrulesshouldbedeterminedthroughbothconsultationwiththebusinessand complianceobligations. When designing the eDRMS to suit the varying needs of the organisation we also need to ensure that any associated compliance requirementsare incorporated, such as information security obligations,mandatorymetadataelements,etc.,regardlessofwhetheruserslikeitornot. eDRMS design takes significant planning, consultation and support. Consider using a business analyst to determine the needs of various business units. At WaterSecure we worked with an implementationpartnerwithindepthknowledgeofFileNetduringbothdesignanddeployment.

6. Successfullytransferringcompliancemessagestostaff
BuildingcomplianceintoaneDRMSisnotsufficientonitsown.Whileusersshouldnotneedtohave an indepth knowledge of records management, they must have a basic understanding of the principlesinordertoknowWHATtosaveandWHYtheyshouldbesavingit.TheHOW,havingbeen builtinthroughtheinnovativeuseofautomaticrecorddeclaration,folksonomytoBCSmappingand smartuseofformsandtemplatesisnotsomethingtheyshouldhavetoworryabout. eDRMSimplementationscanfailforanumberofreasons.Thesereasonsarenotalwaysattributable to the system or to particular software. They generally fail when employees are suspicious and unconvincedthatanewwayofdoingthingswillbebetter,andsotheyjustdonotgetonboardwith

Achievingcompliancethroughgoodbusiness practice
the project from the start. This is why it is vital to start getting the message across at the very beginning of an implementation project particularly when your compliance is dependent on consistentandaccurateuseoftheeDRMSincapturingdocumentsatinceptionasopposedtothe endoftheirlives. At WaterSecure we invested a huge amount of time and energy into our change management approach. We believed that the more change management activities, creative communications, quirky promotional tactics, marketing collateral and training that were provided, the greater the chanceofsuccess.WedevelopedaverycomprehensiveCommunicationsandChangeManagement Planatthebeginningoftheprojecttohelpuswiththechallengesweknewwewereabouttoface. The stated objectives of the Plan were to promote understanding & acceptance of the project, provide mechanisms for staff feedback, support two way communications and to create an environment that encouraged active participation. With this Communications and Change Management Plan the idea was to keep on communicating and engage our users regularly and consistently. This plan was our bible when it came to establishing stakeholder commitment and buy in, managing expectations and interests, building staff understanding of the benefits and limitationsofthenewsystemandidentifyingpotentialriskstothesuccessoftheproject.Weuseda varietyof approachesdetailedinourPlanto achievethis andIdliketosharesomeofthesewith you: Brandedpromotionalmaterialwehadarangeofmaterialsthatincludedtinsofmints,USB sticks, key lanyards and sun visors, all of which were extremely popular and always in demand(especiallythemints!) Naming competition as soon as an eDRMS has been selected, conduct an internal competition to name it noone wants to continually refer to it as the eDRMS! Offer a goodprizeforthewinner.Wegaveawayadoublegoldpasstothecinema. Preimplementation information and demonstration sessions keep staff informed, seek questionsandprovideasmallbrandedprizeforthebestquestioneachsession. Regular, targeted communications these serve to provide information as well as engage staff.Useadistinctivecommunicationsstyleandtone,onethatblendstechnicalfactwith humour and includes fun facts & trivia sheets, posters, frequently asked questions, quick guides(e.g. BusinessRulesataGlance) andcolourfultimelineposters.WaterSecures fun facts&triviasheets,postersandfrequentlyaskedquestionsweredisplayedallaroundthe organisationonwallsabovethephotocopier,onthedoorsinthetoilets,noticeboardsin thekitchenandineveryotherconceivableplacesotheycouldntpossiblybeavoided!The Timelineposterwasparticularlyusefulforraisingawarenessandprovidingouruserswitha snapshotofwhateventswereexpectedtooccuratparticulartimes. Internal newsletter column publish a regular column in your internal newsletter to keep everyoneuptodate.

Achievingcompliancethroughgoodbusiness practice
Competitionsanotherchangedevicethatwedeployed,andonethatwasmetwithgreat successwhileatthesametimestirringthecompetitivejuicesofmanyofourstaff,wasour MindBoggler.Thiswasacrosswordpuzzlethatcontainedembeddedcluesrelatingtothe eDRMSandrecordkeepingingeneral.ThewinnerwasagainawardedwithoneofourIRIS branded promotional items as well as having their achievement recognized publicly in the newsletter. FAQsencourageFAQsandpublishquestionsandanswersinyourregularcolumnaswellas acomprehensivelistonyourIntranetpage. Training well before eDRMS implementation, roll out a series of Recordkeeping 101 style training and awareness sessions to instil the WHAT and the WHY of recordkeeping. They dont have to be long try lunchbox sessions or similar.and always provide lollies!! Mentorsestablishateamofmentorsorchampionswhoarewillingandabletobethego topeoplefortheirbusinessunits.AnincentivetovolunteeringmaybeadvancedeDRMS training and recognition as experts. At WaterSecure we held a Mentor orientation and breakfast, at which roles and responsibilities were clearly defined, as well as dates of activitiesinvolvingthe Mentors.A strongrelationshipwasestablishedbetweenallgroups fromtheoutset.ThisorientationwasalsoattendedbyourExecutiveManagementTeam, includingtheCEO,whichwasagreatdemonstrationofleadershipandcommitmenttothe project. ChangeManagerifhumanlypossibleappointanOrganisationalChangeManager,atleast in the last few months before go live, to assist with the change approach and the change activitiesthatyouhavealreadystarted.Itisinvaluablewhenfocusingonthepeopleside ofthechangeasitgivestheProjectTeammoretimeandflexibilitytofocusonthetechnical aspects of the project. The Change Manager appointed at WaterSecure immediately set aboutinvolvingherselfwithstaff,attendingteammeetings,attendingstaffsocialeventsand developing a rapport with team members, actively promoting the benefits of moving forward(whileatthesametimelisteningtotheirconcerns),aswellasdevelopingarangeof creativecommunicationtools.TheChangeManageralsoattendedmeetingsoftheProject Board and gave regular updates on the status of the change approach across the organisation.

Ithinkitwouldbefairtosaythathavingsomeveryearlyquickwinsontheboardmadeuptakeof theeDRMSatWaterSecurethatmuch better.Atthebeginningoftheprojectwehadsomefairly definite ideas about the sort of functionality and the level of userfriendliness that we wanted to achieve asquickly aspossible.AsIhasmentionedpreviously,oneofthe majorfeatureswewere lookingatwastheeaseofuseforourendusersandweachievedthisimmediately.

Achievingcompliancethroughgoodbusiness practice
Notonly wasthe eDRMS accessiblevia the Internet,but it alsohad seamless integrationwith the basicMicrosoftOfficesuiteofproducts.ThismeantthattheregularlyusedOfficeproductshada FileNettabasapartofthenormaltoolbarsowhenuserswereworking,insayMSWord,theydid nothavetoleavethatapplicationtosavethedocumenttheywereworkingon.Othereaseofuse featuresincludedsinglesignon,afavouritesareawhereuserswereabletostoreandaccesstheir most frequently used documents and folders, saved searches (which many users found extremely useful), email drag & drop, and the automatic record declaration of major versions (users merely neededtoworkontheirdocumentsusingversioncontrolinthesystem).Emailswereautomatically declaredrecordsonsavingintoIRIS.

7. Lessonslearnt
Oneof the biggestlessons that we learntfromtheWaterSecureeDRMS implementation wasthat userslovetobrowsefolderstructuresandfeelthattheyneeddeepfolderlevelsratherthanusing the powerful search engine that is available within the system. This is where the use of Saved Searchescancomeinveryhandy! AnotherthingthatbecameevidentshortlyafterGoLivewasthatafewpeoplewithinthebusiness were not using the eDRMS, despite all the best change efforts. These change avoiders were subsequentlyinvolvedinconsultationtoworkoutapracticablewayforwardthatwouldseethem usingtheeDRMS.Thelessonhereistocheckyourstatsandwhereindividualshavenotbeensaving documents in the eDRMS, have measures in place to manage that. This could include reports to management on activity, either naming and shaming or not, depending on managements preference. Probablythebiggestlessonforuswasthat,aswebecamemoreandmorefamiliarwithFileNet,we alsobecamemoreawareofbetterwaysofdoingthingsandevenbetterwaystoconfigureitsothat itmetourneedstoanevengreaterdegree. These lessons will play an important part in my current role, as a recent evaluation of Seqwaters twoeDRM solutions (as aresultof the merger) has selectedFileNet, sonow wewilldo it all over again!

You might also like