Information systems are organized sets of procedures and techniques designed to store, retrieve, manipulate, analyze, and display information. Recordkeeping systems are organized to support the functions of creating, storing, managing, and accessing records.

Information systems and recordkeeping systems are not necessarily the same thing. Properly configured and with appropriate functionality, it is possible for information systems to meet recordkeeping needs for an entity. As an increasing percentage of University records are produced by electronic information systems and are likely to remain a part of such systems, it is important for those with responsibility for records to understand how information systems operate and their relationship to recordkeeping.

If the information system can not meet recordkeeping needs, then an alternative strategy needs to be developed to secure the records. Wisconsin’s Administrative Rule 12 sets forth requirements for information systems that will serve as recordkeeping systems.

Wisconsin Department of Administration, Chapter Adm 12 (“Electronic Records Management – Standards and Requirements”) states that state and local agencies shall “maintain electronic public records that are accessible, accurate, authentic, reliable, legible, and readable throughout the record life cycle”; and develop policies, assign responsibilities, and develop mechanisms for maintaining public records throughout the record life cycle. The record life cycle in this context means the total length of time the records will be retained, as defined by the approved records retention schedule.

In administering information technology systems the University of Wisconsin System is committed to

• Complying with current federal, state and agency policies regarding records retention;
• Achieving efficiencies in records management through the use of information technology systems records retention schedules;
• Improving services to records users;
• Safeguarding all personally identifiable information about individuals; and
• Implementing electronic records management in the most cost effective manner

Managing electronic records requires the integration of records management concepts with the information technology system that creates, manages, stores, etc. the information/records. The purpose of this section of the guidelines is to provide assistance in the implementation of this policy for information technology systems. These systems range in size, cost and scope from a single e-mail package or messaging utility to a large ERP application and include software and sometimes hardware components. Information technology systems create and maintain records and as such need to be designed, implemented, and maintained with records management requirements in mind.

For information technology systems, there are two general categories of records: those records that are associated with the actual creation, maintenance and retirement of the information technology system itself and those records that comprise the data content of the system. Each of these sets of records must be managed in concert with the other. The records management requirements for the data content of the system are the same as if the records were kept in a non-electronic medium with the additional requirement that technologies must be maintained that enable the records to be accessible, accurate, authentic, reliable, legible, and readable throughout the life of the data record. Records required for the creation and maintenance of the information technology system itself include implementation project documents such as procurement proposals and system support documentation. The records management requirements and retention schedules will likely vary between these two categories of records.

Information technology system implementation, maintenance, and retirement include a myriad of processes often called the software development lifecycle. Using a modified Enterprise Unified Process (EUP) software development lifecycle model, phases of an information technology system’s life include:

• Business Modeling and Requirements and Planning
• Analysis and Design
• Implementation
• Testing/Business Simulation
• Deployment
• Review
• Production
• Retirement

Each of these phases includes the need to identify records and take steps to ensure that records are adequately managed. What follows is a list of potential questions to ask at each stage of the information system’s life. (This is not an attempt at a comprehensive list of all such questions, which will differ for each local situation).

PHASE ONE – BUSINESS MODELING AND REQUIREMENTS AND PLANNING

RECORDS MANAGEMENT ACTIVITY: INCORPORATING RECORDS MANAGEMENT FUNCTIONALITY

The first phase encompasses but is not limited to the determining the scope of the business process, identifying records associated with the business process, modeling the process, determining system requirements, making the decision whether to buy or build, acquiring the technology, achieving executive buy-in, documenting business process, gathering technical requirements, and organizing the project. Some factors to consider during this phase include:

• Does the proposed system maintain its data in an open or flexible format to facilitate retention, storage, and retrieval of the records/data it creates?
• Has a records retention schedule been prepared?
• If a purchase is considered, does the Request For Proposal (RFP) speak to this requirement?
• Are project sponsors convinced of the need to invest time and resources to building out this area of functionality?
• Is anyone on the project tasked with not only safeguarding the records produced by the project, but also ensuring that the new technology satisfies the requirements vis-a-vis the future management of its data?

PHASE TWO – ANALYSIS AND DESIGN

RECORDS MANAGEMENT ACTIVITY: IDENTIFICATION OF RECORDS AND RECORDKEEPING REQUIREMENTS

Analysis and Design steps include training the core project team, fit-gap analysis, developing process (and identifying process changes), and developing a data migration plan. Some factors to consider during this phase include:

• Have records creation/retention needs been identified as a ‘fit’ or ‘gap’?
• Have the records created during this phase of the project themselves been preserved? Typically the documentation at the analysis and design stage is critical for understanding the way the system is created as it is, and the underlying assumptions are useful for the implementation of future projects.
• As information workflow is modeled in the new system, has the potential needs for records retention been modeled as a component of the life cycle of data in the new system?
• Are procedures in place to prove the authenticity of the records?
• Are there a security plan in place to restrict access to private information and an accessibility plan to make public information readily accessible?
• Can the records be exported to another system? Can the records be purged automatically from the system in compliance with the retention schedule? Removed from the system?
• Has a records management program for data and business processes been designed?
• Does the system meet University, State and Federal requirements that may apply to the particular operational area?
• Has a cost analysis been done that takes into consideration staff resources needed to implement and provide ongoing support, as well as potential savings, costs containment and/or improved service benefits?

PHASE THREE – IMPLEMENTATION

RECORDS ACTIVITY: RECORDS CREATION AND METADATA

Once the Analysis and Design phase is completed, the implementation phase begins with creating detailed design documents, data conversion, creating detailed project implementation plans, documenting issues or risks, developing software and creating test plans and scripts for all business processes. Some records management questions to consider during this phase include:

• Have data elements comprising the records been identified?
• Has appropriate metadata been developed and approved? Metadata should include the appropriate retention time.
• What are the storage and retrieval options? Warehouse? Repository?
• What are the long term preservation strategies for all records? These include:

a. Project documents as well as business documents
b. Decisions and why they were made
c. Conversion decisions and data mapping
d. Design architecture

PHASE FOUR – TESTING

RECORDS ACTIVITY: RECORDS MANAGEMENT TESTING

The Testing phase involves loading preliminary data to test newly defined business processes in preparation for cut-over to production. This phase involves testing new business practices, obtaining user acceptance, certifying that data mapping and conversion scripts are complete, testing the go-live conversion, and training end-users. Some questions to consider during this phase include:

• Does the project have documented training plans, user acceptance testing for functionality, and testing of strategic use cases?
• Will there be conversion audits and mock conversions prior to production cutover?
• Is there version control, for rollback to a previous testing environment?

PHASE FIVE – DEPLOYMENT

RECORDS ACTIVITY: RECORDS CAPTURE AND VITAL RECORDS PLANNING

The Deployment phase places the system into a live, production environment; training is complete (or ongoing), and risk factors are assessed in the new environment. Contingency/backup plans are evaluated for the need to execute other options. Any remaining issues are resolved. Some questions to consider during this phase include:

• Who is responsible for safeguarding the 2 categories of records: those associated with the system itself and those associated with the system data content?
  Are business continuity (disaster recovery) systems documented and in place?
  Have records management procedures been extended to other environments (if needed – e.g. testing, development)?
  Is end-user documentation ready, and is there a procedure for changes to this over time?

PHASE SIX – REVIEW

RECORDS ACTIVITY: RECORDS MANAGEMENT AUDIT

The Review phase is to evaluate the new business processes and the overall solution. The new system should be assessed for any performance tuning. Documentation produced during this phase includes recommendations to project sponsors and management, “lessons learned”, and planning considerations for future phases of this project or similar future projects. Some factors to consider during this phase include:

• What system configuration and change management records are required? Who is responsible for maintaining these records?
• Will there be arrangements for a periodic records management audit?
• Are the records useable and understandable? Has sufficient contextual information been captured? Have all the component parts of a record been appropriately migrated?

PHASE SEVEN – PRODUCTION

RECORDS ACTIVITY: RECORDS MAINTENANCE AND USE

The Production phase is the useful life of the information system. Typically, periodic upgrades to the system are needed; major ones go through many of the same steps outlined above and present similar records management challenges. Special records management questions to consider at the Production stage include:

• What factors will determine the need for changes to the system?
• Does the updated software for system upgrades and patches also adhere to the records management requirements of the initial system development phases?
• How will changes over time to authorization/authentication be documented?

PHASE EIGHT – RETIREMENT

RECORDS ACTIVITY: RECORDS DISPOSITION AND PRESERVATION

Retiring an information system requires detailed planning around the survival (via archiving or migration), or deletion, of data and records that it may contain. Retirement of a system may pose the following questions:

• What allowances have been made for continued access to records generated by this system (in accordance with their respective schedules)?
• If the records managed by the system document a core institutional function or provide archival information about the institution’s programs or policies, has a long term preservation strategy been developed?
• Does the current system contain information that will not be converted to any new system, and not archived? Is the deletion of this information in accordance with its schedule?
• For the data that will be preserved, has sufficient metadata been identified and transmitted with the data to the archival digital repository?
• How will the digital archiving be accomplished?