What level of legal and regulatory citations are needed for your records retention schedule? This seemingly obscure question can have a significant impact on your ability to create, implement and maintain a records retention and deletion program.

Good retention schedules balance regulatory requirements, business needs, and the potential risks and costs of discovery. To ensure compliance as well as support legal justification for deleting older records, companies often support their records retention periods with a table of citations. For a given retention category, the associated legal citations may point to sections of the U.S. Code, the Code of Federal Regulations and specific state laws and regulations. However, with more than 30,000 U.S. federal and state citations impacting records retention, the process of creating and maintaining documentation to support the schedule can quickly become overwhelming.

Sometimes state regulations are consistent with federal regulations, or require shorter retention – but in a few cases the state requirements may exceed the federal requirements. Sometimes citations indicate that records need to be retained, but do not specify how long. Furthermore, since the majority of citations are industry-specific, most of them will not apply to a given enterprise – but the process of determining which ones are relevant can be very time-consuming. We have reviewed a number of citation tables that include a high percentage of citations that are simply irrelevant. The classic example was the citations we found at a retail client relating to the retention of invoices; these particular citations were for invoices but only applied to peanut farmers from Alabama.

What's the best way to match the thousands of documents and records most companies have with the thousands of citations that may or may not apply? We have seen two main approaches. The first, more traditional approach is to try to identify all the relevant citations for each record series or category (often with the assistance of record schedule software tools). The problem with this brute-force approach is that it tends to list too many citations, most of which are not applicable (as in the example above), or have no practical impact on the net retention requirements. For example, the supporting documentation for one record category may list citations specifying one-year, three-year and seven-year retention. For compliance and defensibility, only the “high watermark” seven-year citation is relevant, and listing the additional citations does not increase compliance or defensibility. A thicker retention schedule is not necessarily better. We have actually seen the opposite effect, where a thick binder of legal citations proves so complex and intimidating that the organization rejects the work product and fails to move forward with implementation and ongoing maintenance of the records retention program. The big risk here is that the focus becomes schedule creation, and not schedule execution.

There is an alternative approach, gaining favor lately: group and prune. Individual record types are grouped into larger “buckets.” Citations are also organized into high level groups, within each functional area, where non-relevant citations can be identified and pruned. The remaining citations are then reviewed to identify high-watermark retention periods, which are selected for inclusion in more focused citation groupings. Then the record buckets are matched with the relevant focused citation groups. The process of creation and maintenance takes less time and effort, and the business outcome is better as well. In our experience, companies with simpler retention schedules tend to have better acceptance during implementation, better overall compliance with requirements and lower costs over time.

The group-and-prune approach sometimes draws criticism, for in grouping like records and focusing on high-watermark citations companies will theoretically create bigger buckets with longer retention periods than they will with a more detailed and granular retention schedule. Keep in mind that business retention requirements often exceed and trump legally prescribed minimums, so longer periods would result using either approach. Additionally, few organizations are successful in executing with the more granular approach. It becomes difficult to get users to spend the large amount of time to understand a lengthy schedule and to comply with so many distinct retention rules.

There are software tools that can assist in identifying relevant citations. Two popular tools are Retention Manager (published by Donald Skupsky) and Versatile Retention (from Zasio Enterprises). These tools are useful as they can assist in the identification of high-watermark retention categories, and they offer a subscription service with periodic updates. However, such tools do not provide a complete solution out of the box, or exempt companies from the work of identifying their own distinct record categories and unique business retention requirements. Also, their output tends to be voluminous (taking the more traditional, detailed approach discussed above), which can be hard for business stakeholders to digest and implement. Records managers and/or legal counsel typically use multiple sources – and then verify key requirements by checking the current text of the salient laws and regulations, and applying other legal considerations and industry requirements. Specific research tools can be useful, but certainly not a complete “be all and end all” for developing retention schedules.

What works best? Here are our conclusions:

• Don't waste time on stuff that does not matter. Do not focus on citations that have no practical effect because they're not applicable, or if the records they apply to are already being retained for longer periods to meet other legal or business requirements.
• As you are building your schedule, consider how you will maintain it. Grouping like records and citations into meaningful buckets and pruning out non-relevant citations makes maintenance easier. Favor simplicity and control.
• Retention software tools can provide useful information, but may not provide the best blueprint for producing and maintaining an optimum schedule.
• Records retention schedules are but one piece of a larger program that should include litigation readiness, technology implementation and change management. Don't get bogged down in the initial details at the expense of implementing the needed programs.
• Citations can aid in establishing defensible retention rules, but actual compliance comes from managers and users implementing the full records management program.

Read Mark Diamond's previous column.

What level of legal and regulatory citations are needed for your records retention schedule? This seemingly obscure question can have a significant impact on your ability to create, implement and maintain a records retention and deletion program.

Good retention schedules balance regulatory requirements, business needs, and the potential risks and costs of discovery. To ensure compliance as well as support legal justification for deleting older records, companies often support their records retention periods with a table of citations. For a given retention category, the associated legal citations may point to sections of the U.S. Code, the Code of Federal Regulations and specific state laws and regulations. However, with more than 30,000 U.S. federal and state citations impacting records retention, the process of creating and maintaining documentation to support the schedule can quickly become overwhelming.

Sometimes state regulations are consistent with federal regulations, or require shorter retention – but in a few cases the state requirements may exceed the federal requirements. Sometimes citations indicate that records need to be retained, but do not specify how long. Furthermore, since the majority of citations are industry-specific, most of them will not apply to a given enterprise – but the process of determining which ones are relevant can be very time-consuming. We have reviewed a number of citation tables that include a high percentage of citations that are simply irrelevant. The classic example was the citations we found at a retail client relating to the retention of invoices; these particular citations were for invoices but only applied to peanut farmers from Alabama.

What's the best way to match the thousands of documents and records most companies have with the thousands of citations that may or may not apply? We have seen two main approaches. The first, more traditional approach is to try to identify all the relevant citations for each record series or category (often with the assistance of record schedule software tools). The problem with this brute-force approach is that it tends to list too many citations, most of which are not applicable (as in the example above), or have no practical impact on the net retention requirements. For example, the supporting documentation for one record category may list citations specifying one-year, three-year and seven-year retention. For compliance and defensibility, only the “high watermark” seven-year citation is relevant, and listing the additional citations does not increase compliance or defensibility. A thicker retention schedule is not necessarily better. We have actually seen the opposite effect, where a thick binder of legal citations proves so complex and intimidating that the organization rejects the work product and fails to move forward with implementation and ongoing maintenance of the records retention program. The big risk here is that the focus becomes schedule creation, and not schedule execution.

There is an alternative approach, gaining favor lately: group and prune. Individual record types are grouped into larger “buckets.” Citations are also organized into high level groups, within each functional area, where non-relevant citations can be identified and pruned. The remaining citations are then reviewed to identify high-watermark retention periods, which are selected for inclusion in more focused citation groupings. Then the record buckets are matched with the relevant focused citation groups. The process of creation and maintenance takes less time and effort, and the business outcome is better as well. In our experience, companies with simpler retention schedules tend to have better acceptance during implementation, better overall compliance with requirements and lower costs over time.

The group-and-prune approach sometimes draws criticism, for in grouping like records and focusing on high-watermark citations companies will theoretically create bigger buckets with longer retention periods than they will with a more detailed and granular retention schedule. Keep in mind that business retention requirements often exceed and trump legally prescribed minimums, so longer periods would result using either approach. Additionally, few organizations are successful in executing with the more granular approach. It becomes difficult to get users to spend the large amount of time to understand a lengthy schedule and to comply with so many distinct retention rules.

There are software tools that can assist in identifying relevant citations. Two popular tools are Retention Manager (published by Donald Skupsky) and Versatile Retention (from Zasio Enterprises). These tools are useful as they can assist in the identification of high-watermark retention categories, and they offer a subscription service with periodic updates. However, such tools do not provide a complete solution out of the box, or exempt companies from the work of identifying their own distinct record categories and unique business retention requirements. Also, their output tends to be voluminous (taking the more traditional, detailed approach discussed above), which can be hard for business stakeholders to digest and implement. Records managers and/or legal counsel typically use multiple sources – and then verify key requirements by checking the current text of the salient laws and regulations, and applying other legal considerations and industry requirements. Specific research tools can be useful, but certainly not a complete “be all and end all” for developing retention schedules.

What works best? Here are our conclusions:

• Don't waste time on stuff that does not matter. Do not focus on citations that have no practical effect because they're not applicable, or if the records they apply to are already being retained for longer periods to meet other legal or business requirements.
• As you are building your schedule, consider how you will maintain it. Grouping like records and citations into meaningful buckets and pruning out non-relevant citations makes maintenance easier. Favor simplicity and control.
• Retention software tools can provide useful information, but may not provide the best blueprint for producing and maintaining an optimum schedule.
• Records retention schedules are but one piece of a larger program that should include litigation readiness, technology implementation and change management. Don't get bogged down in the initial details at the expense of implementing the needed programs.
• Citations can aid in establishing defensible retention rules, but actual compliance comes from managers and users implementing the full records management program.

Read Mark Diamond's previous column.