A Chief Information Officer from a large manufacturing company last month told me they had recently completed an internal record retention review and had determined that their e-mail system contained no records. I can understand their thinking. E-mail tends to be an informal medium that accumulates seemingly everywhere, and saving some e-mails for a specified period of time can be tricky. One little problem, though: While the company may wish or even adopt a policy stating there are no records in e-mail, regulators and courts are likely to take a very different view. And when it comes to compliance, it is the regulators' view that counts.
Organizations create documents in many different media: paper, electronic files, database systems, as well as e-mail. Some of these documents are business records that the organization has an obligation to retain for a period of time. For the most part, regulators and courts do not discriminate about what are and are not records based on their medium. A file containing a Microsoft Word document has the same legal weight as a paper copy of the same document. What determines whether a document is a business record is its content, not its medium. Companies should consider not whether there are records in e-mail, but rather which records are in e-mail.
We have found that every company has at least some records created or received in e-mail. In assessing more than one hundred large and small organizations last year, we located some records residing exclusively in e-mail in every case. These assessments were conducted in both large and small, public and private, commercial and public sector organizations. Companies with low regulatory requirements may have as little as 5 percent of their e-mails as business records. For companies operating in highly-regulated environments more than 35 percent of their e-mails may be business records. For any given employee, the amount of records varies with his or her function and level. Keep in mind that most e-mails are not business records, but in records-management-speak "transitory records," for which there is no obligation to retain. Nevertheless, every organization has a material amount of records created or received in e-mail.
What records did we find exclusively in e-mail? A partial list includes:
- Shipping (Completion) Notifications
- Supplier Contracts
- Employee Vacation Request
- Expense Approvals
- Budget Approvals
- Project Approvals
- Internal Correspondence
- External Correspondence
- Requisitions
- Employee Reviews
- Legal Opinions
- Filings
- 3rd party Subpoenas
- Quarterly Reviews
- Vendor Transmittals
- Contract Negotiations (in particular for proving "intent")
Declaring that e-mail contains no records is a dangerous proposition. Regulators are savvy as to where the records might be. Many regulatory inquiries begin with regulators wanting access to a company's e-mail. And we have seen the "show us the e-mail records first" tactic increase within the past two years. Answering that the company declared there are no records in e-mail is neither a defensible nor good idea.
