Following the fallout from major corporate crashes such as Enron and Worldcom, stricter compliance legislation has been introduced around the world to ensure that business managers and principals are more accountable for their actions.
The latest compliance standards focus on greater accountability and control in key business processes most importantly document flows and data management.
There are two central aspects to enforcing compliance:
The corporate duty of care in enforcing standards
The need for legal protection in the event of litigation or a dispute
Non-compliance is not an option, companies risk stiff fines and executives can be held personally liable if information is not in order. Therefore, it is important that the business examines all regulations, not just those affecting their specific area of operation, but also generic legislation affecting general business activities.
The consequences of non-compliance are extremely serious; in December 2002 the SEC fined five Wall Street brokerages a total of $8.25m for improperly storing e-mail communications (Forrester Research).
Distributing documents for approval, whether in hard copy or electronic form, raises security issues. Who is authorised to access documents, and what information can they access within them? This is particularly important to ensure compliance with legislation such as the Sarbanes Oxley Act, which applies to US companies and their foreign subsidiaries; and in the UK, the Data Protection Act and the Freedom of Information Act.
Document processing software such as Tokairos TokOpen system addresses these challenges and automatically enforces compliance. Every action relating to individual document access is audited, access is limited to specified personnel, and actions they can undertake are also controlled. Software can also restrict access to different information within a document, to different specified users or groups within an organisation.
This ability to allow different information in a document to be seen by different users means that the divergent needs of the Data Protection Act and the Freedom of Information Act can both be met automatically, without the need to make copies of documents.
This flexibility can also extend to the hierarchy of approval based on the value of an invoice. So if a member of staff is not allowed to approve payment of an invoice of over 500 for example, it can still be checked by them, but then can automatically be escalated to a superior for payment sign-off.
The following are some of the most recent regulations, and the effects they can have on corporate document management strategies:
Sarbanes Oxley Act 2002
This is a key driver of compliant corporate document management systems. In the US non-compliance is now a Federal offence, carrying a penalty of up to 20 years in prison. US subsidiaries in the UK are also required to comply with this legislation. The European Union is expected to introduce similar rulings for member countries.
Under section 302, the CEO and CFO must certify that reports accurately show the companys financial condition and results. In addition, they must certify that they have established and evaluated internal controls to ensure accurate recording and reporting of performance. Any deficiencies in these controls as well as any fraud at management level must be reported.
Section 404 requires annual reports to detail internal controls that are in place to ensure accurate financial reporting, as well as an assessment of their effectiveness.
This can have a significant impact on a document management system. For example, a company without clear control and visibility of approving invoices for payment could be in breach of the Sarbanes Oxley Act.
Data Protection Act 1998
Regardless of what document management system may be in place, personal information for business use needs to be handled in compliance with the Data Protection Act 1998. A secure document management system such as TokOpen can help with compliance, as it reduces the scope for theft or accidental loss of personal and confidential data. It can also facilitate the execution of valid requests for such data.
The Act enshrines eight principles:
1. Personal data shall be processed fairly and lawfully.
2. It shall be obtained only for specified lawful purposes, and shall not be further processed in any manner incompatible with those purposes.
3. It shall be adequate, relevant and not excessive in relation to the purposes for which it is being processed.
4. It shall be accurate and, where necessary, kept up to date.
5. It shall not be kept for longer than is necessary.
6. It shall be processed in accordance with the rights of data subjects under the Act.
7. Appropriate technical and organisational measures shall be taken to prevent unauthorised or unlawful processing of personal data, and to prevent accidental loss, destruction or damage to personal data.
8. Personal data shall not be transferred to a country or territory outside the EU unless an adequate level of protection for the rights and freedoms of data subjects is ensured.
Freedom of Information Act
This gives people a general right of access to information held by, or on behalf of, public authorities. It is intended to promote a culture of openness and accountability amongst public sector bodies, and to increase public understanding of how public authorities work, why they make the decisions they do, and how they spend public money.
Good document management should be a key objective for all organisations, public and private, in the drive to achieve business efficiency, and ensure that information is easily retrievable and properly documented. As a result of this, public authorities will then be able to comply more easily with legislation that affects them, such as the Freedom of Information Act.
The principles underlying records management creation, retention, identification and retrieval apply equally to both electronic and paper media. This means that procedures for e-mail and other information held on shared and personal hard drives have to be as robust and detailed as those for other records.
Conflictions in Compliance
Document management systems are challenged when different data in the same document relates to both the Data Protection Act and the Freedom of Information Act, since one is geared for confidentiality, the other for accessibility.
Leading document management systems such as TokOpen, control who can view different parts of a document, meeting the conflicting needs of both pieces of legislation.
In a typical document, such as a Wire Transfer Application form, some of the information falls under the Freedom of Information Act, and other parts of the document are private meaning access must be restricted and audited in accordance with the Data Protection Act. Certain data must not be disclosed to anyone outside the bank as it is private and for internal use only.
Document management software overcomes this problem by hiding the internal information when the document is viewed by someone outside the bank. Users with authorised access are still able to view the whole document.
In the same example, the applicants name and address are protected by the Data Protection Act, and should therefore only be seen by the staff members dealing with that client, such as HR or Accounts. Remaining staff do not have access to these specific document details. TokOpen document management software can ensure compliance with this.
Document Management: the Way Forward
The increasingly complex demands of legislation underline the need for businesses to implement document capture and document management systems. However, even though a document management system is an important component, alone it will not ensure compliance. A wider view is needed to ensure businesses maintain their compliance with changing legislation.
In a court of law, the judge will consider the evidence based on several criteria:
Are procedures clear and consistent, with a requirement to document procedures? This is often referred to as a document policy.
Are the procedures enforced? This is a shared responsibility between management and the selected document management system’s access and privilege controls.
Can the claims be substantiated? This relies heavily on the document management systems audit trail.
Compiling a Document Policy
After establishing which regulations have to be complied with, a document policy is required covering the following:
o Scope of information covered
o Security classifications
o Storage media
o File format and version control
o Standards (compliance and regulations)
o Retention and destruction
o Responsibilities
A document policy defines how information is stored, and is therefore central to ensuring compliance. It should serve these main purposes:
o Ensure everyone knows what they can do
o Define the business practice at the time
o Demonstrate why a given action was undertaken, e.g. explains why a document was destroyed
o Reinforce documents evidential weight
o Help authenticate documents to increase legal weighting
o Improve the courts view of the evidence presented
Consideration also needs to be given to how long documents should be stored. This depends on the type of document and industry-specific regulations.
This raises an interesting question. What is the legal position if the original document is electronic? This can best be answered in three steps.
Civil Evidence Act 1995
o Authenticated copies will be accepted with equal weighting to the original
o Later revisions are given greater weight than superseded revisions
Admissibility
o Does the court accept this evidence?
o With what weight?
Appropriate procedures must be followed if documents are to be taken to court
Therefore, when considering compliance, the legal weight given to a document also needs to be taken into account. In addition to ensuring that documents and information are managed in accordance with compliance legislation, document management software also plays a key role in ensuring that optimised legal weighting is given to documents, should they be presented in a court.
Improving documents legal weighting depends on three key factors:
Information management
o System management (duty of care, audits, etc.)
o Operational issues (good management practice)
Legal issues
o General (e.g. Data Protection Act, invoice storage, etc.)
o Industry-specific (compliance/regulations etc.)
o Organisation-specific (internal regulations etc.)
Need for clearance permissions
Companies therefore have a duty of care responsibility to ensure they are compliant with legislation. This is best described as information security and can be summarised with the following questions:
Can a court be assured that information (evidence) has not been inadvertently or maliciously altered, or some of it lost?
o i.e. due care has been taken of the data
Basic criteria can be met
o Confidentiality (who has had access?)
o Integrity (is it reliable?)
o Availability (can it be retrieved?)
Summary
Ensuring compliance with legislation is a responsibility shared between:
The staff, following clearly defined document procedures
The management enforcing these procedures
The document management system policing and enforcing duty of care responsibilities
Tokairo is an international solution provider of electronic document management systems and education solutions.
Visit http://www.tokairo.com for further information; REF=TO4EZ
Author: David Coxell
Article Source: EzineArticles.com
Provided by: Guest blogger
A lot of the things you mention happens to be surprisingly precise and that makes me wonder why I had not looked at this in this light previously. This particular article really did turn the light on for me personally as far as this subject matter goes. However there is just one position I am not necessarily too comfortable with and while I attempt to reconcile that with the actual central idea of your point, permit me see just what all the rest of your readers have to point out.Well done.
My partner and I absolutely love your blog and find many of your post’s to be what precisely I’m looking for. Would you offer guest writers to write content available for you? I wouldn’t mind creating a post or elaborating on many of the subjects you write related to here. Again, awesome weblog!
I often read your blog and always find it very interesting.
Thought it was about time I let you know, Keep up the great work.
I’m not that much of a online reader to be honest but your blog keeps me visit amudee over and over again. Really interesting articles. This is going to be next Techcrunch or may be mashable for instance. keep it up! I’ll go ahead and bookmark your site to come back in the future. Many thanks
Hmm it seems like your site ate my first comment (it was extremely long) so I guess I’ll just sum it up what I had written and say, I’m thoroughly enjoying your blog. I too am an aspiring blog blogger but I’m still new to the whole thing. Do you have any points for newbie blog writers? I’d certainly appreciate it.
I do love the manner in which you have framed this challenge plus it does give me a lot of fodder for thought. However, because of everything that I have observed, I only wish as other feed-back stack on that folks keep on point and in no way embark upon a tirade regarding the news. Anyway, thank you for this superb point and even though I do not really go along with this in totality, I regard the point of view.