14 - Embedding records management in the business

Summary

Introduction

This chapter draws upon existing international records management standards, as well as new approaches and products, to suggest some sustainable ways of embedding the management of records into the business processes of a financial institution, to support (amongst other things) its compliance and litigation response. Suggestions and recommendations are made about how such standards and models can be made more relevant, recognized or usable by the financial services sector for meeting compliance, litigation and other business needs.

In examining these issues, this chapter also considers the approaches taken to records management in a range of Australian financial institutions. Some of these organizations are solely Australian-based and some have global operations with headquarters and ownership predominantly based in Australia.

Active or extensive use of ISO 15489, the international records management standard, or of other standards for records management, is low in the context of Australian financial institutions. However, the principles and methods used by such institutions are predominantly based on those standards. This is due to the reasonably widespread knowledge of such tools, employment of information management professionals (with the requisite knowledge), and increasing regulatory-based compliance regimes emerging in the Australian private sector, including, and to some extent focusing on, the financial services sector.

Business drivers for records management

In the private sector, and the financial services sector in particular, there are common business drivers for better or best practice in records management:

• working within and meeting the governance, risk and compliance framework

• improving business efficiency, including cost avoidance.

Governance, risk and compliance

Financial institutions commonly operate within robust governance, risk and compliance frameworks, to ensure ethical practice and financial responsibility. The COSO Internal Control – Integrated Framework of 1992 is one example. Developed by the Committee of Sponsoring Organizations, www.coso.org, this framework defines internal controls to provide reasonable assurance that the organization's objectives are achieved in the effectiveness and efficiency of operations (including safeguarding of assets), reliability of financial reporting, and compliance with applicable laws and regulations. A risk-management framework (e.g. using the ISO 31000 series of risk-management standards, or COSO Enterprise Risk Management – Integrated Framework 2004) is another primary framework, often incorporating governance and compliance functions.