13 - Establishing a global policy framework for the management of records

Summary

Introduction

Whatever the size of a financial institution, the spread of its business activities or the number of countries in which it operates, the effective management of its records requires a formally agreed global policy framework, adopted and endorsed at the highest decision-making level.

The core components of such a framework are a policy, standards (which set out what staff and business units need to do to comply with the policy) and a records retention schedule. The policy should include a clear statement of roles and responsibilities at all levels. In addition to the core components, the framework should include guidance on how the standards can be implemented, and training and compliance testing to ensure that staff are aware of, understand and fulfil their various responsibilities. Monitoring and control will be required to ensure that all business units are compliant. Such a framework is the foundation upon which sound records management practice is built and records management processes, business classification schemes, office procedure manuals and guides can be developed to address local requirements.

Particularly with larger and more complex institutions, the development of the policy framework needs to be collaborative and to involve wide consultation. Individuals across all parts of the institution, and at all levels, should be part of the development process and regularly consulted throughout its formation; with more stakeholders, extended discussion and negotiation may be required to reach a common understanding.

Numerous functional stakeholders have an interest in the management of records, in particular audit, compliance, legal (including some specialists, particularly litigation, data protection and privacy), information security, technology and operational risk functions. In this chapter, these will be referred to collectively as ‘key functions’.

Policy

A records management policy can be characterized as a high-level statement that defines key terms, sets out the principles for the management of records created, captured and maintained by a business and stipulates the roles and responsibilities of all the relevant stakeholders. When agreed, it becomes in effect a charter or memorandum of understanding between the key functions and all other stakeholders that enables them to work together to manage the institution's records effectively.