IBM Enterprise Content Management for Compliance & Risk Management

Transcription

1 IBM Enterprise Content Management for Compliance & Risk Management Paul Krueger ECM Sales Specialist, IBM ASEAN SW Group Financial Services & Insurance 1

2 IBM Corporation All Rights Reserved. The workshops, sessions and materials have been prepared by IBM or the session speakers and reflect their own views. They are provided for informational purposes only, and are neither intended to, nor shall have the effect of being, legal or other guidance or advice to any participant. While efforts were made to verify the completeness and accuracy of the information contained in this presentation, it is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this presentation or any other materials. Nothing contained in this presentation is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. IBM, the IBM logo, Lotus, Lotus Notes, Notes, Domino, Domino.Doc, Sametime, WebSphere, FileNet, Workplace, WebSphere, Lotusphere, QuickPlace, and Quickr are trademarks of International Business Machines Corporation in the United States, other countries, or both. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others.

3 Agenda Records Management Why You Should Care about Records Management IBM FileNet Records Manager Update Content Archiving Why You Should Care about Content Archiving IBM Content Archiving Update ediscovery Why You Should Care about ediscovery IBM ediscovery Product Update No Paper Weight Case Study

4 Agenda Records Management Why You Should Care about Records Management IBM FileNet Records Manager Update Content Archiving Why You Should Care about Content Archiving IBM Content Archiving Update ediscovery Why You Should Care about ediscovery IBM ediscovery Product Update No Paper Weight Case Study

5 What makes Records Management & Compliance a 21st Century Corporate Imperative? Laws and Regulations require retention of information to demonstrate compliance As a result of retaining information it is more readily discoverable In order to avoid sanctions and manage data volumes, IT needs to implement consistent and legally defensible destruction practices The consequences of ignoring the imperative: Audits by Regulators SEC Investigations Litigation and possible sanctions Compliance retention failures against competing regulation requirements Uncontrolled costs for storage, audits, and litigations without routine disposition and destruction practices The potential impact to your company may be significant and cannot be ignored.

6 More Work Required! 88% have formal records management programs but 30% do not include electronic records 36% do not regularly follow own RM policy 39% do not have formal process for holds 93% believe outcome of future litigation based on electronic records policy 46% doubt they could defend own electronic records 44% doubt own IT department understands RM policy Policies aren t clear, well communicated or supported by training Records don't get declared by business users and/or are incorrectly classified Records aren t getting destroyed at all Records are lost or destroyed too soon Records are kept too long RM and compliance policies not enforced Survey Base: 17,000 Users 1,700 Responses Source: Cohasset Associates, AIIM and ARMA 2007 Survey, A Renewed Call to Action

7 RIM (Records & Information Management) Software Preservation Legal Policies Monitoring & Audits Transfers Records Organization Training Reporting Vital Records Processes Security Retention and Disposition Field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records

8 What is a Record? Recorded information made or received by an organization regarding legal obligations or transactions evidence of operations has value requiring retention for a specific period of time regardless of recording format, medium or characteristics, Source: ISO Standard 15489

9 Preservation Processes and operations involved in ensuring the technical and intellectual survival of authentic records though time Content that which conveys information Structure appearance and arrangement of the content Context background information that enhances understanding of technical and business environments to which the records relate (metadata)

10 Classification Systematic identification and arrangement of business activities and/or records into categories (sometimes referred to as the file classification scheme, record plan, or file plan). The ABC Company 1.0 Sales 2.0 Marketing 3.0 Engineering 1 st Tier Categories Business Functions 4.0 Administration

11 Using the File Plan The ABC Company 1.0 Sales 2.0 Marketing 3.0 Engineering 4.0 Administration Organizes, describes, and links records Links and shares interdisciplinary records Provides improved access, retrieval, use and dissemination of records Attributes may be defined at higher levels and inherited at lower levels (i.e. retention, vital record, security, etc.)

12 Retention Schedules Organization s policy stating the retention period of the record May vary by record type and/or business unit (i.e. general correspondence records for the CEO versus general correspondence records for a lower-level department manager) Determined by: Legal Statutes Business Requirements Historical and/or Research Value

13 A Sample Retention Schedule Number Title Authority Description Retention Period Event Legal Citation Notes A-1235 Consumer Complaints Commonwealth of Pennsylavania Insurance Department Consumer complaints Office of Regulation of including log of complaints Companies and correspondence with Insurance Department state insurance department Notice , 19 May Years Resolution of Complaint 40 P.S (11) Failure to maintain a complete record of all complaints received during the preceding 4 Years is a violation of the Unfair Insurance Practices Act.

14 Disposition Information Management Software Enterprise Content Management Those actions taken regarding records no longer needed for the conduct of the regular current business of the organization Create Classify Use Review Disposition Destroy Transfer Time

15 Initiating Disposition Triggered on Time and Events Date Closed Date Discharged Claim Settled Create Classify Use Review Dispose Destroy Transfer Time

16 Holding Records Suspension of the disposition/destruction Ensures records in response to litigation, audit, investigation, etc.

17 Spoliation Information Management Software Enterprise Content Management This term broadly refers to the intentional, reckless, or negligent destruction, loss, material alteration or obstruction of evidence that is relevant to litigation. Courts and litigants are becoming increasingly concerned with the spoliation of evidence. The loss of evidence required for trial may prevent a party from adequately proving or defending a claim. The most severe sanctions are generally reserved for the willful destruction of digital evidence. Nevertheless, numerous courts have shown a willingness to issue harsh sanctions for the negligent destruction of data.

18 RM Strategy This represents best information currently available; Plans do change so check with your IBM representative P8 RM Certification to DoD v3 in Q308 GA in Q308 P8 RM on distributed only, no plans for zos IRM Certification to DoD v3 in Q109 IRM on zos in 1H09 New P8 RM federation capabilities leveraging P8 CFS P8 RM for CMOD P8 RM for CM8

19 IBM is the Acknowledged Leader Market Map Source: IBM 2H07 GMV Records Mgmt $0.1 B, 16% CGR IBM OPEN TEXT EMC MOB OTHER Gartner View Source: Gartner MarketScope for Records Management, 2007, Jan 30, ID G Forrester View Source: The Forrester Wave : Records Management, Q1 2007, Mar 14, 2007

20 Agenda Records Management Why You Should Care about Records Management IBM FileNet Records Manager Update Content Archiving Why You Should Care about Content Archiving IBM Content Archiving Update ediscovery Why You Should Care about ediscovery IBM ediscovery Product Update No Paper Weight Case Study

21 Messaging is Exploding 131 million (est.) s sent daily Predicted to increase to 276 billion by is 75% of corporate Intellectual Property Subject to government and industry regulations eg FRCP Increasingly subpoenaed in litigation 30% of people s time is spent searching for relevant information. Nearly 60% of companies impose mailbox size limits to curb the growth. has become the primary medium for how we communicate. The consequence is that has become a de facto [record] repository. CIO Magazine, Jan 2005

22 But It s Not Just That Is The Problem unstructured content is frequently scattered across an enterprise in hundreds of and file servers that are typically not well organized and not easily found limited visibility into compliance with corporate policies. IDC

23 and Records Management is a transport method, not a record type value is determined by content Arbitrary mailbox limits (30 day, 60 day, or 90 day) help manage mailboxes and storage infrastructure only. Effective management involves: Declaring content as business records Integrating content with other business content, transactions and processes Applying and enforcing records management policy to Records management for mitigates compliance risks commonly found in systems that simply archive all

24 Archiving Market is Evolving on Two Fronts Archive Point Solutions Easier to Deploy and Maintain Simple Archive Rules Simple Retention Rules Another Repository Silo Evolving to Intelligent Content Archiving ECM Based Solutions Platform for Intelligent Content Archiving Many organizations already planning to federate or migrate point solutions into a larger ECM strategy Context and Archive Rules Comprehensive Retention, Hold and Destruction using full Records Management Business Process Integration Single Repository for All Archived Document Types

25 Intelligent Content Archiving Archive for Storage Space Management To reduce operational problems introduced by the growing size of and other content stores. Manage mailboxes Increase Server Performance Enable Faster Backup and Restore Easier Server Upgrades Leverage Storage Best Practices Apply Simple Retention Manage and Content for Compliance Key Business Drivers To comply with regulations, produce records when required, enable good corporate governance and facilitate electronic discovery Enable Records Management Perform Legal Discovery Supervise and Monitor for Non-Compliance Extract Buried Knowledge and Insights To manage, mine, extract, organize and analyze knowledge buried in and other content Manage as a Content Type Along with Other Content Automate or Suggest Message Classification Use Content Analytics to Identify Trends, Risks, Analyze Data Additional Tagging and Meta Data Creation Response Suggestion or Routing of Manage and Content as Part of a Business Process To accelerate and automate business processes where participates in the workflow or is part of the active case Automate Workflow steps Associate and Other Content to Processes, Cases, and LOB Systems PLUS files, Basic Content Services, and other content

26 Only A Platform Approach Can Effectively Address Content Compliance IBM ECM Records Management Intelligent Content Archiving and Management Desktop Instant SharePoint SharePoint Messages File Systems File Systems IBM Classification Module Legal Discovery and Analytics

27 What Will We Have Tomorrow? CommonStore Symphony Intelligent Archive Manager Records Crawler Symphony Intelligent Archive becomes follow on to CS, EM, RC Non-disruptive Symphony upgrade requires no migration Integrated platform to manage multiple content types and leverage full spectrum of ECM capabilities Modular source, target, task connectors...repository agnostic Buy CS / EM / RC today. Get Symphony Tomorrow

28 Symphony Intelligent Archive Leveraging FileNet and IBM Next Generation Archiving Source Connectors Engine Target Connectors MESSAGING / Microsoft Exchange Lotus Domino Novell GroupWise Instant Messaging Other PST and NSF content IM and other messaging via 3 rd party Task Connectors Other File Systems FILE SYSTEMS Microsoft File System Desktops OTHER Microsoft SharePoint Panagon Image Services Panagon Content Services IICE Connector Support Backup Tapes and Other CUSTOM API Support INTERNAL TASKS Copy / Move / Delete / Stub Records Declaration De-Duplication Classification Rules EXTERNAL TASKS ICM Direct Integration Rendering / Encryption System Lookups 3rd Party Rules / Policy Mgt Other Tasks Planned CUSTOM TASKS API Support Partner Apps IBM NATIVE P8 CMv8 Panagon Image Services (NTFS source only) CUSTOM / OTHER API Support IICE Connector Support Available Now / This Year Future

29 Agenda Records Management Why You Should Care about Records Management IBM FileNet Records Manager Update Content Archiving Why You Should Care about Content Archiving IBM Content Archiving Update ediscovery Why You Should Care about ediscovery IBM ediscovery Product Update No Paper Weight Case Study

30 ediscovery: What it Means to You Timely response to ediscovery requests will be cost prohibitive without a robust and enterprise wide records and documents management system. ediscovery will require an ability to store, access, search, and retrieve, structured, unstructured (e.g. , and IM), internal and external data, and metadata as well as their printed outputs and in a very timely and efficient manner. Enforcing record retention policies can mean big savings -- A majority of documents reviewed in legal discovery should have been destroyed as part of a record retention protocol.

31 New Federal Rules of Civil Procedure Took Effect in December 2006 Raising the ECM Bar The US Supreme Court approves new rules of civil procedure bringing a much needed standard and replacing dozens of state and local rulings New Federal Rules of Civil Procedure on Legal Discovery (12/1/2006): Early Attention: Rule 26 (a) (1): Show What You Have Early Attention: Rule 26 (f): Requires a Discovery Consensus Form of Production: Rule 34 (a) & (b): Can Ask for all Types of ESI Sanctions: Rule 37: No Penalty for Purges as Part of Normal Operations Form of Production : Rule 26 (b) (5) (B): Privileged Information Protected Accessibility: Rule 26 (b) (2) (B): Protection from Cost Prohibitive Discovery There is no definition as to what constitute timely response in legal discovery. It is left to the discretion of judges and is bound to tighten as ECM solutions shorten response time.

32 The High Costs of Discovery: 9 Cases at DuPont in 2002 Pages reviewed = 74,450,000 Pages responsive = 11,040,000 Average 50% of pages reviewed past required retention Pages viewed past retention = 37,725,000 Cost to $.20/page = $7,545,000 # Pages responsive = 11,040,000 # Pages past retention = 5,520,000 Cost to $.80/page = $4,416,000 Unnecessary costs = $11,961,000 Loss of reputation Printing, photocopying, preparation, handling, and transportation

33 ediscovery Process Electronic Discovery is more than just searching it is a process that defines what documents are needed, how they are handled, reviewed and eventually packaged to be presented to external or opposing counsel.

34 Motivation: Current ediscovery Approaches - Reactive, Outsourced, Costly, with High-Risk $400/hr $400/hr $1500/Gig Information Management $1000/Gig Sample service provider charges $2250/Day $2600/Gig $1200/Gig Process Management Point solutions drive lack of corporate information management and control Often funneling irrelevant, redundant, expired information to costly outsourced processing and review processes Lack of enterprise level consistent inhouse capabilities, increasing vulnerability and risk Blindfolded without early case information insight

35 It is a Corporate Level Issue to Tackle One offs will Keep Cost and Risk High Corporate Counsel Compliance with the law Agility Defensibility Preservation Litigation hold process Authenticity Chain of Custody Early case insight Technology know-how LOB, HR, Compliance, RIM.. Records or nonrecords Consistent records keeping End user involvement, adoption rate Coherent Litigation hold / Records retention practices IT Volume of ESI ESI Control Scale Flexibility in new ESI adoption Compatibility, fit into core technology infrastructure Automation Legal Domain expertise Enterprises that choose one-off solutions for each regulatory challenge that they face will spend 10 times more on compliance projects than their counterparts that take a proactive approach. Gartner

36 It s time for a different approach Traditional Reactive Approaches Service providers & point solutions Cumulative Cost Cost & Risk Optimization Potential IBM Proactive Alternative Proactive ESI management & agile, defensible in-house response Volume of Litigation Over Time

37 Announcing IBM ediscovery Powered by new IBM ediscovery Manager V2.1 Proactive ESI Management Captured, processed, classified, organized as created Preserved based on information value with zero-click enforced retention policies Secured in a high scale enterprise level content management platform Made dynamically accessible Agility in Responding to Litigation High volume search, cull, hold, export processes with ease of scale, low end to high end Information insight on demand Embedded access and change auditing With multilanguage, globalization support Defensible Integral part of business processes Consistent Key to reasonableness Documented, measurable, repeatable All enabled by underlying IBM ECM Infrastructure and BPM Backbone

38 Agenda Records Management Why You Should Care about Records Management IBM FileNet Records Manager Update Content Archiving Why You Should Care about Content Archiving IBM Content Archiving Update ediscovery Why You Should Care about ediscovery IBM ediscovery Product Update No Paper Weight Case Study

39 No Paper Weight (A Case Study) 39

40 Why Keep The Paper? Hypothesis How do the new economics of Compliance combined with technology advances enable transformation of physical records storage? Does this same dynamic also enable new methods of business intelligence? Validation IBM analysts and Large Commercial Bank customer Evaluated costs, risks and processes associated with handling of paper It now makes sense to stop the flow of paper into warehouses and start the flow into imaging based electronic records management systems Compelling Results Major cost savings and ROI findings Significant opportunity to mitigate legal and compliance risk New visibility and enforced controls into key business processes New ways to analyze operational data Unique solution enabled by integrated imaging, records and process

41 Business Case: Bank Physical Records Line of Business Processes Where Records are Made Statements Consumer lending Claims processing Underwriting Collections Customer service New account onboarding Project management Case management Transition Phase Traditional Active / Inactive Model Single point of consolidation for transfer Event or process causes worker controlled files to move to file room or warehouse CRC Tracking/indexing with Excel or a database Records and Legal Aspects How Records are Managed Retention (time and event based) Legal holds Legal discovery Security and privacy Vital records review Long term preservation Disposition Focus of Project Big Bite

42 The solution Capture Store, Destroy Information Management Software Enterprise Content Management Use, Manage Initial Capture Paper Records consolidated at front end of business process Paper imaged, Indexed / QC, classified for retention Paper records are destroyed after being digitized, IF ALLOWED Born digital records captured and classified using ZeroClick automation Capture Store Use, Manage Record Retrieval On Demand Records access available in real-time electronically Security controls enforced with Active Directory Version control, check-out/in Risk of loss and privacy and security violations are eliminated Create Store, Destroy Use, Manage Record Lifecycle Processing Manages physical and electronic records Enables retention and lifecycle management across all repositories Automates, enforces processes to destroy physical and electronic records on time Automates adherence with policies for Compliance, Discovery and Legal Holds Monitoring, Auditing and Reporting Timeframe years

43 Total Potential Savings with IBM FileNet P8 Technology Potential 3 year savings The bank case study Potential automation saving $ 31 million $ 5 million $36 million

44 Take a BIG BITE Out of Your Compliance Costs All that paper you store and how much it is costing you The Risk that comes with using paper for storing critical business records, and the legal and financial implications Think about. Learn More The productivity gains you can get without shuffling all of that paper, and from getting to the content easier and quicker Increased business intelligence and auditing capabilities from BPM and metadata Find Out How Your Company Might Take a Big Bite out of your budget Visit the IBM No Paper Weight web site

45 Potential Next Steps Review with your Legal Staff upcoming requirements for electronic records management Investigate areas of your business with significant paper handling and storage costs for potential digitization and archival Evaluate business processes with an eye towards reducing records declaration while processing transactions, rather than after Engage IBM to help study ROI of future archival efforts

46 46