Records Management Program

University Guidebook on Records Management

The Guidebook on Records Management, developed by the University Business Office, provides your department with a reference to information concerning records. It includes retention schedules for all primary FO units as well as general information on record keeping. The policies related to records can be found in the UI Operations Manual which also has definitions for some common terms. Unless otherwise noted, the guidelines outlined in this manual are not requirements but rather suggestions on how to improve records management in your department.

This manual should be beneficial to you in making your operation more efficient and effective. If you have any questions regarding any of the information or schedules provided here, please do not hesitate to call Finance and Operations, Office of the University Secretary at 335-3552..

  1. What is a record?
  2. Departmental Record
  3. Maintenance of Records
    1. Scanned Records
    2. Scanning Procedures and Practices
    3. Related Procedures and Practices for Network Administrators
  4. Destruction of Records

What is a Record?

A record is a document that contains the facts and relevant information your organization utilizes in its day-to-day operations. Without records your organization could not make the many decisions essential to its success and could not plan for its future in an organized and systematic manner. While most organizations utilize many types of records in various formats to carry out their mission, the more common records exist as paper records, electronic records or as scanned records stored on microfiche, microfilm or CD-ROM's.

As an instrumentality of the State of Iowa, all University of Iowa (UI) records are public records even though some records are considered confidential and must meet certain approval requirements before being released to the public (see the section on "Confidential Records" for more information). The value of records differs across campus. Generally, the value of a record to a department is based on four criteria: administrative/operational, fiscal, legal and historical. The same record may contain value based on more than one of these criteria. Categorizing a record according to these criteria helps us determine how long the record should be kept and what measures should be taken to prevent loss or destruction.

Administrative/Operational Value - These are records which support the mission of your department. They retain administrative value as long as they assist your department in performing its duties. Departmental policies and procedures, memos describing actions or decisions, and reports containing information on the current status of a project illustrate this type of record.

Fiscal Value - Records of fiscal value are those that provide financial information useful to the department's operation such as budgets, payroll and revenue/expense. Records that help departments maintain an accurate financial picture over an extended period of time should be retained for management purposes.

Legal Value - Records have legal value if they contain evidence of legally enforceable rights or obligations of the UI and its faculty, staff and students, or serve to fulfill legal requirements. Advice regarding the legal status of a specific record may be obtained from the General Counsel's office.

Historical/Research Value - Records of historical value help in current decision making and in future planning by describing the UI's past and how it has influenced prior decision making. Some questions that may help determine the historical/research value of a record include:

  • What historical significance will the records have in the future?
  • Will the records help preserve information important to the department's primary mission?
  • Will the records help preserve information important in planning for the future?
  • Will the records provide important glimpses into past research interests of faculty and how they have shaped current and planned future research in your department  

The University Archives collects and preserves information that is of enduring historical value. The University Archivist can be consulted at any time about the preservation value of records which have outlived their primary purpose within the custodial office and should be consulted about any records which have not been previously placed on a retention schedule.

^Top of Page ^

Departmental Records

Every department generates numerous records in the conduct of its activities that, depending on their relative importance, will determine their level of priority for records management. Records can be a tremendous asset and they can also be a tremendous burden. Since the information within your departmental records can be quite unique and specialized to the responsibilities and functionality of your department, records have the potential to add substantial value to the products, services and decisions produced each day. However, being able to locate the right information at the right time in a cost-effective manner is not always easy and, at times, quite difficult. Each department should view their records management capability with a goal toward enhancing the value of their internal operations and that of those constituents they serve.

Another view of records/file management is as systematic risk management. Reviewing business processes and associated records for their risk/value to your department every few years can be quite worthwhile. This risk/value implies both threat and benefit to your department from the retrievability or non-retrievability of the records in question.

^Top of Page ^

Maintenance of Records

Review of Records Inventory: The first step in reviewing your department's records and the management of those records should be to identify the type of records being maintained, in what form (paper, electronic, etc.) they exist and for how long they're being retained. As this inventory is being taken, identical records that exist in several places should be noted. Once this inventory process is completed, the next step is to determine the importance of the record(s) to the ongoing operation of your department. The process of determining a record's relative importance can result in the decision to limit its retention period or even to eliminate entirely the need for its further retention. (See the section on "Retention Schedules" for more information.)
 

Organization/Filing:
 Organizing your records more efficiently has many benefits and if you're having trouble finding things on a regular basis or often misplace things, the following suggestions are offered:

  1. Which records do you need most frequently? For those records/files needed on a regular basis, keep them in the most accessible place such as a file cabinet within your desk. If you're in an area where the records are needed by many people, keep them centrally located so everyone has fairly easy access. For those records that you don't need regularly, keep them in a place that is out of the way such as a closet or basement so they don't take up valuable office space and inhibit your ability to locate records needed more regularly.
  2. Are there types of records that could be grouped together? Sometimes filing compatible records together by function or project works out well for certain individuals or departments. Many people have a file drawer dedicated to types of records such as finance, employee or research files. Within the finance drawer there might be folders such as budget, monthly expenses and statements of account.
  3. Do more copies of a record or document exist than are really needed? Are the people in your department in the habit of printing off every e-mail they receive whereas keeping them as e-mail may work just as well? Or, what's the worst thing that would happen if the record was destroyed?
     

Organizing Electronic Records:
Many people store records/files on their desktop computer. Organizing these files and keeping them straight can be troublesome but fortunately, computer operating systems are becoming much more proficient at arranging folders and finding files that you can't find. If you prefer not to do a search of the hard drive every time you're looking for a file, the following are a few of the more common options for organizing your computer files:

  • If you prefer to keep all of your files for a particular project or function together, then you'll probably want to create a folder for each project or function that you use (i.e. finance, employee, research etc.). Each of these main folders will store all of your records/files regardless of file type such as spreadsheet or word processing. If you're working on the employee files for the day, all of them would be located in one place.
  • Create a main folder that has all of your word processing documents, another main folder that has all of your spreadsheets, a third main folder that contains any databases and so on. Within these main folders you would then create sub-folders for each type of record/file such as finance, employee, research, special projects, etc. The main advantage of this system is that it allows you to organize or search for files using a software program such as Word or Excel since these programs look for files that only they use. For example, when you're in Excel and want to open a file, Excel will automatically look only for Excel files (called the "default" setting). Excel has the option of looking for Word files or other types of files but you have to tell it to do so. Using this option may mean that there are finance files in two different main folders on your computers hard drive (budgets in Excel, narratives in Word) but finding files that you haven't used for awhile is quick and efficient.

^Top of Page ^

Scanned Records

With the technology advancements in recent years, scanners have become much more affordable and capable of producing high quality scans. Departmental efforts capitalizing on this technology to improve services and/or reduce administrative costs should be applauded and are certainly encouraged. The decision to transform paper records into digital records include managerial and operational preferences and the following are some ideas that may be worth considering:

Management of electronic files offers several advantages...

  • Decreases the volume of paper stored in an office. Valuable square footage within the office suite that was dedicated to file cabinets and storage boxes can now be recaptured  for other purposes.
  • Decreases the volume of paper routed in an office.
  • All documents get a duplicate backup created as part of the normal network safekeeping duties. If a primary document is erased, deleted or otherwise unattainable, a duplicate backup can be accessed. Paper-based systems normally do not have backups.
  • Electronic files are rarely mis-filed and even if they are, computer operating systems have built-in search engines to look for these files.
  • Access to files is easily available to more than one person.
  • Access to files is easily available to more than one person simultaneously.
  • Access to files can be opened up to new users easily
  • Access to files can be closed down to users easily.
  • Retrieval times to the files may or may not be faster than paper depending on the location of the paper file and the speed of the network. If the paper file resides close to the person(s) using it, then its debatable whether it can be retrieved faster than the electronic file. If the paper file is in storage unit located some distance away, then the electronic file can easily be retrieved faster
  • Re-filing times of the files is slightly faster with the electronic type vs. the paper type.
  • Sending and receiving electronic files is significantly faster than using campus mail, U.S. Postal Service, UPS, etc.


…while management of electronic files also have several disadvantages:

  • Convincing users, clerks, etc. that an electronic file system is more beneficial than a paper-based system is probably difficult at best. Users, clerks, etc. have most likely been using the current paper-based system for many years and have become extremely proficient at it. Without asking them, they are presumably comfortable with the current system and would find no significant reason to fix something that isn’t broken.
  • Related to the first point, motivating the users, clerks, etc. to embrace and utilize the new system to its fullest potential would also be difficult at best.
  • Computer networks are still not 100% reliable so there could be times when the network is down and documents can not be accessed.
  • Users typically need to be trained on using software and utilizing it effectively.


Management of paper files offer several advantages…

  • Typically the user does not need any special training to store, retrieve and otherwise manage their paper documents other than a rudimentary plan for organization.
  • Paper documents (in small volumes) are usually more transportable. (When going to a meeting, paper files are easier to manage.)
  • Paper documents are not dependent on machines to be read. (Don’t need a computer with you to read the files.)
  • Many people are more comfortable working with paper documents.


…and management of paper files also incur several disadvantages:

  • Not all paper documents are duplicated as a normal backup procedure. If a paper document is deleted, lost or otherwise unattainable, a duplicate backup is normally not an option.
  • Paper files require a much greater percentage of square footage within the office or storage area than their electronic counterparts.
  • Paper files that are mis-filed can cause a tremendous amount of stress and cost in finding them again. The man-hours necessary for this is exponentially greater than that for the electronic files.Retrieving and filing paper files can be labor intensive.

^Top of Page ^

Scanning Procedures

If your department is ready to initiate a scanning program, the following are procedures and practices that should be followed:

Remember that:

  • Custodians of records are assigned the official responsibility for retention and disposition of the record; generally, the custodian is the unit or office which originally creates or receives the record.
  • Stewards of records administer and manage the records for another department but do not have official responsibility like custodians. An example is Printing Services.
  • Scanned records have the same force and effect for all purposes as the original record whether or not the original record is in existence.


Procedures and Practices:

  1. Custodians/Stewards shall perform periodic checks to validate that the scanned image accurately reflects the original paper document.
  2. Custodians/Stewards shall implement reasonable controls to maintain the accuracy and validity of the scanned document and to prevent the scanned image from being altered.
  3. Custodians/Stewards shall implement reasonable procedures providing backup copies of the scanned images.
  4. Custodians/Stewards shall maintain scanned records for a length of time at least equal to the retention requirements stated on the custodian’s record retention schedule.
  5. Custodians/Stewards shall maintain the original paper documents that the scanned images were derived from for a reasonable period allowing the custodian sufficient time to validate the scanned image (i.e. 30 days).
  6. If the original paper documents are to be discarded, this shall be done in such a manner that they are shredded or otherwise disposed of so as not to be retrievable.
  7. Custodians/Stewards shall implement such computer systems to allow for reproduction of a legible hardcopy or computer monitor view that is at least as legible as the original paper version.
  8. Custodians/Stewards shall be able to provide proper documentation of the computer systems, file names, indexes, etc.
  9. Any system in place to scan documents or maintain scanned documents shall not inhibit the UI mechanisms providing an audit trail from original entry to the tax return.

^Top of Page ^

Related Procedures and Practices for Network Administrators

Those departments on campus providing network administrative support for scanning or maintaining scanned images of official UI records, will need to adhere to the following procedures and practices:

Procedures and Practices:

  1. ITS should run a network "security scan" of new and upgraded systems to help minimize the chance of configuration errors and unwanted access.  (see http://www.uiows.edu/~security/scanform.html )
  2. Backups (related primarily to disaster recovery) should be performed on a routine and consistent basis. Remember that the media used should be one that you can restore from like tape or CD vs. microfilm:
    1. System should have daily incremental backups
      1. These backups are kept for 30 days
      2. These can be kept on site
    2. System should have weekly full backups
      1. These backups are kept for 60 days (so there are at least four iterations at any one time)
      2. One copy of these backups should be kept off site
    3. System should have monthly full backups
      1. These backups are kept for 3 months
      2. One copy of these backups should be kept off site
    4. Reasonable controls shall be in place safeguarding backups kept off site
  3. Archives are inactive records created or received and accumulated by the University in the course of routine business and permanently retained due to their continuing or enduring value. The method used for archiving records can be the same as that of backups but the content may be different. Remember that backups is disaster recovery related and archives is more application/operationally related.
  4. For a user to view the information on the network, the system should have an authentication process of the user (user id and password) to get into the application. Once the user has been verified, there should be authorization for what files, directories, etc. the user can do or see within the application.
  5. Any user ids created for the system should conform to the ITS campus-wide conventions.
  6. Any systems or interfaces that are web-based should be encrypted such as 128 bit SSL. This should encrypt the users id, password and session.
  7. If remote administration is allowed to the system, this should be encrypted.
  8. Any system should have a maximum of two security administrators (those with write access, etc.)
  9. All administrative activity should be logged such as changes to the system. Users accesses may be logged as well.
  10. Depending on the operating system being used, there are industry standards describing the steps and measures taken for security (See http://www.cert.org/tech_tips). These include:
    1. application and operating system software (including patches) should be up to date
    2. running only the network services that are required for the application. (For example, don't run FTP if the application doesn't need to transfer files, and don't run SMTP if the application doesn't need to deliver mail.)
    3. performing regular network security scans
    4. installing a virus scanning/detecting/cleaning program
    5. maintaining a clear separation of the testing/development environment and the production environment, usually on a separate computer.
    6. following industry guidelines for the configuration and setup of computer systems.
    7. understanding the data integrity, confidentiality, and reliability/availability requirements of the application, and construct appropriate controls for them.
    8. understanding that the physical security of the system is just as important as logical security

Backing-up Electronic Records:

If you've used a computer for any length of time, you've undoubtedly experienced permanently losing some file due to a computer malfunction, not saving it or other similar situation. Although computers are becoming more and more reliable, the need still exists to make duplicate copies of our computer files in case a breakdown occurs. This is called backing up your files.

There are many ways to do this and some may be more effective than others. The importance of your files and the frequency with which they are modified will dictate how often you backup your files. Generally though, backing-up once per week is sufficient. Here are a few options to back-up your files:

  • Many desktop computers are connected to each other via a network. One advantage of a network system is that it allows you to easily save copies of your files onto a hard drive other than the hard drive located inside your computer (which is called the "C" drive). Generally, there are two types of accessible hard drives on the network system that you have access to. One type is called a shared network drive which allows many people access to the files (in FO this is the I:\ drive) and the other type is an individualized network drive which only you have access to (in FO this is the H:\ drive). Every night, the files on the network system are saved to a backup disk for everyone so if you copy your files from your C: drive to a network drive, they will be backed-up.
  • Use floppy disks to copy files of various sizes from your computer's hard drive for storage and safekeeping at another location. Floppy disks come in many styles and sizes from the 3.5" 1.4MB to the 2GB Jazz disk and beyond.
  • Print out a copy of your file onto paper. This may be the most expensive option due to paper costs, storage costs, recycling costs, etc., but you'll never have to worry about not being able to retrieve your file from a machine or a computer disk. This option isn't generally recommended but if you have some extremely important records or documents it may be wise to keep a paper copy.

As a final note, some departments have records housed in the computers that ITS maintains and manages. Please remember that even though ITS may store your records in their computers, your department is still the custodian of these records and still has primary responsibility for their safekeeping. Make sure that ITS performs regular backups on your records and archives the older records for as long as you may need them.

Backing up paper records:

Paper records are still used extensively and the original copy of paper records often must conform to greater standards of safekeeping than are required of electronic records. The cost of duplicating paper records can be expensive and if they're not well organized they can be easily lost or discarded. Paper records also require a lot of storage space and are prone to being mis-filed when they are returned after use.

Three of the most popular options for backing-up paper records are microfiche, microfilm and CD-ROM. Microfiche and microfilm have been around for quite awhile. Both last a long time (100+ years) and neither requires the use of expensive reader/printers. However, only one user can read a record at a time unless multiple copies of the microfiche or microfilm record are produced. CD-ROM involves scanning paper records and storing them on a disk similar to a music compact disk (CD). Current studies indicate that CD's should last approximately 5+ years depending on the CD quality. The primary advantage of a CD-ROM is that the CD images can be put on a computer network system, thus allowing any number of users to view the same imaged records simultaneously. The current high cost of this process makes it feasible only for certain high-volume records.

Vital Records:

Vital records are those considered essential for the operation of your department. In the event of a disaster, these are records that, if destroyed, would make it impossible for your department to conduct normal business activities. They include records whose existence prevent your department from incurring serious liability or risk, or that would be extremely costly to replace. You should determine which records fall into this category when conducting an inventory of your departmental records and remember that the number of truly vital records are usually quite small in relation to the total records held in any one department.

Once you've determined which records are vital, the next step is to determine how they can be safely and economically secured. Computer records can be easily duplicated with backups stored at a different location (preferably a different building). You just need to remember to perform backups on a regular basis. Duplicates of paper records should also be kept at another location or, where cost effective, preserved in microfiche, microfilm or CD-ROM. Take precautions to preserve and protect any source records that can be used to reconstruct vital records and remember that duplicate records should be stored away from any hazardous areas or materials.

Confidential Records:

Most every department has some confidential records and student, medical and personnel files are primary examples. Confidential records require special handling and should not be distributed to anyone except for the supervisor or the person that the file is for. Confidential records are not distributed to the general public and also not usually distributed to other UI employees unless approved by the department supervisor. These should be kept under lock and key and away from view of business traffic. (As a side note, if you or anyone in your department is contacted by any type of media representative (newspaper reporter, magazine editor, etc.) for information about the UI, it is standard UI practice to refer them to the Office of University Relations at 335-0557.)

^Top of Page ^

Destruction of Records

All records have some practical period of usefulness. The decision to keep a certain type of record permanently or destroy it at some pre-determined point in time should be based on the significance of the record to ongoing operations within your department. Every department should establish a written policy outlining the conditions under which the destruction of records is appropriate. Once records have outlived their practical usefulness, you must decide whether or not they should be retained. In some instances, there may be a required legal retention period in effect beyond the period of practical usefulness. Whenever possible, you should utilize all available information to determine the retention requirements of a record.

The following points of information should help you to make correct decisions regarding records destruction:

  • Any convenience copy records or non-records (post-it notes, miscellaneous papers, correspondence without official significance) can be thrown away at any time after they have outlived their usefulness in your department.
  • Official records and confidential records require no prior approvals for destruction as long as they are listed on an approved records retention schedule (see "Developing a Retention Schedule"). The destruction of these records must follow the retention time frames listed on the schedule.
  • The UI Archivist (located in the Main Library) collects and preserves records of permanent historical value. The Archivist can be consulted at any time and should be consulted when destruction of records not previously placed on a retention schedule is contemplated. If the Archivist determines the records you have scheduled for destruction should be preserved, he/she will arrange for their transfer to the Library.
  • Once its been determined that the records scheduled for destruction can actually be destroyed, shredding is the preferred method for paper records. For electronic, magnetic tape, CD and other types of computer records, make sure that the records are erased and can not be eventually retrieved. The ITS Help Desk (384-4357) can answer questions regarding ways to assure computer records are unretrievable.

^Top of Page ^

Retention Schedules:

Developing a Retention Schedule:

In order to operate your department efficiently, your personnel must not only have a knowledge of what records are generated in the course of doing business, but how they are organized and utilized in the day-to-day activities of your department. This knowledge can best be obtained and remembered through the development of and reference to a record retention schedule. A record retention schedule template has been developed for the use of FO departments to assist those departments in developing their own schedule of record retention requirements. The template is included in this guidebook.

The purpose of a retention schedule is:

  • To provide an inventory of records within your department
  • To establish custodial responsibility for the various departmental records.
  • To provide a management tool outlining individual record retention and safekeeping requirements.
  • To provide information to other departments regarding your departments official records.
  • To list which records are confidential, thereby requiring special handling for release.
  • To list which records are vital and may require special handling procedures.

In constructing or revising a retention schedule for your unit, it is recommended that you use the template included either in this booklet or on the web. The template shows the information needed for each record and will reduce the time required to organize the records. The following guidelines may be helpful:

  • Conduct an inventory of the various records in your unit which includes:
    1. what documents your department has
    2. where and how the documents are actively housed
    3. how often the documents are used
    4. where the documents are stored
    5. when the documents become inactive
    6. how the documents are destroyed.
  • Determine the official records within your department versus the convenience copies. An official record is usually the original and its usually the one which you or your department authored. Official records should be listed on your department's retention schedule and your department is responsible for maintaining them, providing duplicate copies as requested and, if necessary, disposing of them. Convenience copies are those records where another department has the official record and your department simply has a copy. Convenience copies can be tossed whenever you don't need them anymore, preferably in the recycle bin. The exception to this is when you're dealing with confidential records which need to be shredded (see "Destruction of Records" if you need more information).
  • Determine which records should be considered confidential. (see "confidential records" above)
  • Review the records to determine their operational, legal, fiscal, and historical value. This will help in deciding which records are vital and whether the records are generally safeguarded properly.
  • Review the records retention requirements of your department. These are most likely the legal requirements but also should focus on the operational usefulness of these records in the future. For those items you're not sure about, talk with the staff about how they use the records. As long as there is space available, its ok to err on the conservative side in retaining them. Keeping official records for a period of 5 years plus the current year has become an acceptable time frame but if in doubt, call the FO Business Office. Convenience records can be retained for as long or short as preferred.
  • Review the safeguarding measures your department has for its records. The value placed upon these records will directly affect how much time and money should be spent securing them.

Once this information has been gathered, plugging it into the retention schedule template is quite easy. Think about how the staff in your area will use this tool as well as if the information is clear enough for your successors to understand. After you've developed the schedule and made any revisions, it will need to be reviewed and approved by the UI Secretary or designees.
 

FO Retention Schedules:

The retention schedules for FO departments are posted on the UI Web page at http://www.uiowa.edu/~fusrmp/retention_schd/index.html and are also available through the FO Business Office. A contact person for each FO department is listed on the schedule.
 

Summary Retention Schedule for Common University-Wide Records:

The intent of this schedule (also listed on the web page) is to help you with some of the more common records dealt with. It lists various information similar to the more formal retention schedules. The retention time frames for non-official records listed on this schedule are only suggestions and not requirements. However, bear in mind that your decisions on retaining these non-official records could affect others such as the custodial department. Use your judgment as to how long your department needs these records and if you can shorten the retention period, your department will most likely benefit.

 

 

 

 

Records Management is a part of Financial Managment and Budget within the Finance and Operations organization