“If you think compliance is expensive, try noncompliance.”
Former Deputy US Attorney General Paul McNulty
Compliance is of primary concern to financial service, healthcare, and government organizations. Meeting compliance regulations have historically been perceived as an onerous burden. Today, leading companies are taking a broader approach to meeting compliance and are even embracing the benefits compliance offers. Meeting compliance must be a systemic process that touches all aspects of an organization. Compliance is generally achieved by meeting three requirements: managing documents, enforcing security/disaster recovery, and auditing activities.
Managing documents
Organizations rely on various technologies to help meet compliance requirements. Of these technologies, managing documents is the most prevalent. To remain in compliance, any organization must demonstrate its ability to know the absolute whereabouts of all documents at any given moment. Accomplishing this in a paper-based environment is no longer practical. The best way to organize, track and control documents is to place them into a document repository. This foundation that creates numerous advantages for the organization. First of all, the whereabouts of a document is always known by the system. Anyone with proper authority can quickly locate any document with as little as one piece of information about the document. A good document management system will give the user a number of methods for locating a document including: structural search (mimicking the physical filing aspects of a cabinet, folder, tab structure), Metadata search (file attributes such as name, size, data type, age, etc.), or full text search (locating words within the document’s body). This gives the user the flexibility to use the right tool based on what they know about a document. Having a full arsenal of search options impresses auditors and can shorten the time spent on the audit process. Another common requirement with most compliance regulations is the ability to control the lifecycle of a document. Retention determines how long a document must be in the system before it can be deleted. Retention periods are defined based on what the document is and the industry in which it is being used. Edit rights are used to control whether a document can or cannot be edited. In most cases both the retention and edit rights are put in place the moment the document enters the system. Setting these attributes can also be automated so they are set without user assistance. This can come in handy in demonstrating how the organization’s policies are being consistently enforced during a compliance audit.
Enforcing security / disaster recovery
Enforcing security and providing for disaster recovery are chief compliance criteria regardless of industry. Securing documents in a document management system needs to be accomplished in a way that enables users to be productive the moment they log into the system, yet prevent them from ever accessing restricted information. Enforceable rights should include:
| Folder Rights |
Document Rights |
| None |
None |
| Preview |
Preview |
| View |
View |
| Edit |
Edit |
| Create |
Create |
| Delete |
Delete |
| Lock |
Lock |
| Export (indexes / contents) |
Export |
| Transfer (move / copy) |
|
No document management system should ever be implemented without a sound back-up/disaster recovery plan. Fortunately the DMS simplifies back-up and recovery dramatically because all documents and system information are centrally located in the repository. Some compliance requirements also mandate periodic system recovery testing to verify the recovery plan is working. Required or not, disaster recovery testing is just good policy, much like replacing the batteries in a smoke detector once a year.
Auditing activities
There are two components for having a successful audit. First, all activity needs to be captured in a transaction audit log. Second, the capability to filter the log data needs to be available so it can be presented in a useful manner. Every action performed by a user is added to the audit log with a date/timestamp. This gives administrative personnel the ability to generate a report based on a range of items. Administrative generated reports can be very simple reports of a specific activity or complex queries covering multiple criteria. Beyond satisfying the compliance aspects of audit, auditing activities can be a powerful tool when it comes to identifying events that are too time consuming and in need of improvement.
Complementing the audit functions are search and trace functions. Search is used daily by end users of the DMS to locate specific information. Trace is a simple function that allows the user to review the workflow history of an entire folder or individual document. Trace is especially helpful in demonstrating that a workflow process is following the organization’s documented policies. Just like Audit reports, Trace reports can be immediately previewed on the monitor or saved in a variety of file formats for data reorganization and reporting.
Compliance requirements will often require an organization to produce a complete set of documentation that clearly defines various policies and procedures. During an audit, these policies and procedures must be demonstrated as being readily available and followed. Storing policies and procedures in the EDMS is the best way to make sure they are readily available for reference and review. Version control can be used to keep documentation up to date while maintaining a historical account of all modifications. Creating specific workflows based on policies and procedures also ensures everything remains in order and is properly documented. Workflow policies can also be applied to ensure all policies are periodically reviewed by required personnel.