Analyst Corner: Forrester/ARMA Survey: Mitigating Legal Risks Drives Software Deployment Plans
In conjunction with ARMA International, Forrester recently fielded a survey of more than 400 technology and strategy decision makers responsible for records management. The key finding: More than half of records managers plan to ramp up deployments in 2010. Maybe that’s not surprising, but keep in mind the well-established records management market is currently undergoing significant change.
We’re at a “deer in the headlights” phase of the market. Enterprises need consistent records management approaches to grapple with the explosive volume and diversity of content and to meet legal risk mitigation needs.
Brian W. Hill
Rapid growth in digital content has coincided with increasingly complex compliance and e-discovery requirements that frustrate enterprise efforts. Diverse applications, tools, and file types, along with undocumented, disorganized information architectures, increased litigation, rapidly changing case law, and a fragmented vendor ecosystem further aggravate this scenario. In this landscape, records managers must push for a strategic seat within their organizations, pragmatically aligning near-term requirements to maximize value and fit for their needs.
Evaluating Vendors In Fragmenting Market Is Key
These new requirements fuel an expanded emphasis on vendor evaluation. It’s important for buyers across all markets to select a vendor that cost-effectively meets current and expected organizational needs while delivering on its promises. But, given the high stakes in the records management market (e.g., fines, major e-discovery costs, and reputation damage), information and knowledge management (I&KM) leaders need to navigate cautiously when choosing suppliers. This is key given:
1. Uncertainty regarding vendor selection and fragmentation will define the 2010 market.
A large number of vendors provide offerings for the broad records management market. These include: Autonomy, CA, EMC, HP, IBM, Iron Mountain, Laserfiche, Microsoft, Open Text, Oracle, and others. Records management stakeholders who expect to deploy additional records management licenses or to pilot or implement new records management products next year cited these and other vendors, but nearly 29% of these users have not determined which offering they plan to pilot or deploy in 2010.
2. Records managers give mixed ratings for their current solutions.
Less than half of survey respondents report satisfaction with their current records management solutions, and more than 13% report they are not at all satisfied. Among survey participants employed by organizations that conduct business internationally, satisfaction rates are even lower, factoring in needs for language support, performance, and synchronizing regulatory and privacy requirements. Dissatisfaction with vendor-supplied and homegrown records management solutions is a key factor leading organizations to consider alternative offerings over the next 18 months. (See Figure 1.)
Expanding RM Scope Includes ESI
Factoring in media, format, and other considerations, only 19% of records management stakeholders report they are very confident their organization will be able to rapidly and cost-effectively retrieve records in 15 years. This figure drops to 15% over a 25-year period. For some, vendor viability may be an important consideration. Ongoing market consolidation limits the number of offerings available from “pure play” providers and brings into question the longevity of smaller independent vendors.
Increasing regulatory and litigation concerns, along with organizational change and technology advancements, have combined to accelerate the expanding scope of records management beyond physical records to a range of electronic assets. Current implementations and expected deployments include the following:
1. Current systems focus on physical records management while support for other assets lags.
More than 80% of records management decision makers report leveraging technology for physical records management. This figure dramatically decreases for electronically stored information (ESI). Remarkably, nearly 37% of records management stakeholders do not currently leverage technology to enforce retention management for e-mail. The figures are worse for other types of ESI. Today, about half of the survey participants are not using any type of technology solution to enforce retention policies for file shares, desktops, and other electronic assets.
2. Organizations plan to significantly expand the scope of content under retention management.
In 2010, records management stakeholders plan to leverage technology for retention management focusing on an expanded array of content, led by physical assets, e-mail, enterprise content management (ECM), file shares, and collaboration systems. Instead of traditional approaches focusing on a single content or application type, survey participants anticipate integrating retention management support for other types of ESI with existing records management applications. More than one-third of records management decision makers plan to integrate e-mail, ECM, and collaboration systems with records management solutions currently deployed in their organization.
3. The need for administrative and policy consistency fuels federated records management growth.
Although current adoption of federated records management (FRM) is limited with only 7% of users reporting adoption, nearly 18% of survey participants expect to pilot, expand, or implement FRM solutions in 2010. The top driver leading this increase in FRM plans and deployments is the organizational need to support a consistent administrative framework and retention policies across multiple applications and repositories. Information infrastructure fragmentation clearly challenges many enterprises, but it’s clear this is still an early-stage market with more than half of respondents reporting limited knowledge of FRM.
4. Lack of familiarity and security and privacy and legal concerns limit records management software-as-a-service (SaaS).
Nearly 10% of users currently leverage SaaS or hosted solutions for records management. Survey results show this figure will likely hold steady for 2010. Among those individuals who have deployed or are considering these solutions, top drivers are perceived lower overall total cost of ownership than on premises alternatives and the view these solutions are easier and faster to deploy than traditional software options. More than one-third of records management decision makers are unfamiliar with the records management market for SaaS or hosted solutions for records management and about a quarter have security, privacy, and/or legal concerns limiting adoption for these approaches.
Funding Is Uncertain
It is apparent records management is an important priority across a variety of organizations. What’s less clear, however, is how much budget will be allocated for these objectives. Among records management stakeholders who expect to deploy additional records management software licenses or to pilot or implement new records management software products in 2010, 18% have budgeted more than $250,000 in software licenses alone. Software spending at the lower end of the scale in 2010 will also be significant. Nearly one-third have budgeted under $100,000 for 2010. Reflecting economic uncertainty and pricing complexity, among records management decision makers with plans to deploy or pilot or implement new products in 2010, 44% haven’t yet determined their software budget.
The pricing for records management applications is all over the map, complicating enterprise planning efforts. Many vendors’ pricing models are based on user metrics, but others take per-processor, flat fee, and other approaches. Further complicating cost projections, pricing inconsistency across vendors abounds for specific modules (e.g., physical records management functionality, SharePoint connectors, and FRM) and supporting applications (e.g., e-discovery support), and many vendors provide records management functionality leveraging their ECM technology stacks.
Allocating these precious budget dollars is quite complex, but for many decision makers certification is more than a casual request for proposal check box. They place considerable importance on certification, and there are significant differences in purchasing decision importance between the U.S. DoD 5015.2-STD and international certifications. In particular:
1. DoD 5015.2-STD V3 certification matters.
In making future records management purchasing decisions, DoD 5015.2-STD V3 certification plays a key role. More than 42% of records management stakeholders rate DoD 5015.2-STD V3 (baseline) certification as “important” or “very important” in buying decisions. The comparable figures for DoD 5015.2-STD V3 (classified) and DoD 5015.2-STD V3 (Freedom of Information Act/Privacy Act) are 24% and 34%, respectively. The survey data show these certifications are more important for government (local, state, and federal) organizations, but not dramatically so. In comparison with their non-government counterparts, 5-10% more government records management decision makers rated these certifications as important or very important.
2. International certifications hold less importance in purchasing.
Respondents report certification for Australian VERS and the Model Requirements Specification for the Management of Electronic Records (MoReq2) hold less significance than DoD 5015.2-STD V3 certifications in making purchasing decisions. More than half of survey participants either are not familiar with these certifications or see them as unimportant. In digesting this data, however, it’s important to note that although 55% of the respondents are with organizations that conduct business internationally, the vast majority are employed by organizations headquartered in North America.
Challenging E-Discovery Environment Batters Confidence
Mitigating legal risk is a top priority for records management decision makers. A deeper dive into this environment reveals a market characterized by the following:
1. Limited support for integrated legal hold capability poses significant legal risk.
Integrating legal hold capabilities with records management plays an important role in mitigating legal risk. Nearly 48% of records management stakeholders report their records management solution supports legal hold natively or by a packaged third-party integration. The counterpoint to this figure represents significant potential legal exposure. More than half of records management decision makers report their application doesn’t support legal hold, don’t know if it does, or that it does, but these capabilities aren’t currently being used.
2. Staff shortages, poor application synchronization, and cost are top e-discovery challenges.
E-discovery is a complicated, expensive process for many organizations and effective records management can go a long way toward easing litigation burdens. As the top e-discovery challenge in their organization, 69% of records management decision makers rate not having enough dedicated staff as “challenging” or “very challenging.” The next two top-rated factors are synchronizing e-discovery, records management, and archiving efforts and a perception that the process is too expensive with 60% and 59% of survey participants, respectively, citing these considerations as challenging.
3. Less than one-fifth of records managers express high e-discovery confidence.
Just under 20% of records management decision makers report they are “very confident” that, if challenged, their organization could demonstrate their ESI is accurate, accessible, and trustworthy (see Figure 2).
Surging volumes of content and an expanding array of ESI, combined with rising litigation, staff shortages, limited integration with key applications, and other factors contribute to low confidence and high cost during the e-discovery process.
4. More than two-thirds of records managers report confidence in privacy requirement capabilities.
Records management decision makers are confident in their organization’s ability to meet privacy requirements, specifically those affecting the processing, transporting, and handling of personal information. More than 26% of records management stakeholders report they are “very confident” in their ability to meet privacy requirements and 45% stated they were “somewhat confident.” As regulatory bodies strengthen privacy protections and as litigation across national boundaries expand, the importance and complexity of meeting privacy needs, while addressing e-discovery and records management demands, will increase.
Although the systematic control of records throughout their lifecycle is important in maximizing profit, controlling cost, and ensuring organizational vitality, for many, records managers are not viewed as strategic stakeholders. In more than one-third of organizations, records managers don’t have a strategic seat at the table. Including requirements definitions and vendor selection, 36% of records management stakeholders are not included in the IT strategic planning process. Effective records management can help organizations meet regulatory requirements, maintain and protect key information assets, and ease e-discovery burdens.
Laying the Foundation for RM’s Strategic Position
Records managers must push for a strategic seat at the executive table. These six steps will help lay the strategic foundation:
1. Build a cross-functional legal risk mitigation team.
In different organizations, records managers report into diverse functional groups, including lines of business, IT, executive offices, legal, and others. While records management stakeholders should avoid getting trapped in a given functional silo, these varied reporting structures emphasize that retention management is directly relevant across multidisciplinary perspectives. Fostering a cross-functional team with appropriate broad participation and funding is essential for retention management program success and can be a critical component inmitigating legal risk and cutting e-discovery costs.
2. Expand focus to a broad array of content types and applications.
Four out of five records management stakeholders report leveraging technology for physical records management. Especially with requirements from the revised U.S. Federal Rules of Civil Procedure (FRCP) and technology advances, it’s key to incorporate a broad range of ESI into records management efforts. Failure to do so can entail significant legal risk and litigation expense. Today, 37% of records management stakeholders note their organizations do not leverage technology for enforcing retention management policies on e-mail – the figures are worse for other types of ESI. It’s time tomove beyond the comfort zone of the mature physical records market and to address retention management for a broader array of prioritized electronic assets.
3. Implement and optimize legal hold procedures.
Less than half of records management decision makers state their organizations support legal hold functionality integrated with their records management solutions. Given the FRCP mandate that organizations should be able to implement legal holds in order to stop systematic destruction of information according to retention policies, this lack of integration represents considerable legal risk. In conjunction with legal, IT, and other stakeholders, it’s essential to implement and improve legal hold procedures.
4. Leverage automation for e-discovery and records management.
More than two-thirds of records management decision makers rated insufficient dedicated staff as “challenging” or “very challenging” in the e-discovery process. In the current economic climate, hiring budgets are limited at best for many organizations. Instead of simply throwing more bodies at this challenge, I&KM professionals must work smarter, leveraging technology to automate retention classification and selected e-discovery steps. As the volume and diversity of ESI expand, it’s simply not realistic to assume manual classification and routing will be able to keep up the pace. Look to automation to support retention management classification, legal hold, and other phases of the e-discovery process.
5. Choose vendors carefully in a changing and consolidating market.
While 56% of records management stakeholders expect to deploy additional licenses or to pilot or implement new records management products in 2010, nearly 29% of those individuals haven’t yet determined which offering they plan to use. The records management market is highly fragmented and some enterprises are finding their existing suppliers may do a great job at managing physical records, but lack capabilities for working with a broader set of ESI or functionality needed to support the e-discovery process. In exploring alternative options, I&KM pros should apply appropriate weighting to vendor viability.
6. Incorporate cross-repository strategies.
Leveraging a consistent approach to records management across a range of information assets is important, but the objective of a singlemaster repository simply isn’t realistic for most enterprises. Application constraints, legacy infrastructure investments, and ongoing merger and acquisition activities will frustrate efforts. Consolidation is important, but I&KM professionals need to consider crossrepository functionality, such as FRM. FRM can be an important strategic option in mitigating legal risk and supporting consistent retention policies across appropriate applications and repositories. Although current FRM adoption is limited, nearly one-fifth of records management stakeholders expect to pilot, expand, or implement FRM solutions in 2010.
Brian W. Hill can be contacted at bhill@forrester.com.
From September - October 2009