Disaster Recovery
This is a distinctive and large-scale subject in its own right. In essence it is about pre-planning to recover the business of the institution in whole or in part if the worst happens, whether fire, flooding, accident, bomb or any other hazard. The main task is to prepare a disaster recovery plan and test it. It is usually an institution wide exercise and involves technical expertise of buildings, systems and controls as well as records management. It is not a one-off exercise but one that has to be up-dated regularly. It is likely that the records manager will be a member of the core recovery team but it would be unusual for this person to have responsibility for the whole plan.
Controlled Destruction
Records that have completed their retention period should be sent for destruction. From a managerial point-of-view it is better not to give the creators of records a second chance to review disposals unless:
- There has been a change in the law or in the institution which requires a fresh look at the retention period
- There is uncertainty
- There is a potential re-evaluation of the long-term importance or a particular class of records
Where the matter is clear-cut it should be an automatic procedure:
It is necessary to keep a record of all records disposals. This is an essential audit trail.
All records must be disposed of appropriately. In the case of sensitive or confidential paper records this must mean shredding or pulping. In the case of microfilm this will mean grinding, and in the case of electronic data ensuring that it cannot be recovered.
Increasingly waste disposal is hedged about with environmental regulations and all disposal practices must be compliant with these.
It is very important the list of records sent for destruction is kept (the disposal schedule). Under the Freedom of Information regime this is the definitive proof that disposal of records is taking place in a controlled manner. As a general principle it is sensible for the records manager, or whoever is designated to control the process, to sign off and date the destruction schedule as proof that the records are no longer in the institution. A copy of the invoice from the waste company can then be attached to the schedule to show conclusively that destruction has taken place.
In many ways the easiest option for an institution is to use a commercial disposal firm for the disposal of paper and microfilm because their practices will be controlled, audited, and fully compliant with current environmental regulations (their business can only exist if they are). They will be able to issue a certificate of destruction that should be maintained with the disposal schedule as proof that the record has been destroyed. In the context of both Data Protection and Freedom of Information legislation in the UK these sorts of procedures are the clear proof of controlled destruction of information that the Information Commissioner would be looking for in any disputed request which the institution was unable to answer.
