Records and Risk Aversion

In my profession, I feel like I’m constantly fighting the same battles over getting clients to destroy their older records that no longer have value for the company.

I often come across these old, dusty storage rooms, or offsite storage accounts, filled with boxes and files. Usually, in one of these scenarios, there are no lists that would tell us about the actual contents of the records. One option is to do a sampling and a risk assessment to just get rid of everything. This approach is often met with resistance.

Whenever I start talking about getting rid of the older records with clients, I hear similar concerns voiced:

• What if our reputation is damaged because we destroyed something we should have kept?
• What if we need something?

Once in a while, I hear the other side, usually from my colleagues:

• What if finding something that should have, in fact, been destroyed a long time ago damages the organization’s reputation?
• What if you need something and you can’t find it?
• What if you “find” what you need, but it’s on an obsolete format like a floppy disk, Beta tape, or old backup tape that you can’t view?
• What if the organization gets hacked, and it’s hard to determine what was compromised because too much was saved without being identified properly?

The consequences of saving too much for too long have a real financial impact, especially for electronic records. First of all, it requires an investment in a long-term digital preservation strategy to ensure that older formats and mediums are continually migrated and updated to remain readable with newer technologies. The more volume saved, the more costly this process becomes. As the volume continues to grow, the management of the content also becomes more complex over time.

I’ve come across records stored on old mediums that can no longer be accessed because the hardware and/or software are not available. Last year, tucked behind the equipment on one desk, a user found a dusty plastic box of 3.5” floppy disks. A few of the disks had a label with a handwritten note identifying the contents as “client files,” but no other details were available. At an event the other week, a colleague shared with us that she had just found an old box with a VHS tape in it. I’ve also come across VHS tapes on some of my contracts in the last two years. If information can’t be accessed or retrieved, it’s lost, and either should have been identified and destroyed in a timely fashion or identified for long-term storage and migrated to a newer format/medium.

So which risk, exactly, do organizations think they are averting by electing to save more than is necessary or to maintain records for excessive periods of time? What makes the first concern more plausible or riskier than the second? Are these the risks we should be focusing on averting?