1. Generally Accepted Recordkeeping Principles® Where it’s at, what it means, and what to look for

2. What is GARP®?
GARP® is an Acronym for Generally Accepted Recordkeeping Principles
ARMA understands that records must be created, organized, secured, maintained, and used in a way that effectively supports the activity of that organization.
Records and recordkeeping are inextricably linked with any organized activity. As a key resource in the operation of any organization, records must be created, organized, secured, maintained, and used in a way that effectively supports the activity of that organization. These needs can be fulfilled only if recordkeeping is an objective activity, insulated from individual and organizational influence or bias, and measured against universally applicable principles. To achieve this transparency, ARMA International developed the Generally Accepted Recordkeeping Principles (GARP) in order for organizations to adhere to objective records and information management standards and principles. Without adherence to these standards and principles, organizations will have poorly run operations, legal compliance failures, and – potentially – a mask for improper or illegal activities. 2

3. Quotation
“As to methods there may be a million and then some, but principles are few. The man who grasps principles can successfully select his own methods. The man who tries methods, ignoring principles, is sure to have trouble.”
I happened upon a relevant quote from Ralph Waldo Emerson that explains our approach to developing the Generally Accepted Recordkeeping Principles.
Ralph Waldo Emerson 3

4. What Are They?
A common language and imperative to use with executive management when describing the tenets of a solid program
A model for program development
A benchmark against your peers
A legislative and judicial roadmap to best practices
GARP is our shortened version of the Generally Accepted Recordkeeping Principles sm. ARMA International is developing and socializing the principles in order to provide a framework for guidance in implementing information management programs.
The defined set of principles will help business leaders, legislators, the judiciary, and other stakeholders understand and address the key components of records and information management as a discipline and as a best business practice.
We’ve already used the principles in conversations with the legislature in discussing potential regulations and corporate best practices. 4

5. Where Did They Come From?
Committee of 7 widely-respected professional practitioners on the task force
Using standards, best practices, and practical experience
Sent to public review by ARMA International members and stakeholders
Finalized and released March 31, 2009
It’s important to point out that we didn’t just create these out of thin air. They come from work experience of 7 of our most widely recognized RIM practitioners in a variety of fields, but they also are built upon the collective wisdom of ARMA International standards and best practices as a foundation. Following that, they were reviewed by ARMA International members and practitioners who helped comment and further define the principles.
A committee of widely respected professional practitioners served on the task force to develop the final list of Principles. Among those participating were Fred Pulzello, Patrick Cunningham, Galina Datskovsky, Jim Coulson, John Montana, Lenore Greenberg. Rick Sterling.
ARMA International’s Board of Directors unanimously approved the submitted principles to proceed through a comment phase by members and stakeholders in the business world. The finalized principles were posted to ARMA International’s site and released to the media March 31. 5

6. How will GARP® be Used? By Regulators… By RIM Professionals…
To protect the public by assuring access about the operations, policies and procedures of regulated companies
By RIM Professionals…
To measure the records management programs of a companies in a consistent and systematic manner
By Businesses…
To document to regulators and the public that information will be available from these companies if ever needed 6

7. Generally Accepted Recordkeeping Principles®
Accountability
Integrity
Protection
Compliance
Availability
Retention
Disposition
Transparency
So let’s walk through the actual principles…
The eight principles are Accountability, Integrity, Protection, Compliance, Availability, Retention, Disposition, and Transparency.
In the following slides I’ll summarize each of the eight principles. But for more information about each one of them visit 7

8. Principle of Accountability
An organization
assign a senior executive to oversee recordkeeping program
delegate program responsibility to appropriate individuals
adopt policies and procedures to guide personnel, and ensure program auditability
Principle of Accountability
An organization shall assign a senior executive who will oversee a recordkeeping program and delegate program responsibility to appropriate individuals, adopt policies and procedures to guide personnel, and ensure program auditability. 8

9. Principle of Accountability
Senior executive
Establish method to design and implement a structure to support recordkeeping program
Establish governance structure for program development and implementation
Recordkeeping program
Have documented and approved policies and procedures to guide implementation
Auditability enables program to validate its mission
Principle of Accountability
The senior executive in charge should establish a method to design and implement a structure to support the recordkeeping program
Governance structure should be established for program development and implementation
Necessary components include an accountable person and a developed program
A recordkeeping program should have documented and approved policies and procedures to guide its implementation
Auditability enables the program to validate its mission and be updated as appropriate 9

10. Principle of Integrity
Recordkeeping program
Construct so organizational records and information have a reasonable and suitable guarantee of authenticity and reliability
Principle of Integrity
A recordkeeping program shall be constructed so the records and information generated or managed by or for the organization have a reasonable and suitable guarantee of authenticity and reliability 10

11. Integrity of Records Should include the following:
Correctness of and adherence to the policies and procedures of the organization
Reliability of information management training
Reliability of records created
Acceptable audit trail
Reliability of systems that control the recordkeeping
Integrity of records in a recordkeeping environment should include the following:
Correctness of and adherence to the policies and procedures of the organization
Reliability of the information management training and direction given to the employees who interact with all systems
Reliability of the records created
An acceptable audit trail
Reliability of the systems that control the recordkeeping including hardware, network infrastructure, and software 11

12. Principle of Protection
Recordkeeping Program
Construct to ensure protection to records and information that are:
Private
Confidential
Privileged
Secret
Essential to business continuity
Principle of Protection
A recordkeeping program shall be constructed to ensure a reasonable level of protection to records and information that are private, confidential, privileged, secret, or essential to business continuity 12

13. Protection Controls for Information
Systems must have appropriate security so only approved personnel can access to information
Sensitive records must be safeguarded from inadvertent or malicious leaks
Security and confidentiality must be integral parts of final disposition
Audit program must have a clear process to determine whether sensitive information is being handled in accordance with the principle of protection
Principle of Protection
A recordkeeping program must ensure that appropriate protection controls are applied to information from the moment it is created to the moment it undergoes final disposition
Each system utilized must have an appropriate security structure so only personnel with the appropriate level of security or clearance can gain access to the information
An organization must also safeguard its sensitive records from becoming available on social networking sites and chat rooms by employees who may either inadvertently or maliciously post it there
Security and confidentiality must be integral parts of the final disposition processing of the information
An organization’s audit program must have a clear process to ascertain whether sensitive information is being handled in accordance with the outlined policies in the principle of protection 13

14. Principle of Compliance
Recordkeeping program
Comply with laws and other binding authorities, as well as the organization’s policies
Principle of Compliance
The recordkeeping program shall be constructed to comply with applicable laws and other binding authorities, as well as the organization’s policies
Provide examples of Applicable Laws.
Provide examples of Binding Authorities. 14

15. Principle of Availability
An organization
Maintain records to ensure timely, efficient, and accurate retrieval of information
Principle of Availability
An organization shall maintain records in a manner that ensures timely, efficient, and accurate retrieval of needed information 15

16. Principle of Availability
Organizations must have the ability to identify, locate, and retrieve the records and information required to support its business activities
Information must be described during the capture, maintenance, and storage processes to make retrieval effective and efficient
Routinely back up electronic information
Manage availability of information assets at a reasonable cost from creation through disposition
Principle of Availability
Successful and responsible organizations must have the ability to identify, locate, and retrieve the records and related information required to support its ongoing business activities
Information must be described during the capture, maintenance, and storage processes in such a way as to make retrieval effective and efficient
Electronic information needs to be routinely backed up to ensure that it can be restored if there is a disaster, a system malfunctions, or the data becomes corrupted
To effectively manage the availability of its information assets at a reasonable cost, an organization should in the normal course of business regularly remove obsolete or redundant records and related information from its information systems 16

17. Principle of Retention
Organization must maintain its records and information for an appropriate time, taking into account
legal
regulatory
fiscal
operational
historical requirements
Principle of Retention
An organization shall maintain its records and information for an appropriate time, taking into account legal, regulatory, fiscal, operational, and historical requirements.
Organizations make retention decisions based on the content and purpose of records. 17

18. Principle of Retention
Records retention program based on information life cycle
Time period from record creation to disposition
Retention decisions based on content and purpose of records
Retention periods determined by legal and regulatory, fiscal, operational and historical requirements
Organization must conduct a risk assessment to determine retention period for each record type
Minimize risks and costs associated with records retention, by immediately disposing of records after their retention period expires
Principle of Retention
The records retention program is based on the concept that information has a life cycle, which is the time period from the creation of a record to its final disposition
Organizations make retention decisions based on the content and purpose of records. Retention periods are determined by legal and regulatory, fiscal, operational and historical requirements
Once its records retention requirements are determined, an organization must conduct a risk assessment to determine the appropriate retention period for each type of record
To minimize risks and costs associated with records retention, it is essential to immediately dispose of records after their retention period expires 18

19. Principle of Disposition
An organization
Provide secure and appropriate disposition for records that are no longer required to be maintained by laws and organizational policies
Principle of Disposition
An organization shall provide secure and appropriate disposition for records that are no longer required to be maintained by applicable laws and the organization’s policies 19

20. Principle of Disposition
Records must be designated for disposition
Organization must make reasonable effort to ensure all versions of the records are included in disposition
Disposition of records must be suspended for pending or ongoing litigation or audit
Destruction of records must be performed in a secure manner
Transfer of records to historical archives, library, or museum should be documented as part of the organization’s records retention policy
Principle of Disposition
At the completion of the retention period for an organization’s records, the records must be designated for disposition. In many cases, the disposition for records will be destruction
In all instances, the organization must make a reasonable effort to ensure that all versions and copies of the records are included in the disposition
Disposition of relevant records must be suspended in the event of pending or ongoing litigation or audit
Destruction of records must be performed in a secure manner, ensuring that records to be destroyed are transported securely and destroyed completely
The transfer of records to the custody of a historical archives, library, or museum should be documented as part of the organization’s records retention policy 20

21. Principle of Transparency
An Organization’s
Recordkeeping program shall be documented and be available to all personnel and appropriate interested parties
Principle of Transparency
The processes and activities of an organization’s recordkeeping program shall be documented in an understandable manner and be available to all personnel and appropriate interested parties. 21

22. Principle of Transparency
In best interest for all parties to understand that an organization conducts its activities in a lawful and appropriate manner by having recordkeeping systems that accurately and completely record the activities of the organization
An organization that is subject to open records laws may need to make all records available to any person upon request, and other organizations may have a legitimate need to protect confidential or proprietary information
Every organization must create and manage the records documenting its recordkeeping program to ensure the structure, processes, and activities of the program are apparent and understandable to legitimately interested parties
Principle of Transparency
It is in the best interest of every organization, and of society in general, that all parties clearly understand that an organization conducts its activities in a lawful and appropriate manner, and
those recordkeeping systems accurately and completely record the activities of the organization
An organization that is subject to open records laws may need to make all records available to any person upon request, and other organizations may have a legitimate need to protect confidential or proprietary information
Every organization must create and manage the records documenting its recordkeeping program to ensure that the structure, processes, and activities of the program are apparent and understandable to legitimately interested parties 22

23. The Value of GARP® to Your Organization
Regulatory requirements
Maturity model
Benchmark among peers
The three primary values of GARP for your organization are:
Regulatory requirements
Maturity model
Benchmark among peers 23

24. Regulatory Requirements
Provide common framework among jurisdictions and industries
Demonstrate reasonable adherence to best practices
Regulatory Requirements
Provide common framework among jurisdictions and industries
Demonstrate reasonable adherence to best practices 24

25. Maturity Model
Apply proven methodology to measure progress toward optimization
Measure current state and identify gaps against common framework
Develop remediation plan
Audit and test against metrics
Maturity Model
Apply proven methodology to measure progress towards optimization
Measure current state and identify gaps against common framework
Develop remediation plan
Audit and test against metrics

26. Benchmark Among Peers Establish industry norms
Calibrate resources accordingly
Maintain competitive advantage
Benchmark Among Peers
Establish industry norms
Calibrate resources accordingly
Maintain competitive advantage 26

27. GARP® Roadmap ARMA is introducing GARP® to regulators
ARMA is promoting GARP® awareness
ARMA is providing training sessions on GARP®
Measurements and testing are being developed
GARP® compliance will become a barometer of records management health

28. What’s Next?
Look for more resources to help measure your organization against GARP®
Look for resources from ARMA International that directly connects each principle to related resources and education
And more!
The September / October Hot Topic supplement to the Information Management magazine will focus on the principles.
More resources are forthcoming from ARMA International.
Benchmark / maturity model
Resource list that connects each principle to resources and education
And much more we’re not at liberty to talk about right now for competitive reasons. 28

29. Thank You! 29