Policy 12 – Records Management
Established: August 2, 1978
Last updated: January 11, 2010
1. INTRODUCTION AND SCOPE
The university recognizes that the efficient management of its records is necessary to support and contribute to the effective overall management of the institution, to comply with its statutory and regulatory obligations, and to meet the expectations of its stakeholders. This policy provides the framework through which effective records management can be achieved and maintained; it applies to all university records created, received, or maintained by university employees in the course of carrying out the activities of the university. (See Appendix A for guidance on what constitutes a university record.)
University records are the property of the university. They will be retained only as long as necessary to meet statutory, fiscal, contractual, and operational requirements. Records with enduring evidential or historical value will be preserved as part of the university’s archives.
Overall responsibility for this policy rests jointly with the Secretary of the University and the Chief Information Officer. All university employees must ensure that records for which they are responsible are accurate, complete, and are retained and disposed of in accordance with the university’s approved records retention schedule.
Compliance with this policy, formulated within the context of current legislation and existing university policies and guidelines, facilitates institutional accountability and compliance with information-related legislation (specifically Ontario’s Freedom of Information and Protection of Privacy Act) and any other legislation or regulations affecting the operation of the university.
2. RECORD FORMAT AND MEDIUM
Records may exist in any form including text, numeric, graphic, and sound, or a combination of these, and on any medium such as paper, magnetic media (e.g., hard disks, floppy disks, flash memory devices, magnetic computer tapes, audio- and videotapes), optical media (e.g., CDs, DVDs, optical jukeboxes), and micro media (microfilm or microfiche).
Electronic records and images
The university recognizes the many benefits of creating and maintaining university records electronically, including increased efficiency in information retrieval and distribution, improved security, and reduced storage costs. However, because electronic records are easy to change, copy, and modify, and because technology rapidly becomes obsolete, the maintenance of official records in electronic form is subject to particular requirements.
Electronic records and images, where the image is intended to replace the original as the official record, must be created and used as part of normal business practice, and be maintained in a way that ensures their reliability, authenticity, and usability over their entire retention period and that allows the records and images to be admissible as evidence in legal proceedings.
Records: information, regardless of format or medium, which is created, received, and maintained by the university and which provides evidence of its transactions or activities.
Electronic record: a university record, including a record created or received in a digital image format, which requires a computer or other digital device to read, perceive, or hear.
Electronic image: a digital representation of a university record, regardless of the original format or medium.
Records management: an efficient, orderly, and systematic approach to the creation, receipt, use, and disposition of university records, including processes for capturing and maintaining evidence and information about activities and transactions in the form of records.
Records retention schedule: a comprehensive instruction to ensure that records are retained for as long as necessary based on their operational, fiscal, legal, and historical value, and are disposed of in an authorized manner at the end of the retention period.
The purpose of Policy 12: Records Management is to ensure that university records are managed in such a way that they:
- Meet internal needs
- Demonstrate accountability to the university’s various constituencies
- Comply with statutory and regulatory requirements
- Provide evidence of processes or transactions which are admissible in legal proceedings
- Are maintained and stored in the most economical manner consistent with the objectives above
- Are disposed of in an authorized manner once statutory, fiscal, contractual, and operational requirements have been met, and
- Preserve the history of the university.
The following guidelines will assist university employees in applying and implementing Policy 12: Records Management. Policy 12: Records Management and these guidelines are to be used in conjunction with Policy 13: University Archives; WatCLASS: the University of Waterloo Records Classification and Retention Schedule, and any other records-related policies, procedures, and guidelines that the university may from time to time establish.
These guidelines may be amended, revised, or rescinded by the Secretary of the University and the Chief Information Officer.
Overall responsibility for university records rests jointly with the Secretary of the University, who acts as chief records officer, and the Chief Information Officer, who is responsible for the integrity, reliability, and security of the university’s institutional information systems and information technology infrastructure.
Specific responsibility for university records is delegated as follows:
- The University Records Management Committee is responsible for advising the Secretary of the University and the Chief Information Officer on records-related matters, including appropriate retention periods and disposal actions.
- Unit managers/heads are responsible for ensuring that their unit’s records are accurate, complete, and retained in accordance with the university’s approved retention schedules; and for authorizing disposal actions (destruction or transfer to the university’s archives) at the end of the retention period.
- The University Records Manager is responsible for designing and promoting compliance with the university’s records management program, and for providing guidance on good records management practice to university employees.
- The Freedom of Information & Privacy Coordinator is responsible for guidance concerning the statutory requirements of Ontario's Freedom of Information and Protection of Privacy Act.
- The university archives is responsible for preserving and making available as appropriate university records with continuing value once their retention period has expired.
- Individual employees must ensure that records for which they are responsible are managed in accordance with the university’s records-related policies, procedures, and guidelines.
Policy 12: Records Management applies to all university records. Most documents and other information created, used, and received by university employees in the course of carrying out their job responsibilities are university records. Examples of university activities and transactions which produce records:
- Meetings and other decision-making activities
- Policy making, planning, evaluating, reviewing, and reporting
- Interactions with students, clients, consultants, vendors, partners, government agencies, etc.
- Activities related to the law, such as making agreements and contracts, seeking legal advice, and meeting statutory and regulatory requirements
- Financial activities including budgeting, accounting, making and receiving payments, and banking
- Hiring, evaluating, promoting, and providing compensation and benefits to university employees
- Documenting IT systems and procedures
- Marketing and promotional activities
- Making speeches and presentations
University records include, but are not limited to minutes; correspondence (including email, which is correspondence transmitted electronically); memoranda; policies, procedures and guidelines; source financial documents such as purchase orders, invoices, cheques, and grant documentation; publications such as reports, newsletters, pamphlets and brochures; photographs; maps and plans; data in databases.
The following, however, are not university records:
- Faculty members’ and instructors’ research and teaching materials where the intellectual property belongs to the faculty member or instructor. However, records held by faculty members and instructors that they create and receive in the conduct of “assigned tasks” such as student advising, committee work, or program or unit administration are university records (See also Policy 73: Intellectual Property Rights).
- Records of separate corporations such as staff, faculty, and student associations, and independent businesses, such as the bank, and some commercial outlets and child care centres.
- Personal (i.e., not related to university activities) communications and publications of individual employees unless specifically prepared under contract for the university or prepared as part of the individual’s administrative responsibilities. However, records related to university activities stored on personally owned computers, PDAs, or other devices are university records.
- Reference objects such as library, museum, and specimen materials made or acquired solely for reference, research, or exhibition.
Electronic records and images
Although university units may continue to print and maintain paper documents as “official records,” the majority of records are now created and stored in electronic format. Yet, the methods in place to track and retrieve electronic records or to manage their retention and disposal are generally inadequate. Different versions of the same record may be stored on personal computer drives, shared drives, network servers, or e-mail “in” boxes, making it difficult to locate the official version. Controls to prevent unauthorized or accidental altering or deleting of records are lacking. For electronic records, including electronic images of records originally in another format, to be credible as official university records and to be admissible as evidence in legal proceedings, they have to be captured and maintained in electronic systems that meet statutory requirements and standards for electronic records. These include the Canada and Ontario Evidence Acts, various statutes and regulations pertaining to particular types of records, as well as the Canadian national standards Electronic Records as Documentary Evidence (CAN/CGSB-72.34-2005) and Microfilm and Electronic Images as Documentary Evidence (CAN/CGSB-72.11-93). These standards address issues such as senior management authorization for keeping electronic records, system documentation, security and protection, indexing, audit trails, quality control, and deletion of records. In addition, where electronic records must be retained for long periods or permanently, an appropriate preservation strategy must be developed. Electronic images created and maintained solely as copies are not subject to these requirements.
Confidential records (i.e., records subject to a security classification as defined in Policy 8: Information Security) must be protected against unauthorized access or disclosure. These records include, but are not limited to, most personal information (i.e., information about an identified individual) unless it is public information; information supplied in confidence, explicitly or implicitly, by a third-party; records of closed meetings; commercially sensitive information; and institutional plans, policies, and projects while in development.
Records have a lifecycle which runs from their creation and active use to their final disposition at the end of an approved retention period.
Active records are records which are in current use and need to be accessed frequently or on a regular basis. Records in active use should be kept in or near the unit’s workspace.
Semi-active or inactive records are records which are needed infrequently or never for operational use but which must be retained for a certain length of time to meet statutory, fiscal, or other requirements. Records that are semi-active or inactive may be stored for the duration of the retention period.
WatCLASS: the University of Waterloo Records Classification and Retention Schedule provides a framework for organizing university records according to the functions and activities they support, rather than according to the department or unit that creates and maintains them. This framework ensures that university records common to more than one unit are managed consistently across the university. For example, the function “Human Resources” encompasses the human resources records (e.g., staff employment files, faculty employment files, faculty hiring committee records, etc.) of any university unit not just those kept by the organizational unit called Human Resources. Units are encouraged to develop a file plan for their records (both paper and electronic) based on WatCLASS.
Retention and disposition of records
Retention and disposition refer to how long to keep records and what to do with them when the retention period ends. The retention and disposition of university records is governed by WatCLASS. WatCLASS identifies the records kept in university units by the function or activity that the records support (e.g., student recruitment records support the activity of recruiting students within the broad function of Student Management). Each records class within WatCLASS has an approved schedule which details the retention period and disposition for that class of records, and identifies the unit(s) with primary responsibility for those records (i.e., the unit(s) that are principally accountable for their creation and/or maintenance). Since WatCLASS is under development and it will be some time before all retention and disposition schedules are approved for use, units wishing to dispose of records which do not yet have an approved schedule should consult with the University Records Manager.
Retention is the length of time the records must be kept in the custody of the responsible unit. The retention period may be a simple length of time (e.g., 7 years for many financial records) or may be triggered by an event (e.g., 3 years after an individual ceases employment with the University, 5 years after a student graduates or withdraws). In cases where it is appropriate for records to be kept indefinitely or permanently by the unit, the retention period will be “indefinite” or “permanent.” Retention periods are determined by the statutory, fiscal, contractual, and operational requirements that apply to a particular class of records, including the requirements set out by university policies, procedures, and guidelines.
At the end of the retention period, records must be disposed of in an authorized manner. Keeping records longer than necessary is a liability to the university; it is costly in terms of space and time and complicates the university’s compliance with the Freedom of Information and Protection of Privacy Act. One of the following four dispositions will apply to most university records:
The disposition “Destruction” means that the records have no further value to the university and they must be destroyed by a method that suits the medium, whether paper or electronic. Methods might include shredding, recycling, deleting, or overwriting. Note that at the end of the retention period all copies of records including paper and electronic, must be destroyed. Backups of electronic records must be destroyed as soon after the end of the retention period as is reasonably practical, with clearly articulated timelines specifying when this will occur.
The disposition “Secure Destruction” applies to confidential records (i.e., those subject to a security classification). These records require special safeguards to ensure that security is protected during the destruction process and that the records are completely destroyed with no possibility of recovery or reconstruction.
The disposition “Archives”means that the records are likely to have continuing historical or evidential value. The originating unit will transfer custody and control of the records in their entirety to the archives.
The disposition “Archives Selection”means that some of the records have, or may have, continuing historical or evidential value. For example,particular kinds of records or a sample of the records may need to be transferred to archives. Where WatCLASS does not include specific instructions for what should be transferred to archives and what destroyed, units should consult with the archives concerning the disposition of the records.
Units identified as having primary responsibility for particular records must ensure that a record is kept of those records destroyed or transferred to archives.
Transitory records are records which are required for a limited time to complete a routine action, are used in the preparation of final records, or are retained as information or convenience copies by offices or individuals who do not have primary responsibility for them.
The following are examples of transitory records:
- Working documents, such as drafts or preliminary versions, and supporting materials used in the preparation of final documents, such as reports, contracts, academic calendars, policies and procedures, letters and memos
- Committee agendas and minutes held by units on a distribution list or by committee members other than the committee chair/secretary
- Copies of records retained when the original is sent to another unit (e.g., a copy of an invoice sent to Finance for payment)
- Electronic files retained when a printed copy has been made and filed as the official record
- Printouts and extracts from databases
- “cc”, “bcc”, or FYI copies kept only for convenience or information
- Announcements and notices of a general nature
- Routine emails to schedule or confirm meetings or events
- Stocks of publications or forms
Transitory records are identified in WatCLASS only if a specific retention rule applies to them, usually to ensure that copies of records which contain sensitive personal or other confidential information are disposed of as soon as possible. The general rule of thumb is to retain transitory records only while there is an operational need and to ensure they are destroyed before the end of the retention period which applies to the primary record. However, how long to keep transitory records is often a matter of judgment. Records relating to legal documents, for example, may need to be retained to document how the final agreement was reached. A printout may be an important snapshot record of a database at a particular time.
Legal requirements supersede any and all university policies authorizing destruction of records, including the authority granted in approved retention schedules. If the content of a record is related to actual or pending litigation or government investigation, it may not be destroyed without the expressed permission of the Secretary of the University. This restriction begins from the moment when any employee gains knowledge that legal action or a government investigation is reasonably foreseeable, and remains in effect until removed by the Secretary of the University.
Employees requiring advice or assistance with managing university records should contact the University Records Manager.