White House still under scrutiny for email retention policy
February 22, 2008 at 5:25 pm (archive email, business, citizens for responsibility and ethics, Colleen Kollar-Kotelly, company email policy, corporate, data retention, electronic communication, electronic document retention, Email Archiving, email backup, email compliance, email management, email retention, email security, freedom of information act, Kollar-Kotelly, legal, message archiving, news, politics, white house)
Brian Fonseca of Computerworld reports that “District Court Judge Colleen Kollar-Kotelly this week issued an order enabling the Washington-based Citizens for Responsibility and Ethics watchdog group to perform limited questioning of White House officials.” The group had filed suit against the White House Office of Administration last May “seeking access to White House e-mail under the federal Freedom of Information Act.” The discovery ordered by Kollar-Kotelly was issued to “determine whether the Office of Administration is subject to the Freedom of Information Act.” This will be a situation to keep an eye on as the office contends “it is not subject to FOI requests.” Additionally, Fonseca provided insight from Mike Osterman, president of Black Diamond, Wash.-based Osterman Research Inc., who said: “many businesses operate under the false assumption that e-mail is not a business record. A lot of people are not implementing e-mail archiving [processes]; they’re saving e-mail, but not in a cohesive or consistent way. Companies can say ‘Yes, we need to archive,’ but [the process] must be policy driven and taken out of users’ hands.”
Even though I probably shouldn’t, I still find it fairly remarkable that the White House simply cannot respond about the whereabouts of many missing emails. With the advent of internet technology there seems to be this general attitude that electronic communication does not have to be held up to the same standard as traditional paper documents. Many corporate executives and government officials seem to think they can pretend conversations never happened by simply deleting email backup tapes. In theory paper copies could just be burned up, but it seems that the ease of conveniently “losing” emails is what makes it so much more noticeable. It does not require a lot to act as if nothing ever happened. However, with industry regulations and legal expectations tightening the grip on corporate behavior, abusing the age of email messaging is only going to get harder to do. It is high time for all organizations to integrate an email archiving solution, especially when the center of the American universe is being thrown into the grand spotlight for this exact reason.
Does an employees use of email affect compliance with Sarbanes-Oxley?
February 21, 2008 at 9:09 pm (archive email, business, company email policy, corporate, data retention, Email Archiving, email compliance, email retention, email security, email surveillance, legal, message archiving, news, politics, sarbanes-oxley, sox, thoughts)
According to an article written by Paul Chen for the Sarbanes-Oxley Compliance Journal, the answer is absolutely. Chen discusses how “with regulations like SOX in place, organizations must take special precautions to ensure their employees do not send and receive damaging emails via their workplace account.” However, citing a recent survey on corporate email usage conducted by Harris Interactive, Chen says that “nearly half the people polled say they have sent or received jokes, comical pictures/videos, and stories of a questionable tone, while one in five say they have sent or received a password or log-in information via email.” Amazingly, Chen says that the survey also found that “92% of these employees do not have believe that they have ever sent a risky email, which demonstrates that there is a substantial discrepancy between perceived and actual risks posed by email exchange.”
The Sarbanes-Oxley (SOX) act, as described by Chen, requires all public companies to retain their business records, including email, for at least five years. Since Sarbanes-Oxley does NOT specify which documents are relevant and which are not, it makes the practice of email retention significant for all public companies. Businesses cannot afford to preserve only select electronic communications. But with that being said, I have several questions in regards to the survey conducted by Harris Interactive. If the survey results are truly accurate, what does this say about company email policies? Are organizations effectively communicating the use of business email for personal reasons? How about what language is considered proper? Or how about the tolerance of humor? And if a company DOES have this policy circulating around, then why are so many employees ignoring it? Apathy? No fear of consequences? The survey results say that nearly all the employees polled do not believe that they have ever sent a risky email. Therefore it seems that most employees are not even aware that they are doing anything wrong. I believe that companies need to lay out specific rules within the employee email policy and hold review sessions to make sure that the rules are being followed. Additionally, I think that consequences are necessary and should be mandatory to enforce the rules. With SOX email compliance such a crucial item on the business agenda, more companies should be taking the time to make sure that their employee email policy is stringently regulated.
Simplicato's Weblog 