One of the things that regularly comes up in discussions with customers is the question 'Why can't I just use SharePoint as my information AND compliance platform?'
The answer isn't straightforward, and for some customers the features provided may address enough requirements that it is a viable solution. But, in my personal opinion, it is not the right choice for those serious about governance, compliance, Information Management and Records Management. Remember, this is NOT a marketing blog, so I'm not about to go about positioning SharePoint and HP TRIM. However, what I am going to do is write a handful of posts which explore the shortcomings of using SharePoint as a one-stop-shop for all of these requirements. Note that I have a lot of positive things to Say about SharePoint too, otherwise I wouldn't have dedicated the last 5 years to working with it. But in some areas it does need tools to extend & enhance its capabilities, and this is the core focus of what we do on the integration team.
For the first article, I'm going to focus on the Records Center.
The Records Center is a SharePoint site template specifically designed to contain records. Best practice defines that a records center be created as a site collection, meaning it gets its own content database, and is separate from other corporate SharePoint sites. It allows organisations to create a hierarchical structure, or file plan, providing management of access, audit, retention etc. As a separate site, it must be configured and managed separately, including users and groups for access and security.
Records can be added by users clicking the “Submit a Record” button, or if content is already in SharePoint there is an option to “Send to Records Center”, which can be configured to leave a link to the record in the original location. Multiple Records Centers can be configured if required.
Records added to the Records Center are initially placed in a document library named “Drop-Off Library”. At this point they are subject to Content Organizer rules. Content Organizer rules determine the final location of a record, based on its content type and metadata. If a matching Content Organizer rule is found for an incoming record, it is automatically moved to its final destination. If no Content Organizer rules are applicable then the record will remain in the Drop-Off Library until correctly classified by a records manager. An overview of Content Organizer rules is given below.
The Drop-Off Library
Note that for rules that don’t match an item in the Drop-Off Library, a Records Manager will need to set specific metadata on that item in order for it to be correctly classified and routed. The Content Organiser typically runs once a day (As a scheduled event/timer job) for items that don’t match a rule, so the item will remain in the Drop-Off Library until this happens.
Incoming records are also assigned a unique document ID, which is retained even if the document moves location. This ID can be used to search for the record in future.
Scarily, a document that has been declared as a record, but which hasn’t yet been routed out of the Drop-Off Library (Because rules haven’t been matched) is still editable, documents are not locked down until they reach their Record Library destination.
The File Plan
The file plan is essentially a number of document libraries, with a hierarchical folder structure in each library.
There is only a limited amount of reference material available on creation of a file plan in SharePoint 2010, but it appears that best practice dictates that you create a Record Library (Document Library) for each top level and then create folder structure inside each library for lower levels.
Retention is then applied, based on which folder the record ends up in, as opposed to the content type of the record.
Note - I’ll be delving deeper into retention, content types and libraries in a future post
In the welcome page above I have created a Legal Services record library and have created a folder structure within that defines the hierarchy or classification.
A Records Library is a document library but with a Records Management slant. It is available in the Records Center site and has the following configuration elements added:
- Automatic Declaration Enabled - This document library setting, found in ‘Library Settings -> Record Declaration Settings ->Automatic Declaration’ ensures that any items that end up in this library are declared as records
- Source of Retention is Library and Folders - Normally for a document library the source of retention is the Content Type but for a Records Library this has been changed to Library and Folders
The Content Organiser is simply a rules engine that can be used to move content in SharePoint to the appropriate location automatically.
In the Records Center, Content Organiser rules specify the target location for records, based on their content type and metadata. The target location may be a record library or a folder within a record library.
Rules need to be set for each content type and if multiple conditions are set on metadata then they must all match for the rule to be applied.
Note that rules have to be defined per content type. So, if you have configured 30 Content Types (Contract, Internal Memo, Intel Report, Project Summary etc.) but want to route documents based on a piece of common metadata e.g. Department, then you have to create a separate rule for each of the 30 content types.
There are a number of fundamental limitations with SharePoint and the Record Center:
- Document Centric – Only electronic documents can be sent to the Records Center. Any other list content cannot be routed here, and therefore cannot be kept in context with documents, nor have retention applied. This is very restrictive and doesn’t allow capture of information which could fit the criteria of a record
- No Support for Document Sets – Document Sets cannot be routed to the Records Center, therefore preventing management and retention of compound documents
- Retention – Only very basic retention capability, in terms of schedule management, triggering and review. Described in detail later in this document
- Document Routing – Users cannot choose where to put documents in the file plan; all documents are automatically routed based on defined Content Organiser rules in the Records Center Drop-Off Library
- Document Create Date - SharePoint continues to use the upload date of the document as the create date, and there is no easy (or Microsoft-supported) way to change this behaviour. Sending a document to the Records Center also modifies the create date. Managing records over years/decades requires that the create date of the record not change just because the storage location is altered, or the record is moved from one repository to another. This completely breaks retention based on document create date.
- Document Metadata – Metadata is not maintained separate enough from the document itself, meaning that if document metadata is edited, it changes the last modified date of both the document and the metadata. This prevents editing record metadata without also making the record look as if it was modified too.
- Tracking Metadata - Marking a record un-editable (read-only) also prevents editing of the document’s metadata, which in turn prevents tracking records management activity of the record over its life (changing active record steward, for example, or current Office of Record). Proper records management simply requires that metadata about a record be alterable, while maintaining proof that the record itself has not been altered.
I will be exploring some of these areas in even more detail in future posts, so stay tuned!