So, your maintenance team has requested shred services for the secure bins. On the day of the shred, individuals are coming forward requesting pickup of boxes from their various workstations for shredding. What’s wrong with this picture? How should it be addressed? Would you rate as a purely Awareness issue regarding use of company secure shred bins and proper disposition process?
Sigh, there are days when you want to… Awareness issues never end. It can help on determining where a policy, standard, guideline comes from. The use of shred bins comes from our Information Security folks as it is included in the security standards for handling records. For those holding record review days, our event guideline is to order bins for the day to be placed throughout the area. But nothing can help those who don’t read beyond an email’s subject line.
Since this topic is referring to the disposition/destruction of documents, would anyone know what the standard practice is for keeping Credit Card Applications in the United States?
If you mean processing them as a business, first is what does any law state? Probably none exist. I urge caution on what is noted as an “industry practice” or “suggested standard”, etc. as they are often very conservative, often out of fear of being somehow wrong. It’s a credit card application. If no law, ask questions. Once the application is completed who looks at it again and why? Does it have value if an error occurred? What harm would come to the business if deposed of after 30 days? Keep away from retention times that cover the blue moon, are for CYA and some unknown fear.
This is a good topic. We just had this happen and we were looking to dispose of over 100 boxes. Before we got to number 21 there was a stop and desist order. so now we are awaiting guidance to dispose of the other 80.
this is a logical way of looking at it. I couldn’t find anything on an accredited website. I was hoping that someone in the banking industry would have some internal insight on this.
What’s wrong with this picture? All records pertaining to business falls under a retention schedule. All records should have an trigger and a pre-determined date for destruction according to the retention schedule it falls under. To dispose of records without a retention schedule and pre-defined trigger, and a records destruction request approved by Records Management could lead to many legal issues. Individuals need to make sure they have met their retention, trigger and disposition requirements prior to properly dispositing of their records. Not all records disposition is by shredding. Know the facts before you dispose of records.
Let’s remember there is no law that states you must have a retention schedule. It was discussed as an addition to the Federal Sentencing Guidelines but was rejected. Many mid to small companies do not have an RRS. You can dispose to your hearts content as long as you do not violate a law with a retention time requirement. The RRS just makes it easier for folks instead of figuring it out on your own unless you keep everything 50 years or so…
Thanks for the note re Federal Sentencing Guidelines; didn’t know it was rejected. Do you know of places where it is law for organizations to have retention schedules?
I no of no law globally that requires a public or private business to create and maintain a RRS.
Thanks for that note.
There are lots of laws that require businesses to maintain records for specific periods of time, but there isn’t a law that you need to write those periods of time down into a document and call it a Retention Schedule.
Keeping a Retention Schedule is best practice because it’s very hard to keep track of all of the different laws and policies about retention if you don’t have them written down somewhere.
So, for example, if you were doing business in California you would need to follow the following law:
“Duty to maintain and make available records; examination and copying. Each taxpayer which determines its income subject to tax pursuant to sections 25101 or 25110 of the Revenue and Taxation Code for income years beginning on or after January 1, 1994, is required to maintain and make available, upon request, records regarding the determination of the components of any unitary business of which it might be a part, the apportionment factors of such business, the classification of an item of income or loss as business or nonbusiness, and the attribution of income to either foreign jurisdictions of the United States for the taxpayer and related parties under section 882, or Subpart F, or other similar sections of the Internal Revenue Code. Records which are made available are subject to examination and copying pursuant to section 19504 of the Revenue and Taxation Code.”
And you’re required to keep those documents for the following period:
“the period of time in which the taxpayer’s income or franchise tax liability to this state may be subject to adjustment, including all periods in which additional income or franchise taxes may be assessed, but not to exceed eight years from the due date or extended due date of the return”
If you’re not breaking that out, translating it into human-speak, and writing it down on a Retention Schedule, it will be difficult to remember what you’re supposed to be doing.
Agree. The RRS makes it easier for folks. Surprising how many companies do not have one though. That can be due to the cost or limited business presence so asking their attorney and accountant is enough. At some point your business size must make that rather painful. Folks will reference an RRS guidance that some industry associations create. I have found them to be rather over conservative which increases your cost for little gain. No RRS should be built for a blue moon.
I see what you are saying. Many companies do not even have resources to spearhead an RRS, nevertheless it becomes important and vital to have so that everyone in the organization is on the same page. Thus reducing or mitigating risks associated with premature destruction.
but just be ready for the ramifications and losing lawsuits left and right because of improper handling of records, archiving, and destruction.
You are right that there may not be a law requiring a retention schedule for records. It just plain old fashioned common sense to want to protect your records and your business.
Thanks for the reminder.