Bank Moves to Online Records Management
Iron Mountain provides password-protected visibility of document archives along with storage and destruction services
CHALLENGE: Streamlining and automating current processes while supporting full compliance with retention policy
SOLUTION: Implementing IM Connect™, Iron Mountain’s online customer portal, to support best practice and compliance
VALUE: Substantially improved compliance and a clear, instant overview of stored records and their status
The client is the European arm of a global banking group offering personal accounts, private wealth management and business banking.
In the UK, the Financial Services Authority (FSA) strives to limit the risks of identity theft and fraud. Organisations with inadequate data security are exposed to reputational damage and legal penalties including large fines. Major financial institutions such as this banking group must observe compliance rules to the letter. These include strict regulations on the safe storage of confidential information and legally-binding timeframes for document retention and destruction.
The bank has to do its utmost to ensure that documents managed under FSA rules are securely destroyed when required, and those it needs to keep are protected. It had contracts with three document storage providers, including Iron Mountain. Over time this arrangement had generated no fewer than 750 individual accounts across ten departments – a jigsaw puzzle of geographic and functional overlaps.
The bank embarked on a total overhaul of its document management systems in 2008, the year the FSA published its in-depth report on Data Security in Financial Services. To streamline an unwieldy and sometimes chaotic legacy of multiple storage solutions, the bank put a single company-wide tender out to its three existing document management providers. Iron Mountain emerged as the successful bidder.
Iron Mountain gave unstinting support as the bank formulated a detailed transition plan. The Iron Mountain team engaged with the bank’s records retention champions (RRCs) who are responsible for compliance with the company’s records retention policy. The RRCs undertook a complete review of current inventories to ensure that all boxes due for destruction were signed off with the relevant areas within the bank, and that all remaining boxes had a valid destruction date.
Once rationalisation of the archive was achieved, the bank was ready for the introduction of Iron Mountain Connect™ (IM Connect™), an online document management portal that enables users to easily track and locate files.
IM Connect™ combines speed and simplicity of use with the security of individual user accounts and password protection. The security of the portal is underpinned by a requirement to change passwords every 90 days. For added security any user who does not access the system for 30 days is automatically excluded.
The system is also strictly partitioned so users can only access storage data relevant to their departments. For example, an individual from Operations and IT would be unable to access any records relating to HR, Finance, or other areas of the business.
Integrated with the bank’s intranet, IM Connect™ enabled the creation of a system to allow remote access for people working from home. Security is maintained by a firewall separating the two system domains. Iron Mountain also provides a customised monthly reporting dashboard to aid compliance.
All summary data for new records is now entered via IM Connect™ online. In an important change from previous systems, this means that selected information fields, such as expiry date, are mandatory, so that records cannot be logged without the necessary information to make them searchable.
Using classic programme management techniques, Iron Mountain structured the project into three phases. Weekly progress calls (daily at first) kept everyone on track and avoided the possibility of scope-creep. The bank’s relationship manager, recalls: “This collaborative style of working meant that we successfully brought twelve separate business areas on board and kept them fully involved and informed throughout. Without Iron Mountain that just wouldn’t have been possible.”
To enable a smooth transition to the new system, Iron Mountain provided training and support. In just six weeks face-to-face training sessions were held for the more than 1500 bank employees who use the system. In addition, a training guide was created to support remote users.
Simplifying and restructuring the management and storage of documents such as loan agreements, customer correspondence and deeds, has enabled the bank to improve compliance, reduce costs and increase efficiency. Streamlining the system reduced billing administration and the time spent managing the archive, while valuable office space was freed up through the destruction of redundant files.
Now, with the IM Connect™ implementation complete, the bank can be confident that documents logged in its archive have enforced expiry and destruction dates. This enables compliance with FSA and Sarbanes-Oxley regulations (among others) for document retention, while the real risk of time-expired documents straying into the outside world is substantially reduced.
Bank employees also have access to an instant, real-time overview of their records while the company has greater clarity over their archiving costs.
The bank’s relationship manager concludes: “Iron Mountain has helped us impose structure on our storage data, given us complete visibility of what’s happening in our archives, and allowed us to improve control of our costs. From start to finish, Iron Mountain was fully supportive; nothing was too much trouble. In today’s market, that’s remarkable. In my view, they are best in class.”