The development of legally acceptable retention and disposition processes is arduous and time-consuming, but the ability to make records available according to specifically mandated periods of time is crucial. Keeping materials too long can be costly and burdensome while not keeping the materials long enough can pose a risk of loss or sanction from a legal standpoint. Any records and information technology implementation (hardware and software applications) must provide for the accurate and detailed inventory of all record types, the ability to establish defined retention periods, and the ability to tightly govern and manage the processes for permanent disposition, including archiving, releasing, or eliminating information.

When establishing an organization's records process and controls, consideration should be given to the following critical questions:

• Does the business activity classification system used by your organization include a three-level hierarchy specifying general business function, activities comprising each business function, and transactions or records associated with those activities?
• Has the business activity classification system been constructed with primary input from employees and managers who are charged with creating and managing existing records?
• Has an authorized vocabulary list or list of basic defined terms been compiled and published for use by your employees?
• Have records retention determinations been based on the following?:

o Legal, regulatory, and administrative requirements.
o Use of existing record types, including their use in the creation of other records and/or systems.
o Internal/external influences such as the interests of various stakeholders.
o Comparisons to records reflecting similar activities within the system.

• Has a security and access classification been applied to all records that take into account key considerations such as personal privacy, intellectual property rights and commercial confidentiality, national security issues, legal and other professional authorizations?
• Are all critical processes included in the organization's existing records management framework, such as collection, metadata identification and preservation, classification, access and security, storage, tracking, temporary and permanent disposition?
• Are the storage and handling technology selections for organizational records based on the appropriate key factors?
• Have appropriate technology choices been made to ensure retention, preservation, and continuing access to those records with long-term duration?