Data Compliance - Thoughts from seat 10D

I was recently cleaning out my carry case and noticed among the minutes of the previous meeting or two, some good old SAP OSS notes in hardcopy that have been like friends to me, a shopping list, and various other SAP white papers and guides…I’ve recently been toting around some dog eared Records Retention Policy schedules.

I’ve been carrying around hard copy of the Retention Policy because it has been very useful to have ready at hand. The rules on that policy can decide an issue, shape a discussion, launch a workshop, and protect your work.

A couple years ago in the Data Archiving / ILM projects market, the records retention policy was something we would ask the client to produce and if they could, we would try to get someone to help us map the policy to an SAP activity with the goal of being better able to manage the data destruction when the time comes, almost as if we’d still be around to help them implement the retention policy…hahah!

Most clients didn’t have a policy or if they did, no one really knew what it meant nor certainly was it mapped to SAP transactions. Deepak (Director ILM Services Auritas) and I were at a client a couple of summers ago and could not believe that the invitees to a Retention Policy meeting all showed up. In the back, there was a manager from Internal Audit, a middle aged woman who probably smoked a pack a day since she was six and had the voice of Keith Richards. Up front, an older gentlemen in white shirt and bow tie with the faintest imprint on his temples that suggested he wore a green eye shade (or maybe my memory is filling that bit in) who had just recently updated the corporate records retention policy. A couple seats over from him a young woman from legal probably a two months away from taking the bar for that state, one of the “new” corporate lawyers. Deepak and I thought we hit a home run and we were going to fully implement the retention policy. The reality was none of them (or their department’s) had ever really spoke to the other before coming to our meeting. The result was the Internal Audit lady and the gentleman from Records Retention engaged in a full out war while the lawyer almost shrank under the chair. It was not the client’s most shining moment. As a result they never came together and finalized in the remaining time Auritas was on the project…like old bankers boxes in the attic, I imagine the SAP data will remain in their SAP archive for a very long time…

I retell this story to highlight that it not as simple as it sounds to have a published retention policy to work from. Especially in a global company you can pretty much forget about jurisdictions other than US, Canada, UK, Germany, etc. And even if you have a retention policy from legal as an ILM consultant can we be sure that the policy has been vetted by the various process teams, business owners, or tax?

So why am I talking today about Data Compliance and records retention. I guess in a way to relieve some stress. Every now and again you just come across a team that does not have the best interest of your project at heart (and who can blame them really). But when you get that old stubborn geezer from Production Planning who tells you he needs all the Production Planning data on the live data base for 5 years (and the retention policy say maximum 3 years) it can really make your day when you can say “…well Mr. Smith you would need to get sign off from your legal team to keep data that long” and see how quickly that “…can’t budge on 5 years decision” becomes renegotiable! Gotcha! But on to serious matters…

Previously and in many cases still today, most archiving projects are driven from a performance or cost motivator. There has always been the occasional client that has needed to use archiving tools and methodology to support a corporate policy such as a divestiture, legal discovery, or tax presentation. These projects typically included all data including master data around a certain customer, vendor, account etc. and can be quite complex and involve other issues and project teams.

But now 8 years on from Y2K and the corporate scandals of the late 1990s that resulted in some real hurt to employees, investors, and any faith in a US corporate code of ethics we got what we deserved although typical government broad brush knee jerk. As a result of the subsequent rules imposed from federal agencies and SOX legislation around data, we now find that Data Retention and ILM are finding their rightful place in receiving project dollars to help meet the requirements and manage the data lifecycle. Archiving projects that result from this level of corporate “concern” are very likely to have a strong mandate and senior level support, something always required in a successful data archiving implementation.

On a recent client, the “cleanup phase” for some of the archiving objects were straight to the purge directory since the data was past its retention policy period. As simple to implement as IDOCs really! There are a number of new approaches that can be considered when reviewing residence period vs. retention period. At Auritas, we consider the time between residence and retention and if that is less then one year we will help determine the best use of the storage resources. I’ve recently implemented what I’m calling a temporary archive that has full DR but does not use the external storage system. Think of the example of Material Goods movements or for those of you who speak SAP Archiving, MATBEL. The client’s retention requirement is 3 years and the residence requirement is 180 days. Is it satisfactory that for the 2 ½ years the data is in the archive that it can remain on the file system? I don’t know for your project but the question is valid and is a quantifiable factor in TCO and ROI of the project.

So, as an IT Manager you may feel like having a heart attack the next time the phone rings and its from the Legal team at corporate headquarters, but just think…this may be the first IT project requested from legal EVER so be gentle. But as I stated before you’ll have a pretty big stick to help Mr Smith put some thought towards what he needs vs. what he wants.

Tim, Senior Consultant
5/19/2008

If anyone is interested in additional discussion around Data Retention and ILM in the SAP Environment please contact the Auritas Sales team. Demonstrations of mapping a retention policy to an SAP implementation are available through the Sales team.