Document management vs. records management

Doing business today means working with all different kinds of content.

From nondisclosure agreements and marketing materials, to onboarding agreements, product specs, and sales decks, content powers every process. With multiple teams working on the same pieces of content and multiple eyes reviewing that content, you need an efficient system for organizing and managing it all. 

Document management can help your organization control all its content, and records management helps ensure your information stays confidential and secure. While there is some overlap between the two, document and records management are distinct. Learn more about records management and document management to see if your organization can benefit from one or both.

What is document management?

Document management is the process of organizing and controlling your organization's documents. According to the International Organization for Standardization (ISO), documents fall under the category of "documented information," which also includes records. ISO 9000:2015 section 3.8.6 defines documented information as information that has to be controlled and maintained by an organization — including the medium it's contained in. 

Under this definition, documents are defined as "information created for the organization to operate." Per the standard, documents can take any format, come from any source, and be of any media type. The ISO also has a separate definition of a document, in section 3.8.5: information and the medium that contains it.

With that in mind, here's a partial list of materials that fall into the category of documents:

• Emails that acknowledge receipt of an invoice or confirm an appointment time
• To-do lists
• Draft communications
• Contracts
• Marketing copy
• Product descriptions and specifications
• Executive orders
• Wills
• Invoices

A document can be in any media format, including:

• Photographs
• Video
• Text
• Paper

Organizations have countless documents in many formats. These documents evolve as people edit or alter them. It's important to keep track of documents to ensure they don't get lost and unauthorized changes don't get passed along. That's where having a document management system can prove invaluable. 

Even if you don't have an official document management system in place, you likely use some form of document management each day. However, without a strong system, it's easy for documents to get lost in the shuffle. Managing documents without an effective system can be time-consuming and frustrating. That's why you need to set up a formal document management process to effectively and efficiently organize your documents.

Document management process

The document management process typically involves multiple steps, from creating a document to its eventual storage. The process looks something like this.

1. Creation

How a document gets created depends on the media used and the format of the file. If it's a text-based document, creation can involve opening and saving a word processing document. If it's a video or image-based document, creation can involve uploading video or image files to the document management system.

2. Drafting and review

The created document gets shared with collaborators, who might add edits or comments. Ideally, the document management process will allow collaborators to work on the same document without overriding each other's work. Features like track changes and document locking help to minimize mistakes and streamline the collaborative process. Document version control makes it easy to go back and see what changes were made and by whom.

A document management system can also include automation that makes it easy to review documents. Automated features might include auto-tags on files and spelling or grammar checkers. 

Depending on the organization and the number of people working on the document, the drafting and review process might be ongoing. Once team A has made their edits, they might pass the document to team B, who might pass it to team C before it is ready for the next phase.

3. Assembly and approval

Some documents are more complex than others and might need to be assembled before they are complete. A document management system can assemble a document using custom metadata so all related pages are included. The assembly process can ensure the document meets any regulatory requirements and abides by the company's standards. For example, an employment contract or nondisclosure agreement might need to contain certain clauses to be valid.

Once the document is drafted and assembled, the next step is approval. The approval process can involve collecting signatures on the document. An organization can use e-signature software to streamline this step.

4. Storage and access

Approved documents need to live somewhere. In the past, it was common to print out paper versions or gather physical copies of documents in the form of tapes, DVDs, or photographs. Physical formats need a physical location for storage, such as a filing room or off-site storage facility.

Cloud storage eliminates the need for physical filing cabinets and a dedicated room or facility. A cloud-based document management system means a user can access a document from almost anywhere and the document can be downloaded on any internet-connected device. 

5. Disposal

While some documents need to live forever, not all do. A document management system should include an effective option for deleting or disposing of documents that are no longer needed (or that must be deleted to comply with regulation or policy). Based on your organization's industry and compliance regulations, your system should comply with any disposition requirements that might apply.

What is records management?

A record is slightly different from a document.. Records, according to ISO 9000:2015, are documents that provide evidence of activities performed or that state results achieved. They can be used as evidence of verification, corrective action, or preventive action. They can also formalize traceability.

The United Nations (U.N.) defines a record as "information created, received, and maintained as evidence and information by an organization or person, pursuance of legal obligations or in the transaction of business.” 

Examples of records include:

• Confirmation emails
• Spreadsheets with budgetary decisions
• Photographs
• Final reports

One way to differentiate between records and documents is that records are generally more formal than documents. They need to be managed much closely, as they can act as a form of evidence if needed. While a document can continue to evolve over the course of its life, a record is complete. Once a piece of content has been called a record, there is no way to change it without creating a new, separate record.

How long an organization needs to keep records depends on their industry and the laws governing it. In some instances, records need to be kept permanently. In others, they can be deleted after a certain number of years or at a client's request. In the U.S., laws govern the proper disposal of records. In the financial industry, the Securities and Exchange Commission has rules regarding creating and disposing of records. The Health Insurance Portability and Accountability Act (HIPAA) outlines rules and regulations for creating, storing, and disposing of medical records.

The General Data Protection Regulation (GDPR) was passed by the European Union (EU) and has far-reaching effects. Even if your organization isn't based in Europe, it may still have to comply with the rules of the GDPR when it comes to records management, particularly if it works with clients or companies in the EU.

Records management process

Initially, the records management process is similar to the documents management process. It involves the following:

1. Creation

Records often begin their lives as documents. They can take many forms, such as contracts, photos, and videos. Depending on the type of record, there might be multiple components that need to be created. For example, a medical record might include X-rays of a patient, a written medical history, a list of medications, and written or audio commentary from a physician. A record of an auto accident might include the police report, recordings of eyewitnesses, and photos of the damage. 

2. Drafting, review, and revision

Depending on the type of record being created, there might be a drafting, review, and revision process, just as there is during document management. At this point, it's important to assign user permissions and track who is working on the record at any time to avoid overriding edits and keep the record as accurate as possible.

3. Approval

A record might also need to be approved, which can take multiple forms. For instance, the appropriate parties can sign the record or a court can approve it.

4. Storage

Records need to be stored securely to protect their integrity. Often, a retention schedule is connected to records storage. Depending on the record type, an organization might need to retain it for months, a year, or forever. The retention schedule would also determine where a record is stored. 

For example, say a university needs to store student records. How long the school keeps each record is determined by the relationship the school had with the student. Applicant records for students who applied but weren’t accepted typically don't need to be retained for long. A school might store their records for a year, then archive or dispose of them. 

The records of students who are accepted to the university and who graduate from the school should be handled differently. Often, the school will store those records indefinitely or for many years after graduation.

5. Disposal

Although there are rules regarding how long an organization needs to keep records, they don't necessarily last forever. Records can be disposed of when the time is right. An organization's record management system should outline the proper steps for disposing of records to ensure the process is handled correctly. 

Capabilities of records management

An effective records management system needs to have certain capabilities to ensure compliance. The capabilities should be customizable based on your organization's industry and needs. They include:

• Record registration: After creation, a record is assigned a unique identifier, ensuring consistency throughout its life
• Stringent access controls: Records might need to be restricted, meaning only users with certain permission levels can edit or access them
• Retention rules: A records management system needs rules that define how long records can be kept, where they should be stored, and the disposal process at the end of a record's lifecycle
• Audit functionality: Audits show how the records were created, who handled them, how they were stored, and how they were disposed of

What makes document and records management different?

One way to think about the difference between records management and document management is that while all records are documents, not all documents are records. The process of managing each depends largely on understanding that difference. Other differences between the two include:

1. Their goals

Documents and records management have different goals. An organization looking for a document management system is likely looking for a solution for all its content. Your organization might be swimming in content, including things such as contracts, marketing videos, social media posts, and product ideas. A document management system aims to help you efficiently manage all of that content, so you know exactly who's edited what, what stage a piece of content is at in its lifecycle, and where the content is stored. 

The goal of records management is often to ensure that an organization complies with any laws about the records. In many cases, complying with laws means ensuring the records are kept confidential and secure. Using a records management system also helps your organization avoid penalties for violating the regulations relating to the proper storage, retention, and disposal of records.

2. Their methodologies

Usually, a document management system puts content first and foremost. A user searching for a document might use certain keywords. Since content is key in document management, the system might sort documents based on the project or person who created it. 

A records management system is usually focused on context more than content. Someone accessing an organization's records might be more concerned with finding a particular record type, such as an employment contract or evidence from an auto accident, than they are about the record's specific content. For instance, they might need a contract to prove a person started working on a particular date, or they might require accident photos to show to a jury during a trial. 

Someone looking for a record typically understands they can't make changes to it the way they might change a contract draft. Once an employment contract is signed, it's no longer alterable. Once photographs have become evidence, they can't be altered.

3. Storage

Another notable difference between a document management system and a records management system is how each one stores documented information. With a document management system, the goal is usually to store documents so that they are easily accessible by the people who need to use them. A user could quickly check out a document from a cloud-based document management system, either from their work computer or their laptop at home. They could make changes to it before checking it back in. 

If another user needs access to the same document, they can get to it from their own computer, either in the office or at home. They can review the version history to see what changes another user made and continue to edit as needed.

Records management systems usually have stricter storage requirements. Records are often stored in a format that can't be edited, since the goal is compliance rather than content management. Since context is critical for records management, records are usually stored with other relevant records. The rules governing what records need to be kept, and where, are usually determined by outside agencies.

4. Security

Security is important for both records and document management, but the form security takes is slightly different in each case. Document management is often more concerned with keeping content secure and accessible to the right users. Keeping a document secure can involve setting permissions on it and controlling who can do what to it.

With records management, security involves protecting the integrity of the record. That means controlling who can access it and ensuring the system you use complies with the security requirements of any relevant regulations, such as the GDPR or HIPAA.

5. Disposal

The disposal process often differs for documents and records. For documents, disposal might be as simple as hitting delete when a piece of content is no longer needed. Another option is to archive documents that your organization no longer needs, moving them to an off-site location or putting them in a less accessible area of your document management system. That way, the content is still retrievable if you need it later, but it's not taking up valuable space onsite or in the cloud.

Disposing of records is often more complex. Depending on the regulations that apply, you may need to ensure the records are disposed of so they are completely inaccessible to others. In some cases, the records can't be destroyed or deleted, but instead need to be placed in an archive or deep storage. 

How Box can help you with document management 

Box is a cloud-native document management platform that streamlines the process of creating and collaborating on content. Your team can access your content from any device with confidence that your documents are fully secure. With Box, you can collaborate with anyone, including both team members and outside users. Our platform keeps track of version history so you can see who made what change and when. You can also comment on documents and share links. 

If your organization has preferred apps, such as the Google Workspace or Microsoft 365, teams can easily use them with Box. Our platform seamlessly integrates with other systems and applications, empowering you to increase productivity while ensuring no documents get left behind.

The capabilities of our document management platform include:

• Content creation
• Collaboration and editing
• Organization and classification
• Automated workflows
• Insight extraction
• Storage and access
• Security and control
• Retention and disposal
• Integration with other apps
• Embedded apps

Learn more about what Box has to offer

With every business process today relying on content, you need one secure platform that empowers you to manage the entire content lifecycle and collaborate with ease. Document management is just one of the collaboration tools available in the Content Cloud. Contact us to schedule a demo today.

**While we maintain our steadfast commitment to offering products and services with best-in-class privacy, security, and compliance, the information provided in this blogpost is not intended to constitute legal advice. We strongly encourage prospective and current customers to perform their own due diligence when assessing compliance with applicable laws.