Electronic records management: rules and solutions

Between tax audits, commercial disputes and the shift to fully digital invoicing, keeping your electronic documents in order is no longer optional. But what is electronic records management exactly, how does it differ from a simple document store, and what do the rules say about how long you must keep records? Here is a concrete explanation, with the standards that matter and the traps to avoid.

What is electronic records management, in practice?

Electronic records management covers the procedures and tools that let you keep digital documents in their original state, securely and for a defined period. We are talking about “fixed” records here: a validated invoice, a signed contract or an issued payslip are not meant to change again. The goal is that they stay readable, intact and admissible throughout their entire retention life.

The technical system that plays this role is often called an electronic archiving system (EAS) or records repository. It does more than file away documents: it logs every deposit, access and operation in an audit trail, and it applies cryptographic mechanisms (hashing, timestamping, sealing) that make any tampering detectable.

How is it different from a document management system?

The confusion is common, because both handle digital documents. A document management system (DMS) deals with “live” documents: they move between teams, go through successive versions and pass through approval workflows. A DMS exists to create, share and quickly find information day to day.

Electronic records management, by contrast, takes over once a document is permanently fixed. It is not there to make collaboration easier, but to preserve proof. Where a DMS favours flexibility (edit, comment, version), a records repository favours immutability and traceability. Many organisations use both in a complementary way: the DMS upstream for the document’s working life, records management downstream for legal retention.

A DMS manages a document while it is alive; records management protects it once it is fixed.

What is the evidential value of a record?

A document has evidential value when it can be produced as proof, for example during an audit or a dispute, with a weight comparable to that of an original. For an electronic record to reach that level, it must combine three fundamental properties:

In concrete terms, evidential value relies on precise technical mechanisms: computing a digital fingerprint (hash) of the file, qualified timestamping, sealing and keeping a proof log. It is this combination, not any particular file format, that lets you demonstrate a document has not moved since it was archived.

How long do you need to keep your documents?

Legal retention periods vary with the nature of the document and the jurisdiction you operate in. They change over time and come with special cases, so it is always best to verify them at the source. As a general and indicative guide, common retention windows include:

• Accounting documents and supporting records: often kept for 7 to 10 years, depending on the country.
• Tax records: frequently a minimum of 6 to 7 years for supporting evidence.
• HR, payroll or contractual documents: variable periods depending on the type of record.

A good records system makes this easier to manage: it lets you apply a retention period per document category and, when the time comes, handle the final disposition of the record (destruction or extended retention) in a logged, auditable way.

Which standards govern electronic records management?

The international reference is ISO 15489, the standard for records management. It sets out the principles and requirements for creating, capturing and managing records so they stay authentic, reliable, usable and complete over time. Alongside it, ISO 14641 specifies the technical and organisational measures an electronic archiving system must meet to preserve the integrity and evidential value of stored documents. In France, the national equivalent is NF Z42-013.

Next to a full archiving system, a digital vault answers a narrower need: keeping a set of documents with strong integrity and confidentiality guarantees. It is a component (payslips, contracts, sensitive records), often offered as a service, rather than a complete lifecycle management system. Do not confuse the two building blocks: the vault is a component, the archiving system is a broader framework covering the whole record lifecycle.

Depending on your sector, extra requirements may apply. Regulated industries such as finance, healthcare or the public sector often add their own retention and audit obligations on top of the general standards. Each activity can carry its own rules, so verify what applies to your context.

Which electronic records management solution should you choose?

Broadly, the approaches fall into three families:

• The dedicated archiving system: a platform specialised in evidential archiving, often certified to ISO 14641, suited to large volumes and strong proof requirements.
• The digital vault: lighter, focused on secure retention of documents (payslips, contracts), usually delivered as a service.
• Built-in modules: some line-of-business tools (invoicing, HR, DMS, support) embed archiving or logged retention features, enough for simpler needs.

Pricing varies widely, usually by stored volume, by number of users, or on a quote basis for enterprise projects. Before you commit, clarify three points: the standards actually covered, reversibility (being able to recover your records in a usable format if you switch providers) and the data hosting location.