link to page 2 link to page 2 link to page 3 link to page 4 link to page 6 link to page 7
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
PAC
23 May 2016
Document Management EBA Staff
Document Management Guidance on
documents to be (and not to be)
registered in the EDMS
1. Definition of a Document
2
2. High Level Principle for Documents to be registered in the EDMS
2
3. What does need to be registered
3
4. What is not to be registered
4
5. Supplementary guidance re Emails
6
6. Frequently Asked Questions
7
Document Version History
Version
Date
Author
Description
v.0.1
3 May 2016
Initial draft
Revisions following 1st level
v.0.2
17 May 2016
review – per Comments Log
Revisions following 2nd level
v.1.0
23 May 2016
review – per Comments Log
1
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
1. Definition of a Document
The EBA’s Document Management Policy defines a “document” as any content drawn up or
received by the EBA concerning a matter relating to the policies, activities and decisions falling
within the EBA’s competence and in the framework of its official tasks, in whatever medium
(written on paper or stored in electronic form).
Documents
a)
are received or formally drawn up by the EBA in the course of its activities; and
b)
are likely to require action, follow-up or a reply from the EBA or involve its responsibility;
and
c)
contain important information which is not short-lived.
Important and not short-lived are criteria subject to subtle judgement that will vary with the
content and context of the document.
E-mails may be documents when they meet these tests.
2. High Level Principle for Documents
to be registered in the EDMS
All EBA documents have to be registered in the Electronic Document Management System (EDMS), unless
they are Business Applications, or classified as EU Restricted documents, or items listed in section 4 of this
document
2.1 Document registration
In accordance with the EBA High Level Policy on document management, a document drawn up or received
by the EBA must be registered if it contains important information which is not short-lived and/or may
involve action or follow-up by the EBA or one of its departments.
Not registering such a document could prevent the institution from retrieving it at a later date. Equally, not
registering a document does not mean that it will not be subject to access to documents requirements.
Keeping documents in a working space such as shared drives or electronic mailbox folders does not ensure
their integrity, preservation and retrieval. It is therefore essential that all documents that meet the
registration criteria defined in the policy are registered.
2
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
It should be noted that registering a document does not mean that it will automatically be released in case
of a request for access to documents, as exceptions may well apply.1
2.2 Registration and retrieval
Registering a document ensures its integrity and preservation. This will facilitate its retrieval, both by
enabling a meta-data search and by making it accessible to a larger number of colleagues – as appropriate
to the nature and classification of the document.
An unregistered document is only accessible to a few colleagues, e.g. the sender, the recipient(s).
Registering it makes it accessible to the members of the group which has been granted access to the
document. This can be a unit or a department within the EBA, though the default is to give EBA-wide access
to documents which are both of general interest and do not contain sensitive information.
While the eDMS provides search features including full-text search functionality for most document types,
retrieval of registered documents will still depend critically on the quality of the attribution of appropriate
metadata and classification to the documents when registering.
3. What does need to be registered
Illustration of Externally communicated documents
• Products of an EBA decision-making process (e.g. final version of an EBA report, final version of EBA
annual accounts, final Annual Report, final version of a regulatory product and its impact assessment
and LegisWrite version (where appropriate))Drafts of any of the above at the point at which they needs
cross-unit or cross-project collaboration, or a review/approval (e.g. outside of the initial drafting group,
by HoU, by Director, or sent to an external party etc.), or it is externally circulated.
• Records of meetings of and documents sent to/received from EBA bodies and groups (e.g. BoS, MB,
standing committees, working groups, task forces, Joint Committee, Board of Appeal, Banking
Stakeholder Group)
• All documents published on the EBA Website.
• All documents published on the EBA Extranet.
• All correspondence sent to External Stakeholders, which meets the criteria for a “document”.
• Documents relevant for the EBA’s internal organisation and implementation of the Financial Regulation
and Staff Regulations and related decisions (e.g. Invoices).
• Documents that provide evidence that commit the Authority and/or its units and sections to an action;
that establish or delegate any obligation and responsibility; where staff considers that it is relevant to
maintain the information more than temporarily.
• Nominations to governance structures and substructures of the EBA.
• Any decision taken regarding the publication/sending/or non-publication of EBA products.
• All emails sent to external parties, that contain relevant information and whose storage is crucial to
prove the transmission of information to external parties must be registered (e.g. the email launching a
written procedure and communicating the outcome; an email sent to SCRePol asking for comments on
a TS that will go to BoS for approval; etc.]
– see section 5 for further guidance
• All correspondence received (via email and in paper) which contains information which commit the
EBA to an action and it is necessary, for administrative/legal reasons, to keep evidence of the
request/action and its date.
1 Under Regulation (EC) No 1049/2001 regarding public access to European Parliament, Council and Commission
documents
3
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
• Documents supporting Governing Bodies decisions, including votes,
o relevant for the EBA’s internal organisation and implementation of the Financial Regulation
and Staff Regulations and related decisions;
o relevant for the development of EBA products (e.g. RTS, GL, Opinion, Recommendations,
Reports); including all versions tabled at Subgroup, Standing Committee, Board of Supervisors
and Management Board level;
o that commit the Authority and/or its units and sections to an action;
o that establish or delegate any obligation and responsibility.
• Documents2 containing comments from an EBA Working Group member (e.g. member of BoS, Standing
Committee, Task Force, Working Groups, etc.) to a draft document.
• Any documents where staff considers that it is relevant to maintain the information not only
temporarily.
Illustration of Internal documents
• Management meeting – Agenda, Backing documents and minutes
• Selection and Evaluation Committee (used for Recruitment/Procurement) - Agenda, Backing
documents and minutes; Interview Questions (and Model answers) etc.
• Mission requests - On the basis that as soon as a document needs a level of Review/Approval, that
version should be logged into eDMS.
• Procurement procedure documentation, including contracts and amendments.
4. What is not to be registered
4.1 First Drafts
From initial creation a draft created by an EBA staff member need not be registered in eDMS until it reaches
the point at which it needs cross-unit or cross-project collaboration, or a review/approval (e.g. HoU,
Director), or it is externally circulated.
4.2 Short-lived Documents
• Any other document not relevant for EBA’s mission or responsibilities; including emails that are not
relevant for the documentation of the development of EBA documents.
• Any type of written communication, including emails, which documents minor tasks or arrangements,
e.g. to discuss the organisation of upcoming meetings, procedural questions, or emails within the unit
in the context of the development of products, and/or which have no material impact on the final
outcome laid down in a document or do not require documentation, as they present interim working
results that are recognised within other documents and are not relevant to retrace their origin.
• Private documents of staff members. Staff are reminded that only a reasonable private use of EBA’s
resources can be accepted that does not impair the availability of resources for the professional use
within EBA.
2 It is not necessary to store each and every response as a separate document or version of the eDMS document. The
key requirement is to be able to evidence an audit trail of comments/responses, for example via a template like the
summary one used for BoS/MB written procedures, which is later shared with the BoS/MB and which reflects all those
comments/votes; or similar to the one used by IT for capturing comments from reviews of their document outputs.
These can be stored in eDMS as annexes to the main document.
4
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
4.3 Business Applications
Business Applications (BAs), defined here as “Applications that are developed by end users, usually in a non-
controlled IT environment. Similar to traditional IT applications, BAs automate and facilitate business
processes. Although the most frequently found BAs are spreadsheets, BAs can also include databases,
queries, scripts, or output from various reporting tools. In general a BA is any application that is not
managed and developed in an environment that employs robust IT controls.”
Furthermore, Business Application refers to any application that is important to running your business, but
are not business or mission critical. Business applications can range from large line-of-business systems to
specialized tools. Consider all the applications that run on either client computers or servers, including
commercial off-the-shelf products, customized third-party systems, and internally developed systems.
Business applications should not be business or mission critical and are under the full responsibility of the
business owner. Such applications are very often temporary solutions or prototypes and should not impact
business critical processes or have security needs with classified information.
Such Business Applications and their related files do not need to be registered in eDMS, as they are more
likely to be ‘calculation engines’ or working files that might result in the output of a Report (for example).
Clearly the resulting output may well meet the definition of an EBA Document. Additionally, while many
spreadsheets are BAs, other spreadsheets may still be "documents" which need to be registered.
By contrast, IT application refers to applications that are critical to run the business of EBA. Business
applications can range from large line-of-business systems to specialized tools are managed under the
Infosec guidelines, policies and procedures. Such systems are mainly mission or business critical for EBA and
have a shared responsibility between a data and an application owner.
Such applications are supporting audit functions and therefore it is not necessary to register documents
from these IT applications in EDMS, except when you enhance the output or use it for another purpose
which may then become an EBA Document. For example mailing an output manually to an external
customer, the email becomes an EBA Document in its own right with the content of the output of the IT
application.
IT application contain in most of the cases EU classified information and are reflected in the business
continuity plan of EBA.
The solution for where the BAs are to be hosted will be clarified in a separate document.
4.4 EU Restricted documents
• Documents classified as EU classified information (EUCI)3, and above, e.g. ‘EU Restricted’ must not be
registered.
• Staff who handle EUCI classified documents must familiarise themselves with the requirements of
Commission Decision (EU, Euratom) 2015/444 of 13 March 2015 on the security rules for protecting EU
classified information
.
3 As defined in the EBA Document Classification policy, documents classified as EU RESTRICTED, i.e. information and
material the unauthorised disclosure of which could be disadvantageous to the interests of the European Union or of
one or more of its Member States.
5
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
5. Supplementary guidance re Emails
EBA’s Document Management Policy states:“…Documents may include e-mails.”
E-mails that fall into the definition of “documents” must be registered in the eDMS, rather than stored in
Outlook.
Where an email message has an attachment a decision needs to be made by the Document owner as to
whether the email message, the attachment or both should be registered individually.
The decision on whether an email and/or its attachment needs to be registered depends on the context
within which they were received. It is likely that in most circumstances the attachment should be registered
with the email message as the email message will provide the context within which the attachment was
used.
E.g. There are instances where the email attachment might require further work, in which case it would be
acceptable to register the email message and the attachment together and keep a copy of the attachment
in another location to be worked on. In these circumstances the copy attachment that was used for further
work will become a completely separate document.
E.g. Email from European Commission (EC) in relation to Technical Standards (TS) submitted by the EBA , to
which the EC sought EBA staff response in a short time period, where EC attached proposed revisions to the
submitted TS.
Both the email and its attachment should be recorded on the EDMS with appropriate meta-data Separately,
it is also possible to make use of the Linking functionality which provides an extra means by which
relationships between Documents and their annexes may be shown. However, recording appropriate meta-
data is key as linking alone is not sufficient to ensure adequate search and retrieval criteria.
Encrypted email records - Where is it known that an email has been encrypted it is important that it is
unencrypted prior to capturing it being registered. If an email document is captured without being
unencrypted it is highly likely that there will be problems with accessing the document at a later stage.
Email messages that need to be registered should be captured as soon as possible. Most email messages
will form part of an email conversation chain. Where an email chain has formed as part of a discussion it is
not necessary to capture each new part of the conversation, i.e. every reply, separately. There is no need to
wait until the end of the conversation before capturing the email chain as several subjects might have been
covered. Email chains should be captured as documents at significant points during the conversation, rather
than waiting to the end of the conversation because it might not be apparent when the conversation has
finished.
E.g. Capture the original email and the end of the chain of emails on the EDMS and subject to judgement
record the various responses to the email chain, if they require action, follow-up or a reply from the EBA
and/or a decision which is not short-lived.
6
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
6. Frequently Asked Questions
6.1 Q: At what point does my draft become a document that
needs registering in eDMS ?
A: Providing it meets the definition of an EBA Document, and at the first point at which it needs cross-unit
or cross-project collaboration, or a review/approval (e.g. HoU, outside of the initial drafting group, by
Director, or sent to an external party etc. – refer to section 4).), or it is externally circulated.
6.2 Q: Where do I draft documents before registering them in
eDMS?
A: Documents in early drafting can be created on local, Unit, or Project level workspace – this is to be
defined outside of this document.
6.3 Q: Where a document needs cross-unit collaboration, where
do I work on it?
A: At the point at which at which a Document needs cross-unit or cross-project collaboration, then it can be
registered in eDMS with a status of ‘Draft’, and providing permissions are managed appropriately,
colleagues may ‘Check-out’ the document to make their changes and then ‘Check-in’ the document with
their changes, making it available for other colleagues with appropriate permissions to work on.
6.4 Q: Who manages who can see/edit what document?
A: The Document Owner – i.e. the person who initiates or receives the document and registers it into the
eDMS - has to manage the permissions and the classification level of the Document, i.e. dictates to eDMS
who can Read / Edit the Document. The default permission in eDMS is that documents can be read by all
EBA staff, so it’s critical that documents are classified correctly and assigned with the appropriate
permissions.
6.5 Q: How do I send documents for review from eDMS?
A: The eDMS is capable of providing a URL (Hyperlink) for any registered Document, which can be pasted
into an e-mail. The recipient can then access the Document from that URL providing they’ve been granted
appropriate permissions to that document. Note that this will only work from devices inside of the EBA’s
network – i.e. BlackBerries or iPads are currently not able to access the document from the URL. Where
there is doubt about the recipient’s whereabouts it would be prudent to also send the document as an
attachment.
7
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
6.6 Q: How do I know what kinds of documents I can find in the
eDMS?
A: Every document will be registered in the eDMS with a series of meta-data fields, and each functional
team that generates documents as part of their processes will have developed a specific guideline for that
type of document, detailing what the meta-data values should be. From those a global guideline document
has been developed detailing the meta-data values to search with when seeking a specific type of
document. Of course, whether you can see the document in question depends on whether you’ve been
granted read/edit rights by the Document Owner.
6.7 Q: If a document is to be published on the Intranet /Extranet
/EBA Website, do I still need to register it eDMS?
A: Yes, all EBA documents must be registered on the eDMS, irrespective of whether they are published
elsewhere.
6.8 Q: If a Document is to be published on the
Intranet/Extranet/EBA Website, will eDMS automatically do so?
A: No, this feature will be assessed as to whether could be incorporated into a future release of the tool,
but for the moment it is not available.
6.9 Q: Why is it so important to register work-related e-mails?
A: All official documents, including e-mails, should be registered, to provide an audit trail of the EBA’s
decision making. Moreover emails can be subject to an Access to Documents request. Storing an important
and not short-lived e-mail in an electronic mailbox or on a shared drive is not sufficient because this does
not ensure its integrity and preservation, nor others ability to access it.
In case of an Access to Document request, those e-mails considered as an EBA document should be
retrievable in eDMS, just as other types of documents to be registered in the EDMS.
6.10 Q: Which e-mails should I register?
A: It is impossible to draw up a definitive list or typology of documents with clear and unambiguous rules
for what must be registered and what not. The question of whether or not to register a given document can
only be answered by analysing it in context. This analysis must be applied to all documents, whatever their
medium.
To assist you in your thinking, if the answers to all of the following questions are "yes", then the document
needs to be registered in eDMS.
1. Has the document been "drawn up or received" by the EBA?
A document is considered as "drawn up" if it is approved as ready for transmission by the author,
i.e. the person who signs it or takes responsibility for its content.
8
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
A document is considered as "received" if it has been intentionally delivered to the EBA by the
(external) sender.
2. Is the document related to the policies, activities and decisions falling within the EBA’s scope of
responsibility?
Documents related to one's personal situation must not be registered.
3. Is the information contained in the document important and not short-lived?
Information is unimportant and short-lived if losing it would have no negative administrative or
legal effect for the EBA. A document which requires action or follow-up or involves the
responsibility of the institution is important.
Examples (non-exhaustive)
Yes
No
Drafts (i.e. documents not yet validated by the
Formal notes/communications, both received and
person who will sign them or take responsibility for
sent
them)
E-mails and other texts circulated within an informal
Financial documents
exchange of views between colleagues
Minutes of meetings, especially with other
institutions or external stakeholders, and, for
important meetings, briefings/speaking/defensive
Exchanges on short-lived matters (such as
etc.
invitations)
Information received/sent from/to other institutions
or external stakeholders
Information on one's personal situation
Responses to EBA consultation papers or Discussion
consultations
Responses to EBA- Governing Bodies’ written
procedures
Documents, even e-mails or notes to the file that
attest situations or events, justify decisions made or
otherwise explain the development of official
actions
Instructions notes, guidelines
6.11 Q: If an e-mail had multiple addressees, who registers it ?
A: Assuming it meets the criteria of an EBA Document, and if it relates to a specific EBA body or committee
then the relevant Administrator should so register. In the case of an “orphan” e-mail , i.e. is an EBA
Document but not specific to any EBA body or committee, the Administrator for the most senior person
addressed should so register.
9
DOCUMENT MANAGEMENT: GUIDANCE ON DOCUMENTS TO BE REGISTERED IN THE EDMS
EBA Regular Use
6.12 Q: When do I have to register my document into eDMS ?
A: by the end of the business day that it was deemed to meet the criteria of and “EBA Document”.
10