How to Build a RIM Playbook Part 2 - Develop the Initial List of Plays

This is a brainstorming session based on the discussion with the sponsor and stakeholders. In the article, I noted that organizations should not simply review RIM textbooks and put everything they find into their playbooks. But a RIM textbook could be a useful starting point to make sure you don’t overlook anything because you don’t do it regularly. 

A mature RIM program might have 50 or more plays, and an IG program could include hundreds of plays depending on its scope. We'll talk about documentation, and how to validate the list of plays, in much more depth in the next article in this series. 

The Initial List of Plays

If you’re the one building the playbook, and running the program, there are some obvious RIM plays to include (and perhaps some to definitively exclude at present!). For example, an organization with any formality and maturity to their RIM program would probably have plays for: 

• Reviewing and updating the RIM policy
• Reviewing and updating the records retention schedule
• Conducting regular records disposition processes
• Placing and removing legal holds
• Administering the recordkeeping system(s)
• Sending records to, and retrieving records from, offsite storage
• Updating and delivering RIM training
• Etc. 

Be sure not to overlook plays that are unique to your industry, your organization, or your culture. Most government agencies have to manage some sort of open records request process. Law firms have to deal with matter mobility and managing client files. Financial services and other highly regulated sectors may have unique reporting, monitoring, and even surveillance processes to manage. And these will not be listed in a standard RIM textbook. 

The Granularity of Plays

You should also think about how granular you want to be. Some organizations might have a play called “Send records to offsite storage” and another called “Retrieve records from offsite storage.” Other organizations might lump those together into a single play called “Manage records stored offsite.” 

This also applies to things like reviewing policies, developing and delivering training, or conducting awareness activities, especially if the scope of your playbook is larger than just the RIM program. In other words, do you have a play called “Review and update policies”, or do you have a series of plays called “Review and update RIM policy”, “Review and update Acceptable Use policy”, etc.

Projects vs. Plays

At the same time, don't include projects in your list of plays. For the purposes of this series, I define projects as a "one-and-done" effort with a start and a finish. Plays, on the other hand, are executed repeatedly and generally on a regular cadence. Here are a couple of examples of the difference: 

• Project: Selecting and implementing a new recordkeeping solution 
• Play: Administering the recordkeeping solution

Hopefully you're not selecting and implementing a new recordkeeping solution regularly. But once the implementation project is done and the system goes live, there will be an ongoing need to administer it. 

• Project: Develop the retention schedule from scratch 
• Play: Review and update the retention schedule

Likewise, if you have no retention schedule at all, developing it the first time is a project. Once it's gone live, you should have a regular review and approval cycle which would be a play. 

Next up: Part 3 - Gathering and Reviewing Existing Documentation

I teach a workshop on how to build playbooks - you can find more details about the course and approach at https://athroconsulting.com/?page_id=981. 

I also build playbooks for organizations - drop me a note at jesse.wilkins@athroconsulting.com and let's talk about what that would look like.