You deal with all kinds of sensitive data - mostly client data. As a result, you need to have two policies related to shredding paperwork. One applies to the daily operation of you company. The other is a once per year process for cleaning out old records.
The paperless office will arrive shortly after the paperless bathroom.
Having said that, we are all working to print out fewer and fewer pages as we do our work. First, we realize that we can access the electronic version any time - if we've filed it away properly. Second, we tend to print things and then only use them for a short period of time.
When we're done with the printed paperwork, we either store it some place or dispose of it. It is critical that you do one of these two things. Do not set the paper down when you are finished with it. Either file it or dispose of it. Setting down papers you're done with creates piles that have to be sorted at some later date. Don't do that. The only way to avoid that is to not set down the paper in the first place!
As you do your work, you will have all kinds of papers. These might be contracts, case notes, quotes for clients, checklists, proposals, warranties, etc. You should have a standard process for putting things where they belong. That means that client warranties go in one place, payroll paperwork goes in one place, client contracts go in one place, and so forth.
But MOST of the paper you touch does not need to be kept. If you print out service ticket notes, you only need them for a very short period of time. Unless you hand-write some critical information on them, you can print out a new copy any time. So you should dispose of these. The same is true with quotes for service and almost any document that your company generated. If you can go click-click-click and print another copy, then there's no reason to keep the paper version.
Still, you'll end up keeping a lot of paper. It is what it is.
So now we get to the disposal part. If you're going to file it away, file it. If you're going to dispose of it, there are two options. One is the recycling (or garbage if you don't recycle). The other is shredding.
In an age when grandma shreds her credit card offers when she sorts the mail, you know you need to take this seriously.
Like it or not, there are people who go through the garbage and recycling bins at your office. They're mostly looking for bottles and cans. But a nice juicy list of clients might just be useful. Some people are actively looking for secrets. Others are just smart enough to realize when they've stumbled onto sensitive information.
Really, honestly, no one may ever care about what you throw away. But we live in a weird world. And it would be horrible if your largest client came to you with a paper you threw away that had their name on it. So it's the same as network security: Just have a good policy. Then you'll never have to explain why you don't.
As you and your employees go through your day, you need a very simple policy to determine what goes in the shredding pile vs. recycling or garbage. Some things are really harmless, like pdf's you've downloaded. But here's a short list of the kinds of things you should shred just so they're not out in the bin and they're not your file cabinet:
- Anything with a client name on it
- Ticket/case notes
- Quotes for service
- Contracts
- Anything with a signature
- Anything with financial data
- Anything with usernames, password, or configuration information
You may have very good reasons for keeping these things in files. Great. Do it. Don't leave them lying around the office. Either file it or shred it.
Tis the season to be shredding.
Every year, we have an end-of-year process with our paper files. Basically, we take all of the "this year" files out of our file cabinet and put them into paper file boxes. These boxes sit on shelves for several years. Then one day, most of their contents are shredded.
The basic flow of paper documents over their lifetime is:
- Into file cabinet
- From file cabinet into paper box
- From paper box to either
- - Permanent storage
- - Shredding
Almost everything is shredded at some point.
How long do you keep things? Well . . . there are approximately 7,942,856 articles about this on the Internet. Here's what we do.
In the "live" file cabinet we keep things like current client contracts, current employee records, and this year's bank statements, this year's bills, this year's purchases from vendors. You get the picture. It's basically the stuff for 2013, 2014, 2015, etc. As the new year ticks over, all the year-specific information goes to the paper file. But ongoing contracts of any kind stay in the file cabinet.
All paper files are kept for at least three years. Lots of people might audit us in that time period (the feds, the state, vendors who rely on our reporting of licenses used, and so forth). After that, we only really care about three types paperwork: Taxes, vendor purchases, and contracts that have some element that lasts a long time, such as the right audit.
For us, the taxes we worry about are federal income tax, state income tax, state sales tax, and anything related to employees. Depending on who you talk to, we should these things for three years, five years, seven years, or forever. We make it easy on ourselves and keep it all for seven years. After that, we shred everything we can reconstruct from electronic files or online services.
The big thing we used to keep after seven years was employee-related information. Because we have a tax pro prepare our taxes, we can get the tax stuff whenever we need it. The state sales tax is done online now, so we can get that. Payroll is now totally online, so we don't need to keep that either.
So really, after seven years we keep almost nothing for permanent storage.
Note on Vendor Purchases
One thing we store separately is vendor purchases for hardware, software, and services. I'll have another blog post about the details here, but basically we keep these in binders. You'd be amazing how many times someone has had a question about a four year old server and we got useful information from these binders. But even these have a lifespan.
How Do You Shred?
I used to pay my daughter to shred boxes of documents. Some years she had three boxes of paper to shred. I bought a shredder at Staples and paid for the extended warranty because I knew she'd burn it out - no matter how much I paid. Then I'd replace the shredder and it would be good until the next year. If you go this route, be sure to get a cross-cut shredder. I'm not sure why the old type shredder still exists.
Turns out, that was a really expensive way to do it.
Now we take boxes of shredding to the UPS store and then charge us by the pound. It costs about $20 to shred a full paper filing box. But that's cheaper than paying my daughter $10/hr plus buying a new shredder.
Live and learn.
Comments welcome.
- - - - -
About this Series
SOP Friday - or Standard Operating System Friday - is a series dedicated to helping small computer consulting firms develop the right processes and procedures to create a successful and profitable consulting business.
Find out more about the series, and view the complete "table of contents" for SOP Friday at SmallBizThoughts.com.
- - - - -
Next week's topic: End of Year SOPs
:-)
A Note About the Paperless Office
The paperless office will arrive shortly after the paperless bathroom.
Having said that, we are all working to print out fewer and fewer pages as we do our work. First, we realize that we can access the electronic version any time - if we've filed it away properly. Second, we tend to print things and then only use them for a short period of time.
When we're done with the printed paperwork, we either store it some place or dispose of it. It is critical that you do one of these two things. Do not set the paper down when you are finished with it. Either file it or dispose of it. Setting down papers you're done with creates piles that have to be sorted at some later date. Don't do that. The only way to avoid that is to not set down the paper in the first place!
Why We Shred Almost Everything
As you do your work, you will have all kinds of papers. These might be contracts, case notes, quotes for clients, checklists, proposals, warranties, etc. You should have a standard process for putting things where they belong. That means that client warranties go in one place, payroll paperwork goes in one place, client contracts go in one place, and so forth.
But MOST of the paper you touch does not need to be kept. If you print out service ticket notes, you only need them for a very short period of time. Unless you hand-write some critical information on them, you can print out a new copy any time. So you should dispose of these. The same is true with quotes for service and almost any document that your company generated. If you can go click-click-click and print another copy, then there's no reason to keep the paper version.
Still, you'll end up keeping a lot of paper. It is what it is.
So now we get to the disposal part. If you're going to file it away, file it. If you're going to dispose of it, there are two options. One is the recycling (or garbage if you don't recycle). The other is shredding.
In an age when grandma shreds her credit card offers when she sorts the mail, you know you need to take this seriously.
Like it or not, there are people who go through the garbage and recycling bins at your office. They're mostly looking for bottles and cans. But a nice juicy list of clients might just be useful. Some people are actively looking for secrets. Others are just smart enough to realize when they've stumbled onto sensitive information.
Really, honestly, no one may ever care about what you throw away. But we live in a weird world. And it would be horrible if your largest client came to you with a paper you threw away that had their name on it. So it's the same as network security: Just have a good policy. Then you'll never have to explain why you don't.
Day to Day Shredding Policy
As you and your employees go through your day, you need a very simple policy to determine what goes in the shredding pile vs. recycling or garbage. Some things are really harmless, like pdf's you've downloaded. But here's a short list of the kinds of things you should shred just so they're not out in the bin and they're not your file cabinet:
- Anything with a client name on it
- Ticket/case notes
- Quotes for service
- Contracts
- Anything with a signature
- Anything with financial data
- Anything with usernames, password, or configuration information
You may have very good reasons for keeping these things in files. Great. Do it. Don't leave them lying around the office. Either file it or shred it.
The Annual Shredding Policy
Tis the season to be shredding.
Every year, we have an end-of-year process with our paper files. Basically, we take all of the "this year" files out of our file cabinet and put them into paper file boxes. These boxes sit on shelves for several years. Then one day, most of their contents are shredded.
The basic flow of paper documents over their lifetime is:
- Into file cabinet
- From file cabinet into paper box
- From paper box to either
- - Permanent storage
- - Shredding
Almost everything is shredded at some point.
How long do you keep things? Well . . . there are approximately 7,942,856 articles about this on the Internet. Here's what we do.
In the "live" file cabinet we keep things like current client contracts, current employee records, and this year's bank statements, this year's bills, this year's purchases from vendors. You get the picture. It's basically the stuff for 2013, 2014, 2015, etc. As the new year ticks over, all the year-specific information goes to the paper file. But ongoing contracts of any kind stay in the file cabinet.
All paper files are kept for at least three years. Lots of people might audit us in that time period (the feds, the state, vendors who rely on our reporting of licenses used, and so forth). After that, we only really care about three types paperwork: Taxes, vendor purchases, and contracts that have some element that lasts a long time, such as the right audit.
For us, the taxes we worry about are federal income tax, state income tax, state sales tax, and anything related to employees. Depending on who you talk to, we should these things for three years, five years, seven years, or forever. We make it easy on ourselves and keep it all for seven years. After that, we shred everything we can reconstruct from electronic files or online services.
The big thing we used to keep after seven years was employee-related information. Because we have a tax pro prepare our taxes, we can get the tax stuff whenever we need it. The state sales tax is done online now, so we can get that. Payroll is now totally online, so we don't need to keep that either.
So really, after seven years we keep almost nothing for permanent storage.
Note on Vendor Purchases
One thing we store separately is vendor purchases for hardware, software, and services. I'll have another blog post about the details here, but basically we keep these in binders. You'd be amazing how many times someone has had a question about a four year old server and we got useful information from these binders. But even these have a lifespan.
How Do You Shred?
I used to pay my daughter to shred boxes of documents. Some years she had three boxes of paper to shred. I bought a shredder at Staples and paid for the extended warranty because I knew she'd burn it out - no matter how much I paid. Then I'd replace the shredder and it would be good until the next year. If you go this route, be sure to get a cross-cut shredder. I'm not sure why the old type shredder still exists.
Turns out, that was a really expensive way to do it.
Now we take boxes of shredding to the UPS store and then charge us by the pound. It costs about $20 to shred a full paper filing box. But that's cheaper than paying my daughter $10/hr plus buying a new shredder.
Live and learn.
Comments welcome.
- - - - -
About this Series
SOP Friday - or Standard Operating System Friday - is a series dedicated to helping small computer consulting firms develop the right processes and procedures to create a successful and profitable consulting business.
Find out more about the series, and view the complete "table of contents" for SOP Friday at SmallBizThoughts.com.
- - - - -
Next week's topic: End of Year SOPs
:-)
On that last note, I don't believe in outsourcing shredding, ever, no matter how cheap it is. If it is important enough to shred, it is important enough to do it on-premises by employees. You can't trust anyone these days.
ReplyDeleteI see your point, Andrew. Everyone has to find their comfort level. The place I take it to puts it into a locked bin that's picked up and taken to the shredding center.
ReplyDeleteI can see why that might make you nervous since you can't really follow the chain of custody.
Generally around here if you have a shred bin, they shred it on the truck, in your parking lot.
ReplyDeleteGreat post! Been trying to get my business to shred more of our documents as well. Thanks for the thoughts and info!
ReplyDelete