Data Retention: Opportunity or Burden in Times of Economic Downturn?

Introduction

Unibail-Rodamco has rolled out SAP to several of their European entities. The legacy systems in use in the countries where this migration occurred were kept live. Partly this was due to operational requirements for continuity and partly this was due to data-retention requirements. Unibail-Rodamco wanted to close down these systems to reduce costs and to prevent the use of the legacy systems. However, before discontinuing the obsolete systems, Unibail-Rodamco wanted to ensure that all local data-retention requirements would be met as they related to what historical data needed to be retained as well as the accessibility and storage requirements of this data. This article is a case study of the approach Unibail-Rodamco has chosen to phase out their legacy systems. The following subjects will be discussed: Project goal and project scope; Business case; Approach; Conclusion

Project Definition – Defining the Objective and Scope of the Project

Clearly defined objectives determine the project approach and project result. The objective of this project was defined as “Investigate what data needs to be retained according to legal and regulatory requirements and, consequently, determine which systems can be phased out.” Two criteria were used to determine what data and systems came within the scope of the project. The first criteria was to focus on legacy systems that became obsolete as result of the SAP roll-out. The second criteria was to focus on the primary business processes.

Business Case – Where to Start?

Defining a clear (quantitative) business case is usually difficult because information regarding future costs and benefits is not easily determined or obtained. For this reason Unibail-Rodamco chose to start with an initial business case outlining high-level costs and benefits, and to further detail the business case at later stages of the project. This resulted in a business case where as many specifications as possible were added at each phase of the project. At the start of the project benefits were mainly qualitative, and costs were limited to project costs specified in man days (internal and external) and travel expenses. During the project this has been augmented with other costs like maintenance costs, license costs, hosting costs and hardware costs.

Table 1. The business case.

Approach

Activities were categorized in phases for improved project management. Each phase had its own specific objective, deliverables and timeline. The total project was planned to be finished in eighteen months for a European organization operating in twelve countries. In the following paragraphs each phase is described.

Phase 0 “Establish Foundation”

The objective of the preliminary phase was to establish a foundation for the project by outlining the business case and timelines, then obtaining approval to commence the project. This phase includes activities such as drafting the business case, writing the project plan and obtaining approval of the management board to commence the project. It started off with a video conference in which the ICT Director, Board member responsible for IT, Head of Risk Management and members of the project team participated. This phase took one month.

Phase 1 “Current State Assessment”

The objective of the first phase was to determine the current state of existing data-retention policies, to identify legacy applications (and related costs) and to study legal and regulatory requirements. There were questions that needed to be answered within this phase: What policies regarding retention of data, procedures and controls have already been implemented? What does the IT infrastructure (hardware, software, interfaces) look like? Which applications can be identified as legacy applications? What are the terms and costs regarding software and hardware licenses? What hardware technology is being used? How do the applications support business processes? Has data ownership been allocated? Which systems can be phased out and which local legal and regulatory requirements are applicable?

The starting point was to ask all local IT managers from the European entities which applications could be identified as legacy systems. Then questions were asked on a per-application basis regarding the environment (supporting operating systems, databases), costs (licenses, maintenance fees) and risk management. Table 2 shows the categories and examples of questions per application that have been included in the questionnaire.

Table 2. Current state assessment – questionnaire.

A detailed version of this questionnaire was sent to all the IT managers of the countries that were within the project’s scope. It revealed which European ICT systems were identified as legacy applications, since there was no need for actual use of these applications. Second, it showed the expenditures on legacy applications, thereby creating awareness of the costs of legacy systems whose benefits were no longer always clear.

Unibail-Rodamco has indicated that this exercise proved very valuable. The results of the survey are still used to evaluate IT contracts and IT costs, and are also used in the budget rounds to control costs of maintenance and license fees of IT systems. The identified cost savings qualify as significant because the annual savings alone already outweighed the project costs. The results of the survey have been used to further quantify the business case.

During this phase Unibail-Rodamco wanted to reduce expenses on their projects. For this reason it was decided to continue with the project but to limit its scope to the corporate legacy systems and to non-critical business applications that were identified as legacy. The critical business applications that were identified as legacy were kept out of the project’s scope because in some way these were used in daily operations (for example, for processing of service charges for older contracts). Obviously, the time and effort saved through this decision will be expended once Unibail-Rodamco continues with a data-retention project for the critical business applications that are regarded as legacy systems.

Phase 2 “Desired State Design”

The objective of the second phase was to define a desired future design: i.e., determine how Unibail-Rodamco should deal with the identified legacy applications and identified legal and regulatory requirements. To do this, a workshop was organized to determine in what way the identified data-retention requirements could best be dealt with. During this session priorities had to be set regarding what data needed to be retained. This was done based on the results of a gap and risk analysis showing to what extent the organization presently complied with legal requirements but also where the organization failed to comply with these requirements. The results of the workshop led to an understanding of how the organization should best deal with data-retention requirements based on the triangle of risk, cost and effort. Based on the results of the workshop, a data-retention strategy describing the intended solutions is written.

The project made clear to corporate and local management that know-how and expertise in local regulations was required. Therefore at corporate level it was determined which systems needed to be retained from a legal perspective and those decisions were subsequently communicated to the European entities. For other legacy systems, local IT managers were allowed to determine themselves whether the systems needed to be retained based on business needs or legal requirements. Most of the research has been performed regarding corporate-transaction systems, consolidation systems and data-warehouse systems that were identified as legacy at that moment, or as soon-to-be legacy, because most of the potential cost savings (e.g. for housing, hosting, contracts and maintenance) could be realized for these systems.

Initially, the duration of this phase was estimated at two months. However because the scope had been reduced and the analysis of legal requirements could be performed at corporate level in an efficient way, this phase was finished in a couple of days.

Phase 3 “Implementation”

In this phase the data-retention strategy needed to be implemented. The first step in this phase was to write the implementation plan for each entity. These plans explained how solutions had to be implemented, by whom and when.

Unibail-Rodamco has indicated that several corporate and local systems containing data that did not have to be retained for business and legal reasons have been switched off and phased out. Data is retained for some corporate legacy systems which must be retained from a business and legal perspective. For other systems, this is under investigation, because occasionally the system and data is necessary for business reasons.

Depending on the type of data, Unibail-Rodamco has chosen virtualization technologies or storage on different media (like tape and DVD) to retain data in a way that assures availability and accessibility. License fees and contracts have been revised in case just read-only access was required. The duration of this phase took four months. This phase started three months after phase two was finished because from this moment all systems identified as legacy were no longer required for operational use.

Phase 4 “Operations and Review”

The objective of the fourth phase was to assess whether controls have been implemented effectively and to determine corrective actions if necessary. The duration of this phase was three days.

Table 3 shows an overview of the objectives, main activities and deliverables.

Table 3. Objectives, main activities and deliverables.[Klik hier voor grotere afbeelding]

Conclusion

This project shows that a data-retention project has several advantages for an organization. Most importantly, significant cost savings can be realized by phasing out corporate legacy systems and non-critical business applications. In the case of Unibail-Rodamco, these cost savings were realized by reducing the number of servers, interfaces and applications; in turn, these reductions have significantly lowered the costs of maintenance and licensing. Furthermore, the overview of identified legacy systems showed the costs that were related to these systems and made IT management reconsider whether they needed to keep these systems running, which has led to internal agreements to phase out other legacy systems in the near future. The case with Unibail-Rodamco proves that an organization can significantly cut IT spending by phasing out legacy systems and at the same time can avoid risks of non-compliance with legal and regulatory requirements. In this way it can definitely be regarded as an opportunity instead of a burden in these times of economic downturn.