If you've been to as many compliance meetings as I have, you've likely heard managers refer to the IT department's backup strategy as their department's solution for meeting the company's record retention policy.

Backup might appear to be an easy way out with regards to records retention, but is it the right answer?

If backups are the universal solution to records retention, that means an awful lot of responsibility gets shifted to IT. Not the responsibility to actually do the backup—that's a given. Or, at least, it should be. Rather, you're now asking IT to take on the burden of knowing the content of every file and every e-mail message on a backup tape, determining how long content like that should be kept and taking appropriate action when the retention period is up.

But given that it would be impossible for IT to make these determinations, the "safest" (and simplest) thing for IT to do is to save backups forever. Obviously this isn't workable, nor is it something your legal department would stand for. (You can almost sense the collective panic as the implication of "save forever" sets in.)