Secure records migration with an unbroken chain of custody

Secure records migration is what you need when a body of records has to move and your organisation still has to answer for it afterwards. The move might be physical, from a store room to a scanning facility. It might be logical, out of a legacy repository and into a new one. It is often both at the same time, and it frequently coincides with a change of supplier. In every version the risk is identical: a record that cannot be traced through the move is a record whose integrity you can no longer defend.

What actually breaks when records move

Most losses in a migration are undramatic. Nothing is stolen. A box is signed for as one item when it held four files. A folder is opened to be checked and does not go back in the same sequence. An export quietly drops the documents whose filenames contained a character the target system rejects. None of this is visible on the day. It becomes visible much later, when somebody asks for one specific file and it is not where the register says it should be.

• Counts taken at box level when the eventual request will be at file or page level
• Metadata that lived outside the documents, in a spreadsheet or the old system's database, and was never mapped across
• Version history flattened on export, so the current version survives and every superseded one disappears
• Permissions rebuilt from memory in the new system rather than exported from the old one
• Audit history left behind in a platform that is switched off before anyone checks whether the log was needed
• Silent transfer failures, where the load reports success at batch level and nothing counts the individual items

Two chains of custody, not one

Physical custody is the one people plan for. It is answered with a manifest produced before collection, a signature at each point the records change hands, controlled storage at the processing site, and an access log naming everyone who entered the area. The manifest has to be written at the granularity you will one day search at. If the register says twelve boxes and the request eighteen months from now is for one lease agreement, twelve boxes is not an answer.

Logical custody is the one that gets skipped. During a system move somebody is granted broad read access so the extract can run, and that account often outlives the project. Ask who holds the migration credentials, what they can see, how long the account exists, and what evidence you will be given that it was disabled at cutover. Ask the same question of the outgoing platform: the audit log inside it is part of the record, and it stops being retrievable the day the licence lapses.

On-site or off-site: the custody trade-off

Where the work happens is a custody decision before it is a logistics decision. Off-site processing is faster and cheaper per page because the equipment and the people are already in place. On-site keeps the records under your roof and your control throughout, which for some collections is not negotiable. Many projects use both, splitting the collection by sensitivity rather than by convenience.

Reconciliation belongs in the contract

Reconciliation is the step that turns a claim into evidence. It should not be a verbal assurance at the end of the project. Write it into the scope, and specify what you expect to receive at closure.

• An opening manifest, agreed and signed before the first item moves
• A closing reconciliation of every item against that manifest
• An exceptions register listing what could not be captured and why, including items found damaged, empty or duplicated
• A variance report explaining any difference between the opening and closing counts, signed by both sides
• A dated record of the return, continued storage or destruction of every physical item

Taking over from an incumbent supplier

Supplier changes are where collections get lost, because two registers run in parallel and neither is authoritative. Before the handover date, ask the outgoing supplier for the index database and not only the image files. Establish what format the index arrives in, whether audit history is included, and whether the file naming carries meaning that only their system understood. Agree a single date after which their register is frozen. Then agree, in writing, what happens to anything they still hold: returned to you, transferred to us, or destroyed with a certificate.

Where digitization fits in

A migration is the natural moment to digitize, because the records are already being handled item by item. It is also the moment to avoid digitizing indiscriminately. Records past their retention period should be dispositioned before capture, not scanned and carried forward as a searchable liability. That decision sits with your compliance function, and it is far cheaper to make it while the boxes are open than to unpick a loaded repository afterwards.