MGIC - Record Retention

Record Retention and Access

Purpose

The purpose of this policy is to ensure prudent retention of records and data by users and administrators of the Maryland Global Initiatives Corporation (MGIC), to meet reporting and audit requirements and to safeguard confidential information.

Background

MGIC is a mechanism used by the University of Maryland, Baltimore (UMB) and Affiliate Entities to conduct business outside the United States, including but not limited to contracting authority, financial transactions, and foreign registration and legal actions.

The International Operations (IO) division of UMB’s Administration and Finance department maintains complete records for every MGIC financial, procurement, personnel, and legal transaction (hereafter referred to as “operations records”), for purposes of corporate governance and to support UMB’s legal and compliance obligations.  The IO division, in partnership with Requesting Units, must therefore take appropriate and responsible custodial care to store these records and to dispose of them in accordance with best practices.

Policy Statement

Record Retention

1. MGIC operations records must be retained by the IO division for the following time periods, depending on the type of record:
   • Financial transactions: supporting documentation collected for payment purposes must be retained for a minimum of three (3) years, or longer if the Requesting Unit informs the IO division of a sponsor or university mandate.
   • Procurement instruments and licenses, including but not limited to purchase orders, service contracts, funding agreements, insurance contracts, insurance policies, space leases, and software licenses: must be retained during the term of the license or agreement and subsequently for the longer of (a) four years after termination, expiration or non‐renewal of the license or agreement, (b) a longer retention period required by an award to UMB, or (c) a longer retention period required by local law.
   • Personnel records: All employment, payroll and benefits records of MGIC employees (personnel hired through an MGIC Employer of Record), must be retained throughout a person’s employment and for four years after the date of separation, or for a longer retention period if required by local law.
   • Legal Counsel, Audit, and Accounting Firm records of correspondence: should be maintained indefinitely.
   • Corporate governance documents, including but not limited to legal documents of the Corporation and of the Board of Directors: should be maintained indefinitely.
2. Programmatic records, including deliverables and acceptances of work from vendors, service providers, partners and collaborators engaged by MGIC on behalf of Requesting Units, must be maintained by the Requesting Unit as the original auditable files for the university, as required for fulfillment of sponsor or other funding source obligations. Programmatic records are not considered MGIC operations records and are outside the scope of this policy.

Storage of Records

1. MGIC will collect, produce, and store operations records in electronic formats whenever practicable.
2. Electronic records should be kept on secure UMB data platforms or on an MGIC-procured platform approved by UMB, and not on third-party services unless required by the State of Maryland, US Government, or relevant foreign government authority.
3. Paper records should be kept in lockable, fire-resistant storage on UMB property.
4. In the case of hard-copy documents that are more than three years old and unless otherwise dictated, MGIC may substitute high-quality scanned or other electronic versions of the documents.
5. MGIC will maintain reasonable safeguards against alteration and should conduct periodic quality control reviews of stored documents.
6. MGIC will have record retention controls in place that protect personal, confidential, proprietary, or sensitive information in the possession of IO from loss of integrity, confidentiality, or availability. These controls must comply with sponsor, UMB, and applicable government requirements.

Access to Records

1. MGIC administration access: Access privileges of IO personnel who administer the MGIC mechanism must be assigned according to job responsibility. See MGIC policies on Financial Conduct and Responsibility, Financial Management Systems and Processes, Internal Controls, Personnel Records, Procurement, and the MGIC Table of Authorities.
2. Internal requests: Authorized officials from UMB or an Affiliate Entity, USM, or the State of Maryland must be able to access MGIC records upon request. IO will obtain clearance from the MGIC President and/or MGIC Treasurer if a requestor’s authorization is in doubt.
3. External requests: Copies of, or access to, MGIC records may be requested by other parties, such as auditors, sponsors, local government agencies, media, and persons relying on U.S. government information laws. The MGIC Vice President – Policy & Administration and MGIC Treasurer shall authorize all external requests for MGIC records.
4. Personnel requests: If an MGIC employee or former employee requests a copy of the employee’s own personnel records and the records are deemed to have sensitive material therein, UMB’s International Human Resources Manager may engage legal counsel prior to releasing records.

Disposition of Records

1. Unless otherwise directed by a UMB official with authority regarding disposition of records, the IO division should discard, destroy, or otherwise dispose of expired MGIC records according to the retention schedule above. Records should not be retained longer than required.
   • Exception related to open audit or legal matters: Any records related to an outstanding audit or audit issue or related to an open legal proceeding must be retained until the audit or legal matter has been fully resolved and in consultation with the MGIC VP – Policy and Administration.
   • Exception related to programmatic records: MGIC must transfer any programmatic records to the Requesting Unit.
2. When disposing of records, confidential and personally identifiable information must be protected from loss of integrity or availability.
   • Paper documents containing personal, proprietary, or confidential information may be shredded using a cross-cut shredding device.
   • Electronic records or computer equipment or other media containing sensitive data must be disposed of in ways that securely eliminate remnants of the records.

Scope

This policy applies to all UMB personnel and affiliates, including MGIC employees, who manage and maintain operations records and data for MGIC.

Responsibilities

1. International Operations staff: Comply fully with all aspects of this policy. Develop, implement, and follow appropriate standard operating procedures to ensure policy compliance, function efficiently, minimize risk to MGIC users and stakeholders, and maintain appropriate segregation of duties and standards of ethical conduct.
2. Assistant Vice President - IO (in capacity of MGIC VP – Policy & Administration): Oversee division’s record management processes and protocols.
3. Requesting Units: Follow MGIC policies and procedures. Inform IO of record retention and storage mandates for specific activities supported by MGIC that exceed the periods described in this policy. Retain all programmatic data, deliverables and works contracted through MGIC, and records pertaining to the Unit’s use of the MGIC mechanism, for future audit or financial review by USM, State or sponsor entity.

Procedures

See MGIC Standard Operating Procedures.

Documentation Requirements

• MGIC Table of Authorities

References

• MGIC Policy on Confidentiality and Data Protection
• MGIC Policy on Financial Conduct and Responsibility
• MGIC Policy on Financial Management Systems and Processes
• MGIC Policy on Insurance
• MGIC Policy on Internal Controls
• MGIC Policy on Personnel Records
• MGIC Policy on Procurement