Work with your business process and legal advisers to develop a records management policy, and from that, develop procedures and a retention schedule (after performing an inventory of existing records) and assessing who creates, receives and manages what information for your organization.