A practical guide to information governance

Proven Practices. New Thinking. All in one Resource.

Why Read This Document?

As you know by now, the volume of information continues to explode exponentially and has become more mobile, making the job of protecting it even more difficult as requirements to do so increase. Most organisations are quickly realising the need to, and value of, managing information more effectively on an enterprise basis. Traditional activities, such as records management, are no longer sufficient to meet the demands of the business or the ever increasing and more complex current legal and regulatory requirements. The evolution of information management governance is now an essential business requirement to mitigate risk, reduce cost, and increase revenue.

With increasing pressure from the many global regulatory agencies, the need for an Information Governance Program is evolving from a “nice to have” to a “must have.” In addition to regulatory, customer, and shareholder pressures, legal discovery requirements continue to become more standardised with courts having less tolerance for noncompliance to established standards and commercially reasonable expectations.

Outside of regulatory compliance, market pressure for increased revenue is driving efforts to find creative ways for organissations to leverage the large volumes of information they retain to increase market share, drive revenue, and maintain a competitive advantage. Without effective enterprise Information Governance, business initiatives such as customer relationship management, knowledge worker collaboration, employee and customer mobility, data mining, big data, enterprise search, data and content analytics cannot be maximised or implemented successfully for enterprise success.

Readers of this paper will find helpful guidance on how to manage information related risks and compliance requirements, as well as develop and implement improved information management and governance processes and practices.

Introduction

Members of Iron Mountain’s Financial Services Customer Advisory Board formed a committee along with Iron Mountain subject matter experts in early 2013 to share best practices around the topic of Information Governance. We started out with the question: What is the best way to construct and maintain an Information Governance Program for our respective companies?

Through our discussions we determined that while each organisation shapes and defines what Information Governance means to meet their individual requirements and culture, there are certain elements that are universal. This prompted the committee to create a practical guide with the objective of establishing a common language and an outline of the most critical components and organisational best practices.

Methodology

Over the past year, the committee members met to discuss and develop a working guide to Information Governance. It is the committee’s intention to share its work with records and information management professionals in all industries to use as leverage as they continue to build and refine a robust Information Governance Program. The guide includes the following topics:

• Definition of Information Governance
• Information Governance Principles
• Information Governance Model
• Roles and Responsibilities of Information Governance Council
• The Value of Information Governance
• Organisational Best Practices

The Information Governance Committee and Iron Mountain are pleased to provide the records and information management community with this guide for developing and maintaining a practical Information Governance Program. This is by no means a definitive, final Information Governance framework. Rather, it is a first step in a journey to develop clarity and guidance on how to approach Information Governance in the context of your particular industry. It is our hope not that you adopt the guide as complete, but use the topics to start an internal dialogue and gain the cross-functional executive buy-in mandatory to support a holistic Information Governance platform.

Information Governance Definition

Information Governance is the multi-disciplinary enterprise accountability framework that ensures the appropriate behavior in the valuation of information and the definition of the roles, policies, processes, and metrics required to manage the information lifecycle, including defensible disposition.

All too often we see the terms “Information Governance” and “Records and Information Management” used synonymously. While the records and information management function is a part Information Governance, other critical components need to be considered equally.

The associated diagram depicts the various types of content, and its repositories, that are overseen by the activities of Information Governance.

Information Governance Principles

It’s no secret that initiatives that drive increased operational efficiencies and allow for flexibility to accommodate changing regulations are very popular in today’s financial organisations. Establishing a strong Information Governance Program will allow for just that. A critical first step is to define a set of core principles that will permeate your Information Governance Program and processes. These should include elements such as:

• Educate all employees regarding their Information Governance duties and responsibilities.
• Confirm the authenticity and integrity of information.
• Recognise that the official record is electronic (unless otherwise specified).
• Store information in an enterprise-approved system or record-keeping repository.
• Classify information under the correct record code.
• Control the unnecessary proliferation of information.
• Dispose of information when it reaches the end of its legal and operational usefulness.
• Secure customer and enterprise confidential/personally identifiable information.
• Comply with subpoena, audit, and discovery requests for information.
• Align all lines of business systems and applications to Information Governance standards.
• Ensure that third parties that hold customer or enterprise information comply with with your organisation's Enterprise Enterprise Information Governance standards.

Information Governance Model

We know that no two organisations are alike, so rather than put forth a single “best practice” Information Governance Program infrastructure, we set forth in this document the recipe and ingredients that can ensure its successful institution. How your organisation combines the ingredients is dependent on your culture, state of maturity, risk profile, current functional orientation, advocacy level, and much more. We encourage you to create your own “ideal” structure that suits your situation today and helps you plan for the future.

There is one common and critical requirement in the formation and sustainability of an Information Governance Program: the sponsorship of an executive, preferably someone within or close to the “C Suite,” such as the CIO or General Counsel. Their endorsement of the Program lends a degree of seriousness, expectation, and accountability that will trickle down through the organisation. Without such sponsorship, some necessary elements of an Information Governance Program may be overlooked or undervalued.

Information Governance Oversight

In order for Information Governance to become institutionalised in an organisation, it requires guidance and oversight by a cross-functional, senior level Information Governance Council (Council) that meets on a routine basis, at least quarterly. To be most effective, the Council should not exceed 10 individuals. Selected members should be able to represent the functions fulfilled by the following roles, some of which may not exist in your organisation. In order to keep the size of the Council to 10 members, certain members may need to be able to represent other roles. For example, your Legal member may be able to speak for the Litigation Officer and the Compliance Officer.

• Executive Sponsor: CIO, or a designee
• Legal (Office of the General Counsel)
• Chief Data Officer
• Chief Health Information Officer
• Discovery or Litigation Officer
• Risk Management
• Compliance Officer
• (Global) Records and Information Manager
• Chief Data Privacy Officer
• Information Technology Security Leader
• Information Technology Infrastructure/Architecture Leader
• Critical Line of Business/Business Unit Leader(s)
• International (Regional) Leaders

The Council is responsible for approving an enterprisewide Information Governance strategy, developing operating procedures for the Council, providing guidance about technology and standards, assisting in the securing of funds, and advocating the business value of information governance at the C-Suite and Board levels of the organization.

It is important to consider your corporate culture in order to strike the correct balance in the Council membership, participation and collaboration. While support is needed from your most senior leaders, given their span of responsibility, they may not be able to directly manage all of the obligations of the Council. Moreover, it may be best to create sub-committees or other working groups that report into the Council that take responsibility for specific topics or business lines. Alan Weintraub, a principal analyst at Forrester Research, points out that through his research he found that the centralisation of the Council can be a potential impediment to the line of business’ ability to make their own governance decisions. He warns that IT representatives may, “try to exert too much control over the information governance process, which can shut out members from the business side from providing input or actively participating in the governance efforts.” He also notes that in larger organisations, it may make sense to have more than one Council to fulfill different aspects of Information Governance, such as strategy and daily operational governance.(TechTarget.com Beth Stackpole, 27 July 2011)

The notion of a multi-tiered Information Governance leadership structure is particularly relevant for industries with varied and numerous lines of business situated within a complex geographical footprint. The executive sponsor or the senior-level Council would determine the need for, and composition of, the subject and/or region specific Councils. In addition, the Councils may assign cross-functional working teams assembled to address a particular topic, such as the creation of standards for line of business selfassessments. In any event, the different tiers of Councils or working teams must be organised in such a way that they roll-up to and are held accountable to the ultimate owner of the Information Governance Program.

Information Governance Typical Functions and Roles

The Information Governance Model (see above diagram) represents the functional areas that are directly responsible for the governance of information across an enterprise. The Model also weights the involvement of the functional constituents: Business and IT have larger, more complex roles, Legal and RIM slightly less, and Information Privacy and Security share the smallest component as they are more specifically focused in their duties. This is not to minimise the importance that Information Privacy and Security has in the Information Governance model, in fact, in some industries, such as financial services, the Privacy and Security areas will play a greater role due to the abundance of regulations in place to protect the sensitive and confidential nature of information created and received in the course of business.

The following are high-level descriptions of the typical Information Governance responsibilities assigned to the primary functions in the Information Governance Reference Model. In some instances, functions may be combined within an organisation. For example, Legal is frequently where the Compliance and Discovery functions reside, rather than being separate groups within the organisation.

Legal

The Legal function is responsible for determining the risk profile of an organisation based on litigation exposures, international privacy requirements, intellectual property protection, working environment, and more. They should be intimately involved in the development and approval of the organisation’s records retention schedule and RIM Policy; designation of privacy classifications (confidential, public.); rules for management of email, social media, mobile devices, etc.; communication of any changes to the organisation through mergers, acquisitions, and divestitures; approvals for defensible disposition; communication to the RIM and IT teams related to any changes to new rules and regulations; and collaboration with key Information Governance stakeholders.

Discovery

The Discovery function is responsible for the communication, instruction, and coordination with business units and/or individuals related to information that must be located, preserved, and produced to satisfy litigation requirements. They may also be responsible for managing Freedom of Information Act requests in countries such as the UK. This function should regularly update designated custodians (typically business owners and IT) on the status of the “holds” on information, including when information can be released for normal lifecycle management; apprise RIM and IT teams when there are any changes to discovery requirements; and institute a repeatable process with associated guidelines to manage the spectrum of simple through complex litigation.

Risk

The Risk function is responsible for the protection of the organisation’s brand, finances, and operations by managing and mitigating risk exposures. This requires a full understanding of the organisation’s risk profile (litigation, investigations, regulatory requirements, protection of private information, protection of intellectual property.) They should be involved with Legal in the creation of “acceptable use” policy and with IT to develop acceptable disaster recovery and business continuity processes; selection of SaaS/Cloud providers; provide on-going education of employees regarding prevention of risk-related activities; provide input to Key Risk Indicators; conduct periodic risk assessments; and work closely with RIM, Legal, and IT to destroy information that is no longer required.

Compliance

The Compliance function is responsible for ensuring that the organisation is aware of, and meets the requirements of rules and regulations imposed by a variety of authorities (federal, state/provincial, and local governments; regulatory agencies; data privacy authorities and industry groups.) They should be involved in determining internal metrics and controls; establishing an enterprise-wide audit program; and responding to and managing requests from regulators, auditors, investigators, customers, and other third parties.

Records and Information Management

The Records and Information Management (RIM) function is responsible for the development and publication of the RIM Program policy for paper and electronic records. It includes providing implementation support through training and on-going communications; determining and gathering of metrics to determine compliance; cost containment through information lifecycle awareness and storage options, and destruction execution; participation on IT projects for software review and implementation; establishment of a support system for lines of business to include a records coordinator network; staying abreast of trends in RIM (Cloud, big data, BYOD.); and communication/collaboration with key stakeholders to determine policy/approach.

As business-level self-governance becomes institutionalised, the RIM department must create a “self-service” environment from which businesses can “pull” the information they need to comply with RIM Information Governance requirements.

Information Governance will necessitate the evolution of this function from providing records-centric guidance to being inclusive of all information — record or not.

Data Office or Data Governance

The goal of the Chief Data Office function, and specifically the role of the Chief Data Officer (Chief Health Information Officer in the Healthcare Industry), is to assist businesses and other functions in ensuring a consistent and controlled approach to the development and use of enterprise information assets and critical data elements across an organisation.

The Chief Data Office is responsible for guiding the establishment of processes and systems sufficient to create, maintain, and share data in compliance with an organisation’s data standards and external regulations/laws. He or she is the governing authority, along with Enterprise Data Governance Council Members, that implements a framework of controls that support effective and efficient management of data.

The Chief Data Office partners with Data Governance Officers assigned to the functions and businesses across the organisation. On data governance/data management practice assessments through various tools such as the Data Maturity Model, Data Quality platform, and Data Standards implementation plans.

Information Technology

The Information Technology (IT) function is fundamental to the success of Information Governance. While traditionally this function was focused on technology and infrastructure, it is shifting to be more aligned with the business and its objectives. To that end, the Information Governance goal of IT is to increase the ability to efficiently manage the high volume of data being created and received, and to eliminate costs, particularly around redundant technologies and storage. They need to provide leadership for the proper protection and authentication of data and its availability for use, preservation, and disposition. The role also requires collaboration with RIM, Risk, and Compliance to determine appropriate disaster recovery and business continuity plans.

The IT function must collaborate with all other Information Governance roles to understand the requirements of each when it comes to technology selection and deployment.

Information Privacy

The Information Privacy function is responsible for managing the risks and business impacts of privacy laws and policies and responding to regulator and consumer concerns over the use of personally identifiable information, including medical data and financial information, and laws and regulations for the use and safeguarding of information. This role involves selecting and implementing technology as well as staying informed of international privacy law and its impact on records management.

Information Security

Information Security

The Information Security function is responsible for the development, implementation, and management of the organisation’s security vision, strategy, policy, and programs. They are responsible for policy creation; technology selection and implementation; monitoring and informing parties about malware, breaches, hacking, etc.; formally communicating policies and procedures to the business; enabling security standards dictated by customers, such as the government; informing the necessary parties when there are issues with breaches; issuing data classification codes (in conjunction with Legal); and remaining compliant with ISO and other regulatory bodies, as required.

Information Architecture

The Information Architecture function focuses on the organisation of information and database development to support the business needs. It includes designing complex, shared information systems; involvement in the selection and management of cloud-based services; support in creating archives for email and social media content; and support for building efficient websites and intranet sites to support RIM.

Business (Operations)

The Business (lines of business, business units and/or departments) function is responsible for compliance with the Information Governance policies. The management of information through its lifecycle is most efficient when it acquires the attributes, tags, indices or metadata necessary for compliance as close to its creation as possible. Examples of such metadata are: flagging a piece of information as being confidential, or containing personally identifiable information, or that it is an official business record belonging to a specific category of information. A common complaint of business lines is that records management “gets in the way” of doing business. To that end, IT and RM should work closely with the businesses to determine how they can best take control of their information through technology and process in the least intrusive way.

The line of business is in the best position to determine the “value” of the information they create, maintain, or receive beyond that of its “official” use. Certain types of records may be used to determine marketing trends, track quality control issues over time, expand customer profiles, identify “bad actors” in a regulated environment. Once again, RIM should work with the businesses to help determine value and how to manage valuable information in a secure and compliant manner.

There is an emerging movement to make business units responsible for self-governance for a variety of corporate requirements or imperatives, including RIM. This is particularly the case in large, geographically dispersed organisations with diverse business lines. The business expectation is to “pull” the information required to selfgovern from sources such as RIM and Legal.

International Representation

Since Information Governance should extend across an organisation’s entire enterprise, there must be proper representation on the Council. This is most often a representative from a region (i.e., Asia Pacific, EMEA, and North America) that can speak to the concerns of the different jurisdictions within the region.

The Value of Enterprise Information Governance

The value of an organised and uniformly applied Information Governance Program can be defined in a variety of ways for a variety of audiences — for some, value centers around cost and risk reduction — whereas for others, value is seen as better use of the information itself (e.g. big data). The value question varies not only from organisation to organisation, but it may vary also from executive to executive, business area to business area, or user to user. Whoever the audience is, gaining buy-in from your organisation to establish and fully support the success of your Program can be a challenge.

Value, whether it is true information efficiency or more reliable analytics, is the third element of the proverbial stool needed to stand up an Information Governance Program. Risk and cost reduction have traditionally been at the forefront of the value proposition. However, as we have learned over time, the real value of a well-organised Information Governance Program cannot easily be measured using a standard ROI model. Some early attempts at creating Information Governance Programs are met with mixed results due to the fact that the cost savings were overstated. While the Program may have demonstrated “value” in other ways, it failed to produce the promised cost savings thus damaging its reputation. In some instances the true benefit your organisation will gain is in protecting and better leveraging the information assets it owns. One of the functions of the cross-functional Council is to establish acceptable goals for information cost, risk mitigation, and organisational value.

The Value of a Diverse Council

As noted above in the Information Governance Model Functions and Roles section, a true Information Governance Program is more than a Records and Information Management program and should include any and all areas of your institution where information is created and managed. All too often, Information Governance is viewed as starting and stopping with the Records Management and Legal and Compliance functions. By limiting the governance model to only these functional areas, the overall value of an Information Governance Program is diminished. The value of an effective Information Governance Program ultimately stems from the fact that it includes all types of content, from all areas of the organisation. An important step is to recognise that each area contributes and interacts with information in different ways and therefore gauges value differently. Below is one example of how different business areas may view the same type of information.

Information should not be kept in functional silos unless policy dictates otherwise. Gaining control over your information is not only valuable to those who manage the lifecycle of the information, but may support the initiatives of other business units across the organisation. A strong Information Governance Program can help break down information silos. Cross-functional teams can leverage information that is consistently available, accessible, and most importantly, accurate to create incremental value.

Information can be used in a number of ways. In our conversations with senior information managers at top financial services institutions, we heard several stories, good and bad, about how to position an Information Governance Program for success. The Programs with the greatest amount of success are positioned from a value perspective, demonstrating how information may represent a potential risk but more importantly how it can be used as a strategic asset to deliver value. By examining the information and all its potential uses, you will be better positioned to make consistent Information Governance decisions throughout your institution.

Organisational Best Practice

Moving projects and ideas from the Information Governance Council into production is not always an easy task. This section introduces current and emerging processes that have been culled from both real-life successes and failures. The concept of Information Governance is not new, but it is far from being a perfected process. While certainly not an exhaustive list, the following recommendations and insights are put forth to enable or facilitate the various components of Information Governance.

Secure Executive Sponsorship

As recommended earlier, the Information Governance Council is a mix of diverse functions all bringing different functional requirements to the process. One of the most important best practices we can recommend is the designation of an executive sponsor. The lack of a clearly defined executive sponsor is one of the top reasons why earlier attempts at forming an effective Information Governance Program are often unsuccessful.

For some Orginisations the recently emerging role of Chief Data Officer is responsible for information lifecycle management as well as sponsorship of the Information Governance Council. This senior executive position provides the level of advocacy needed to ensure that the company stays focused and committed not only to data analytics or data warehousing, but also to the processes that manage and house various types of information (RIM, Cloud, Email, Apps Management, big data, social media.).

The selection of the Council members must be given special consideration. Its composition should be made up of members of various departments and functional areas, but not the senior most executives. Earlier attempts to implement Information Governance Programs have been stalled — or failed — as a result of having senior management with no business line input sitting on the Council. It may make sense to rotate Council members on a periodic basis, for example every 18 – 24 months, to maintain interest.

Create real value for one or more businesses and then have them be your spokesperson.

In Closing

Information Governance is a framework that is supported by people, processes, and technology. It is laudable in its effort to pull together what may have been previously disparate functions across an organisation in order to create a consistent, compliant, and collaborative approach to managing information for risk, cost, and its value to the organisation. The Information Governance Program construction will be different from company to company, but its intent should remain firm.

Information Governance is not a project with a defined time span, but a program with requisite support from executives. Most institutions will go through many iterations implementing and administering the Information Governance Program, including the establishment of a Governance Council. It is important to go into the process with the understanding that there is no “silver bullet” or all-inclusive piece of technology that will provide your institution with instant governance over the entirety of your information.

The Information Governance Program needs to be adaptable as the business and regulatory environments change. Merger, acquisition, and divestiture activity is common in many industries and may result in potential new lines of business, new geographic locations, new technology, cultural and organisational shifts, new members to sit on the Council, and much more. It is important to remember that Information Governance is a framework — it is not static and must reflect current and emerging requirements for the management and use of information as an asset, and potential liability, of the organisation.