A year-end review of Information Governance

A successful IG program will require input from all stakeholders to avoid siloing

Before 2013, use of the term “Information Governance” or “IG” was generally limited to narrow technical circles; however, a new focus on the secure and appropriate management of information —seen especially in the context of the Snowden affair — has led to renewed interest in the field.

But despite the additional publicity and widespread discussion, the concept of IG is still in the throes of definition and understanding. Gartner, a premier information advisory company, suggests that IG is the “specification of decision rights and an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving and deletion of information. It includes the processes, roles and policies, standards and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals.” The Association for Information Management posits that IG represents, in part, a maturation of roles traditionally played by “libraries and librarians” where “practitioners in all aspects of information management” are involved in decisions related to the strategic, as opposed to tactical, enterprise-wide approach to the governance of the organization’s information. Finally, AIIM, the Global Community of Information Professionals, indicates that IG represents “policies that can be applied across the enterprise,” dictating “investment [into] records and information management systems.”

All agree that IG as a policy regime requires strategic coordination across all business units, as well as the supporting services of IT, security, compliance, privacy, and legal. A successful IG program will require input from all stakeholders to avoid siloing, and its strategy should also incorporate four lines of function: organization and culture (structure and change management); policy and measurements (the legal aspect); the effect on business processes; and technology optimization (the technology solutions).

This, of course, may be easier said than done.

To steer the process, many organizations have performed some combination of the following: implemented IG steering committees, created Chief Data Officer positions, revamped records policies and schedules, and overhauled IT infrastructure in order to keep the sum of the parts — the holistic result of IG strategy — firmly in mind. A centralized, global approach to IG is necessary so that organizations can maximize the value of their data while also reducing risks and costs. Going forward, IG models likely will start with a common strategic seed and seat of individual responsibility, possibly at a C- or near-C-Level position, but will be further refined based on organizational and even division-based risk assessments.

Big Data

The emergence of Big Data, seen as the process of “building new analytic applications based on new types of data” that organizations had previously not collected or tracked, has created tremendous opportunities for sales, marketing, and plaintiffs’ attorneys alike. Big Data’s accompanying risks and benefits in turn accelerated IG and strategic management of Big Data to a prominent C-Suite concern for many organizations in 2013. As the volume of enterprise-data grew at an astounding 40 to 60 percent over the course of 2013 (with an expected annual increase of 4,300 percent by 2020) organizations recognized the need for efficient and effective information management, a critical component of IG, which can be leveraged across different types of information and varied responsibilities. Today’s Big Data environment demands good organization of records, taxonomy, retrieval, and defensible destruction policies. The C-Suite challenge is to strike the right balance between the need to mine data assets for valuable information (such as customer buying preferences, optimal marketing strategies, and workforce analytics) and the cost of storing ever-increasing amounts of data; maintaining its security; and complying with relevant laws, regulations, and litigation holds.

These sometimes competing interests must be carefully weighed when developing enterprise-wide IG policies and procedures, with two considerations that directly impact policy notes: an appreciation of the organization’s culture and the potential effects on existing business processes. Just as individuals driving change within an organization cannot ignore the business realities of their decisions, they cannot forget that IG strategy is much more than imposing guidelines and additional requirements on already-resource-starved departments and personnel. Understanding existing culture and how it may be harmonized with new complexities takes a deft understanding — done correctly, it can keep new initiatives from immediate failure, and even set up new programs for success.

Data security

Massive breaches, caused by everything from international hackers to negligent employees to vendors to one-time NSA contractors, also made headlines throughout 2013. Regulations were strengthened and class action lawyers asserted creative theories of liability for breaches. And the White House introduced the Executive Order on Improving Critical Infrastructure Cybersecurity, focused on “jointly developing and implementing a framework of cybersecurity practices” with industry partners.

It became even clearer in 2013 that organizations must consider data security issues strategically and proactively — that is, at the point of procurement as well as their points of use and storage. Organizations of all sizes should incorporate into their IG program a comprehensive data protection plan to minimize the likelihood of a breach, and an incident response plan that can be immediately implemented in the event of a breach.

Conclusion

The increasing prominence of Information Governance as a strategic enterprise-wide concern in 2013 was a positive development largely driven by the costs, benefits, high-profile risks, and exponential growth of Big Data. Development of improved IG is well worth the effort in light of the resultant increased efficiencies and productivity and decreased costs and risks. We look for even greater appreciation for the need for strong IG throughout 2014.

Contributing Author

author image

Judy Selby

Judy Selby has more than 20 years of experience in large scale first- and third-party complex insurance coverage matters, providing a full range of services...

Bio and more articles

Contributing Author

author image

James Sherer

James Sherer is counsel at BakerHostetler and focuses on e-discovery, data privacy, data security, and information governance matters. His experience includes the provision of legal...

Bio and more articles

Join the Conversation

Advertisement. Closing in 15 seconds.