Watch. Automating Information Governance - assuring compliance. AIIM Market Intelligence. Industry

Transcription

1 AIIM Market Intelligence Delivering the priorities and opinions of AIIM s 80,000 community Underwritten in part by: aiim.org l

2 About the Research As the non-profit association dedicated to nurturing, growing and supporting the information community, AIIM is proud to provide this research at no charge. In this way, the entire community can leverage the education, thought leadership and direction provided by our work. We would like these research findings to be as widely distributed as possible. Feel free to use individual elements of this research in presentations and publications with the attribution AIIM 2014, Rather than redistribute a copy of this report to your colleagues or clients, we would prefer that you direct them to for a download of their own. Permission is not given for other aggregators to host this report on their own website. Our ability to deliver such high-quality research is partially made possible by our underwriting companies, without whom we would have to return to a paid subscription model. For that, we hope you will join us in thanking our underwriters, who are: ASG Software Solutions 1333 Third Avenue South Naples, FL USA Tel: (USA Only) sales@asg.com Web: Concept Searching, Inc 8300 Greensboro Drive, Suite 800, McLean, VA Tel: Tel Europe: +44-(0) Web: AvePoint Harborside Financial Center, Plaza 10 3 Second Street, 9th Floor Jersey City, New Jersey Tel: Sales@AvePoint.com Web: IBM Corporation Corporate headquarters: 1 New Orchard Road Armonk, New York Tel: Web: CCube Solutions. 13 Diamond Court Opal Drive, Fox Milne Milton Keynes MK15 0DU UK Tel: Fax: sales@ccubesolutions.com Web: OpenText 275 Frank Tompa Dr, Waterloo, ON N2L 0A1 Tel: sales@opentext.com Web: Process Used and Survey Demographics While we appreciate the support of these sponsors, we also greatly value our objectivity and independence as a non-profit industry association. The results of the survey and the market commentary made in this report are independent of any bias from the vendor community. The survey was taken using a web-based tool by 531 individual members of the AIIM community between Mar 15, and Apr 08, Invitations to take the survey were sent via to a selection of the 80,000 AIIM community members. Survey demographics can be found in Appendix 2. Graphs throughout the report exclude responses from organizations with less than 10 employees, and suppliers of ECM products and services, taking the number of respondents to AIIM - The Global Community of Information Professionals 1

3 About AIIM AIIM has been an advocate and supporter of information professionals for 70 years. The association mission is to ensure that information professionals understand the current and future challenges of managing information assets in an era of social, mobile, cloud and big data. AIIM builds on a strong heritage of research and member service. Today, AIIM is a global, non-profit organization that provides independent research, education and certification programs to information professionals. AIIM represents the entire information community: practitioners, technology suppliers, integrators and consultants. About the Author Doug Miles is head of the AIIM Market Intelligence Division. He has over 30 years experience of working with users and vendors across a broad spectrum of IT applications. He was an early pioneer of document systems for business and engineering applications, and has produced many AIIM survey reports on issues and drivers for Capture, ECM, Records Management, SharePoint, Mobile, Cloud, Social Business and Big Data. Doug has also worked closely with other enterprise-level IT systems such as ERP, BI and CRM. Doug has an MSc in Communications Engineering and is a member of the IET in the UK AIIM - Find, Control, and Optimize Your Information 1100 Wayne Avenue, Suite 1100, Silver Spring, MD Phone: AIIM - The Global Community of Information Professionals 2

4 Table of Contents About the Research About the Research Process Used and Survey Demographics...1 About AIIM...2 About the Author....2 Introduction Introduction....4 Key Findings....4 Coping with Information Volumes....4 Maturity of Policies and Systems Maturity of Policies and Systems...5 Paper v. Electronic... 5 IG/RM Policies...6 RM Systems...6 Perception of IG IG Risks and Rewards...7 Information Governance Policies Information Governance Policies...9 Maturity IG Policy Scope...10 Audit and Conformance Audit and Conformance Training Audit...12 Issues from Non-Compliance...12 Data Protection Retention Policies Savings on Storage...14 Multiple Repositories and Cloud Multiple Repositories and Cloud Cloud...21 Opinions and Spend Intentions Opinions and Spend Intentions...21 Spend...22 Conclusion and Recommendations Conclusion and Recommendations...23 Recommendations References...23 Appendix 1 - Survey Demographics Appendix 1 - Survey Demographics Survey Background...24 Organizational Size...24 Sector...25 Job Roles Appendix 2 - Selective Comments Appendix 2 - Selective Comments Underwritten in part by: ASG Software Solutions AvePoint...27 CCube solutions...28 Concept Searching, Inc IBM Corporation...29 OpenText...29 About AIIM...30 Automated Classification Automated Classification...14 Automated Agents...15 Automated Records Declaration Content Types...16 Benefits Accuracy Experiences Archives Archives...18 Legal Hold AIIM - The Global Community of Information Professionals 3

5 Introduction What s in a name? When it first came into vogue a few years ago, information governance (IG) was often considered to be just an updated form of records (RM), extended to take account of the US legal discovery rules. If all electronically stored information can be requested prior to a court case, not just content that has been specifically declared as a record, then work-in-progress, content on laptops and mobiles, back-ups, and, in particular, archives, are all discoverable, and need to be governed. However, in the past twelve months, the impact of data leaks and security breaches, most especially the Edward Snowdon activities, has brought the security and privacy elements of information governance strongly into play. Metadata has become an issue for front-page news, and heads-of-state discuss individuals rights to data privacy and information deletion. Meanwhile, massive data leaks of personal information have damaged corporate reputations and hardened already strong views in some jurisdictions. We therefore need to work harder to protect live content and preserve content records, but the volume, velocity and variety of content generation makes it nearly impossible to manually maintain and enforce the policies we so earnestly set. Computers are more consistent than humans, but you still have to teach them - and trust them. We seem to be at an adoption tipping-point for automating real-time compliance processes, and for machine audit of existing content for metadata accuracy, content security, and de-duplication. Is this a silver bullet? What are the early adopter experiences? In this report we take an in-depth look at information governance policies, privacy and records issues, policy enforcement, and how well technology can set or correct metadata, detect security risks, and enforce deletion policies. Key Findings Coping with Information Volumes n On the whole, organizations are stabilizing the volume of paper records, but electronic records are increasing rapidly in 68% of organizations surveyed. While 32% reported an actual decrease in their paper records, not one respondent could report a decrease in electronic records. n Only 12% of respondents feel confident that they store only what they need to store. 42% are not confident about what is safe to delete. n 43% feel that automated classification is the only way to keep up with rapidly increasing information volumes. 14% are already using it, but a further 35% have immediate plans for adoption. n Of those already using auto-classification, only 10% have been disappointed with the results. In particular, classifying scanned documents has performed better than or as well as expected for 83% of users. n Improved searchability, higher productivity and defensible compliance are given as the top three benefits from automated classification. IG Policies n The three biggest risks from failure of information governance are excess litigation costs, loss of intellectual property and damage to reputation. 24% have had a compliance issue around litigation and discovery in the last 2 years. n 40% of organizations have recently moved, or plan to move in the next year or so, from a traditional RM view to a much wider IG view. 33% are still working in classic RM mode, including 18% who are still taking a mostly paper-records view. n The three biggest benefits from good information governance are reduction in storage costs, exploiting and sharing knowledge resources, and faster response to events and inquiries. Users are also becoming more aware of the need to support big data analytics. n Getting senior level endorsement and involvement is the biggest issue in creating an IG policy. Then enforcement once the policy has been agreed AIIM - The Global Community of Information Professionals 4

6 n Only 10% have an IG policy in place that is respected and enforced 21% have a policy in place but it is mostly ignored. For 55% the IG policy is a work-in-progress. n Of those who have information governance policies, only 19% regularly audit for compliance. 40% of organizations do not allocate any staff time for IG training, and only 4% specifically update senior. and Cloud n RM policies for are still very variable. 18% keep everything, 16% delete everything, 22% have no policy or strategy. 17% move s to their ECM/RM system or a dedicated archive with RM retention functions, but only 5% use automation. n Use of cloud or SaaS systems for RM is up from 5% to 7% in the past year, with those actively planning up from 11% to 14%. But those saying unlikely or never is up from 46% to 51%. Spending Plans n On the whole, users are likely to increase spend on all aspects of IG in the next 12 months, in particular IG training, archive, search, RM systems and automated tools. Spend on back-file scanning of paper records is set to increase, but outsourced RM, both paper and electronic, is net-neutral. Maturity of Policies and Systems Paper v. Electronic The good news on paper records is that the number of organizations reporting a rapid increase has dropped from 15% to 10% since our survey a year ago1, and that smaller organizations have balanced out, with the same number reporting increasing volume to those reporting decreasing volume. The bad news is that bigger organizations seem to have suffered a setback with 48% reporting an increase compared to 31% reporting a decrease a gap of 17% compared to a 3% gap last year. There is no obvious explanation for this. Decreasing somewhat, 25% Decreasing rapidly, 7% Stable, 27% Figure 1: Is the volume of your paper/electronic records? (N=483) Paper Records Increasing rapidly, 10% Increasing somewhat, 32% Decreasing somewhat, 0% Stable, 4% Increasing somewhat, 28% Decreasing rapidly, 0% Electronic Records Increasing rapidly, 68% When it comes to electronic records, the picture is much clearer: nobody We don t is have reporting a decrease, and around 70% of all sizes are reporting We have rapidly robust, increasing volumes. informa on and records policies, 7% enterprise-wide informa on governance policies, 15% We have definite plans to develop enterprise-wide informa on and records policies, 14% We have 2014 AIIM - The Global Community established of policies Information Professionals 5 in some areas/ departments but

7 10% Decreasing somewhat, 25% Increasing Increasing somewhat, Decreasing IG/RM Policies somewhat, 28% somewhat, Decreasing Decreasing Increasing 32% 0% rapidly, 0% Before rapidly, being 7% too specific rapidly, about all-encompassing information Stable, governance 4% policies, it is useful Increasing to look at policies in general, and maturity 10% levels of basic records. Just 15% of respondents rapidly, feel they Decreasing have robust, enterprise wide IG policies, albeit rising to 22% for the largest organizations. The 68% rest of the somewhat, picture Stable, is somewhat patchy. 28% have departmental or geographical variations, 38% feel they are still some 25% 27% Increasing way from maturity, and 21% actually Increasing have no policies in somewhat, place as yet - although two thirds of those have good intentions. Paper It Records would seem that somewhat, 12% of even the largest 28% organizations Electronic have Records no agreed RM policies. 32% Figure 2: How mature are your information governance and records Increasing policies? rapidly, (N=483) 68% Stable, 27% Paper Records We have robust, enterprise-wide informa on governance policies, 15% We have robust, enterprise-wide informa on governance We have policies, 15% established policies in some areas/ departments but not others, 26% We have established policies in some areas/ departments but not others, 26% We don t have informa on and records policies, 7% We don t have informa on and records policies, 7% Electronic Records We have definite plans to develop enterprise-wide informa on and records policies, 14% We have definite plans to develop enterprise-wide informa on and records We have informa on policies, 14% and records policies but have nothing you could describe as mature, 38% We have informa on and records RM Systems Supporting these policies, we see an equally wide range of system architectures. policies Only but 23% have have what we would call the classic EDRMS system, combining content, document and records nothing you. could 27% describe as mature, have RM capability in their ECM/DM system but don t use it although most (22%) say they are planning to turn it on in the next months. A similar proportion, 0% 25%, have 10% separate 20% 38% systems for active 30% content and records. Often this involves SharePoint as the DM system, with a more robust RM system It is incorporated underlying in it. our 26% ECM/DM have no system RM capability. Figure We have 3: How records would you describe capability your in mechanism our for managing electronic records? (N=478) ECM/DM system but no plans to use it We plan to add/ turn-on records 0% 10% 20% 30% in our ECM system in the next months We have It is incorporated separate systems in our for ECM/DM ac ve content system and records We have records capability in our Our ECM/DM system system doesn t but no support plans records to use it We plan to add/ turn-on records in our ECM system in the next months We don t have an ECM/DM system We have separate systems for ac ve content and records Our DM system doesn t support records We don t have an ECM/DM system Records We have looked is at things this way 2014 AIIM - The Global Community of mostly Information about Professionals for quite some 6 paper files in our me (3+ years), organiza on, 18% 18%

8 We have records capability in our ECM/DM system but no plans to use it We plan to add/ turn-on records Perception in our ECM system of IG in the next months As we noted in the introduction, information governance as a term has burst into popularity in the last few We have separate systems for ac ve content years at least on the part of the vendors. Although this survey was self-elected against a title that included and records the word information governance, there is strong evidence that the term and indeed the practice has struck Our a DM chord system with doesn t users. support Figure 4 records shows that the number of organizations changing their view from of declared records to of all electronically stored information has jumped from 18% to 34% in the last 2 years, with a further 24% planning to adjust their view in the next months. There is evidence We don t that have smaller an ECM/DM organizations systemare more likely to have made the move perhaps as they are less likely to have had traditional RM roles. Unfortunately, there are still some organizations that have yet to accept the reality of electronic records, and continue to live in the paper world 18% in this survey Figure 4: To what extent would you say the perception of information governance in your organization has progressed from of declared records, to of ALL electronically stored information for privacy, security and e-discovery? (N=425) Records Managers manage records, but the rest is not so well managed, 15% Records is mostly about paper files in our organiza on, 18% Records Managers manage records, and IT take good care of the rest, 9% We have looked at things this way for quite some me (3+ years), 18% We have recently adjusted our view to align with this, 16% We have plans to adjust responsibili es in the next months, 24% 40% of organizations have recently changed, or are about to change, from a declared records view of information and control to an IG view across all of their stored information. IG Risks and Rewards So accepting that the majority of our respondents understand the wider implications of IG, we asked what they considered to be the three biggest risks associated with IG failures. Excess litigation costs or damages heads the list, followed by loss of valuable information and then loss of customer confidence all of which would be considered major business disasters. Understandably, loss of intellectual property is of the most concern to smaller businesses, and inability to respond to information requests is a particular concern of mid-sized organizations AIIM - The Global Community of Information Professionals 7

9 Figure 5: Which of the following do you consider to be the biggest risks to your company from a failure of information governance? (Max THREE) (N=482) 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% Excess li ga on costs or damages resul ng from poor records keeping Loss of intellectual property or company confiden al informa on Loss of customer confidence or bad publicity 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% from data loss Excess li ga on costs or damages resul ng from Inability to respond to requests poor records (e.g., Freedom keeping of Informa on) Loss of intellectual property or company confiden al informa on Audit qualifica ons due to inadequate records Loss of customer confidence or bad publicity Regulator ac on from loss/exposure from data of personally iden fiable informa on Inability to respond to requests (e.g., Freedom of Infringement of industry-specific Informa on) compliance regula ons Audit Poor qualifica ons outcome of due customer/supplier inadequate records disputes due to gaps in communica ons trail Regulator ac on from loss/exposure of personally iden fiable informa on Fines resul ng from poor records keeping Infringement of industry-specific compliance Criminal prosecu on for allowing regula ons personally sensi ve data to be lost Poor outcome of customer/supplier disputes due to gaps in communica ons trail On the positive side, users see many benefits from good information governance, the most significant of which is to Fines reduce resul ng storage from and poor infrastructure records keeping costs and this is a tangible cost-saving benefit. Next comes exploitation and sharing of knowledge, followed by faster response to events, accidents, press activities, etc. Criminal prosecu on for allowing personally 0% 20% 40% 60% and in the modern era of sensi ve 24 hour news data to and be lost social media comment, this can be vitally important to prevent reputational damage, and, indeed, to saving lives. Reduce storage and infrastructure costs Figure 6: Which three of the following do you consider to be the biggest benefits to your company Exploit and share from our good knowledge information resources governance? (max THREE) (N=478) Faster response to events, accidents, press 0% ac vi es, FOI enquiries, etc. More Reduce personalized storage and and infrastructure accurate service coststo customers Exploit Support and share for our poten al knowledge big data/analy cs resources ini a ves Faster response to events, accidents, press Be er customer/supplier ac vi es, FOI enquiries, rela onships etc. More personalized and accurate service to Pro-ac vely support patents, customers li ga on, healthcare, tax collec on, etc. Support for poten al big data/analy cs Be er reputa on/improved ini a ves shareholder value Be er customer/supplier rela onships Faster and cheaper financial audits 20% 40% 60% Pro-ac vely support patents, li ga on, healthcare, tax collec on, etc. Be er reputa on/improved shareholder value Faster and cheaper financial audits 0% 10% 20% 30% 40% 50% Ge ng senior endorsement It is also worthy of note that support for big data initiatives has moved up from 6th last year to 5th place. Having the right people at the table 2014 AIIM - The Global Ge ng Community anybody of Information to be interested Professionals 8 0% 10% 20% 30% 40% 50% Enforcing it once it is completed

10 More personalized and accurate service to customers Support for poten al big data/analy cs ini a ves Information Governance Policies Creating a comprehensive Be er customer/supplier information rela onships governance policy can be daunting, and the key to success is to obtain senior endorsement. However, even with support from the top, other senior managers Pro-ac vely support patents, li ga on, need to sign-up to take healthcare, part. Our tax users collec on, also identified etc. enforcement of the policy once in place as a big issue, which we will return to later. Be er reputa on/improved shareholder The scope of extending coverage from records value to include all stored content is considered to be an issue, especially for mid-sized businesses, but identifying the legal requirements does not come high on the list, despite changing (and Faster confusing) and cheaper laws financial on data audits protection. For smaller organizations, finding time and resources is obviously difficult, and this heads the list for them. Figure 7: What have been the three biggest issues with creating an information governance policy? (N=387) 0% 10% 20% 30% 40% 50% Ge ng senior endorsement Having the right people at the table Ge ng anybody to be interested Enforcing it once it is completed Alloca ng sufficient me from the day jobs Extending coverage to all stored content Transla ng the policies into system rules Nailing down classifica on and taxonomy Being over ambi ous in scope and detail Trying to cover too many scenarios Iden fying the legal requirements Most respondents have had to fight to gain involvement 0% and 5% support 10% from 15% senior 20% 25% 30% for creating an IG policy. Enforcing it once complete is a further issue for many. The RM/IM/Compliance department takes responsibility Each line of business or department manages their own records Responsibility As we have moved from the IT paper are mostly records responsible era to electronic records, the involvement of IT has increased steadily. Moving The on again IG Commi ee to the IG set era and where supervise all stored content needs to be managed for security, accessibility and lifecycle, policies the involvement for all departments of IT is paramount, even if the ultimate responsibility still lies with the Records Manager or increasingly the Compliance Officer. However, we can see from Figure 8 that in 28% of organizations The legal records department takes the responsibility lead resides within each line of business or department a situation which is unlikely to be conducive to a coordinated, enterprise-wide information governance There is no formal alloca on of initiative. Only 10% have a formal IG responsibili es committee to oversee activities, policies and systems. In 24% of organizations, responsibility has not been formally or specifically allocated AIIM - The Global Community of Information Professionals 9

11 Trying to cover too many scenarios Iden fying the legal requirements Figure 8: How would you describe allocation of responsibility for information governance and retention of records in your organization? (N=393) 0% 5% 10% 15% 20% 25% 30% The RM/IM/Compliance department takes responsibility Each line of business or department manages their own records IT are mostly responsible The IG Commi ee set and supervise policies for all departments The legal department takes the lead There is no formal alloca on of responsibili es Maturity Despite the publicity that data leaks and privacy breaches have generated over the last year, there is little evidence that organizations have taken much notice in particular their senior managers. Overall, 52% have undertaken or are undertaking IG projects, but sadly, for a third of those it has been a somewhat wasted exercise in that the policy is largely unreferenced and unaudited. Only 8% feel that the policy is in place and is working. Figure 9: Which of the following do you think best describes the way that information governance policy is regarded in your organization? (N=391) Senior show li le interest or investment, 9% We have li le in the way of official policy, just accepted prac ce, 12% Nobody takes much interest, 10% It s in place, it s important and it's communicated and enforced, 8% We have a policy but it s largely unreferenced and unaudited, 17% It s very variable across different departments, 17% We are working hard to achieve a corporate-wide view, 27% IG Policy Scope Best practice for information governance is to ensure that all stored content is addressed by the policy (content at rest), as well as any content being accessed or transferred between servers, websites, user clients or mobile devices (content in motion). 0% The 10% issues 20% addressed 30% 40% should 50% include 60% secure 70% access, privacy protection, back-up, disaster recovery, retention, legal discovery and legal hold. Informa on reten on Access/confiden ality Data protec on and PII Dele on and disposi on processes Legal holds and e-discovery 2014 AIIM - The Global Community of Information Professionals 10 Informa on in mo on laptops, USBs, etc.

12 important and We it's are working much interest, 10% communicated hard and to achieve a It s very variable enforced, corporate-wide 8% across different view, 27% departments, Senior 17% show We have a policy Although most organizations with IG policies li le interest cover or a variety of these requirements, it is obvious but it s from largely Figure unreferenced and un- 10 that there are many gaps for most. investment, 9% audited, 17% Figure 10: Which of the following We have elements li le in are included in your information governance policy? the way (Check of official all that apply) (N=388) policy, just accepted prac ce, 0% 10% 20% 30% 40% 50% 60% 70% 12% Informa on reten on We are working Access/confiden ality hard to achieve a It s very variable corporate-wide across different Data protec on and PII view, 27% departments, 17% Dele on and disposi on processes Legal holds and e-discovery Informa on in mo on laptops, USBs, etc. Content in archive/back up Audit of compliance Laws and regula ons in mul ple Informa on jurisdic ons reten on Mobile access and Access/confiden ality on-device storage Devices outside of corp. control Data (BYOD protec on & home) and PII Use Dele on of cloud-based and disposi on content sharing processes None of these/we Legal holds have and no e-discovery policy Informa on in mo on laptops, USBs, etc. Content in archive/back up Audit and Conformance 0% 10% 20% 30% 40% 50% 60% 70% Audit of compliance As we suggested Laws and earlier, regula ons an IG in policy mul ple that jurisdic ons not referenced and supported is not going to help the business achieve compliance and remain compliant. 0% 10% 20% 30% 40% 50% Mobile access and on-device storage Training Devices outside of corp. control All staff, (BYOD regularly & home) One way to ensure that staff are made aware of the importance of information governance in particular and compliance in general Use is of to cloud-based train them content part sharing All staff, occasionally/ad hoc of their post recruitment on-boarding. The only way to keep them aware is to train None all staff of these/we as part of have a regular no policy program. Unfortunately, 40% of organizations New in recruits our survey only do not allocate any time to IG training, and only 12% regularly train all staff. A tiny 4% hold specific update sessions for senior. RM staff only Figure 11: Do you allocate specific staff training-time to information governance? Training/updates (Tick for senior those that apply) (N=392) 0% 10% 20% 30% 40% 50% No, we don't allocate training me All staff, regularly All staff, occasionally/ad hoc New recruits only RM staff only Training/updates Very rarely, for senior 31% Yes, on a regular basis, 19% No, we don't allocate training me 2014 AIIM - The Global Community of Information Professionals Yes, but 11 sporadically, 18%

13 RM staff only Training/updates for senior Audit No, we don't allocate training me When it comes to specific auditing of IG policy compliance, only 19% of those with policies run regular audits across the business. 17% carry out departmental checks. 45% nearly half rarely audit or only do so under pressure. Not training staff and not auditing performance shows little intent that IG is a serious consideration for day-to-day operations. Figure 12: Do you audit and measure compliance with policies across the business? (N=305 with IG policies) Very rarely, 31% Yes, on a regular basis, 19% Some mes, when pressured to do so, 14% Yes, but sporadically, 18% Yes, departmentally, 17% Issues from Non-Compliance It seems that many organizations are more prepared to accept the consequences of non-compliance with information governance rules than to implement and mandate improved policies. 52% report that they have had issues of non-compliance over the last two years. 25% have failed internal audits as part of governance monitoring, but more seriously, 24% have had external litigation and discovery issues, rising to 31% of the largest organizations. 17% have had problems with their external auditors. Taking Figure 13 as a whole, this represents an enormous amount of disruption, cost and potential risk to the business. Figure 13: In your organization, has non-compliance created a significant issue with any of the following in the last 2 years? (Tick all that apply) (N=381) 0% 10% 20% 30% 40% 50% None of these Internal audits (regulatory, financial, HR) Li ga on and discovery External audits (industry, government) Freedom of Informa on Requests (FOI) Regulatory submissions Customer audits/sla reviews Cer fica ons (ISO, etc.) Data Protection Data protection and privacy rules vary country-by-country and state-by-state, and some are on a roadmap of change (such as in the EU). Most organizations have a responsibility to protect the information they hold 0% 10% 20% 30% 40% about their employees, and many hold customer or client data of greater or lesser sensitivity. 18% of our respondents were honest enough to admit that their organization would probably fail if audited against their We would probably struggle if audited against applicable the legislation, relevant data and protec on 7% admitted legisla on that they have suffered privacy breaches or data loss. A further 26% We operate to the minimum requirements of the relevant data protec on legisla on 2014 AIIM - The Global Community of Information Professionals 12 We have to meet stricter requirements than

14 Regulatory submissions None of these Customer audits/sla reviews felt unable Internal to comment audits (regulatory, perhaps not financial, surprisingly, HR) as these are potentially legal offenses. Another 22% feel that they are operating at the Cer fica ons very minimum (ISO, of requirements. etc.) Overall, Figure 14 paints a picture suggesting Li ga on and discovery that half of organizations are running significant risks. External audits (industry, government) Figure 14: Which of the following would you say describe the attitude to privacy protection and data Freedom loss of prevention Informa on in Requests your organization? (FOI) (Check those that apply) (N=380) Regulatory submissions We would probably Customer struggle audits/sla if audited reviews against the relevant data protec on legisla on Cer fica ons (ISO, etc.) We operate to the minimum requirements of the relevant data protec on legisla on We have to meet stricter requirements than most due to the nature of our business 0% 10% 20% 30% 40% 50% 0% 10% 20% 30% 40% We could be a target for the of personal data 0% but senior aren t too concerned We We would know probably we are struggle a target if for audited the of against personal the relevant data data but protec on have had no legisla on incidences We operate We have to the suffered minimum privacy requirements breaches and/or of the relevant data protec on legisla on data loss We have to meet stricter requirements than most due to the nature Unable of our to business comment 10% 20% 30% 40% We could be a target for the of personal data Retention but senior Policies aren t too concerned When We it comes know we to are compliance a target for with the data of retention personal policies, there is both a legal risk to the business where undeleted records data may but be have exposed had no at trial, incidences and a financial penalty for excess storage costs. In Figure 15, we have separated out deletion of paper records, s and other electronic records. We have suffered privacy breaches and/or This is obviously an area of concern, as data 84% loss do not delete s and electronic records in a formal way (compared to 45% for paper records, which itself is still 0% not 10% good). 20% It may be 30% that 40% they do 50% not have 60% defined retention periods, they are not Unable actually to be comment carrying out destruction when the retention period is up, or they may wait until other We factors don t such have as defined storage reten on space come into play. For paper records (other than those managed by an electronic system), destruction periods/policies is normally a manual process, but so, it would seem, is the deletion of electronic records and for many. Only 20% have automated deletion, and just 9% have automated systems in place Most to things delete are electronic never records at the end of their retention period. deleted/destroyed Figure 15: How rigorously would you say content deletion/destruction is carried out in your When IT decide to ra onalize organization? storage Paper records (N=384) volumes s 0% Some me a er the reten on date, 10% 20% 30% 40% Electronic 50% records 60% We don t have defined but reten on not sooner periods/policies Manual process or confirma on at end of reten on period Most things are never deleted/destroyed Fully automated, at end of reten on period When IT decide to ra onalize storage volumes Some me a er the reten on date, but not sooner Paper records s Electronic records Manual process or confirma on at end of reten on period Fully automated, at end of reten on period 0% 5% 10% 15% 20% 25% We don t have them 2014 AIIM - The Global Community of Information Professionals 13 We have them but they are mostly not followed

15 volumes Some me a er the reten on date, but not sooner s Electronic records 84% of Manual organizations process have or confirma on ad hoc processes at end ofwhen it comes to deletion of s or electronic records. reten on period Savings on Storage Fully automated, at end of reten on period Given the lack of rigor in deletion policies within most organizations, it is hardly surprising that most are seeing little reduction in storage requirements as a result of data retention policies, although 21% feel they are seeing a worthwhile reduction and 18% a small difference. For many (23%), it will be many years before the effects kick-in a powerful argument for the near 40% doing nothing to get started as soon as possible. Figure 16: To what extent are your data retention policies keeping your storage requirements in check?) (N=391) 0% 5% 10% 15% 20% 25% We don t have them We have them but they are mostly not followed Haven t yet kicked-in for most of our records/content Only making a small difference They make a worthwhile difference They are having a significant effect Automated Classification There are a number of mechanisms for automated classification. The record may be tagged at the point of declaration, or there may be a post-process, either during migration to another system or as a batch agent. Some may work on the existing metadata of a document or ; others will run analytics on the content to create new metadata. The process may be fully automatic, or the user may be prompted to confirm the suggested tagging or metadata revision AIIM - The Global Community of Information Professionals 14

16 According to Figure 17, 45% of those responding to our survey perform some form of automated classification, including 18% at the point of ingestion and 28% as part of the workflow. 15% conduct postprocess metadata cleaning. Figure 17: Do you do any of the following? (Check all that apply) (N=341) None of these 0% 10% 20% 30% 40% 50% 60% Automa cally classify/declare content at the point of inges on to ECM/RM/ system 0% Automa cally classify/declare content as 10% 20% 30% 40% 50% 60% part of workflow/process None of these Prompt for records declara on and Automa cally classify/declare suggest content classifica on at the point of inges on Use OCR to to ECM/RM/ auto-classify inbound system Automa cally classify/declare scanned documents content as Trawl legacy content part of workflow/process for data cleansing Prompt for records declara on or improvement and Process migrated suggest content classifica on for metadata Use OCR correc on to auto-classify or re-alignment inbound scanned documents Automated Trawl Agents legacy content for data cleansing Automated or batch agents are quite or improvement popular with 45% using them in one form or other. Many of these applications flow down from a process of correcting misapplied or unapplied metadata, thereby, for example, Process migrated content for metadata correcting security settings, and enabling deletions against the retention rules, and of course, improving correc on or re-alignment searchability. Tagging, detecting duplicate files and 0% encrypting 5% or 10% redacting 15% are the 20% most 25% popular 30% applications. There are also a number of techniques in use to monitor system health and unusual user activity. Tag/add metadata based on rules Figure 18: Do you use any automated agents to perform any of the following functions: Detect (N=155, duplicate excl. files 188 not using batch agents) 0% 5% 10% 15% 20% 25% 30% Encryp ng or redac ng content Tag/add metadata based on rules Monitor unusual user ac vity Flag for dele on based Detect on duplicate applica on files of reten on rules Monitor Encryp ng performance redac ng and resilience content of ECM/ERM system Detect security Monitor risks and unusual misallocated user ac vity access or confiden ality Flag for dele on based on applica on of Pre-migra on data reten on selec on rules or metadata mapping Monitor performance and resilience of Measure access ECM/ERM frequency system for hierarchical storage Detect security risks and misallocated access Detect/par on/delete or confiden ality trivial or nonimportant content Pre-migra on data selec on or metadata mapping Measure access frequency for hierarchical storage Detect/par on/delete trivial or nonimportant content We are doing it successfully across a number of content 2014 AIIM - The Global Community of Information Professionals types, 8% 15 We have no plans, 24% We are doing it

17 Flag for dele on based or on confiden ality applica on of reten on rules Pre-migra on data selec on or Monitor performance metadata and resilience mappingof ECM/ERM system Automated Records Measure Declaration access frequency for Detect security risks and hierarchical misallocated storage access If we narrow down the automated or classification confiden alitythat leads to, or takes place at, records declaration time, then we can Detect/par on/delete see that there is a huge trivial interest or nonimportant data selec on content or Pre-migra on in moving as quickly as possible in this direction. Only 14% are successfully auto-classifying across metadata multiple mapping content types plus 6% across one or two types, but 25% are just getting started and another 10% are keen to get going soon. In total, nearly half of the survey-takers are Measure access frequency for moving quickly in the direction hierarchical of auto-classification. storage Figure Detect/par on/delete 19: How would you trivial best or describe nonimportant classification content of records? your overall plans for automated declaration/ (N=366) We have no plans, 24% We have no plans, 24% It s something we plan to do in the future, 28% We are doing it successfully across a number of content types, 8% We are doing it We are doing successfully it across successfully across one or a two content number of content types, 6% types, 8% We re are just doing ge ng it successfully started, 25% across one or two content types, 6% We are keen to automate We re as soon just as ge ng we can, 10% started, 25% Content Types It s something we plan to do in the We are keen to The most popular application area is inbound documents both scanned automate and as electronic. soon as This has the future, 28% benefit of automating routing and distribution as part of the digital mailroom we can, concept, 10% as well as preallocating the trailer documents that are often just checked for compliance purposes and then archived. Despite the increasing volume of s exchanged with customers, automating the response mechanism is only half-way up the table. 0% 10% 20% 30% 40% 50% Figure 20: Are you Incoming using scanned automated declaration/classification for the following Incoming electronic (PDF, Web, content etc.) types? (N=112 users) Office documents On exit from process Incoming workflow scanned Incoming electronic (PDF, Web, etc.) Office SharePoint documents Output On exit documents from process to customers workflow Website content Internal social business SharePoint systems Output documents Instant to messaging customers Website content Internal social business systems Instant messaging 0% 10% 20% 30% 40% 50% 2014 AIIM - The Global Community of Information Professionals 16

18 Benefits As we will see later in the report, 43% of respondents agree that automated classification is the only way to keep up with the volume of content that needs to be processed or sorted. However, coping strategies are seldom funded, so we asked about specific benefits. Searchability, productivity and compliance come out as the strongest. There is no business value in content that can t be found; people are being bogged down trying to tag content manually; and if they get it wrong, or avoid doing it altogether, then they will be in breach of compliance. Figure 21: What would you expect to be/what have been the two biggest benefits from automated classification? (Max TWO) (N=355) 0% 10% 20% 30% 40% 50% 60% Improved searchability General staff produc vity Defensible compliance Repository alignment Storage volume reduc on Staff coopera on 0% Big data readiness Improved searchability Migra on General staff produc vity Not sure yet 10% 20% 30% 40% 50% 60% Defensible compliance We also asked Repository the non-users alignment what is putting them off from using automated classification and declaration. By far the Storage biggest volume reason reduc on is that nobody is pushing for it. They need a champion. Then, of course, there is the fact that they need to sort out their IG policies first or they will have no rules to put into the classification engine. Only a few Staff non-users coopera on questioned how well the process might work from the technical standpoint. It s hard to actually Big data readiness It s hard to actually Accuracy measure this, measure this, Measuring 18% the accuracy Migra on of automated Much classification be er requires the setting up 5% of representative documents, Much be er or than expected, using a sampling technique with human verification. It would seem from Figure 22 that users are than more expected, Not sure yet Not as good likely 17% to put this in place for scanned documents than for electronic as ones. expected, Either way, for both types of document, 27% 12% only Not as 11% goodfeel that the accuracy of the classification engine is worse than expected, with the accuracy on scanned as expected, documents using OCR being generally much better than expected. 11% Figure 22: How would you describe the accuracy of automated declaration/ classification that you are achieving About for the electronic/scanned same documents? (N=125 users) About the same as expected, as expected, 54% 56% It s hard to actually measure this, 18% Not as good as expected, 11% Electronic Documents Much be er than expected, 17% It s hard to actually measure this, 5% Not as good as expected, 12% Scanned Documents Much be er than expected, 27% About the same 0% 20% 40% 60% as expected, Start small and build out with confidence 54% Se ng up the rules is challenging and me-consuming Generally, it works and is well worth the investment Needs constant monitoring to ensure compliance Electronic Documents Scanned Documents About the same as expected, 56% 2014 AIIM - The Global Community Information Professionals 17 It takes a huge load off of opera onal staff 0% 20% 40% 60%

19 It s hard to actually It s hard to actually measure this, measure this, 18% Much be er 5% Much be er than expected, Not as good than expected, 17% When asked about the accuracy and consistency of human beings as expected, 27% versus machines, there is a general 12% consensus Not as good that humans are more accurate than machines, but much less consistent and generally too slow, although as expected, 26% consider machines can be both more accurate and more consistent. On the other hand, 44% 11% feel that machine prompting for human decision works the best. Experiences About the same as expected, We asked the users what they had learned 54% from their automated classification projects. The general advice 56% is to start with smaller, more achievable projects and build out from there. There seems to be no doubt that time will need to be invested in setting up the rules, and that even then, consistent monitoring is needed to ensure compliance Electronic is being Documents met. On that basis, the consensus is that automated Scanned classification Documents works and is a worthwhile investment. Figure 23: What have been your experiences with automated classification? (Check any that apply) (N=120 users) About the same as expected, 0% 20% 40% 60% Start small and build out with confidence Se ng up the rules is challenging and me-consuming Generally, it works and is well worth the investment Needs constant monitoring to ensure compliance It takes a huge load off of opera onal staff When it gets it wrong it can be very wrong! It has transformed the completeness and accuracy of our records We needed to increase the spread/number of training documents 90% of those using automated classification are satisfied that the performance is sufficiently accurate, although attention needs to be given to the rules setup, 0% and 5% ongoing 10% monitoring 15% is important. 20% 25% Fixed dele on periods enforced on mailserver Archives Automa cally selected for archive into ECM/RM system In a classic records or information governance scenario, s are simply another form of electronic document, Manually a (small) selected proportion for archive of into which need to be tagged and declared as records into the records system. Unfortunately, ECM/RM systemeven a small proportion of a massive daily volume can overwhelm a user s ability Moved (or enthusiasm) to a dedicated for tagging. On top of that, there is the potential that excessive numbers of s will clutter up the archiving clutter up system the RM system, or overwhelm it with duplicates. Automating the declaration of s Reliant into on records server can be to create one way to overcome this, although while 14% of our respondents direct records to archives/back-ups ECM, only 3% use automation and this is despite the fact that most inbound s are already scrutinized by quite intelligent spam and virus filters. Reliant on archive se ngs in client For some organizations (13%), (e.g., the Outlook answer Archive) has been to implement a dedicated archive to handle bulk s, where they can be dealt with in a robust, and possibly automated way. We keep everything It s not mandated or policed in any way 2014 AIIM - The Global Community of Information Professionals 18

20 We needed to increase the spread/number of training documents Figure 24: How would you best describe your mechanism for archiving s? (N=357) 0% 5% 10% 15% 20% 25% Fixed dele on periods enforced on mailserver Automa cally selected for archive into ECM/RM system Manually selected for archive into ECM/RM system Moved to a dedicated archiving system Reliant on server to create archives/back-ups Reliant on archive se ngs in client (e.g., Outlook Archive) We keep everything It s not mandated or policed in any way The remaining strategies in Figure 24 leave much to be desired. 17% keep everything, 16% delete everything after a fixed period, and 22% have no policy or strategy. For those that do have a dedicated archive, most could not consider it to be a records repository. 30% still do mass deletion, with only 8% using any kind of metadata analysis or rules to justify their actions, such as recommended by the Capstone guidance for government agencies. Only 8% go further and analyze the body content of s for classification purposes. When it comes to RM functionalities such as retention, 24% have basic retention and hold functions for legal discovery, plus 10% who have rules-based automated retentions. More encouragingly, 16% have integrated search, discovery and hold integration with other content systems using manage-inplace scenarios. Figure 25: What level of RM functionality do you use on your archive system? (N=49 users, excl. 15 Don't Know) Fixed dele on based on elapsed me Fixed dele on using rules and system metadata (e.g., as per Capstone) Classifica on using content analy cs of body content Basic reten ons and holds Event-triggered dele on Automated reten ons and holds based on rules Search/discovery/hold integra on with other content systems 0% 5% 10% 15% 20% 25% 30% 35% 17% keep all s, 16% delete after a fixed period, and 22% have no policy or strategy a total of 55% who are not providing formal governance of s. 0% 20% 40% 60% 2014 AIIM - The Global Community of Information Professionals 19 Triggered by ECM/RM system(s)