How to Plan and Implement Information Governance

Transcription

1 Doculabs White Paper: How to Plan and Implement Information Governance Information governance (IG) is the control of information to meet your legal, regulatory, and business risk objectives. The primary focus of IG is to protect an organization by controlling the risks and the risk-related costs of that organization s information as opposed to objectives that impact the bottom line, such as improving productivity, reducing the time to bring a product to market, or improving customer retention. While these may well be secondary benefits, the primary benefit of an effective IG program is the control of risk and risk-related costs. This white paper provides an overview of why information governance has become increasingly complex in recent years, then presents a comprehensive program framework for planning and implementing IG within your own organization Doculabs, 200 West Monroe Street, Suite 2050, Chicago, IL 60606, (312) , [email protected]. Reproduction in whole or in part without written permission is prohibited. Doculabs is a registered trademark. All other vendor and product names are assumed to be trade and service marks of their respective companies.

2 2 Doculabs White Paper Introduction This white paper introduces some of the most important issues in information governance IG) to help get you started. It addresses the following topics: What s the scope of information governance? How is information governance different today? How should you plan and implement information governance? An example: addressing the fragmentation and landfill problems What s the Scope of Information Governance? Let s start with a definition. The best general definition we ve seen for information governance is Robert Smallwood s: Information governance is the control of information to meet your legal, regulatory, and business objectives. It s a great start because it s accurate and simple; it avoids the trap of being a laundry list written in legalese. But let s tweak it to clarify it and guard it from overreach and failure. Let s say: IG is the control of information to meet your legal, regulatory, and business risk objectives. Information governance doesn t address all your business demands; its primary focus is on defensive business objectives, as opposed to offensive business objectives. IG s primary focus should be on controlling the risks and costs (primarily the risk-related costs) of your information. It doesn t primarily address the offensive objectives of operational efficiency or meeting customer demands; its primary focus is not on helping you meet your sales numbers, improve the time needed to bring a product to market, improve customer retention, or rebrand your company. These may be secondary benefits of good information governance, but defense should have priority. This narrowing of focus is critical, as no other discipline in your organization can do the job of information governance, and this job is becoming very complex very quickly. If your IG program succeeds at protecting your organization from information risk and risk-related costs, it s a successful program. But whether or not it improves the operational efficiency of some of your business processes, if it fails to protect you, it s a failure.

3 How to Plan and Implement Information Governance 3 How is Information Governance Different Today? (Or How to Get from Year 2000 IG to Year 2020 IG) Here are what we might call 2015 and 2020 IG problems: 1. The digital landfill problem. You may have 50, or 100, or 1,000 terabytes of documents all over the place in your various systems. Some of you are approaching 10,000 TBs (10 petabytes). How do you sort through it and responsibly retain or dispose appropriately within your budget constraints? 2. The systems of engagement fragmentation problem. How do you do IG on your dynamic, sometimes chaotic systems of engagement (SOE)? They use social media, mobile devices, and the cloud. You may be feeling your way with some deliberate initiatives to move your business forward with these new technologies, but they re also growing organically, both within and outside your organization. So your problem has three parts: - How do you meet your IG demands with your internal use of systems of engagement which you use for collaboration, interactive community building, etc.? - How do you meet your IG demands with your use of external SOE beyond the firewall, with customers, vendors, and the public? - How do you meet your IG demands in how you re integrating your evolving SOE into your more mature systems of record, which help to run your core line-of-business processes? 3. The discovery problem. How do you prepare for and respond to litigation and other discovery, given numbers 1 and 2 above? Most of today s commonly adopted IG technologies and practices would fail for records management and IG in 2000; forget about 2005, 2010, 2015, or To pick one example, take a look at most of the complaints about the adequacy of Microsoft SharePoint for enterprise records management (RM). The list includes usability in every RM activity, such as: The dilemma that while a separate records repository a Records Center is untenable for the enterprise, going without one makes the RM job almost insurmountable The unwieldiness of administering types (records series, classes, etc.) The difficulties in getting either humans or machines to reliably declare and classify content, etc.

4 4 Doculabs White Paper But these are old RM problems. They were some of the big problems back in the year 2000 for electronic records management. If you were around back then, think about what electronic RM problems you wanted to tackle. These probably included: Managing the electronic analogues of the documents your paper RM program had been managing. These were the high-value, high-risk, highly manageable documents you were already managing in paper according to your retention schedule. Managing the electronic documents, some of which were records, that were authored or modified by knowledge workers using Microsoft Office and . Managing electronic documents that were of lesser value, risk, and manageability than the first bullet point above, or were of possibly high value and risk, but which were mixed in with a lot of lower value and risk documents. So part of the challenge was sorting the haystack. Managing , particularly the messages and attachments that qualified as records, being of high value and risk. These are all Year 2000 IG problems. They all increased in magnitude by 2005 with more records, desktop-authored documents, junky documents, and and there were some additional problems. Some of these additional problems were caused by the solutions themselves. Most of the management solutions that were deployed in the early 2000s weren t able to scale or provide fast reliable access to the archived s and attachments. As a result, many users defected and redoubled their efforts at squirreling away messages and personal archives, thus rendering disposition impossible. Other new problems arose because of new technologies the Internet, for instance. For a first approximation, we might divide the history of IG into the history of five periods and the kinds of problems they face: Period 1: Pre-2000 (predominantly paper RM) Period 2: 2000 (the four problems outlined above; also electronic document management systems, or EDMS) Period 3: 2005 (the magnification of the four problems, plus the Internet; also enterprise content management, or ECM) Period 4: 2015 (the magnification again of the preceding, plus the SOEcaused fragmentation problem and the digital landfill) Period 5: 2020 (the magnification of the preceding, plus expected and surprising disruptions) Most organizations are somewhere around 2000 when it comes to IG. IG gets interesting because today we don t have the luxury of stepping through each period sequentially. We must address 2015 challenges like the fragmentation problem and the digital landfill, while also trying to speed through the last 15 years or so.

5 How to Plan and Implement Information Governance 5 How Should You Plan and Implement IG? IG is a mix of a lot that s old and a lot that s new. The good news is that while much of the terrain is very new (mobile, social, cloud, big data, and petabytes of files), there are proven, reliable methodologies that we can apply to keep us on solid ground as we forge ahead. Start with an IG program framework just a glorified checklist, but a useful one for organizations addressing complex initiatives in enterprise information management, ECM, RM, regulatory compliance, and e-discovery. The program framework organizes the individually necessary and jointly sufficient activities for planning and management initiatives in the content technologies. Assembling these conditions and activities to effectively handle IG involves much more than just technology or process. Effective IG requires competency in a number of different areas. We have found that it s most useful to bucket the areas of competency into six general categories: AREAS OF COMPETENCY Overall Information Governance Program Strategy Governance Team and Operations Information Architecture Process Design and Implementation Architecture and Technology Communications and Training The following subsections address each of these categories. Overall Information Governance Program Strategy A best practice is to develop an overall strategy for an IG Program that encompasses and aligns your organization s existing visions and strategies for IG, addressing any significant gaps that may exist. The strategy should also establish, at a high level, general principles for the level of resources the organization will apply to the program. The key elements of an overall IG program strategy typically include: Your set of defined goals, priorities, and desired outcomes. This will include ranking your defensive objectives (your regulatory, legal, and business risk objectives) against each other, against acceptable levels of costs and risks of project failure, and against your offensive organizational objectives (e.g. business process operational efficiency, increased sales and retained customers, products in the pipeline, etc.). Your explicit, documented IG policy. This is the design specification that clearly states the objectives your IG program will fulfill. You should be able to defend your actions by pointing at your policy for information control, which shows what you intend to do, and then showing that you are following it. You don t need such a policy for many other kinds of content initiatives, like most ECM programs. But you should have one for

6 6 Doculabs White Paper IG, since you ll likely need to defend your information governance actions by pulling out your IG policy and showing how, in practice, you fulfilled it. An objective assessment of your organization s current state with respect to IG. Address the familiar categories: people, process, technology, and content. There s a solid methodology for doing this, available from AIIM and others. A realistic target future state vision. This future state vision is typically defined for a periods of 1.5 years, 3 years, and 5 years out. It should be clearly articulated and documented. A roadmap. This roadmap outlines the sequencing of projects required to take you from your current state to your sequence of future states. A business case. Often, it s advisable to develop a business case showing that the expected benefits of your IG program justifies the required investment of time and capital and justifies an acceptable level of risk of initiative failure. The good news is that in the eyes of the law you don t need to be perfect; you don t have to perfectly satisfy your retention, disposition, and other IG demands. However, you do need to use the Principle of Reasonableness and act in Good Faith: Courts do not ask, expect or necessarily reward organizations for perfection. Courts do expect, however, that whatever information management tactics an organization undertakes are appropriate to how that particular entity is situated (size, financial resources, regulatory and litigation profile, etc.). 1 Governance Team and Operations This component of the IG Program addresses the governance and operational structures for implementing the program. The key elements of the governance and operations component are: Structure of the Governance Team Operational Roles and Responsibilities of the Governance Team You probably know that a program of any complexity requires some kind of formal governing. But it s hard to know where to begin. This section should get you started by addressing how you should stand up your IG team, where it should live, and how it should operate. 1 Jim McGann and Julie Colgan, Implement a defensible deletion strategy to manage risk and control costs, Inside Counsel.

7 How to Plan and Implement Information Governance 7 How should you stand up your IG team? In most cases, you should start with a lightweight team dedicated to IG. If you re reading this, you probably have an IG project planned or under way, with a project core team. Members of this project core team can form an interim steering committee until a more permanent body is established. In the first phase, members will work only part time on IG, while still having their main jobs. Then, if there is enough IG work and a solid business case, you will transition to a permanent body with dedicated roles and resources to fill them. Where should the IG team live? Where the IG team should live depends a lot on your organization context; specifically, on such factors as: - Where the impetus for IG first arose at your organization. Did it start in Legal or Records Management, in IT (maybe with a focus on security and business continuity), or perhaps in the business (maybe with a focus on intellectual property)? - Where the records management function currently lives at your organization. Is it part of facilities management (bad) or part of an organizational unit that also addresses IT or Legal (good)? - Where your organization falls on the authority continuum. Is authority at your organization centralized, federated, or distributed? How should the IG team operate? More important than where the IG team lives is how it operates. Will it include participation from the lines of business, IT, and other governance functions? Will it have top-level executive support? A picture will help clarify how the IG team should operate: Many IG teams start at the upper right as strategy advisory bodies. But in an IG program of any complexity, the other three cells should be filled. IG programs require alignment of strategy and efforts, and it s wise to do this well rather than stagger into it. Most successful organizations therefore expand the authority of the IG team leftward, from just providing advice to providing more control over what should be done. They also expand the focus of the IG team downward, to facilitate not just what should be done, but how it should be done.

8 8 Doculabs White Paper Information Architecture This component of the IG Program addresses how information is organized. It includes: We find that many organizations have the first item, the records retention plan, but relatively few have either an information architecture or taxonomy (to organize their information), or an ESI-repository map (to show where their electronically stored information, or ESI, is stored). A records retention plan can be strengthened by undertaking the development of an information architecture and by developing an ESI-repository map. The taxonomy facilitates ESI management and discovery. A well-designed taxonomy is necessary for effective e-discovery search and discovery readiness and can significantly reduce an organization s requirements for e-discovery search technology products and development. It also facilitates the development and maintenance of an effective records retention plan. The plan addresses not only paper documents, but ESI, along with the particular metadata, confidentiality, and other issues associated with ESI. The third element, the ESI-repository map, is critical to the development and maintenance of information architecture. To create this map, conduct an inventory of the instances of your organization s ESI not just the types that are addressed in a taxonomy or retention plan, but an inventory of where the bodies are buried. The inventory includes descriptions of the formats and other relevant characteristics of your ESI and notes the systems in which they reside. As part of this inventory, evaluate the value, risk, manageability, and required management capabilities for the various types of ESI and identify areas requiring improvement (e.g. whether to keep that type of ESI in place and manage it with the in-place system or to move it to an external system). There s been a dramatic advance in the effectiveness of this kind of mapping in the last few years, with the greater use of assessment tools. This repository mapping dramatically helps with discovery by helping you fulfill the pre-trial conference requirements that are now part of the Federal Rules of Civil Procedure (FRCP). But more important, the repository mapping helps you to prioritize ESI and the systems that need improvement and to develop an effective roadmap for IG. Make sure that your ESI map is informed by technical expertise and that it includes an evaluation of your organization s content systems and repositories, as well as proactive recommendations to help improve your organization s discovery readiness.

9 How to Plan and Implement Information Governance 9 Process Design and Implementation This component of the IG Program addresses the overall processes used to support the information lifecycle and IG. These include: The information and records lifecycle management process defines the upstream and downstream ESI lifecycle stages. The information and records lifecycle management process defines the upstream and downstream ESI lifecycle stages. It typically includes the following stages: Ingestion Indexing (declaration and classification) Access and distribution Retention Disposition Lifecycle management is necessary for effective discovery readiness, in order to control litigation risks and costs. You may find the Information Governance Reference Model (IGRM) somewhat helpful in guiding you, although we find it not as useful as the Electronic Discovery Reference Model (EDRM). 2 A great starting point for evaluating and defining your discovery process is to map it against the industry-standard EDRM, which identifies the following stages for the discovery process: Identification, Collection, Preservation, Processing, Review, Analysis, Production, and Presentation. It s among the most useful standards to come out of the content technology world because it fulfills the two requirements for any good standard: it is actually very useful and it has become widely adopted. Organizations then need to design the rules: the structured, modular set of policies, procedures, and guidelines that are essential for an IG Program to be successful. In our experience, most organizations have outdated, incomplete, incomprehensible, or otherwise inadequate rules. The policies should fulfill the organization s defensive requirements, yet be capable of being put into practice. The procedures must fulfill the policies if followed. The guidelines must fill in any gaps that make the policies and procedures difficult to execute. And all such rules must be easy for the organization to maintain and to modify when necessary. 2 For more detail on both models, see

10 10 Doculabs White Paper Architecture and Technology This component of the IG Program addresses the overall technologies that are relevant to IG, as well as the architecture addressing how they fit together. IG must be concerned with the dual nature of your organization s content technologies, as they are the cause of and possible solution for most of your IG problems. The relevant technologies include ECM, RM, e-discovery, and the newer technologies involving mobile, social, cloud, and big data. The emerging stable category for all of these technologies is enterprise information management (EIM). EIM includes ECM, but also enterprise data management (EDM), the social content technologies, and all the relevant RM, discovery, and analytics tools. We recommend that organizations develop a functional architecture for IG. Where relevant, it should align and integrate the different tools and capabilities you have or need for ECM, RM, management, e-discovery, social content, etc. This helps ensure that IG become entrenched in an organization s IT strategy, enabling the IG program to leverage the organization s technical resources and technologies. Developing the architecture required to effectively fulfill the IG Program requires not just technical expertise, but also ECM, RM, and related expertise to provide a more comprehensive strategy for controlling the risk of your enterprise information. Communications and Training This component of the IG Program addresses the way you educate the user community and improve compliance and adoption of the procedures and solutions that support IG. The communications and training component includes: Communications and training should socialize the IG Program and the rules, ensuring that the policies defined as part of the program continue to be effectively followed in practice. Training should differentiate between types of roles, including information consumers, contributors, and coordinators as well as subtypes within each of those categories. Coordinators, for example, include IT administrators, records coordinators, business unit managers, and many others. The goal is to achieve high employee participation, along with high quality of participation. But practically speaking, it s difficult to achieve both of these objectives from the beginning. So a best practice is to identify the highfrequency, high-risk, high-value areas within the organization, focusing communications and training on them and aiming for high participation in those areas. Then, as the program develops, participation and quality can be ramped up.

11 How to Plan and Implement Information Governance 11 An IG Program is most effective when these communication and training activities are strategically integrated into the IG Program roadmap, and when those activities are sufficiently differentiated to address the specific information needs of the various participants in the discovery process. The result is higher participation and higher quality participation. Example: Addressing the Fragmentation and Landfill Problems Let s use some of the methodologies described above to address two of the challenges identified previously in this white paper as 2015/2020 problems: the fragmentation problem and the landfill problem. We ll focus first and primarily on the fragmentation problem. The fragmentation problem is the outcome of the explosion of systems of engagement (SOE) a useful popular term to distinguish the collaborative and social technologies from the older systems of record (SOR) that most of us in ECM are familiar with. (And when we say SOR, it doesn t mean we re confused about what a records manager s record is; it s just a useful term.) The SOE and associated trends include mobile applications, social media, wireless access, life-splicing (integrating professional and personal life), multiple BYOD devices and platforms, syncing all devices by using the cloud, and consumerization. Such trends are the primary cause of the fragmentation problem, which shows itself in uncontrolled diversity, failed enterprise syncing (a problem way beyond desktop syncing), and other SOE problems such as content getting stored in multiple locations; multiple and varied content formats; failed access; and the absence of security control, version control, process control, and backup. What we want to do is maximize the upside of these new realities, while minimizing the downside: i.e. increase the benefits, while decreasing the costs and risks. Following is a brief outline of how you might address the fragmentation and landfill problems, focusing on just a few highlights of the IG Program Framework activities and components described previously in this white paper. Step 1: Assess your current state. Do a quick, focused current state assessment of your organization s situation, particularly with respect to ECM and your social content technologies. Address the ECM categories people, process, technology, and content using the solid methodologies you can get from AIIM and others. 3 But also be sure to address and document the important SOE issues. Look for your organization s social media policy (or develop and provide one, if you don t have one. Download a starter policy and tweak it for your own organization). 3 See for resources on best practices in ECM.

12 12 Doculabs White Paper Assess and document the important SOE categories and issues, such as the division of labor between IT and users, the capabilities used, the configurations, the types of devices (such as smart phones, Blackberries, ipads), and the types of users and user scenarios. You ll see lots of fragmentation: uncontrolled diversity, failed enterprise synching, and lots of SOE problems. For basic ECM health and IG adequacy, these need to be managed at the enterprise level. Step 2: Implement general baseline rules. Define and implement baseline rules i.e. standards, policies, and guidelines across your information silos, content formats, devices, business units, and organizations. Step 3: Address over-retention to control both fragmentation and the landfill problem. Over-retention is a huge problem that would have plagued us without the explosion of SOE and fragmentation, but it s far worse with them. Think of and Twitter feeds, distributed repositories inside and outside your firewalls and organizations, and so on. Organizations have been overretaining electronic information and failing to dispose of it in a legally defensible manner when business and law will allow. It s an issue you must address if you re going to be letting folks seriously engage with SOE. Almost all organizations over-retain, but this problem is far worse for bigger organizations. So if you re a small firm, you may be in pretty good shape. But if you re big, you may have hundreds of terabytes or even petabytes of information that is only compounding. So you must address it if your organization is to meet general adequacy. The best way to address this monster problem of over-retention is to break it into two more tractable sub-problems: day-forward information disposition and historical informational disposition. Step 4: Tackle day-forward over-retention first. Addressing day-forward over-retention is much easier to address than historical retention, even though addressing it messes with employees day-to-day activities. The key is to initiate information lifecycle practices on a day-forward basis first, so that any new content created or saved is assigned a disposition period. Then provide employees with very clear and explicit guidance for the acceptable use of available tools for dynamic content and their associated retention periods. An example is to retain non-records for 3 years, and retain official records per the retention schedule. The above is an example of guidance for day forward. A best practice is to break your systems and repositories into four or so different categories. Note that for a category such as Social Community Sites, you might say that you can t store documents in the communities but only links, and you could establish a medium retention period for non-document content, such as discussion threads.

13 How to Plan and Implement Information Governance 13 Step 5: Address your landfill of historical content over-retention by using a defensible disposition methodology. The good news is that there s a solid methodology to follow that s specific to defensible disposition. It ll be a long haul and you may be at it for years, but you can tackle it incrementally and you ll start getting immediate benefits. You do it by developing and then executing the following four pieces: The Defensible Disposition Policy the design specification that states very clearly the objectives that your defensible disposition methodology will fulfill; a smaller, more specific version of your IG policy, described above. The Technology Plan addresses what analysis and classification tools you should use, as there are lots of them out there and you should pick the right ones for your particular needs. The Assessment Plan describes how you ll use the automated tools and human labor to sort through your piles of files. It includes the sets of rules you ll use. The Disposition Plan describes how and when you ll purge or keep the results of your sorting.

14 14 Doculabs White Paper The Final Word Putting an IG Program framework in place involves more than just technology or process; it requires competency in areas such as program strategy development, information architecture, technology architecture and standards, and communications and training. And pursuing the requisite funding for initiatives in these areas may require making a convincing business case to take to executive management one that addresses the broad range of benefits that an effective IG program brings to an organization. Doculabs can provide expertise in these areas, helping you take an objective look at your existing practices and identify any significant gaps that may exist. We can then work with you to develop a vision and strategy for IG, along with the roadmap to take you to the target future state and the business case to help you obtain the buy-in and funding to realize your vision for IG. Make no mistake: Information governance has become increasingly critical as the content in the digital landfill continues to proliferate. The challenges have only compounded with the advent of the new systems of engagement. Finally, these problems themselves only exacerbate the difficulties of conducting discovery on this volume of content, whether for litigation, audit, or regulatory compliance. Getting control of your information is a complex undertaking. But it s an increasingly important element of how an organization controls risk and riskrelated costs to meet its legal, regulatory, and business risk obligations.

15 About Doculabs Doculabs is a strategy consulting firm. Our clients rely on us to help them improve the way they manage information. The services we provide include the development of strategic roadmaps and business cases, program management, and content migration assistance. Our consultants are experts in helping clients manage business content such as Office documents, web content, , customer communications, and corporate records to improve operations, lower costs, increase revenue, and reduce risk. 200 West Monroe Street Suite 2050 Chicago, IL (312) Doculabs at: [email protected] Doculabs has in-depth expertise in information management across a range of industries, from financial services and insurance, to energy, manufacturing, and life sciences. Our recommendations are based on our experience and our empirical data from the hundreds of consulting engagements we have conducted since We do not sell technology solutions; we provide services and recommendations that are completely objective. This objectivity is the cornerstone of our reputation as trusted advisors. For more information about Doculabs, visit our web site at or call (312)