Information Governance Is Diet and Exercise – Part 1

In general, I like to break problems down into two types: complex, difficult problems and straightforward, difficult problems. Landing a rover on Mars would be an example of the former. Diet and exercise would be an example of the latter: No one is confused about what they’re supposed to be doing, it’s just difficult to actually do it. There’s almost too much information out there about eating right, getting enough sleep, effective exercises and mindfulness. But once you have a meal plan, workout routine, a sleep schedule and meditation approach, you need to execute on it day in, day out, for the rest of your life.

Information governance (IG) is a great example of a straightforward, difficult problem. The what organizations need to do is well-known — it’s the how, the doing of it, that can keep them from being successful. If your internal stakeholders, outside counsel, professional services partners or software providers see IG as an example of a complex, difficult problem, it’s time for a level set. Like diet and exercise, IG is hard enough when you’re clear on how to approach it. If you’re overcomplicating it, however, you have a slim chance of actually succeeding.

This series of articles will address the most important challenges facing information governance. These are challenges that typically lead organizations to consider IG a complex, difficult problem:

• Moving beyond records
• Impractical records retention schedule
• Lack of executive alignment
• Focus on go-forward IG

In reality, these challenges have straightforward solutions, albeit ones that are, like diet and exercise, difficult to execute.

Let’s turn now to the challenge posed by moving beyond records and how you need to evolve your records information management (RIM) policy to do so.

The Problem With Records

The most pressing issue with RIM policies is their reliance on the distinction between records and non-records. That is, certain kinds of documents at a fixed point in their lifecycle rise to the status of records — before that, they are non-records (and therefore aren’t in scope for management) either because they aren’t the kind of document that RIM cares about or because they are work in progress or convenience copies.

There are a number of problems with this approach to RIM:

• It relies on end users to understand the difference between records and non-records and be able to accurately and consistently apply the distinction in their day-to-day work.
• An organization’s information risk isn’t correlated to records vs. non-records but rather, sensitive vs. non-sensitive data.
• Many systems are unable to manage data according to the distinction between records and non-records and so compliance needs to be manually effected.

These problems are compounded when the RIM policy also relies on distinctions between categories of records, e.g., vital records, business records, essential records and so on. From an end-user perspective, asking them to not only understand the distinction between records and non-records but also what makes a record vital versus essential places a heavy burden on them — and opens the door for inconsistency and the appearance of caprice, both of which impair the defensibility of your RIM practices when interacting with regulators or the courts. From a technology perspective, trying to support a complex taxonomy of record categories is best case difficult, and worst case impossible, given the typically limited RIM capabilities of legacy systems and the poor organization of data found at many organizations.

Focus on All Information

The solution to these problems is to move beyond the category of records altogether and instead focus on all information and how to manage it according to its risk level. For example, whether personally identifiable information (PII) appears in a bank statement, a convenience copy of that same statement, an account database or a draft of an email, the compliance obligations of the organization (and the risks associated) are the same. Yet going by the RIM policy, only the bank statement (and maybe the database) would be in scope for the policy — despite the fact that if any of that data got breached, regulators would consider all of it subject to their authority.

In terms of your RIM policy, you need to expand it beyond records/non-records to all corporate information, which means all information in any format stored on company systems or locations. It covers paper and electronic information, and this approach has two advantages: (1) It avoids end-users having to make judgment calls about what is and is not a record, and (2) It covers the range of legal and compliance obligations organizations are subject to.

This leaves you with three kinds of information subject to the policy:

• Information for which your organization has a legal obligation to retain for a specific time period and then delete (aka, traditional records)
• Information for which your organization has a legal obligation to retain no longer than a specific time period and then delete (aka, privacy data)
• Information for which your organization has no legal obligation to retain or delete (aka, general business data, nonbusiness data)

This approach has a number of benefits. First, it’s easy for end users to understand. Individuals don’t need to make decisions about whether any given information is or isn’t subject to the policy or what category of record it is: Any company information is subject to the RIM policy and must be managed accordingly. Second, IT will be better able to apply the policy to systems and repositories because all information is subject to the policy. Third, the approach is straightforward and consistent to explain to third parties, such as the courts or regulators. And finally, the simplicity of the approach provides a solid foundation for streamlining your records retention schedule, which can be overly complex and difficult to understand when based on the distinction between records and non-records or a taxonomy of record categories, such as vital, essential, etc.

Now that we’ve looked in detail at how organizations need to transform their RIM policy to simplify the problem of IG, the next article will explore the challenge of an impractical records retention schedule and how to streamline it to be effective.