Practical over Perfect: A Way Forward with Information Governance That Works

In my 25 plus years of working in information governance (IG), which has changed names from enterprise content management and electronic document management, to information management, records and information management, information lifecycle management/governance, and even content services over that time, organizations seem to have perpetually struggled to get IG working for them. All this despite tremendous expenditures of people hours, consulting engagements, and software implementations.

When I think about the reasons why organizations have failed in their IG efforts, there are a number of culprits: weak technology, poor technology implementations, lack of top down support, underinvestment in change management, and a disconnect between IG and larger organizational goals and priorities. But the single most significant factor that has held organizations back from succeeding with IG, in my experience, is aiming for a best practices, totalizing approach to IG rather than a more measured, incremental, and small-scale approach that aims for “baby step” gains over big bang, solve world hunger approaches.

The Perfect is the Enemy of the Good

Allowing the perfect to be the enemy of the good is a perpetual blind spot of many IG efforts, i.e., we must do it perfectly or not do it at all. As IG pros, we are brought up on industry frameworks, best practices, and other methodologies for solving IG problems across all information, in all systems, for all users, across the entire organization. While this is a noble goal, it’s rarely (never?) attainable: organizations have far too many systems and far too much information per user to address IG whole cloth—let alone that nearly every business process is running today without good IG involved…so a totalizing approach to IG requires changing how everyone works, everywhere across the organization. Good luck with that.

The answer to this perfect versus good enough dilemma is to be ruthlessly practical in your approach to IG: what is the greatest impact to the organization for the least amount of effort/change? And by impact, we should focus less on the value of information to the organization and more on the legal and compliance risk reduction IG can deliver to the organization: we need to play defense rather than offence.

The reason for this is straightforward. As anyone who’s tried to articulate the value of information to an organization knows, the offensive value of information is incredibly slippery, qualitative, and “soft”: those hours you estimate folks will save by finding information more rapidly may or may not deliver value to the enterprise…and you certainly won’t be able to guarantee the real-world dollars the organization will realize because if it.

On the other hand, the legal and compliance risks of poor IG, while constituting cost avoidance (the color of the bus that didn’t hit you), nevertheless have some numbers associated with them: eDiscovery costs, regulatory fines, lawsuit judgments, and, maybe most persuasively, sanctions against execs and board members.

In my experience over the last 17 years as a consultant, these defensive concerns are significantly more motivating than the (mostly theoretical) offensive benefits of good IG. So, if you want to maximize the defensive benefits of IG while avoiding the perfect being the enemy of the good, where should you start?

Forget Go-forward IG

The biggest way IG pros succumb to the perfect rather than the good, even when focusing on a defensive, risk management posture, is in deciding whether to address go-forward or legacy IG, i.e., whether to change how employees incorporate IG into their day-to-day work versus addressing the 20 plus years of legacy information being over-retained in corporate systems and repositories.

This makes a certain amount of sense when looked at with a best practices, industry framework lens: if we don’t fix how folks work today, we’ll just be in this mess again in the future…so let’s fix it today so it doesn’t happen again (and again).

But looked at with a purely legal and compliance risk reduction lens, it makes far less sense. Here’s why.

If an organization currently has 10 PB of information and has a 20% growth rate for information annually (not unusual for a Fortune 1000 company), they would create two PB of information in the next 12 months. If we managed to get thousands or tens of thousands of users to practice good IG, these two PB would be classified properly and ready for lifecycle management…but wouldn’t be eligible for disposition (and therefore reduce risk) for years in the future. The 10 PB of legacy information, meanwhile, would remain untouched, posing significant ongoing risk to the organization.

Let’s keep in mind that industry numbers suggest that 40% plus of unstructured data is stale or junk—and therefore has little to no value to the organization while posing increasing legal and compliance risk with every day it’s retained. A go-forward approach in and of itself does nothing to address this risk.

The solution is to forget go-forward (for now) and focus on legacy data.

Look Backward to Move Forward

Looking at industry numbers of the volume of unstructured information that’s stale and therefore could be purged now (with a cross-reference to active or reasonably anticipated preservation obligations, such as legal holds), 40% is an accurate number. In my experience with hundreds of organizations over 17 years, it rings true. Shared drives, Box, DropBox, on-premises SharePoint, and legacy ECM systems (OpenText, FileNet, Documentum, Hyland) are dumping grounds for stale—yet often incredibly sensitive and risky—information.

Taking the hypothetical Fortune 1000 organization with 10 PB of legacy unstructured information, cleaning up this legacy information (assuming 40% is stale) would yield a four PB reduction in the near term: tens or hundreds of millions of documents that contain PII, PHI, SPI, etc. Compared to the future de-risking of go-forward IG efforts, the de-risking of legacy information should be a no brainer: in the years it will take for go-forward IG efforts to reduce the risk surface of an organization’s information, those four PB of stale data would be sitting there, posing risk and increasing the negative impacts of the breaches, lawsuits, and regulatory actions that will inevitably happen in the meantime.

Bide Your Time

All this is not to say that go-forward IG isn’t important—it is. But immediate risk reduction is more important for nearly all organizations. And addressing legacy IG over the next 18 – 24 months doesn’t close the door on future go-forward IG efforts. On the contrary, it increases the likelihood they’ll succeed because of the pace of technology innovation.

Consider this: if you decided to implement a go-forward IG software solution (to classify documents in real time, assign a retention period to them, and dispose of them when past retention), it would likely take six months to select and procure the solution, three months to configure it, and at least nine months to roll it out with the change management and training needed…maybe more depending on your organization’s culture.

But IG technology is rapidly advancing: the ability to scan unstructured information and classify it with high accuracy is nearly table stakes; the ability to do this at scale (PB per month not TB) is becoming commonplace; connecting this classification to workflows that automate disposition is not far behind. In the next 18 – 24 months, it’s hard to imagine that there won’t multiple vendors able to support the full IG lifecycle from creation/ingestion to disposal/archive with near automation at a reasonable price point.

So, to undertake the 18 – 24 month effort to roll out today’s limited technology to address go-forward IG in an attempt to change how the whole organization does work (when in 18 – 24 months IG technology may reduce end-user involvement in IG to near zero), while ignoring the huge near-term legacy de-risking opportunities in front of you seems like a fool’s errand.

For my money, every organization should address legacy information and achieve massive de-risking over the next 18 – 24 months and then reassess IG technology to find the most effective go-forward IG solution that impacts end users the least. That’s the recipe for success, today and in the future.