Information Governance

 

Yesterday, we talked about the Information Lifecycle Governance Leader Reference Guide from the Compliance, Governance and Oversight Council (CGOC).  The guide provides a program for operationalizing an effective defensive disposal program for expired data, which is an increasingly important issue for many organizations as organizational data doubles every 18-24 months.

Deidre Paknad, Director of Information Lifecycle Governance (ILG) Solutions for IBM, is a well-known thought leader in the legal and information governance domain and one of the authors of the guide, as well as the founder of CGOC (and also a previous thought leader interviewee on this blog).  Deidre has also been a member of several Sedona Conference working groups since 2005 and has co-chaired the EDRM IGRM project since 2010.  I recently interviewed Deidre and asked her some questions regarding the goals for the guide, the target audience and how it fits in with other information governance initiatives in the industry.

Who is the target audience for this guide in terms of job functions and/or size of organization?

The guide is for companies and their Information Governance leaders who are looking to transform legal, records and IT practices to drive substantial cost savings and risk reduction.  It is for business leaders or stakeholders such as the Chief Information Officer (CIO), General Counsel (GC) and records managers who are looking for program models to define, operationalize and improve processes that enable defensible disposal of unnecessary data. The goal is to curb storage growth and lower costs associated with IT, eDiscovery and processing, to not only save money but also lower organizational risk going forward. Based on insight from 1700+ CGOC corporate practitioners, it is apparent that organizations with extensive preservation requirements due to litigation and regulation requirements who retain large amounts of data are in need of such a leadership guide.

Are there any success stories or examples of organizations using the principles described in this guide that you can provide?

Yes. We just had a very successful summit in February with more than 100 corporate practitioners (the proceedings documentation from the CGOC web site are available here).  Anthony Perkins of BNY Mellon provided the keynote speech regarding the high cost of information and how IT organizations are responding.  BNY Mellon and several others are setting new benchmarks and advancing ILG practices for defensible disposal that have become strategic enterprise initiatives.  Scott Bancroft of Novartis International also shared their experience in how they structured an effective governance program.  In the panel discussion, practitioners (such as Jason R. Baron of the National Archives and Records Administration, Eckhard Herych of Novartis and Mark Tabs and Thomas Zingale of UBS) shared their own experience and leadership on assessing process maturity to drive process improvement.  From those proceedings, you can see how Legal, RIM, IT and program office leaders (i.e., members of our target audience) share their experience to modernize their practices and collectively transform their enterprise processes for cost saving and risk reduction.

As this guide references the Information Governance Reference Model (IGRM) – which, of course, is a part of the Electronic Discovery Reference Model (EDRM) – how does this guide and the efforts of CGOC fit in with the EDRM-ARMA initiative?

We established CGOC in 2004 and it has grown to a community of over 1700 experts in retention, legal holds, discovery, and privacy exclusively for corporate practitioners. Its charter is to create a forum in which Legal, IT, RIM, Privacy and compliance executives can get the insight, interaction, and information they need to make good business decisions. CGOC fills the critical practitioners’ gap between ARMA and The Sedona Conference, providing the ability to move from theory to efficient practices. CGOC also provides educational seminars, benchmarking surveys, group workshops, an annual Summit and retreat, white papers by expert faculty, a professional networking website, and regional working groups to corporate litigation, discovery, privacy, records management and program office leaders and practitioners.  Membership in the forum is free to qualified executives.

What are your expectations/goals/hopes that you envision for how the guide is used and adopted?

In the fall of 2010, CGOC issued its Information Governance Benchmark Report, which presented findings from their first survey of legal, records management (RIM) and IT practitioners in Global 1000 companies. The report confirmed that CGOC members viewed defensible disposal as the most essential outcome of a good governance program  but revealed challenges with funding and cross organizational cooperation that impeded program launch or effectiveness. The ILG Guide now simply provides members with a construct for how to operationalize an effective program and overcome these barriers. By leveraging the guide, program leaders can clearly see the sixteen processes to coalesce Legal, RIM, Business, Privacy and IT processes to lower cost and risk. The impacts to the enterprise (and resulting costs) are high when legal, records and IT don't work in concert, and the cost of doing nothing is even higher.  Organizations can improve information economics by operationalizing their information lifecycle governance program using this guide, resulting in significant cost savings and reduced risk going forward.  We are excited to be able to provide such a guide to our member organizations.

Thanks, Deidre, for participating in the interview!

And to the readers, as always, please share any comments you might have or if you’d like to know more about a particular topic!

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

With all of the recent attention on technology-assisted review and current case law related to that subject, it’s sometimes easy to forget that most sanctions are issued because of failure to preserve potentially responsive data.  A sound Information Governance (aka Records Management) policy is the first step to enabling organizations to meet their preservation obligations by getting control of the data up front.  Organizations such as EDRM and ARMA have focused on Information Governance and have even collaborated on a January report on Information Governance.  Another organization focused on Information Governance is the Compliance, Governance and Oversight Council (CGOC).  In the fall of 2010, CGOC issued its Information Governance Benchmark Report, which presented findings from their first survey of legal, records management (RIM) and IT practitioners in Global 1000 companies.  Recently, CGOC developed a new guide for helping organizations with succeed in improving information and eDiscovery economics.

For most organizations, information volume doubles every 18-24 months and 90% of the data in the world has been created in the last two years. In a typical company in 2011, storing that data consumed about 10% of the IT budget. At a growth rate of 40% (even as storage unit costs decline), storing this data will consume over 20% of the typical IT budget by 2014.  Accumulating, storing and litigating data without value is simply no longer an economically viable proposition.  The 36 page Information Lifecycle Governance Leader Reference Guide (written by Deidre Paknad and Rani Hublou) provides a program for operationalizing an eff­ective defensive disposal program for expired data and overcome the barriers to do so.  It can be downloaded here from the CGOC site (if you don’t have a user account, you’ll have to create one, but it’s free).  The guide shows how to:

• Define the economic and business objectives of an information governance program to quantify savings and ensure appropriate funding for change;
• Establish a program strategy;
• Structure an organization that aligns functional silos to ensure savings and business objectives are achieved;
• Identify and improve the business processes for defensible disposal and risk reduction; and
• Audit these processes to ensure systemic, sustainable change.

Aside from the Introduction and Conclusion, the guide is divided into five parts, as follows:

• Defining Program Strategy: The focus is simple – to dispose of unnecessary data and keep only the data that has business utility or is subject to legal hold or regulatory record keeping requirements.
• Setting Quantifiable Cost and Risk Reduction Goals: Setting goals with primary focus on how to lower storage and infrastructure costs from defensible disposal, lower risk through improved governance instrumentation and lower eDiscovery costs through governance instrumentation and lower enterprise data volume.  This section provides a particularly useful eDiscovery Cost Reduction section (page 13) that demonstrates the potential cost savings due to defensible disposal of unnecessary data and a Risk Reduction section (page 14) that provides a risk matrix to assess the risk level of each data process.
• Operationalizing the Strategy: Putting the plan into place involves defining business objectives for the program and means for measuring achievement, defining processes and practices to achieve the objectives, establish accountability for outcomes and defining staff and instrumentation required to work the plan.
• Program Leadership: For any program to be successful, you need buy in at the top.  That includes an Executive Committee (including the CIO, CFO, General Counsel), a Senior Advisory Group comprised of line of business leaders (division executives) to provide the staff­ and support needed to achieve the defined goals, a plan for achievement measurement and accountability and an execution timeline.
• Process Maturity and Management: Each process should be assessed as to its level of maturity (from Level 1-ad hoc to Level 4-automated and cross-functional).  The effort required in each department to achieve the objectives should be clearly mapped out and an audit process should be established for confirming that the governance programs meet objectives and raising issues when there are issues.

All in all, the guide provides an excellent approach for organizations to address implementation of an information lifecycle governance program and illustrates the benefits and cost savings for doing so.  With organizational data doubling every 18-24 months, information governance costs for many organizations will skyrocket without an effective plan to manage the explosion of data.

So, what do you think?  Has your organization implemented an effective information governance program?  Does it have any of the components outlined in the CGOC guide?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.