Holy PHIG I’m Writing a Book


By now all of you (yeah, right) have read my Principles of Holistic Information Governance (PHIGs) post, viewed the slide deck, and some of you attended the presentation I gave in Calgary. Based partly on the popularity of PHIGs, but mostly on my belief that they cover an important business and information management topic, I have decided to attempt to write a book based on PHIGs.

I’m not sure at this point whether it’s going to be tome-like or Cole’s Note-ish (bet on the latter ‘cause I’m kinda a lazy writer) or what the final format will be. I do know that it’s going to be written based on my consulting experience. I also know that my goal is to get people thinking about information and what it really means to their organizations. It may or may not include anecdotes from previous projects, but it will include (I hope) practical stuff that can be used.

Why am I telling you about this? Well, Bryant Duhon of AIIM told me to, and he knows a butt-load more about this writing stuff than I do, so I am taking his advice. Also, I wanna generate “buzzzzzzzzz” and get you excited. Probably the most important reason I am doing this (the blog post) is because I’d love to get your input into the book. I figure you’re the audience (paying, I hope) so you ought to have some say as to what goes into it.

So let me know what you think and what you’d like to see in the book and I’ll occasionally update how things are moving along. I’m looking forward to this thing, I hope you are too.

One last thing … I have no timeline for this book; it’ll be ready when it’s ready.

This may be the shortest post I’ve ever written.

Principles of Holistic Information Governance


This previous post was about the need for holism in information governance. This post brings up topics that you’ll have to deal with in defining holistic information governance. (I think I’ll refer to these as PHIGs – Principles of Holistic Information Governance). This isn’t going to be exhaustive or ultra-detailed; it’s just a list to guide where you need to pay attention.

Gartner defines information governance as the specification of decision rights and an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving and deletion of information. It includes the processes, roles and policies, standards and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals.

Principles of Holistic Information Governance

Figs

1 – Information is an organizational asset.

In the course of our employ we produce and receive information. It doesn’t belong to us, it belongs to our employers. As such, we need to treat it like any other corporate asset. Even if you use a personal device to produce the information, it still belongs to the organization.

Assets have acquisition costs, maintenance costs, residual value (sometimes), and get disposed of at the end of their useful lives. Tell me how this doesn’t apply to information.

If you do not understand this, stop reading and go away. There is no hope for you.

2 – Understand what you’re using information for.

How does information help you achieve strategic objectives? A government entity and a direct-to-consumer sales organization may use some of the same information, but they will use it differently and for different purposes.

Understanding what you’re using information for ought to help you understand what information you actually need.

3 – Understand where it’s coming from and where it’s going to.

Information doesn’t just magically appear; it comes from somewhere. You need to identify your internal and external information sources.

Most organizations don’t just fire information out willy-nilly. Information is intended for specific audiences, for specific purposes. You need to understand what effect your information is intended to have, and who you want/need it to effect.

4 – Understand when you need it.

The next person that says “I need this yesterday.” wins a smack in the head with a frozen mullet (the fish, not the hairstyle).

Information is needed at various points in business and decision making processes. Is real-time information really necessary or can you wait a few minutes or hours for it? Figure out when you actually need the information in order to make a decision.

5 – Understand who can and should be using it, and for what.

This is not just about security, though that’s a big piece. This is also about getting the information out to those that need it or to those that you want to influence with it. Think about it in terms of getting your message out to your target audiences.

Once the information has found its way to the audience, what are they going to do with it? Are they going to make a decision, buy something, receive a benefit…?

6 – Understand your social, regulatory, and compliance obligations.

Depending on what you do and for whom you do it, you have information related obligations. Some of these are imposed by statute, some by convention, and some are self-imposed. These obligations determine how long you must keep information, what you can do with it at the end of its life, and to whom you may or must disclose it when asked.

7 – Understand your information related risks (too much, not enough, disclosure, etc.).

If some of your information leaks, what’re the consequences and can you live with them?

If you’re overwhelmed by information how does it impact performance?

If you’re missing information can you still get stuff done?

How likely are you to be sued?

8 – Understand how stakeholders are interacting with it.

It’s not enough to know what your stakeholders are doing with information. You need to figure out how they’re doing it. It’s not enough to identify the types and locations of devices that stakeholders are using; you also need to find out if the interactions are passive or active.

9 – With few exceptions, information has a finite useful life.

Unless your information has historical/archival/archaeological value, get rid of it as soon as you can. It’s not just about the whole discovery/litigation thing; it’s also about de-cluttering and being info-efficient.

Information is a perishable good; once it’s stale or rotted, get rid of it.

10 – Make someone accountable.

Overall organizational performance, financial performance, legal, technology … they all have single-role accountability and responsibility. As, arguably, the second most important asset of an organization, information deserves at least the same level of attention as finance, IT, HR, legal, etc.

A C-level executive needs to be accountable for how information is governed and managed across the organization.

Principles of Holistic Information Governance

Principles of Holistic Information Governance

The End

None of these ten “principles” is much good on its own; they only work as a whole. Other than the first and last, the key is to go only as deep as you need to in order to make things work for your organization. Nobody is expecting perfection; things just need to be good enough.

I’m not trying to downplay the difficulty in formulating information governance policies and procedures. However, much complexity can be avoided if common sense is applied and business objectives remain the primary focus.

PHIGs downloadable PDF

PHIGs  – the new and improved slide deck …

Governance Sucks but Doesn’t Have To


Governance is the Super Ego to the Id of collaboration.

If you’re an information consumer or producer, governance sucks. Think about it; all you really want to do is get the info you need or pass stuff on to stakeholders. Maybe what you need is to be able to work on something as a group. You try, but you’re info-blocked at every turn. The amount of crap one must put up with in order to create or consume relevant information, or to collaborate, is enough to drive one to drink (but in a responsible manner & you take a cab home).

Let’s start with something simple … You want to create a document & share it with stakeholders. Easy, right? Not! It used to be that the biggest challenge was making sure the content was appropriate to the purpose. Now you also have to worry about whether or not the stakeholders have the rights to see the content, how long the content will be relevant for, how many copies there are (or will be), whether or not the content could be relevant in legal proceedings, and where the hell to classify it (what is this “classify” thing, anyways?”).

Governance is all the rules, regulations, legislation, standards, and policies with which we need to comply when we create, share, and use information. Don’t misunderstand me; it’s not the results or purposes of governance that annoy me, it’s how governance is applied. The in-your-face, gavel banging, fanaticism driven approach of many of the legal, risk, and compliance crowd is the issue.

Many of these folks are trying to manage electronic content the same way that paper has been managed; that’s like trying to perform “brain surgery too, mama, with a monkey wrench” (props to those who identify the song, band, and album without using any search engines).

The Good:

  • Facilitates finding what you need when you need it;
  • Reduces legal risk;
  • Preserves history and corporate memory;
  • Secures information from inappropriate exposure;
  • Facilitates good decision making.

The Bad:

  • Increases complexity;
  • Introduces bottlenecks;
  • Prioritizes compliance obligations over getting work done;

The Ugly:

  • Turns users into Records Managers;
  • Users circumvent the rules;
  • Perception is we’re making progress, reality is we’re not.

Why There’s Hope

If everybody would just chill for five minutes, we could get this under control in a manner that makes sense and provides the benefits that governance ought to provide. Even though the same rules apply, electronic content cannot be managed the same way as physical content.

  • Users aren’t Records Managers, nor do they want to be.
  • Policies aren’t the problem, procedures are.
  • Pretending social media doesn’t exist won’t have any effect on your obligations.
  • Some governance is better than no governance.
  • It doesn’t have to be perfect, you just need to make a reasonable effort.

Most credible EIM providers (ECM for you dinosaurs) have the tools to implement effective governance in their arsenals. But don’t go to them and ask them to implement governance until you’ve actually sorted out what it is in your organization. It’s your task to develop the policies, it’s our task to advise you on how best to develop and implement the procedures.

When you and I sit down and talk about governance, if the only team you bring to the table is Legal/Risk/Compliance, I am going to shut the conversation down in about two minutes. The only way that I can help you implement governance that doesn’t suck is to deal directly with all the affected stakeholders (groups, not individuals). One of the toughest collaboration challenges an organization faces may be trying to define a truly effective governance framework that serves the needs of all affected stakeholders. If those stakeholders don’t have a voice, it’s not gonna happen.

If you’re running a real EIM solution and your users have to think about where to file content, you’ve mucked up your deployment. It doesn’t matter if you go big bucket or not, a good deployment uses auto-classification, profiles, workflow, etc. to take the governance burden off the users and put it squarely on the system. If you think classifications and retention schedules are the same thing, there’s not an EIM solution on the planet that’s gonna help you and you’re not an Information Professional.

You’ve done governance right when:

  • Users focus on their jobs, nothing else;
  • You get defensible disposition and it’s implemented;
  • People find the information they need, when they need it;
  • Information leaks are down to an acceptable level (face it, it’s not going to get to zero);
  • Your corporate counsel can focus on attacking instead of defending;
  • Social media doesn’t scare you;
  • The only people thinking about governance are those who are paid to.

Records Matter, Declaration Doesn’t – Revisited


This is a response to comments that Jürg Meier made recently on something I posted a while ago. Jürg is a very smart and personable guy, whom I had the pleasure of meeting in person at ARMA Switzerland’s inaugural event on November 29, 2011. I urge you to check him out on twitter and here, where he works.

I was going to simply reply to Jürg’s comments on my blog, but I figured that the points he brought up are pretty substantial and would be of interest to a broader audience. I asked Jürg if I could paste his comments into a post and respond to them. You’re reading this so either: a) Jürg agreed; or 2) I’m in deep doo-doo.

From the original post: “Users know what business process they’re involved in. …”

JM: Chris, not sure here. What about knowledge workers, who “often advance the overall understanding of that subject through focused analysis, design and/or development” (Wikipedia). Are they in a business process? Perhaps, but more often than not in a very large one, like a product development, an IT or marketing project. These people send email, word and powerpoint docs back and forward, take notes. Notes? Karl Alexander Mueller, Nobel price winner in physics 1987, discovered a material for high-temperature supraconductors. He took the decisive note a few years earlier at a congress – on a single page of his pocket notepad.

Moreq2010 comes up with a similar example. In the introduction chapter, they show a hand written shopping list and the resulting cash register receipt. They consider only the latter as a record.

I would say that regardless of what the duration or intended outcome of a process is, it’s still a business process with measurable business objectives. Projects and cases (as in case management) cross multiple business processes and can be of several years duration. Product development takes ages, is complex, involves large numbers of people and huge volumes of content. However, it can still be tied to business processes and the participants (usually) know what they’re doing. In that type of scenario I think I would recommend using a case aggregation for the users to plunk their content into, and apply appropriate retention to the aggregate.

I would assume that Müller knew what he was working towards when he wrote the decisive note in his pocket notepad (how different is the pocket notepad from a tablet these days?). If my assumption is correct then it stands to reason that the note is part of the research documentation, which must be filed and retained. The big question in my mind is related to ownership of the intellectual property; does it belong to Müller, to IBM, or to both?

Another question that I have concerns an outcome that is unintended, but beneficial nonetheless. I’m sure we all remember what Sildenafil was originally intended for, and what its current use is. What, if anything, are the impacts on categorization and retention? Research & knowledge based processes are really tricky to deal with, but I think the key is that you can apply (business) rules & automation to the mundane aspects, use aggregations to capture the content, and let the participants do what they are engaged to do. I would certainly rather have medical / pharma researchers figuring out cures than worrying about where to file something.

The Moreq2010 shopping list / receipt example is analogous to an order / invoice example. Each document provides a part of the complete picture, and therefore is required. I also think that particular example is nonsensical unless for some official reason (e.g.: personal taxes) you need to hold on to the receipt. Frankly, I need to keep the list to prove to my wife that I didn’t bugger something up when she “let” me go shopping for her.

JM: In my experience, it is really a question of who will consume the information. There are the usual suspects:
– business
– legal
– long-term (historical) archive

As you pointed out during your speech at the Swiss ARMA Chapter inaugural meeting, different people have different views on the same information. So, it would be compelling to classify information multiple times by different consumers… and I’m inclined to say: as late as possible. Only if we know about the purpose of the classification, we can do it right. E.g. for legal, they actually only know what they are looking for upon a litigation. By then though, they know very well what they need.

But what’s wrong with classifying as soon as possible, and adding additional classifications as they are identified, if that’s the case. The classification with the longest retention drives how long any content needs to be kept. This only works when classification and retention/disposition are segregated. In litigation situations simply applying a hold / freeze will do the job. There’s no reason to apply additional classification to the content because you create a legal case file aggregation and dump the content into it.

Content that has archival value, but no risk is easy – just keep it. I mean, I know we’ll want to keep all of my blog posts for the next 300 years or so. J It’s tougher when content that has archival value has some potential risk associated to it (privacy issues, legal exposure). I think at that point it’s really a judgement call. Frankly, I’m in favour of preserving because I’d like to think that sometime in the future there are going to be people that are interested in what we’ve been thinking and doing, and that the information they want is available. I’m also hoping that we’re not so stupid that we evaluate everything in terms of whether or not we’re going to get sued.

JM: However, the case of “late classification” does not answer one key question: for how long should we retain? The only reliable basis here is law and the retention schedule. And for that, by nature, we must classify upfront. That isn’t too difficult for “real business processes” (e.g. selling a ticket), but becomes tricky with output from knowledge workers. Here, to some extent, we need their support. Classifying draft/final is a good start, formally assigning it to a project would be very helpful, as well as identifying ownership and the document type.

For the most part I agree with this paragraph. For the knowledge workers, especially those that are involved in a lot of trial and error, I think we can come up with some reasonable classifications and retentions for them to use. Imagine how different things would be if the people that were working on Sildenafil tossed everything away once they realized they weren’t going to achieve what they set out to do.

Cloudy with a Chance of Success


This was originally posted on the AIIM Community on November 18, 2011.

This post was inspired by this article on CMSWire by @billycripe and by the Cloud themed tweet jam hosted by CMSWire on November 17, 2011. As usual this is just my opinion.

CloudsI’m not an expert on cloud computing, I’m just some guy that likes to be able to access the content I need to do my work, from wherever I happen to be, using whatever device I feel like using at the moment. Take this post, for example; it was written on a laptop and a tablet, in a dining room and a swimming pool (not really in the pool since my tablet isn’t waterproof though that would be mega-cool).

I agree with Billy Cripe’s thoughts that Agile can (ought to) be applied in the development of cloud based ECM solutions. However, as Billy correctly states, “Managing content is not the goal of most businesses.” Most businesses exist to make money by providing products and/or services that consumers want. Businesses rely on information in order to get their stuff done, whatever their stuff is. In order to fully exploit information, the tools (i.e.: information stores) that the businesses rely on need to be connected to each other (so do the people – the tools need to facilitate this). Content / information management tools (cloud or not) need to be part of bigger picture business solutions. We need to build solutions that deliver “I need to share this” in the context of why it needs to be shared (answer why you need to share and you’ll likely figure out who and what).

No sane person can argue the value and validity of the cloud. Except me. I’m not daft enough to think that cloud computing doesn’t have value or is not a valid approach to take. However, I do think that we’re not going to realize the full potential of the cloud (and by extension, content) if we simply limit its scope to content management. Yeah, I know that there are other things that are done in the cloud, such as CRM, payroll, and accounting.

Content Wherever I Am

One of the cool things about content in the cloud is that my content is wherever I am. (Okay, so it’s not really my content, it’s my organization’s content.) That’s not the point, though. The point is that I can work with content wherever I happen to be, using whatever device I choose. This does assume that the chosen content repository is able to be synched appropriately. Wouldn’t it be cool, though, that if in addition to being able to work with the content and share it with collaborators (the work variety, not the WWII Nazi variety) the content could also be appropriately tagged, filed, and placed under retention at the point that I plunk it into the repository? I.e.: Cloud repositories need to become extensions of ECM and ERM systems, probably through federation.

Correctly Connecting Corporate Content

Content is spread throughout an organization; cloudification just increases the spread. When I say content, I mean anything that is stored on digital media that serves any legitimate business activity. (For obvious reasons I am excluding physical content.) A key to widespread cloud acceptance is to be able access / leverage content in order to execute a business activity, regardless of where the various pieces of content reside. An agent in a social services organization should not have to know or care that a citizen’s information is spread over a number of repositories that could be on-premises, in a private cloud, and in a public cloud. The agent is there to service the needs of the citizen, not to figure out some (likely) convoluted architecture just to try and find stuff.

CMIS is a step in the right direction, but where CMIS falls short is that it doesn’t address non-CMS (think ECM) repositories. What we need is something that allows connecting everything that we need, when we need it. Device and location should not be factors. In fact, the only thing that a user should worry about is whether or not they have the right content to do the job. Governance, classification, and security ought to be just taken care of.

Speaking of Governance…

Until the governance issues get sorted, I doubt very much that we’ll see widespread adoption of public cloud services. Smaller organizations, organizations with lax regulatory / privacy regulations, and organizations that can bully providers into rock-solid SLA’s may be able to go full public cloud, but I doubt they will. I think the reality is that organizations will end up having hybrid environments of cloud and on-premises.

When I say governance I am not only referring to the poo that legislators, regulators and litigators throw in our way. Governance needs to address issues such as:

  1. what can / should be stored in the cloud
  2. service level agreements
  3. disaster recovery / business continuity
  4. security
  5. classification / categorization
  6. retention & disposition (thanks to @JamesLappin & @AlanPelzSharpe for bringing this up)

Governance of cloud content has to deal with all of the things that we need to deal with for on-premises stored content, with the added complication that we also have to deal with where the damn box is and if some foreign government can get at it whenever they bloody well feel like it. Canada’s Anti-terrorism Act and the United States’ PATRIOT Act are not going to be very helpful in encouraging organizations to move to the cloud in a big way.

Parting Shots

  1. Hybrid (cloud / on-premises) will be in the majority
  2. Governance (internally & externally imposed) has to be figured out
  3. Integration / interoperability are critical
  4. Privacy concerns and government snooping are major inhibitors (@ron_miller wrote a pretty good piece about this)
  5. If we’re not careful we’ll just move the mess from our hard drives to someone else’s
  6. Some Systems of Record will end up in the cloud, if they’re not already there
  7. Services are where it’s at

Bonus Material

I couldn’t decide which song I wanted to use for this post, so you’re getting three:

  1. CCR – Have You Ever Seen the Rain?
  2. CCR – Who’ll Stop the Rain?
  3. SRV – Couldn’t Stand the Weather

A couple definitions for those that think it should be “on-premise”

  1. http://oxforddictionaries.com/definition/premise
  2. http://oxforddictionaries.com/definition/premises
%d bloggers like this: