Over the last few weeks some pretty bright minds have been talking / writing about what Information Governance (IG) is and isn’t. Unfortunately, I couldn’t find the restraint to stay out of it. To get some of the background of what’s been going on, read a few posts from these guys (I don’t always agree with them, but I do have a great deal of respect for them and their smarts):
- George Parapadakis (this, this, and this)
- Barclay Blair (this one and this one)
- Laurence Hart (this one and this one and this one, too)
There’s also been a bit of a conversation going on on Twitter involving the folks mentioned above, along with Jeffrey Lewis, Ron Layel, Ron Miller, Bryant Duhon, et moi. Had I been prescient I would have captured / saved the stream and included it here. Oh well.
First things first … the definition of Information Governance I use is the one I wrote: “Information governance is all the rules, regulations, legislation, standards, and policies with which organizations need to comply when they create, share, and use information.”
The thing to remember about IG is that it’s really about policies that put constraints and roadblocks in the way of working with information. Implementing the policies, via procedures, is where value gets added; using the right technologies helps take the burden off of people. Information Governance without appropriate procedures and tools is just not going to work. Don’t even bother to try.
I am definitely in the camp with those who view IG as an overarching thing that covers a vast array of disciplines that determine every aspect of managing, using, storing, sharing, and disposing of information. And therein lies the problem with IG; it is too broad to be of real interest to any single executive in the C-suite, unless that executive’s job is IG and only IG. That said, oversight for IG has to be centralized in order to be effective on a broad scale, and it has to be centralized in a manner that allows no bias.
Putting oversight for IG in the hands of the CMO, the CIO, the CLO, or anyone else in the C-suite, assuming they actually wanted the job, would likely end up biasing IG towards a specific agenda. IG implemented has to be good for the overall business. Granted, there are various drivers, but those drivers cannot be used as justification to sacrifice or jeopardize other business concerns. Does that mean we need a new title in the C-suite? Maybe, maybe not. Personally, I’d like to see the CIO role redefined on a global basis to be the information equivalent of the CFO and let the various disciplines report into it.
If an organization is a litigation magnet for sure that organization needs to do whatever is necessary to reduce the risk and the burden. But it can’t be done in a way that compromises business effectiveness of other parts of the organization. The policies need to be implemented via procedures and tools that support the business moving forward. There is no legitimate reason that one cannot implement litigation risk mitigation that also benefits the rest of the organization. The immediate need may be related to litigation, but the long play has to be holistic. By the same token, getting field manuals to engineers cannot expose the organization to unnecessary risk or exposure.
During the past few weeks there was also talk about splitting out Information Governance and Information Management. The short version is that governance is the policies and management is the procedures. I don’t think that there’s anything wrong with splitting things out like that, but does it make a huge difference when trying to convince clients or execs about the need for governance? I’ve been guilty of using the terms interchangeably, but I’ve made progress so I don’t care. The fact is some of my clients get the shakes when I mention IG, but they’re cool when we talk about IM. The end result is the same except that I have not “educated” the client about the right terminology. Again, who cares? My clients don’t hire me to teach them the right terminology so that they can sound hip when having beverages with the IG illuminati; they hire me to solve problems or leverage information better.
I really like Barclay’s sentiment: it doesn’t matter what you call it as long as the concepts are understood and progress is being made. Ultimately, that’s the bottom line.
We can bang on all we want about IG vs IM or whatever, and continue to struggle to get buy in and move things forward. Or, we can compromise our principles a little (it’s not like it’ll matter in the long run anyways) and focus on telling clients, sponsors, and executives what they need to hear in a way they understand, are comfortable with, and ultimately buy into. As long as I do right by my clients, I personally don’t care whether we call it IG or IM. We can have the philosophical conversations next time we’re gathered at some conference and it’s only us nerds talking.
During the Twitter conversation, Ron Layel asked me if I thought that information is the currency of business. I don’t think so. If an organization has a bunch of cash sitting in the bank, idle, the cash doesn’t expose the organization to risk, and it appreciates in value. If information is just sitting around, it potentially causes risk, and has no value. Information accumulates, morphs, and transmogrifies too fluidly to really be considered currency. To be sure, businesses couldn’t run without information or currency, but unlike information you can fake currency (think about letters of credit, loans, debentures, IPO’s, etc.).
One last little point … peeve, actually … there are vendors out there (hardware, software, services, associations) that tout themselves as Information Governance vendors. They’re not. They may solve portions of what IG is, but they don’t do it all.
A while back I wrote a couple of posts (one and two) about attempting to value information as an asset, carried on the balance sheet. I took a very accounting oriented approach, and I think I’ve made some progress. This post follows, after a fashion, those two previous posts.
During my session (here’s a link to the deck) at the 2014 AIIM conference, someone from the middle of the room respectfully disagreed that information is always an asset. My response at the time was that information is always an asset and that you need to set up a contra account to offset any of the negatives that can happen. For example, a contra account for Accounts Receivable would be Allowance for Bad Debts. You can read more about contra accounts here, on Investopedia.
What I should have said was …
When information reaches the stage where it can harm you, let’s say in litigation, you need to create a contingent liability account in order to capture how much (in dollar terms) you anticipate the exposure to be. Now, I’m not an accountant, but from what I can find out an asset cannot be transformed into a liability (please correct me if I’m wrong). However, assets that expose organizations to financial risk, can be accounted for by using contingent liability accounts. You can read more about contingent liabilities on Investopedia.
The other thing I should have said was that organizations need to evaluate the value:risk ratio of their information periodically. It’s absolutely true that certain types of information don’t age well and expose organizations to risk that is greater than the information’s value. At this point an organization needs to determine whether they will dispose of the information (legally) or commit additional resources to mitigating the risk, in whatever manner is most appropriate (doing nothing is not an option).
So, to the gentleman in the middle of the room; Thank you. Your comments forced me to dig a bit and learn something.
For those of you interested, here’s the presentation to which I am referring …
As some of you may already know, I will be speaking about the Principles of Holistic Information Governance at the AIIM Conference in Orlando (my session is at 2pm on April 3). Here’s a brief preview of what I’ll be talking about.
This is a little story about how the Principles of Holistic Information Governance (the PHIGs) were leveraged to turn a pure Records Management project into something the entire organization, and its stakeholders, could benefit from.
I was approached by a partner to help them out on a project they are working on for a public transportation company. Their project is to put together a new web communication and presence strategy, and to implement it. Where they asked me to help out is on developing a Records Management strategy. The two projects were to be separate from each other since the RM project was really to fill in some gaps in the client being compliant with legislation and in helping them to respond to Freedom of Information (FOI) requests. There was no thought given to integrating the two projects or to looking at how an holistic approach could benefit the entire organization and its stakeholders.
As all good analysts and consultants do, I started gathering as much information about the organization and the projects as I could. The two critical documents that I had access to were the Web Communication project strategy (summary and detailed) and the organization’s 20 year strategic plan and roadmap.
There were obvious tie-ins to linking the RM project and the Web project, but selling them to the organization wasn’t easy as they just didn’t care all that much. They were happy to go forward with identifying what was a record, and subject to FOI, then just firing that content into their RM tool (which they don’t have yet). The real clincher to getting the organization to accept a PHIGged approach was the long term strategic plan. In the plan were articulated six values and five major objectives.
- Customer Service
All six of the values can be directly supported by information, provided it’s properly governed and managed, from cradle to grave.
- Develop Financial Sustainability
- Support and Shape Livable Communities
- Change the Perception of Transit
- Deliver Operational Excellence
- Strengthen our People and Partnerships
Like the values, the objectives will benefit from taking an holistic view of how information lives in the organization.
One of the other things that I did was to review the RM strategy document I was provided and link those objectives to the objectives in the Web Communication strategy and the long term strategy. It’s both funny and sad that folks get so focused on their own view of the world that they don’t see the bigger picture. The RM strategy probably had 85% of what was needed for an organization wide (I’m trying not to use the word “enterprise” too much) information management strategy.
From a technology point of view there will be many different tools used to provide the solutions that the organization will, over time, implement. But, they’ll be underpinned by the PHIGs. The PHIGs are there to help organizations take a look at how and why information exists and affects all relevant stakeholders. The PHIGs aren’t about technology; they’re about business and doing it better by understanding what you need from information.
By reordering and rewording some of the RM strategy objectives, and adding a couple of new ones, we were able to change the focus from an RM project that would provide very limited benefits, to an organization-wide information management program that will benefit all stakeholders. Of course it’ll take longer to get to the end, but at least the client has taken the first step and realized the importance of information to the proper running of the business.
Below is the presentation from my session at the AIIM 2014 conference …
Over the last couple of days I’ve seen/heard some comments that Big Buckets don’t work well in Records Management. Uhm, you’re doing it wrong.
I suspect that a large part of the issue is that classification models are too granular and too tightly coupled to the retention schedule. I’ve been involved in a couple of projects where this was the case. One client understood this, made the necessary adjustments, and achieved success. The other client … held steadfastly to granular, overly complex schedules and models, and is only now (4+ years later) re-examining their original plan.
You wanna make big buckets work? Here’s some simple stuff you need to do:
- Simple, function based classification models;
- Uncouple classification from retention;
- Automate & hide RM tasks from users (they know what they’re working on and don’t give a rat’s ass about RM – I know, hard to believe);
- Classify on capture/creation;
- Check out the cool diagram;
- Review periodically.
Note: During a Google Hangout yesterday (featuring @cawprhyd, @tchernik, @lllivingston, and some others whose twitter id’s I don’t have handy) the subject of disposition reviews for automated disposition came up. My position is pretty simple – you don’t need them. Sort of. If you assume that classification and retention have been agreed prior to implementation, and that content is classified up front, there is no need to review. Of course, this works only on a day forward basis and requires that whatever tools you have in place can do the legal hold and suspend disposition processing / time clock when needed. You really should follow the twitterers that I’ve id’d here – they’re pretty smart.