Information governance is about better managing information assets, not just ensuring compliance. Information Governance (IG) seeks to meet the needs of the total organization (Compliance, IT, and lines of business) with optimized information management practices.
“Information governance includes decision rights and an accountability framework to encourage desirable behaviour in the valuation, creation, storage, use, archiving and deletion of information. Information governance reduces the cost and risk associated with information, increases the value of information, and therefore supports business growth” - Debra Logan, VP, Gartner
Benefits include better information availability, completeness, and trustworthiness, but also reduced operational, financial, and legal risks (see previous blog post about business benefits).
An IG program should have a coordinating role between multiple disciplines for managing information across the lifecycle – like in the below Information Governance Reference Model.
Office 365 includes a lot of features and technologies to help you manage and protect information (see previous blog post), but you still need a governance framework around this.
“Software is not a silver bullet for information governance. Look beyond vendor hype – information governance is not something to go buy so you can say your company has it. Look at information governance as an evergreen corporate objective, enabled by programmes, policies, people- and yes, a range of technologies.” - Cheryl McKinnon, Principal Analyst, Forrester
Effective information governance depends on:
Setting policies and standards over the information lifecycle
Assigning responsibilities and authorities for managing the information
Establishing and promulgating procedures and guidelines
Providing a range of services relating to the management and use of information
Designing, implementing and administering systems for managing information
Integrating information management into business systems and processes – the goal is often compliance by design
Monitoring and addressing non-compliance
Continuous improvements
Information governance is therefore an ongoing process – think 360° program for information governance. This often entail the following ongoing steps.
For ensuring information management compliance:
Executive direction: Leaders will need to lead by example and communicate the importance of information governance and compliance
Policies and procedures: Document what is expected from staff, but also ensure that policies and procedures are updated based on new regulations and standards
Communication: Ensure staff knows what is expected from them
Training: Staff and contractors are educated about what we expect them to do
Systems: Continuously work on automating information governance
For detecting non-compliance:
Key Performance Indicators: Establish metrics to measure compliance
Monitoring: Continuously check system and logs to detect non-compliance
Audits: Site visits to verify compliance among staff and executives
Workshops: Run workshops to identify ways to avoid compliance
For responding to non-compliance
Enforcements: Ensure staff and executives understand the implications of non-compliance
Improvements: The IG program needs to change when the requirements change. This could be changes to technology, lifecycle model, metadata model, policies, procedures, training, communication, etc.
Feel free to contact us if you need help establishing an information governance program, or if you need help creating a business case for setting up an information governance program.
Comments