Making the Case for Information Governance: 10 Reasons Information Governance Makes Sense


Published on

The Economist Intelligence Unit, in a recent study on information governance, found that the single biggest worldwide challenge to successful adoption of information governance is the difficulty of identifying its benefits and costs.1 In other words, the difficulty of making the case for IG.

This eBook, in a small way, is designed to help readers with this big problem. There is no magic formula, no perfect argument for information governance. But, there are many reasons why IG makes sense today, and will make sense well into the future.

This piece doesn’t try to advance an airtight argument, nor does it propose a detailed financial model. The former doesn’t exist, and the latter is beyond the scope of this work. This doesn’t mean that you shouldn’t develop and use such models at your organization, as they are essential.

This eBook is based on a series of observations that I have made as a consultant, advisor, and author in this space over the course of the last decade. I hope to point out some simple reasons we need information governance. I hope it helps you on your journey to manage information better.

Published in: Technology, Business
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Making the Case for Information Governance: 10 Reasons Information Governance Makes Sense

  1. 1. Making the Case for Information Governance   10  Reasons  Why  IG  Makes  Sense   Barclay  T.  Blair          
  2. 2.  Preface ........................................................................................................................ 3  Introduction ................................................................................................................ 4   Defining  Information  Governance ........................................................................................ 4   Learn  to  Tell  the  IG  Story ..................................................................................................... 5   Be  Practical .......................................................................................................................... 6   IG  is  Change  Management ................................................................................................... 8  1.   We  Can’t  Keep  Everything  Forever...................................................................... 10  2.   We  Can’t  Throw  Everything  Away....................................................................... 12  3.   E-­‐Discovery......................................................................................................... 13  4.   Your  Employees  are  Begging  for  It  –  Just  Listen................................................... 15  5.   It  Ain’t  Gonna  Get  Any  Easier.............................................................................. 16  6.   The  Connected  Thinking  of  IG  is  the  Future  of  Business  Success.......................... 18  7.   The  Courts  Will  Come  Looking  for  IG................................................................... 20  8.   Manage  Risk:  Information  Is  a  Big  One ............................................................... 21  9.   Email:  Reason  Enough ........................................................................................ 22  10.   IG  Provides  Certainty........................................................................................ 23   P a g e  |  2         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  3. 3. PrefaceThe  Economist  Intelligence  Unit,  in  a  recent  study  on  information  governance,  found  that  the  single  biggest  worldwide  challenge  to  successful  adoption  of  information  governance  is  the  difficulty  of  identifying  its  benefits  and  costs.1    In  other  words,  the  difficulty  of  making  the  case  for  IG.    This  eBook,  in  a  small  way,  is  designed  to  help  readers  with  this  big  problem.  There  is  no  magic  formula,  no  perfect  argument  for  information  governance.  But,  there  are  many  reasons  why  IG  makes  sense  today,  and  will  make  sense  well  into  the  future.    This  piece  doesn’t  try  to  advance  an  airtight  argument,  nor  does  it  propose  a  detailed  financial  model.  The  former  doesn’t  exist,  and  the  latter  is  beyond  the  scope  of  this  work.  This  doesn’t  mean  that  you  shouldn’t  develop  and  use  such  models  at  your  organization,  as  they  are  essential.      This  eBook  is  based  on  a  series  of  observations  that  I  have  made  as  a  consultant,  advisor,  and  author  in  this  space  over  the  course  of  the  last  decade.  I  hope  to  point  out  some  simple  reasons  we  need  information  governance.  I  hope  it  helps  you  on  your  journey  to  manage  information  better.    Barclay  646  450  4468   P a g e  |  3         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  4. 4.  IntroductionThis  eBook  is  divided  into  two  sections.  The  first,  this  introductory  section,  lays  the  groundwork  for  the  book  and  provides  some  tips  and  ideas  that  have  helped  our  clients.  The  second  section  focuses  on  a  series  of  specific  reasons  why  IG  makes  sense.  Read  them  in  the  order  that  works  best  for  you.    Defining  Information  Governance   "If  you  think  compliance  is  expensive,  try  noncompliance.”   Deputy  US  Attorney  General  Paul  McNulty2  Information  governance  is  a  relatively  recent  term  for  a  set  of  activities  that  have  been  around  for  a  long  time.  I  like  the  term  because  it’s  simple  -­‐  it  places  the  emphasis  of  the  activity  (i.e.,  governance)  on  the  thing  we  want  to  act  on  (i.e.,  information).  The  simplicity  of  this  phrase  belies  the  complexity  of  a  field  that  borrows  ideas  and  practices  from  a  variety  of  specialties  and  packages  them  together  to  address  a  difficult  problem  in  a  holistic  manner.    For  example,  information  governance  is  not  synonymous  with  corporate  governance,  but  it  incorporates  elements  of  corporate  governance  (some  have  called  information  governance  “GRC  for  information”  i.e.,  governance,  risk  management,  and  compliance  for  information).  The  same  goes  for  information  protection,  records  management,  compliance,  and  so  on.  Some  of  the  other  fields  that  are  part  of  information  governance  include:    Information  Management    Enterprise  Risk  Management    IT  Governance      Archiving    Privacy    Business  Continuity,  Disaster   Recover    Knowledge  Management    Storage  Management    Enterprise  Content      E-­‐Discovery    Document  Management    Enterprise  search  So  how  exactly  should  we  define  information  governance  (IG)?     P a g e  |  4         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  5. 5. The  Economist  defines  IG  as  the  “strategically  created  enterprise-­‐wide  frameworks  that  define  how  information  is  controlled,  accessed  and  used,”  and  the  mechanisms  that  enforce  those  frameworks.3  AIIM  International  defines  it  as  “the  establishment  of  enterprise  wide  policies  and  procedures  and  the  execution  and  enforcement  of  these  to  control  and  manage  information  as  an  enterprise  resource.”4  These  definitions  are  pretty  similar  and  they  illustrate  two  key  points.    First,  IG  is  about  building  a  foundation  of  rules  (in  the  form  of  policies,  procedures,  practices,  etc.)  that  guide  information  management  across  an  enterprise.  Second,  IG  requires  enforcement  –  in  the  form  of  technology  and  human-­‐focused  programs  -­‐  to  be  successful.  IG  rules  themselves  don’t  solve  any  problems  and  in  fact  can  create  problems  if  they  are  not  properly  enforced.    At  the  highest  level,  IG  is  about  managing  information  better.  Sometimes  we  want  to  manage  it  better  because  an  outside  party  –  such  as  a  government  body  or  court  –  is  telling  us  we  have  to,  and  sometimes  we  want  to  mange  it  better  simply  because  it  helps  us  be  a  better  business.      Learn  to  Tell  the  IG  Story   “At  first  sight,  legal  compliance  would  seem  to  be  the  major  driver  for  taking  better   control   of   emails.   However   .   .   .   ROI   from   efficiency   improvement   is   a   genuine   justification.”   AIIM  Industry  Watch:  Email  Management,  The  Good,  The  Bad  and  The  Ugly5  To  be  successful  with  IG,  you  must  learn  to  tell  the  IG  story.  More  correctly,  you  must  learn  to  tell  IG  stories  as  different  audiences  need  to  hear  different  versions  of  the  IG  story.    At  a  large  financial  services  company  I  worked  with  for  many  years,  the  chief  “evangelist”  for  IG  understood  this  implicitly.  I  tagged  along  with  her  to  many  meetings  and  listened  to  her  tell  the  IG  story.  There  was  one  story  for  the  lawyers  who  were  going  to  have  to  defend  the  company’s  practices  in  court.  There  was  another  story  for  the  corporate  chiefs  who  were  going  to  have  to  pay  for  it.    And  yet  another  story  for  the  heads  of  business  units  and  departments  who  were  going  to  have  to  live  with  the  IG  program  everyday  in  the  real  world.  In  “Made  to  Stick,”  Dan  and  Chip  Heath6  argue  that  storytelling  is  a  critical  skill  for  anyone  wanting  their  ideas  heard,  remembered,  and  acted  upon.  According  to  them,  “stories  have  the  amazing  dual  power  to  simulate  and  to  inspire,”  as  they  provide  a  simple,  concrete  way  for  others  to  understand  your  ideas.     P a g e  |  5         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  6. 6. The  ability  to  tell  stories  is  so  important  in  the  IG  world  because  of  its  complexity  and  breadth.  Despite  this  complexity,  I  believe  that  there  are  only  two  basic  “plots”  to  the  IG  story.    The  first  is  the  “faster,  better,  cheaper”  plot.  In  other  words,  IG  can  help  organizations  make  decisions/create  products/go  to  market/  etc.  faster.  It  can  also  make  business  processes  more  efficient  (i.e.,  better),  and  enable  the  organization  to  lower  the  costs  of  many  business  processes  (i.e.,  cheaper).    Steve  Bailey,  author  of  “Managing  the  Crowd:  Rethinking  Records  Management  for  the  Web  2.0  World”7  convincingly  argues  in  his  work  that  the  information  management  community  hasn’t  done  a  good  job  of  putting  hard  numbers  behind  the  “faster,  better,  cheaper”  story.  I  agree,  because  aside  from  some  near-­‐apocryphal  statistics  those  are  frequently  used,  to  my  knowledge,  the  economic  case  has  not  been  universally  made.  However,  IG  professionals  can  make  solid  economic  arguments  that  are  specific  to  their  organizations.  I  have  helped  many  of  my  clients  do  this.    Some  have  been  financially  dramatic  (increase  profit  $300  million  over  3  years),  some  strategically  profound  (competitive  advantage  in  our  market  for  2  years),  and  some  have  been  very  practical  (cut  email  costs).    The  second  basic  plot  of  the  IG  story  is  “fear,  uncertainty,  and  doubt.”  This  story  focuses  on  risk  side  of  IG.  This  has  been  a  relatively  easy  story  to  tell  in  the  past  few  years,  with  many  massive  business  failures  and  high  profile  court  cases  tied  to  IG  shortfalls.    A  note  of  caution  about  this  plot:  don’t  overuse  it.    Many  in  the  IG  field  are  guilty  of  over-­‐relying  on  the  “sky  is  falling”  argument  to  make  their  point.  I  have  seen  too  many  presentations  in  too  many  dim  conference  rooms  where  the  IG  story  starts  with  the  same  few  slides  detailing  eye-­‐popping  court  judgments,  executives  going  to  jail,  and  so  on.  This  story  can  be  effective,  but  it  loses  is  power  if  it’s  overused.    Both  IG  plots  have  merit.  The  key  is  to  tailor  the  story  to  the  audience  and  tell  it  using  practical,  concrete  examples.  Business  units  that  drive  80%  of  the  company’s  profits  may  not  care  as  much  about  risk  as  the  compliance  department.  The  litigation  team  may  not  care  as  much  about  cutting  information  management  costs  as  the  CFO.      This  book  tells  the  IG  story  using  both  plots.  Take  them,  make  them  your  own,  and  tell  your  own  IG  story.  Be  Practical  Start  in  the  Right  Place   P a g e  |  6         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  7. 7. “Organisations   become   overwhelmed   when   they   start   recognising   the   many   risks   inherent  in  information  mismanagement.  ‘Trying  to  address  them  all  at  once  can  feel   like  trying  to  boil  the  ocean.’”   “The  Future  of  Enterprise  Information  Governance,”  Economist  Intelligence  Unit8  Some  time  ago,  I  had  a  client  with  over  10,000  poorly  indexed,  improperly  stored,  and  nearly  undocumented  backup  tapes.  The  metaphorical  weight  of  these  tapes  around  the  neck  of  the  poor  folks  trying  to  implement  an  IG  program  at  the  company  was  massive.  How  could  they  even  begin  to  think  about  “easy”  things  like  policy  development  when  they  had  the  problem  of  10,000  legacy  backup  tapes  to  deal  with?    Many  organizations  are  in  this  position.  They  have  so  much  unmanaged  information  in  their  environment  that  it  effectively  paralyzes  them.  It  doesn’t  have  to  be  this  way.  In  fact,  organizations  should  focus  first  on  building  the  foundation  for  their  program  (policies,  procedures,  etc),  implementing  those  foundations  (tools,  training,  etc.)  and  only  then  cleaning  up  their  environment.  This  isn’t  the  only  way  to  approach  IG,  but  it  is  a  useful  framework  for  organizations  that  are  stuck.    This  approach  (detailed  in  Figure  1)  encourages  organizations  to  build  the  “new  world”  of  their  IG  program,  and  them  bring  old  content  into  that  world  over  time.  This  is  a  conceptual  model;  in  the  real  world  these  things  often  happen  simultaneously,  in  a  different  order,  and  faster  or  more  slowly  than  we  like.     Foundation     (policies)   Implementation     (tools,  training)   Remediation     (clean  up  the  past)   Continuous  Improvement   (audit  and  adjust)    Figure 1: A Practical Approach to Building an IG Program  Start  Small     P a g e  |  7         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  8. 8. “Real  transformation  takes  time.  Complex  efforts  to  change  strategies  or  restructure   businesses   risk   losing   momentum   if   there   are   no   sort-­term   goals   to   meet   or   celebrate.”   John  P.  Kotter,  Leading  Change9  I  had  another  client  with  75,000  employees  across  the  globe  involved  in  vastly  different  commercial  activities.  The  client  had  bought  into  the  dogma  that  IG  “must  be  done  on  an  enterprise  level.”  However,  the  complexity  of  implementing  a  single  email  management  policy  across  the  enterprise  (much  less  the  technology  and  management  programs  required  to  support  it)  was  so  great  that  in  effect,  nothing  was  happening.  This  is  a  common  mistake.  Although  the  goal  of  IG  should  be  consistent,  defensible  practices  across  an  entire  enterprise,  that  doesn’t  mean  that  the  entire  enterprise  needs  to  get  there  at  once.  In  fact,  the  more  effective  approach  is  often  to  start  small,  and  focus  on  a  manageable  group  in  which  to  try,  test,  and  validate  the  IG  approach.  Yes,  it  is  critical  that  the  principles  of  the  IG  program  can  be  effectively  implemented  across  the  enterprise,  but  starting  small  will  only  make  the  program  better.    So,  write  the  policies,  select  the  technology,  design  the  training  with  the  enterprise  in  mind,  but  try  it  first  on  a  manageable  group.  What  you  learn  from  this  approach  will  make  your  eventual  enterprise  program  better  and  increase  the  likelihood  of  IG  success  by  giving  you  powerful,  practical  IG  stories  to  tell,  and  thus  building  credibility  and  capital  with  decision  makers  and  stakeholders.  IG  is  Change  Management   “Top-­down  support  is  critical  to  the  success  of  any  information  governance  strategy.”   “The  Future  of  Enterprise  Information  Governance,”  Economist  Intelligence  Unit10  IG  and  change  management  are  inseparable.  For  many  years  organizations  have  effectively  allowed  knowledge  workers  to  create,  use,  retain,  and  destroy  digital  information  with  almost  no  (enforced)  rules  or  (effective)  controls.  IG  seeks  to  change  that.  It  is  not  an  easy  change.    Just  think  about  how  you  personally  view  your  email  at  work.  Even  the  most  enlightened  IG  practitioners  probably  feel  a  stab  of  angst  at  the  idea  of  someone  -­‐  or  some  policy  -­‐  dictating  how  they  manage  “their”  email.  Multiply  this  feeling  across  hundred  or  thousands  of  less  IG-­‐enlightened  employees  and  the  change  management  challenge  becomes  clear.    The  social  and  cultural  aspects  of  IG  change  are  often  ignored  -­‐  at  an  organization’s  peril.  When  implementing  IG,  you  consider  the  following:   P a g e  |  8         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  9. 9. 1) IG  change  will  not  happen  from  the  bottom  up.   2) IG  change  will  not  happen  unless  we  honestly  calculate  the  cost  of  the  change   and  plan  for  it.       3) IG  change  will  not  happen  unless  we  learn  to  tell  the  IG  stories.   4) IG  change  will  not  happen  unless  we  can  create  and  point  to  its  benefits  in  the   short-­‐term.     5) IG  change  will  not  happen  without  the  support  of  all  the  stakeholders,  including   legal,  IT,  records  management,  and  business  leaders.       P a g e  |  9         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  10. 10. 1. We Can’t Keep Everything Forever “Information   workers,   who   comprise   about   63%   of   the   U.S.   work   force,   are   each   bombarded  with  1.6  gigabytes  of  information  on  average  every  day  through  emails,   reports,  blogs,  text  messages,  calls  and  more.  .  .”   “Don’t  You  Dare  Email  This  Story,”  Wall  Street  Journal11    IN  BRIEF.  IG  makes  sense  because  it  enables  organizations  to  get  rid  of  unnecessary  information  in  a  defensible  manner.  Organizations  need  a  sensible  way  to  dispose  of  information   in   order   to   reduce   the   cost   and   complexity   of   IT   environment.   Having  unnecessary   information   around   only   makes   it   more   difficult   and   expensive   to  harness  information  that  has  value.    Most  statistics  on  the  volume  of  digital  information  organizations  create  contain  numbers  so  large  that  they  are  hard  to  comprehend  (for  example,  “the  digital  universe”  is  281  exabytes  in  size12).  Organizations  experience  30,  50,  or  even  100  per  cent  annual  growth  in  the  volume  of  information  they  store.  The  trend  doesn’t  seem  to  be  slowing  down.  Although  the  cost  of  storage  hardware  continues  to  drop,  storage  hardware  costs  are  just  the  beginning.  According  to  International  Data  Corporation,  the  total  cost  of  storage  ownership  “far  outweighs  the  initial  purchase  price”  of  the  hardware,  and  includes  factors  such  as  migration,  outage,  performance,  information  governance,  environmental,  data  protection,  maintenance,  and  staff  costs.13  Organizations  often  claim  that  they  are  just  keeping  a  piece  of  information  “for  now.”  Without  a  firm  plan  in  place,  this  really  means  “keeping  it  forever.”  After  all,  unless  you  plan  on  keeping  a  piece  of  information  forever,  you  will  need  to  make  a  destruction  decision  about  it  at  some  point.  Will  that  destruction  decision  be  easier  or  more  difficult  in  the  future?  After  all,  in  three,  five,  or  ten  years  will:    You  have  the  software  that  created  the  information?    You  have  the  hardware  to  read  the  media  that  the  information  is  stored  on?    The  employee  that  created  it  still  be  working  at  the  company?    The  department  that  the  employee  worked  in  still  exist?    Anyone  remember  anything  about  the  project  that  document  was  created  for?    Litigation  be  filed  that  requires  the  preservation  of  that  information?  IG,  with  its  legal  and  compliance  foundations,  provides  a  defensible  approach  to  disposing  of  unnecessary  information.  The  combination  of  good  policies  around  retention  of   P a g e  |  10         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  11. 11. information  during  normal  business  operations  and  preservation  of  information  during  litigation  or  regulatory  investigation  protects  your  organization.  The  law  doesn’t  require  us  to  keep  everything  forever,  but  only  IG  provides  a  defensible  framework  to  help  us  get  rid  of  the  information  we  don’t  want  and  aren’t  required  to  keep.     P a g e  |  11         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  12. 12. 2. We Can’t Throw Everything Away “Ensuring  the  right  information  is  available  to  users  when  needed  is  regarded  as  the   highest   business   priority   for   large   companies   in   2009   .   .   .   and   the   vast   majority   of   decision-­makers  believe  that  an  effective  information  strategy  has  a  very  significant   impact  on  this  top  business  goal.”   “Managing   Information:   Research   Study   on   Customer   Priorities   and   Challenges,”   RONIN  Corporation14  IN  BRIEF.  IG  makes  sense  because  organizations  can’t  keep  everything  forever,  nor  can  they  throw  everything  away.  We  need  information  –  the  right  information,  in  the  right  place,  at  the  right  time.  Only  IG  provides  the  framework  to  make  good  decisions  about  what  information  to  keep.    If  we  could  throw  away  every  piece  of  information  created  and  received  in  our  institutions  whenever  we  wanted  to,  there  would  be  little  need  for  IG.  The  reality,  of  course,  is  much  different.    Information  is  how  we  do  business  and,  to  a  greater  degree  each  year,  business  success  is  influenced  by  how  well  we  manage  that  information.    Although  most  information  is  created  by  individuals,  “enterprises  are  responsible  for  the  security,  privacy,  reliability,  and  compliance  of  85%”  of  it.  15  This  is  the  role  of  IG.    Some  information  we  keep  because  of  its  business  value.  Some  we  keep  because  of  legal  requirements.  By  some  calculations,  there  are  thousands  of  laws  and  regulations  in  the  US  alone  that  speak  to  the  way  organizations  must  manage  their  information.    The  role  of  IG  is  to  parse  those  laws  and  regulations  into  practical  policies  and  retention  schedules  that  guide  the  organization  on  its  proper  management.  Without  an  IG  program,  organizations  are  at  risk  of  breaking  the  law.    Certain  external  events,  such  as  litigation  or  a  regulatory  investigations,  also  create  special  legal  requirements  for  the  management  of  information.  In  these  situations,  even  information  that  could  normally  be  thrown  away  has  to  be  preserved  and  properly  managed.  Failure  to  do  so  opens  an  organization  and  its  employees  up  to  serious  criminal  and  civil  penalties,  such  as  those  spelled  out  in  Section  802  of  Sarbanes  Oxley:     “Whoever  knowingly  .  .  .    destroy[s]    .  .  .  any  record,  document,  or  tangible  object  with   the   intent   to   impede,   obstruct,   or   influence   the   investigation   or   proper   administration  of  any  matter  .  .  .  shall  be  fined  under  this  title,  imprisoned  not  more   than  20  years,  or  both.16  We  can’t  throw  everything  away.  We  need  some  way  to  determine  which  information  has  value  -­‐  either  because  of  business  goals  or  legal  requirements.  IG  helps  us  with  this.   P a g e  |  12         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  13. 13. 3. E-Discovery “It   costs   about   20   cents   to   buy   1GB   of   storage,   however,   it   costs   around   $3500   to   review  1  GB  of  storage.”   AIIM  International  Email  Management  ROI  Calculator17   “87%   of   lawyers   who   responded   to   the   survey   said   electronic   discovery   is   too   costly…   A   fundamental   problem   stems   from   companies’   not   considering   the   retention   of   information.”   Digital  Data  Drive  Up  Legal  Costs,  Wall  Street  Journal18  IN  BRIEF.  IG  makes  sense  because  it  reduces  the  cost  and  pain  of  discovery.  Proactively  managing  information  reduces  the  volume  of  information  exposed  to  e-­discovery  and  simplifies  the  task  of  finding  and  producing  responsive  information.    In  the  past  five  years,  electronic  discovery  has  evolved  from  a  specialized  legal  issue  into  a  disruptive  force  in  the  business,  IT,  legal,  and  information  management  realms.    This  transformation  was  kicked  off  in  the  US  by  the  2006  amendments  to  the  Federal  Rules  of  Civil  Procedure,  and  fueled  by  years  of  inattention  to  information  management  at  many  organizations,  which  had  allowed  vast  stockpiles  of  unnecessary  email,  documents,  and  databases  to  accumulate.      Today,  organizations  can  expect  to  spend  millions  of  dollars  finding,  processing,  and  producing  responsive  digital  information  in  the  course  of  a  major  lawsuit.  One  out  of  five  large  organizations  spends  more  than  $10  million  each  year  on  litigation  (excluding  settlements  and  judgments).  19By  2011,  it  is  expected  that  organizations  will  spend  nearly  $5  billion  annually  on  e-­‐discovery  tools.  20  The  expense  of  e-­‐discovery  comes  from  many  sources,  but  one  of  the  most  significant  is  the  cost  of  finding,  processing,  and  reviewing  information  that  has  been  unnecessarily  retained.  The  law  on  this  point  is  quite  simple:  if  you  possess  information  at  the  time  you  know  or  suspect  it  will  be  responsive  to  a  legal  matter,  you  must  preserve  it  –  even  if  you  could  have  normally  disposed  of  it  in  accordance  with  your  records  management  program.21  The  proactive  nature  of  IG  means  that  unnecessary  information  is  disposed  of  as  soon  as  it  is  no  longer  needed  and  all  legal  requirements  for  its  retention  or  preservation  have  been  satisfied.  IG  enables  us  to  get  rid  of  unnecessary  information  in  a  defensible  manner.  As  such,  it  can  reduce  the  amount  of  information  that  needs  to  be  reviewed  in  the  course  of  a  legal  matter.     P a g e  |  13         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  14. 14. When  working  with  clients,  it  is  not  uncommon  to  find  that  75  to  95  percent  of  the  information  created  by  the  organization  in  the  email  system,  for  example,  has  no  long-­‐term  business  value  or  legal  retention  requirement  and  can  be  disposed  of  in  the  ordinary  course  of  business.  These  percentages  vary  by  system  and  industry,  but  the  amount  of  “record”  content  is  usually  much  lower  than  “non-­‐record.”  Further,  a  good  IG  program  reduces  the  amount  of  duplicate  information  stored  by  an  enterprise.  Duplication  is  expensive  and  wasteful.  In  our  e-­‐discovery  practice,  it  is  not  uncommon  to  find  that  30  percent  or  more  of  the  data  we  collect  from  clients  is  duplicate  information.      The  value  of  IG  then,  is  that  it  can  help  organizations  defensibly  reduce  the  amount  of  information  stored  by  orders  of  magnitude  –  a  benefit  that  is  felt  not  only  in  reduced  management  costs,  but  also  reduced  e-­‐discovery  costs  and  risks.     P a g e  |  14         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  15. 15. 4. Your Employees are Begging for It – Just Listen “When   you   start   to   actively   address   your   organizations   information   overload   challenges  and  give  people  the  guidance  and  tools  they  need  to  work  more  effectively,   amazing   things   happen.   They   start   to   make   better   decisions.   They   finish   projects   faster.  They  generate  new  ideas.  And  they  drive  business  growth.”   Basex  Information  Overload  Exposure  Assessment22  IN  BRIEF.  IG  makes  sense  because  it  help  knowledge  workers  separate  “signal”  from  “noise”  in  their  information  flows.  By  helping  organizations  focus  on  the  most  valuable  information,  IG  improves  information  delivery  and  improves  productivity.  Study  after  study  shows  that  most  knowledge  workers  feel  overwhelmed  by  the  amount  of  information  they  have  to  deal  with.  One  study  found  that  “sheer  overload”  is  the  biggest  problem  with  email  as  a  business  tool.  23  Another  says  that  most  professionals  spent  way  too  much  time  looking  for  information  and  feel  they  could  not  handle  any  “increases  in  information  flow.”24  Yet  another  study  claims  that  companies  in  the  US  lose  $900  billion  each  year  worth  of  employee  productivity  due  to  information  overload.25    Our  experience  with  implementing  IG  programs  has  taught  me  that,  after  a  period  of  initial  resistance,  most  knowledge  workers  appreciate  the  clarity  that  IG  policies  and  technology  provide.  Rather  than  struggling  to  invent  their  own  “filing  system”  and  worrying  about  the  trouble  that  they  may  face  if  they  get  it  wrong,  the  majority  of  employees  quickly  understand  the  value  of  IG  and  make  it  part  of  their  daily  routine.  At  one  organization  the  time  that  employees  spent  managing  information  dropped  by  50%  within  three  months  of  program  implementation.    The  deluge  of  poorly  managed,  redundant,  irrelevant,  and  unclassified  information  that  most  knowledge  workers  face  today  is  huge  and  growing.  IG  can  improve  productivity  and  reduce  the  impact  of  information  overload  by  helping  organizations:      Classify  information  better  so  it  can  more  easily  be  found    Get  rid  of  unnecessary  information  so  employees  don’t  have  to  weed  through  it    Better  target  and  personalize  information  for  individuals  and  communities    Provide  better  access  to  information  while  still  meeting  confidentiality  and   information  protection  requirements    Assign  resources  and  technology  to  information  commensurate  with  its  value     P a g e  |  15         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  16. 16. 5. It Ain’t Gonna Get Any Easier “By   far   the   biggest   mistake   people   make   when   trying   to   change   organizations   is   to   plunge   ahead   without   establishing   a   high   enough   sense   of   urgency   in   fellow   managers  and  employees.  This  error  is  fatal  because  transformations  always  fail  to   achieve  their  objectives  when  complacency  levels  are  high.”   John  P.  Kotter,  “Leading  Change,”  Harvard  Business  School  Press,  1996,  p.  4.  IN  BRIEF:  IG  makes  sense  because  it  is  a  proven  way  for  organizations  to  respond  to  new  laws  and  technologies  that  create  new  requirements  and  challenges.    The  problem  of  IG  will  not  get  easier  over  time,  so  organizations  should  get  started  now.    Every  day  the  pile  of  unmanaged  information  in  your  organization  grows.  Every  day  the  habits  of  your  knowledge  workers  get  more  ingrained.  Every  day  new  technologies  enter  your  enterprise  and  create  new  sources  of  unmanaged  risk.  Every  day  technology  gets  more  complex.  Every  day  courts  and  regulators  grow  more  sophisticated  and  demanding  when  it  comes  to  information  management.  Time  will  not  make  the  information  management  problem  any  easier.      More  regulation  of  information  management  is  expected.     “It’s   now   ‘inevitable   that   more   regulation   will   come,   forcing   companies   to   be   more   ethical,  more  compliant  and  overall  better  corporate  citizens.’"   Former  SEC  Chairman  Harvey  Pitt26  Beginning  as  early  as  the  1970s  (with  privacy  law  directed  at  the  federal  government)  and  intensifying  in  the  early  years  of  the  new  millennium  (with  Sarbanes-­‐Oxley  and  the  revised  Federal  Rules  of  Civil  Procedure),  governments,  regulators,  and  standards  bodies  have  demonstrated  an  increasing  appetite  for  the  regulation  of  IT  and  information.  Increasing  federal  and  state  regulation  has  driven  demand  for  IG  products  and  services.  27  The  current  administration  in  the  US,  as  well  as  regulators  in  nations  across  the  globe,  have  demonstrated  an  increasing  appetite  for  regulation;  an  appetite  that  seems  only  to  be  increasing  in  the  wake  of  the  recent  global  economic  crisis  that  is  widely  seen  as  having  a  root  cause  in  inadequate  government  oversight  and  regulation.  This  is  likely  to  drive  legal  and  regulatory  changes  that  will  create  new  IG  requirements  for  organizations.    Information  is  getting  more  complex.     P a g e  |  16         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  17. 17. “Using   a   growing   set   of   free   and   simple   tools   and   applications,   it   is   easy   to   create   customized,   personal   web-­based   environments   —   a   personal   web   —   that   explicitly   supports   one’s   social,   professional,   learning   and   other   activities   via   highly   personalized  windows  to  the  networked  world.”   The  New  Horizon  Report28  The  growing  business  use  of  Web  2.0  technologies  such  as  blogs,  wikis,  and  social  networking  tools,  along  with  other  developments  such  as  Internet  “cloud”  based  applications,  are  making  information  management  more  challenging.  The  emergence  of  such  technologies  is  a  challenge  to  the  “very  strong  and  entrenched  ‘command  and  control’  ethos  that  is  prevalent  in  the  records  management  world.29  The  reality  today  is  that  each  knowledge  worker  –  like  it  or  not  –  is  his  or  her  own  records  manager.  Responsibility  for  the  creation  and  management  of  information  has  become  highly  distributed  and  a  new  generation  of  Internet-­‐based  tools  and  applications  only  encourage  this  trend.      In  addition,  technologies  like  “Google  Wave”30  create  new  difficulties.  Products  that  blend  together  formerly  discrete  communication,  collaboration  and  content  creation  tools  challenge  the  long-­‐standing  focus  on  “the  document”  and  usher  in  a  world  where  we  no  longer  manage  discrete  piece  of  information.    The  “wave”  of  information  created  by  these  tools  is  an  ever-­‐changing  Hydra  that  pulls  information  from  a  variety  of  sources  and  blends  them  together  into  an  environment  that  cannot  be  “retained”  or  managed  using  traditional  approaches.    As  technology  –  and  the  new  forms  of  information  created  by  that  technology  –  grows  more  complex,  IG  provides  the  foundation  from  which  we  can  build  processes  and  techniques  to  properly  manage  that  information.  IG  isn’t  getting  any  easier  -­‐  the  time  to  act  is  now.   P a g e  |  17         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  18. 18. 6. The Connected Thinking of IG is the Future of Business Success “While   detailed   knowledge   of   a   single   area   once   guaranteed   success,   today   the   top   rewards  go  to  those  who  can  operate  with  equal  aplomb  in  starkly  different  realms.”   Daniel  Pink,  “A  Whole  New  Mind”31  IN  BRIEF.  IG  makes  sense  because  it  reflects  the  future  of  organizational  culture  –  diverse  groups  working  together  to  solve  complex  problems.  IG  can  help  to  foster  this  culture  and  lead  organizational  change.    In  the  bestselling  book,  “A  Whole  New  Mind,”  Daniel  H.  Pink32  argues  that  the  future  belongs  to  those  who  can  see  across  boundaries  to  envision  the  “connections  between  diverse,  and  seemingly  separate,  disciplines.”  He  posits  that  this  ability  is  becoming  essential  to  the  success  of  individuals  and  organizations.    This  theory  is  directly  applicable  to  information  governance.  Information  governance,  with  its  legal,  technology,  records  management,  and  business  elements,  is  by  nature  multi-­‐disciplinary.  Success  in  IG  is  synonymous  with  the  ability  to  peer  beyond  the  confines  of  one  discipline  to  understand  how  each  discipline  connects  with  the  others  to  solve  the  problem.    Steve  Bailey  suggests  that  “[r]ecords  management  has  .  .  .  long  been  defined  by  the  narrowness  of  its  focus”33  But,  records  management  shouldn’t  be  singled  out.  Just  as  records  management  has  clung  to  the  idea  that  it  should  only  worry  about  one  narrow  class  of  information  (i.e.,  records  –  often  in  paper  form),  IT  has  largely  refused  to  take  management  responsibility  for  the  information  flowing  through  its  systems.  Business  leaders  and  attorneys  have  their  own  form  of  blinders  that  are  a  barrier  to  the  connected  thinking  and  problem  solving  that  IG  requires.      As  a  consultant,  I  have  many  times  sat  in  windowless  rooms  drinking  terrible  coffee  and  mediating  between  these  groups.  Although  this  is  rewarding  work,  the  pattern  is  always  the  same:  nobody  understands  that  they  are  all  trying  to  solve  the  same  problem.  Each  group  is  more  than  willing  to  share  their  discipline’s  view  of  the  problem  (often  using  their  “outside  voices”),  but  nobody  believes  that  they  “own”  the  IG  problem  as  a  whole.    And,  in  most  cases  they  are  right.  Corporate  governance  structures  mostly  have  not  evolved  to  address  the  complex  issues  of  IG.  The  result?  When  the  committees  and  task  forces  and  working  groups  have  all  come  and  gone,  nobody  is  on  the  line  –  in  their  career  and  their  paycheck  -­‐  for  the  success  of  the  IG  effort.     P a g e  |  18         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  19. 19. The  flipside  of  this  is  equally  true.  When  everyone  owns  a  task,  nobody  in  particular  owns  the  task.  Thus,  nobody  can  be  held  accountable.  Corporate  structures  aren’t  very  good  at  holding  groups  responsible  -­‐  at  least  at  the  task  level.    In  mediating  such  sessions,  I  have  been  most  successful  when  each  group  has  learned  –  often  through  a  traumatic  experience  -­‐  to  empathize  with  the  others  (incidentally,  another  “right  brain”  quality  that  Pink  points  out  as  essential).    Any  guesses  as  to  what  the  catalyst  for  this  empathy  is  the  majority  of  the  time?  Lawsuits.  Investigations.  Major  business  events  that  require  legal,  IT,  records  management,  and  business  to  work  together  –  often  under  enormous  pressure  –  to  solve  a  problem.     P a g e  |  19         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  20. 20. 7. The Courts Will Come Looking for IG “It   is   clear   that   [the]   lack   of   a   retention   policy   and   irresponsible   data   retention   practices  are  responsible  for  the  loss  of  significant  data  .  .  .  Information  management   policies   are   not   a   dark   or   novel   art.   Numerous   authoritative   organizations   have   long   promulgated  policy  guidelines  for  document  retention  and  destruction.”   Philip  M.  Adams  &  Associates,  LLC  v.  Dell,  Inc.,  200934  IN  BRIEF.  IG  makes  sense  because  courts  and  regulators  will  closely  examine  your  IG  program.  Falling  short  can  lead  to  fines,  sanctions,  loss  of  cases,  and  other  outcomes  that  have  negative  business  and  financial  consequences.    There  used  to  be  an  open  secret  about  IG.  Nobody  talked  about  it,  but  everyone  believed  it.  The  secret?  If  all  you  did  about  IG  was  write  a  bunch  of  words  on  a  piece  of  paper,  call  it  a  policy,  and  put  it  in  a  binder  on  a  shelf  somewhere,  you  were  good.  You  had  taken  care  of  your  problem.    That  era  is  over.    Today,  courts,  regulators,  and  other  outside  parties  have  grown  in  sophistication  and  expertise  when  it  comes  to  IG.  Dead  policies  on  dead  trees  don’t  work.  Today,  your  IG  program  needs  to  be  comprehensive,  funded,  enforced,  and  real.    Recent  cases  demonstrate  this.  For  example,  in  the  case  quoted  above,  the  court  not  only  looked  for  the  existence  of  an  IG  program,  but  evaluated  the  legitimacy  of  various  aspects  of  the  program  in  detail.  It  questioned  the  lack  of  IG  policies,  stating  that  the  litigant  “did  not  have  a  .  .  .  information  management  policy”  and  questioned  why  it  offered  “no  statement  from  management-­‐level  persons  explaining  its  practices,  or  existence  of  policies.”35  Further,  the  court  made  an  interesting  statement  about  evaluating  IG  programs  that  should  put  all  organizations  on  notice  that  they  can  expect  outside  parties  –  including  courts  and  regulators  –  to  evaluate  the  quality  and  reasonableness  of  their  IG  programs:        “A   court-­and   more   importantly,   a   litigant   –   is   not   required   to   simply   accept   whatever   information   management   practices   a   party   may   have.   A   practice   may   be   unreasonable,   given   responsibilities   to   third   parties.   While   a   party   may   design   its   information   management   practices   to   suit   its   business   purposes,   one   of   those   business  purposes  must  be  accountability  to  third  parties.    An  IG  program  is  not  merely  an  internal,  private  affair.  Rather,  an  IG  program  is  a  statement  to  the  world  about  how  seriously  you  take  your  information  management  obligations.  Expect  it  to  be  closely  examined.       P a g e  |  20         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  21. 21. 8. Manage Risk: Information Is a Big One “Risk  doesn’t  mean  danger—it  just  means  not  knowing  what  the  future  holds.  That   insight  resides  at  the  core  of  risk  management  for  companies,  whether  in  managing   the  potential  downside  of  an  investment  or  putting  a  value  on  the  option  of  waiting   when  making  irreversible  decisions.”   McKinsey  Quarterly,  “Peter  L.  Bernstein  on  Risk”36    IN  BRIEF.  Organizations  need  to  do  a  better  job  of  identifying  and  managing  risk.  The  risk  of  information  management  failures  is  a  critical  risk  that  IG  helps  to  mitigate.    Organizations  cannot  get  an  accurate  picture  of  their  enterprise  risk  without  including  IG  in  that  calculation.  The  cost  of  information  management  failures  has  grown  in  recent  years,  and  is  only  growing  as  regulation  and  scrutiny  in  this  area  intensifies.  The  widespread  failure  of  financial  institutions  to  adequately  quantify  and  mange  risk  is  seen  by  many  to  be  a  major  contributor  to  the  current  economic  downturn.    In  fact,  the  Shareholder  Bill  of  Rights  Act  of  2009,  a  new  law  currently  being  considered  by  the  US  Congress  states  that,  “both  executive  management  and  boards  of  directors  have  failed  in  their  most  basic  duties,  including  to  .  .  .  appropriately  analyze  and  oversee  enterprise  risk.”    The  way  that  information  is  managed  can  be  the  difference  between  winning  and  losing  in  litigation.  It  can  dramatically  affect  the  outcome  of  regulatory  investigations.  It  contributes  significantly  to  the  success  of  mergers  and  acquisitions.    IG  needs  to  be  part  of  every  organization’s  strategy  to  measure  and  mitigate  enterprise  risk.     P a g e  |  21         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468      
  22. 22. 9. Email: Reason Enough  “Workers  distracted  by  phone  calls,  e-­mails  and  text  messages  suffer  a  greater  loss  of   IQ  than  a  person  smoking  marijuana,  a  British  study  shows.”   Emails  ‘hurt  IQ  more  than  pot,’  CNN.com37  IN  BRIEF.  IG  makes  sense  because  it  helps  organizations  take  control  of  email.  Solving  email  should  be  a  top  priority  for  every  organization.  According  to  the  study  quoted  above,  using  email  can  be  hazardous  to  your  intelligence.  Sometimes  I  think  that  the  same  IQ  deficit  sets  in  when  companies  try  to  manage  email.  Everything  they  have  learned  about  information  management  seems  to  be  forgotten,  and  they  end  up  with  policies  that  indiscriminately  keep  every  email  message,  or  throw  away  every  message,  regardless  of  what  the  message  contains.  Or,  they  impose  volume  limitations  without  the  support  of  a  policy  that  tells  employees  that  some  messages  have  legal  implications  and  cannot  be  blown  away  simply  because  they  violate  an  arbitrary  storage  limitation.  Or,  they  just  do  nothing.    Email  is  how  we  do  business  today.  Our  email  systems  are  full  of  “a  significant  number  of  important  emails  involving  the  organization  in  obligations,  agreements,  contracts,  regulations  and  discussion.”38  At  the  same  time,  email  mismanagement  causes  so  many  problems  that  it’s  amazing  we  use  it  at  all.      IG  helps  us  take  control  of  the  email  management  problem.  IG  policies  provide  rules  on  how  email  is  managed.  Retention  schedules  guide  the  retention  and  disposition  of  email.  Information  technology  helps  us  implement  and  enforce  the  policies.  IG  training  ensures  that  everyone  understand  their  responsibilities.    Apply  IG  to  your  email  system  –  it’s  reason  enough  to  invest  in  an  IG  program.  When  doing  so,  keep  the  following  in  mind:   1) Develop  defensible  policies  that  align  with  your  approach  to  information   management  in  other  systems   2) Consider  turning  off  the  ability  for  users  to  export  email  to  local  files   3) Ensure  that  your  Legal  Hold  process  covers  email   4) Look  at  email  archiving  to  reduce  volume,  duplication,  and  improve  centralized   management  capabilities     P a g e  |  22         ©  2010,  2011  Barclay  T.  Blair                                                      646-­‐450-­‐4468