This is the third article in our blog series looking at the practicalities of making Information Governance (IG) stick. Having introduced our take on IG in our overview article, ‘Living on the Left of the EDRM’, we then covered the leadership and vision needed to get an IG program started. So, with you as a reader ready at the starting line, this article explores the plan required to actually start work. Drawn from experience across a range of organizations, both enterprise and government, our aim here is to lay out the key parts of a working plan from which you can draw inspiration and ideas to apply to make your own. One size, of course, does not fit all, but best practice is always a great place to start.
First and foremost, work out who will spearhead the program. This individual needs to set a vision and answer the crucial question ‘why?’. We addressed the ‘why’ in our last article on leadership and vision and here we’ll ask ‘who?’, generalizing the most appropriate role or position in the organization.
It’s hard to generalize about organizational roles, but one constant pretty much everywhere is Information Technology or IT. From the outset we want to be clear that, in general, IT is exactly the wrong place right place to seek sustained leadership for an IG program. This is because it is rare to find IT leadership actively seeking responsibility for the information it facilitates, stores, and protects and because its ownership of the supporting technology architecture creates an unnecessary conflict of interest. What’s more, and maybe most importantly, IT is unlikely to have the skills required for success. That’s not to say that IT cannot lead; rather, it’s our experience that IT often ends up with the problem at its feet when it’s too hard to find anyone else. In our view, that means the program is set for failure. Of course, a powered-up IT lead who has sought the role rather than been handed it can be a good thing so long as conflicts of interest can be addressed.
In general, we would recommend that an IG program be led by some combination (or equivalent) of Compliance or Legal. Where it exists, we usually see a dedicated IG team reporting into one of these two but it’s unusual to see that team with sufficiently senior representation to be effective in the lead role. Elsewhere we have seen Records teams acting as proxies for IG but, again, it’s unusual to see such a team with senior representation. There are circumstances when others are more appropriate; often, a specific event might trigger an entirely different approach where a different leader makes obvious sense – for example, in response to a data breach might be led by the CISO.
A working program committee is a must. It brings together stakeholders to, among other things, drive program cadence, direct communications, be accountable for performance and the business case, and provide authority to act. In providing authority to act, it’s important to underline the need for an appropriate risk appetite – since IG programs inevitably involve the disposal of data, a committee that cannot set the necessary risk appetite will find itself forever mired in resolving escalations rather that directing the wider effort.
In many cases we find that a suitable function is already in place (for example, an IT investment committee, executive operations group or an information and records management committee). The important point is that it brings together stakeholders and program leadership in a deliberate effort to deliver beneficial change.
The program committee can consist of a range of members according to need but we generally see the following core membership:
In addition, we recommend that a non-core membership be established – these members take part when the focus is in their area of responsibility. Most commonly this would be information stakeholders from lines of business or business unit functions as the program progresses. See more later when we discuss ‘program shape’.
IG programs can fail in the starting blocks if program scope isn’t properly managed. To oversimplify, program leadership -advised by the program committee, needs to reign in its desire to boil the information ocean. Instead, it must identify and prioritize the right data with a risk appetite driven by the criticality of that data. In general, the greatest IG risks lie in the wilderness of uncontrolled unstructured (and semi-structured) data where a combination of user and machine processes continually create, combine, and forget about huge volumes of information relating to just about any business function. The committee needs to build a roadmap which enables this data to be addressed methodically and programmatically, piece-by-piece, repository-by-repository, and function-by-function. This roadmap needs to account for the following real-world constraints:
With leadership and an enabling committee in place, what might an IG program actually look like? Unsurprisingly, its structure is much like any enterprise information or technology project – a phased roll out kicked off by technology evaluations and one or more pilots, followed by a transition to business as usual. The emphasis in all phases is to bring together the people, technology, and processes necessary to deliver outcomes and a minimum set of information standards across all business functions.
Implicitly, the Committee must also plan to transition into a business-as-usual state. This should involve integrating the monitoring of standards across the business alongside any other standing responsibilities the committee might hold. Exceptions should be addressed within the committees’ established authority and, ideally, an ongoing dialog with the business will enable it to develop new IG capabilities which progress from compliance and efficiency to a more value-driven outcomes.
Sustaining an IG program can be a significant challenge for any organization, most often because first, leadership lacks the understanding that initial program gains will be lost without follow-on investment and, second, because the program fails to identify areas of additional value that might be delivered. We’ll therefore complete this article with a brief exploration of continual IG built around developing core capabilities of data discovery and data decision making, capabilities that define the core skillset for any IG team.
An initial implementation program can be built around a set of information standards which might be termed ‘minimum viable governance’ or MVG, which will vary by industry and jurisdiction. This typically requires a discovery and inventory of the target data estate; assignment of ownership/stewardship to business units; triage of data to be maintained, deleted, and archived; the classification of spilled sensitive data; and potentially the identification and capture of critical records and/or the production of a data map or record of processing activities to meet privacy or industry regulations. Meeting these requirements across the business gets IG moving but should be followed by additional value.
The most successful sustainment implementations we’ve seen establish a core team (the IG team or even, in one case, the Information Architecture team) which offers a menu of services to which the business can subscribe. Such a use case menu allows business functions to plan the development of their own information estate but also advertises what the team can offer in response to a particular risk or event. Example use cases might be:
This list, of course, is just an example. The potential range of use cases is virtually endless. The key point is that through the implementation of an IG program the organization and IG team grows a set of capabilities that can be repurposed to deliver new value and sustain the program and, in turn, continued information compliance.
In this article we’ve described our experience drawn from both successful and unsuccessful IG projects across a broad range of industries. We’ve presented potential approaches for leadership and what we think is a sound outline for a program committee and covered the shape of the program that committee will direct and the importance of managing and prioritizing the program’s data scope. We then finished with a discussion about program sustainment which, in our opinion, is the hallmark of a successful project. In our opinion, this is the crux. We see little point in investing in IG unless the organization and leadership expressly intend to resource and support its longevity and growth. This is because, with sustained investment, a successful program which leaves behind a functioning IG team and committee can deliver not only a minimum information compliance standard (described as MVG) but will and offer additional value and increased efficiencies as it grows and becomes embedded.