"It is not the beauty of a building you should look at; its the construction of the foundation that will stand the test of time."
- David Allan Coe
A
neighbor is building a house a couple of lots away here on the Pacific
coast and I have been watching the workmen at their tasks from my third
floor home office. They spent an entire month digging and laying the
foundation, but when actual construction began they had four walls up
within the first two days. And getting the next two floors up has gone
pretty fast since then (slightly blocking my ocean view!).
When formulating an information governance
(IG) program, your organization must do more than recognize the need to
reduce information risks and costs and maximize its value. You must do
more than name an IG lead, who will act as a sort of general contractor
coordinating the efforts of the various specialty disciplines.
You must build an information governance framework (IGF) which is the foundation of your IG program. Without it, you will end up with a weak and unstable program that will likely fail, as many have.
Each
IG framework will look a little different but there are commonalities
that appear in successful ones. An IGF needs to be modified according to
the terrain (competitive industry scenario) and elements (external
business environment) and available labor and building materials
(internal human resources, skillsets, budget).
Here are the key components of an IG Framework that will serve as the construct, the foundation for your successful IG program:
- Business Objectives -
This is where you start. Your organizational goals and objectives are
the key reason for implementing an IG program. They provide the business
rationale for investing resources. The objectives for the IG program
must align with and support the organization's overall strategic plan,
and IT strategy. (My neighbor's key objectives are to build a safe and
comfortable home with an ocean view for he and his wife to enjoy their
eventual retirement in, and for now to provide a workspace for his
daughters to pursue artistic projects).
- Executive Sponsor - The person with the money and the motivation to build the IG program. Like my neighbor, the executive sponsor
is involved with developing the blueprint and overall building plan but
leaves the specifics to those with expertise in key areas. He stays in
the loop, and, at times, may have to intervene - like when the workmen
had covered up the base of the foundation without first applying a
waterproofing seal. He made them go back, re-dig, and do it properly.
But also, other times, he is the one offering coffee and donuts in the
morning, or springing for a pizza party on a Friday afternoon after a
long week of work where good progress was made. A good executive sponsor
uses both carrots and sticks.
- IG Lead - This
person is accountable for executing the IG strategic plan and completing
milestones within the budget, resource, and time constraints approved
by the executive sponsor. The IG lead could be the organization's
General Counsel, CIO, Chief Risk Officer, even CEO, or ideally, as the
Sedona Conference and IG Initiative have called for, the Chief IG
Officer.
- Cross-functional IG Team
- Just as architects, bricklayers, plumbers, electricians and
carpenters are needed to build a house, an IG program will need a blend
of professionals. They should be leaders in key functional areas,
including: legal, IT, privacy, security, records management, and also
business unit heads/information owners, and potentially other key areas
such as change management, risk management, communications, training,
and other specialties as appropriate. Your IG team will have a different
makeup from your neighbor's IG team, as business objectives, resources,
corporate culture and other variables are different, even if you are in
the same industry.
- Survey and Evaluate External Factors
- Once you have an IG team in place and the IG plan is harmonized and
aligned with your organization’s strategic plan and IT strategy, you
have made fair progress. But you are not finished yet, because the plan
cannot survive in a vacuum: Organizations must analyze and consider the
external business, legal, and technological environment and fold their
analyses into their plans. This includes an analysis of IT trends,
business conditions, and the economic environment. It also includes
analyzing relevant legal, regulatory, and even political factors.
Further, you must consider IG principles, survey industry best practices
and relevant standards, and form a business rationale to select the
appropriate best practices and standards to guide your program. Use the IG Reference Model to facilitate discussions and leverage any IG Maturity Models (e.g. information security, records management, privacy)
available for assessments. Then you synthesize the gathered information
and fuse your findings into your overall IG strategic plan.
- Program Communications & Training - Your IG program must include a communications and training component
as a standard function. Your stakeholder audience must be made aware of
new policies and practices that are to be followed, and how this new
approach contributes toward accomplishing business objectives. But
critically, they must receive training on the new approach, and constant and consistent reinforcement of new IG precepts.
- Program Metrics, Monitoring, Auditing & Enforcement
- How do you know how well you are doing? An IG program must have
established metrics and controls to determine the level of employee
compliance, its impact on key operational areas, and progress made
toward key business objectives. Testing and auditing provide an
opportunity to give feedback to employees on how well they are doing and
to recommend changes they may make. And having objective feedback on
key metrics also will allow your executive sponsor to see where progress
has been made, and where improvements need to focus.
By including the above elements in your IG framework your
organization will have established a solid foundation to build your IG
program, and it will have greatly increased its odds of success.
-------------------------------------------------------------------------------------------------------------
I am teaching live, online IG Advanced classes June 22, 24, & 26. These are the most comprehensive and up-to-date courses on IG topics available in the world.
With our virtual classroom, you have no travel hassles and you get
instructor-led training by the author of the leading book on IG, along
with other industry leaders, including Barclay Blair, Dr. Pat Franks, CRM, IGP, and Charles Dollar. Detailed syllabuses and our new pricing can be found here: https://www.igtraining.com/live-online-training.html
Come
join us and let's learn together! We already have a good group of
students and returning students for our late-June Advanced IG class but
there is still time to register!
Try our special offer: your first day of training is just $99! More details are here: https://www.igtraining.com/
---------------------------------------------------------------------------------------------------------
Robert Smallwood is a keynote speaker, consultant, trainer, and author of 7 books, including the leading text on IG, Information Governance:Concepts, Strategies, and Best Practices (Wiley, 2014). He is a frequent blogger on IG topics, and is Managing Director of the Institute for IG at IMERGE Consulting, at www.IGTraining.com. He teaches comprehensive courses on IG and E-records management for corporate and public sector clients.
Follow Robert on Twitter @RobertSmallwood and if we are not connected - please feel free to reach out!
#Smallwood #infogov #InformationGovernance #InfoSec