Blogs

This previous post was about the need for holism in information governance. This post brings up topics that you’ll have to deal with in defining holistic information governance. (I think I’ll refer to these as PHIGs - Principles of Holistic Information Governance). This isn’t going to be exhaustive or ultra-detailed; it’s just a list to guide where you need to pay attention.

Principles of Holistic Information Governance

1.       Information is an organizational asset.

In the course of our employ we produce and receive information. It doesn’t belong to us, it belongs to our employers. As such, we need to treat it like any other corporate asset. Even if you use a personal device to produce the information, it still belongs to the organization.

Assets have acquisition costs, maintenance costs, residual value (sometimes), and get disposed of at the end of their useful lives. Tell me how this doesn’t apply to information.

If you do not understand this, stop reading and go away. There is no hope for you.

2.       Understand what you’re using information for.

How does information help you achieve strategic objectives? A government entity and a direct-to-consumer sales organization may use some of the same information, but they will use it differently and for different purposes.

Understanding what you’re using information for ought to help you understand what information you actually need.

3.       Understand where it’s coming from and where it’s going to.

Information doesn’t just magically appear; it comes from somewhere. You need to identify your internal and external information sources.

Most organizations don’t just fire information out willy-nilly. Information is intended for specific audiences, for specific purposes. You need to understand what effect your information is intended to have, and who you want/need it to effect.

4.       Understand when you need it.

The next person that says “I need this yesterday.” wins a smack in the head with a frozen mullet (the fish, not the hairstyle).

Information is needed at various points in business and decision making processes. Is real-time information really necessary or can you wait a few minutes or hours for it? Figure out when you actually need the information in order to make a decision.

5.       Understand who can and should be using it, and for what.

This is not just about security, though that’s a big piece. This is also about getting the information out to those that need it or to those that you want to influence with it. Think about it in terms of getting your message out to your target audiences.

Once the information has found its way to the audience, what are they going to do with it? Are they going to make a decision, buy something, receive a benefit…?

6.       Understand your social, regulatory, and compliance obligations.

Depending on what you do and for whom you do it, you have information related obligations. Some of these are imposed by statute, some by convention, and some are self-imposed. These obligations determine how long you must keep information, what you can do with it at the end of its life, and to whom you may or must disclose it when asked.

7.       Understand your information related risks (too much, not enough, disclosure, etc.).

If some of your information leaks, what’re the consequences and can you live with them?

If you’re overwhelmed by information how does it impact performance?

If you’re missing information can you still get stuff done?

How likely are you to be sued?

8.       Understand how stakeholders are interacting with it.

It’s not enough to know what your stakeholders are doing with information. You need to figure out how they’re doing it. It’s not enough to identify the types and locations of devices that stakeholders are using; you also need to find out if the interactions are passive or active.

9.       With few exceptions, information has a finite useful life.

Unless your information has historical/archival/archeological value, get rid of it as soon as you can. It’s not just about the whole discovery/litigation thing; it’s also about de-cluttering and being info-efficient.

Information is a perishable good; once it’s stale or rotted, get rid of it.

10.   Make someone accountable.

Overall organizational performance, financial performance, legal, technology … they all have single-role accountability and responsibility. As, arguably, the second most important asset of an organization, information deserves at least the same level of attention as finance, IT, HR, legal, etc.

A C-level executive needs to be accountable for how information is governed and managed across the organization.

The End

None of these ten “principles” is much good on its own; they only work as a whole. Other than the first and last, the key is to go only as deep as you need to in order to make things work for your organization. Nobody is expecting perfection; things just need to be good enough.

I’m not trying to downplay the difficulty in formulating information governance policies and procedures. However, much complexity can be avoided if common sense is applied and business objectives remain the primary focus.