AIIM Open Forum

 View Only

Constructing Your Information Governance Framework

By Robert Smallwood posted 06-13-2015 18:05


"It is not the beauty of a building you should look at; its the construction of the foundation that will stand the test of time."
                                   - David Allan Coe

A neighbor is building a house a couple of lots away here on the Pacific coast and I have been watching the workmen at their tasks from my third floor home office. They spent an entire month digging and laying the foundation, but when actual construction began they had four walls up within the first two days. And getting the next two floors up has gone pretty fast since then (slightly blocking my ocean view!).

When formulating an information governance (IG) program, your organization must do more than recognize the need to reduce information risks and costs and maximize its value. You must do more than name an IG lead, who will act as a sort of general contractor coordinating the efforts of the various specialty disciplines.

You must build an information governance framework (IGF) which is the foundation of your IG program. Without it, you will end up with a weak and unstable program that will likely fail, as many have.

Each IG framework will look a little different but there are commonalities that appear in successful ones. An IGF needs to be modified according to the terrain (competitive industry scenario) and elements (external business environment) and available labor and building materials (internal human resources, skillsets, budget).

Here are the key components of an IG Framework that will serve as the construct, the foundation for your successful IG program:

  • Business Objectives - This is where you start. Your organizational goals and objectives are the key reason for implementing an IG program. They provide the business rationale for investing resources. The objectives for the IG program must align with and support the organization's overall strategic plan, and IT strategy. (My neighbor's key objectives are to build a safe and comfortable home with an ocean view for he and his wife to enjoy their eventual retirement in, and for now to provide a workspace for his daughters to pursue artistic projects).
  • Executive Sponsor - The person with the money and the motivation to build the IG program. Like my neighbor, the executive sponsor is involved with developing the blueprint and overall building plan but leaves the specifics to those with expertise in key areas. He stays in the loop, and, at times, may have to intervene - like when the workmen had covered up the base of the foundation without first applying a waterproofing seal. He made them go back, re-dig, and do it properly. But also, other times, he is the one offering coffee and donuts in the morning, or springing for a pizza party on a Friday afternoon after a long week of work where good progress was made. A good executive sponsor uses both carrots and sticks.
  • IG Lead - This person is accountable for executing the IG strategic plan and completing milestones within the budget, resource, and time constraints approved by the executive sponsor. The IG lead could be the organization's General Counsel, CIO, Chief Risk Officer, even CEO, or ideally, as the Sedona Conference and IG Initiative have called for, the Chief IG Officer.
  • Cross-functional IG Team - Just as architects, bricklayers, plumbers, electricians and carpenters are needed to build a house, an IG program will need a blend of professionals. They should be leaders in key functional areas, including: legal, IT, privacy, security, records management, and also business unit heads/information owners, and potentially other key areas such as change management, risk management, communications, training, and other specialties as appropriate. Your IG team will have a different makeup from your neighbor's IG team, as business objectives, resources, corporate culture and other variables are different, even if you are in the same industry.
  • Survey and Evaluate External Factors - Once you have an IG team in place and the IG plan is harmonized and aligned with your organization’s strategic plan and IT strategy, you have made fair progress. But you are not finished yet, because the plan cannot survive in a vacuum: Organizations must analyze and consider the external business, legal, and technological environment and fold their analyses into their plans. This includes an analysis of IT trends, business conditions, and the economic environment. It also includes analyzing relevant legal, regulatory, and even political factors. Further, you must consider IG principles, survey industry best practices and relevant standards, and form a business rationale to select the appropriate best practices and standards to guide your program. Use the IG Reference Model to facilitate discussions and leverage any IG Maturity Models (e.g. information security, records management, privacy) available for assessments. Then you synthesize the gathered information and fuse your findings into your overall IG strategic plan.
  • Program Communications & Training - Your IG program must include a communications and training component as a standard function. Your stakeholder audience must be made aware of new policies and practices that are to be followed, and how this new approach contributes toward accomplishing business objectives. But critically, they must receive training on the new approach, and constant and consistent reinforcement of new IG precepts.
  • Program Metrics, Monitoring, Auditing & Enforcement - How do you know how well you are doing? An IG program must have established metrics and controls to determine the level of employee compliance, its impact on key operational areas, and progress made toward key business objectives. Testing and auditing provide an opportunity to give feedback to employees on how well they are doing and to recommend changes they may make. And having objective feedback on key metrics also will allow your executive sponsor to see where progress has been made, and where improvements need to focus.

By including the above elements in your IG framework your organization will have established a solid foundation to build your IG program, and it will have greatly increased its odds of success.


I am teaching live, online IG Advanced classes June 22, 24, & 26. These are the most comprehensive and up-to-date courses on IG topics available in the world. With our virtual classroom, you have no travel hassles and you get instructor-led training by the author of the leading book on IG, along with other industry leaders, including Barclay Blair, Dr. Pat Franks, CRM, IGP, and Charles Dollar. Detailed syllabuses and our new pricing can be found here:

Come join us and let's learn together! We already have a good group of students and returning students for our late-June Advanced IG class but there is still time to register!

Try our special offer: your first day of training is just $99!  More details are here:


Robert Smallwood is a keynote speaker, consultant, trainer, and author of 7 books, including the leading text on IG, Information Governance:Concepts, Strategies, and Best Practices (Wiley, 2014). He is a frequent blogger on IG topics, and is Managing Director of the Institute for IG at IMERGE Consulting, at He teaches comprehensive courses on IG and E-records management for corporate and public sector clients.

Follow Robert on Twitter @RobertSmallwood and if we are not connected - please feel free to reach out!

#Smallwood #infogov #InformationGovernance #InfoSec