Information Governance: Who's In Charge?
Records managers, for example, are dying to find ways to get at the table. What we're trying to do is empower them—and I use that word ‘empower.' The way they can do it is by emphasizing the cost issue. If a records manager can tell a business manager, who's getting charged an incredible amount of money to manage information, how to save on the costs of their fileshares and address the compliance issues, they will add incredible amounts of value to the company. Until records managers can prove the value in their projects, the business will not make investments in them.
TS: What David just said is really important. I want to underscore that elevating the records management function is extremely important. But one of the challenges the records manager has is this question: ‘Is everything a record?' Maybe yes, maybe no. Is a tweet to a Twitter account a record? If so, is it mapped to a retention schedule? This is the key difference between information governance and what we consider traditional records management. The old view of records management was the person in the warehouse or the basement sending documents off to a physical storage site of some kind. But now there are hundreds of systems maintaining hundreds of repositories, many of which may reside outside the four walls of the organization. So records managers need to think beyond their standard, traditional processes. They need to overhaul their entire process, to include things like the cloud, social media, BYOD, and make sure their practice spans all information... not just static records.
AM: Records management has become blurry due to social media, BYOD, workarounds like Dropbox, etc. Are you finding that companies have employees who have gone ‘off the reservation' to create their own systems, that are outside the reach of governance policies and systems?
TK: It's a two-part question. First, it's really important, to follow up on what Tamir said, you have to figure out what you are as an organization and have a clear information governance policy and abide by that. But you're right: the enforcement of that is more problematic. We tend to think of records managers as the corporate librarians who take everything and store it away in the warehouse forever. That's not real or practical anymore.
Read All About It
TK: What we're all waiting for, and maybe dreading, is some sort of defining moment that will help codify all this. There hasn't yet been a massively publicized event, with a jury trial, big fines...
DG: Actually, there has been a big deal or two. Look at Pacific Gas and Electric. They got fined $13 million because they couldn't produce records. And it's still in the news because people are continuing to file lawsuits. There are lots of examples of companies getting caught, and that leads to discovery and there are direct costs related to that. What puzzles me more is why companies haven't been able to read the press clippings and do something about it!
I think it's also a matter of understanding communications internally. I don't see too many records managers who really understand infrastructure costs and until they get smart on that, they won't get a seat at the table to have this discussion.
TK: My point is that we haven't had the event that captures worldwide attention. We haven't had the Enron or the BP disaster, which captivated folks and was on the front page of every major publication.
TS: Actually, we DID have the Apple/Samsung lawsuit, in which Samsung had a lot of problems producing meeting notes, emails, and such, and the judge decided that without that evidence to rule against them until they could prove differently. And people are still talking about UBS, which dominated global headlines. So you both are right: Theresa is right in saying there's not a pivotal event that has changed the way of thinking about this stuff, and David is right that these articles appear from time to time in the Wall Street Journal.
The analogy I use is this: Why do we all speed on the highway? We all know there are going to be police. We could get into an accident. We know there's a risk. But we still do it anyway. But we have the mentality that ‘nothing's going to happen to me.'
AM: I couldn't resist telling the old joke: Guy gets pulled over by the police. ‘Didn't you see the speed limit sign?' Guy says, ‘Sure I saw it. I just didn't see you.' The point of the story is that companies can have the temptation to view governance costs as one would an insurance policy: I don't want to pay it as long as nothing is happening to me.
TK: Well, I do speed on the highway. I am leadfooted. But I also have car insurance. And I'm not going to let it lapse.
DG: It's not about insurance; it's about ongoing cost management. I have two analogies. One is the kitchen drawer you have to clean out every once in a while because it's jammed full of random utensils and soy sauce packages. The other is your garage-the stuff tends to spill over. That's what happens to your infrastructure. Stuff tends to accumulate and spill over. So governance is really about managing the cost of housekeeping.
If a records manager can't make the cost argument, they really don't deserve a seat at the table. You have to be able to determine what is trivial and redundant from what is important, and how do you eliminate the unimportant stuff. I'm sitting here watching my Exchange folders fill up, and most of it has no business relevance. So it has no compliance impact, but it certainly has a cost impact. Deciding the difference between the irrelevant and the stuff that has business relevance is the new role of the records manager.
MLM: I don't think records management has been completely disregarded. But the feeling is, ‘as long as I have policies written down, the fines I might face will be reduced eventually. As long as we can prove we're trying to enforce the policy, the repercussions can be reduced.'
AM: Choosing to drop the contentious ‘insurance' analogy, I cleverly changed the subject. Is governance a cost factor or a value factor? Do companies see a revenue opportunity in managing their information better?
TS: Depends on the industry. Pharma is a great example where their entire business is driven from information-from their R&D group, from clinical trials and then from post-marketing surveillance once the product is on the market. It's ALL about information. Now imagine that: tons of different formats, tons of different lifecycles, very regulated industry that has to comply with many different regulations. In that case, it's fairly easy to put a value around information management.