Using guiding principles to drive your information governance (IG) program can help educate stakeholders, focus efforts, and maintain consistency.

The Sedona Conference® Commentary on Information Governance

The Sedona Conference is a group of mostly legal and technology professionals that meets periodically and develops commentary and guidance on e-discovery, electronic records, privacy, risk, IG, and related issues. They have developed 11 general principles of IG,¹ which provide guidance on the expectations and aims of IG programs. These principles can further an IG team's understanding of IG and can be used in an introductory “IG Awareness Training” session in the early stages of your program launch. A good exercise is to have team members rewrite these principles in their own words, and then hold discussions about how each of these principles would apply to their departmental IG efforts, and the overall IG program. The Sedona Conference Commentary on IG, formed as principles, are:

1. Organizations should consider implementing an IG program to make coordinated decisions about information for the benefit of the overall organization that address information-related requirements and manage risks while optimizing value.
2. An IG program should maintain sufficient independence from any particular department or division to ensure that decisions are made for the benefit of the overall organization.
3. All information stakeholders should participate in the IG program.
4. The strategic objectives of the IG program should be based upon a comprehensive assessment of information-related practices, requirements, risks, and opportunities.
5. An IG program should be established with the structure, direction, resources, and accountability to provide reasonable assurance that the program's objectives will be achieved.
6. The effective, timely, and consistent disposal of physical and electronic information that no longer needs to be retained should be a core component of any IG program.
7. When IG decisions require an organization to reconcile conflicting laws or obligations, the organization should act in good faith and give due respect to considerations such as privacy, data protection, security, records and information management, risk management, and sound business practices.
8. If an organization has acted in good faith in its attempt to reconcile conflicting laws and obligations, a court or other authority reviewing the organization's actions should do so under a standard of reasonableness according to the circumstances at the time such actions were taken.
9. An organization should consider reasonable measures to maintain the integrity and availability of long-term information assets throughout their intended useful life.
10. An organization should consider leveraging the power of new technologies in its IG program.
11. An organization should periodically review and update its IG program to ensure that it continues to meet the organization's needs as they evolve.

Smallwood IG Principles

The following 11 IG principles are the result of the author's research and consulting efforts over the past decade or so, where a great deal of practical information on IG program successes, failures, and best practices was synthesized, analyzed, and distilled.

These 11 IG principles must be adhered to as general guidelines for IG programs to succeed:

1. Value information as an asset. Just as any organization has physical assets like buildings, furniture, fixtures, equipment, computers, software, and vehicles, and so on, that have value, information collected and analyzed also has value. The formal management of information assets with the goal of monetizing and leveraging that information is clearly outlined in the book Infonomics: How to Monetize, Manage, and Measure Information as an Asset for Competitive Advantage (Bibliomotion/Taylor & Francis, 2018), written by Doug Laney. It is necessary to identify and map out information assets so that confidential information including personally identifiable information (PII), credit card information (PCI), and protected health information (PHI), may be secured directly, so that if hackers are able to get inside the organization's firewall, this information is encrypted and unreadable. The IG steering committee must also explore which analytic tools could help to maximize information value, which may come in the form of reducing uninformed or poor decisions, improving customer satisfaction, improving operational efficiency, reducing legal costs, improving compliance capabilities, and other related benefits. In addition, clear policies must be established for the secure access and use of information, and those policies must be communicated regularly and crisply to employees, with constant reinforcement. This includes conveying the value and risk of information and the consequences of violating IG policies.
2. Stakeholder consultation. IG programs are, by nature, cross-functional efforts. Those who work most closely to information are the ones who best know why it is needed and how to manage it, so business units must be consulted in IG policy development. Records and information management (RIM) professionals know the details and nuances of managing records. They should be deeply involved in electronic records management (ERM) and document management governance efforts, which should be at the core of IG. Effective ERM governance also leads to reduced costs and improved operational efficiency. Therefore, RIM professionals must be an active part of IG programs and their input into the policymaking process is critical. RIM professionals must also work hand-in-hand with privacy and legal professionals to ensure customer (and employee) privacy is protected vigilantly. Privacy has become even more important globally with the implementation of Europe's General Data Protection Regulation (GDPR), which applies to any organization conducting business with European citizens, regardless of location. In-house legal council should be a key player in IG programs and the legal team must be consulted on a variety of legal, regulatory, privacy, and litigation issues as IG program efforts involve all these areas. Further, IG programs can cut electronic discovery collection and review costs and make the legal hold notification (LHN) process more streamlined and effective. The IT department must play a major role as technology is leveraged in IG program efforts. The increased level and sophistication of cybersecurity attacks underscores the need for a robust cybersecurity program, including security awareness training (SAT) to offset information risks. It is clear that cross-functional stakeholder consultation is a necessary component of IG programs.
3. Information integrity. The business-to-customer relationship is based on trust, and that trust includes ensuring that accurate customer information is created and also kept secure. IG programs focus heavily on information quality, from the ground up, beginning with data governance. Data governance techniques and tools focus on creating clean, accurate, nonduplicate data in database tables so that downstream reports and analyses are more trusted and accurate. Information integrity considers the consistency of methods used to create, retain, preserve, distribute, and track information. Information integrity means there is the assurance that information is accurate, correct, and authentic. From a legal standpoint, enabling information technologies and data stewardship polices must support the effort to meet legal standards of admissibility and preserve the integrity of information to guard against claims that it has been altered, tampered with, or deleted (called “spoliation”). Audit trails must be kept and monitored to ensure compliance with IG policies to assure information integrity.
4. Information organization and classification. This means that not only must customer and business operations records be organized in a standardized taxonomy with a specified metadata approach, but that all information must be organized in a standardized way, categorizing all information and semantically linking it to related information. It also means creating a records retention schedule (RRS) that spells out how long the PII/PCI/PHI as well as business information (e.g., e-mail, e-documents, spreadsheets, reports) should be retained and how it is to be disposed of or archived (disposition). Further, it means developing departmental file plans that are logical and help end users to conduct more complete and accurate searches for information.
5. Information security and privacy. This again focuses on the trust proposition between customer and the business or governmental agency. Information security must be in place before information privacy can be assured. This means that every attempt must be made to secure PII, PCI, and PHI in all three states: at rest, in motion, and in use. It means that the organization should conduct regular security awareness training, which can include staged phishing and spear phishing attacks to see if employees handle them properly, and to coach them on mistakes they may make during the test. Ransomware is also a problem. When rogue players launch ransomware attacks, they typically encrypt the storage drives of the organization and demand a modest payment by Bitcoin. To offset this risk a complete backup of your entire information system must be made daily and kept separate from your network, offline. Additional cybersecurity hygiene measures are needed to protect information from damage, theft, or alteration by malicious outsiders and insiders as well as nonmalicious (accidental) actions that may compromise information. For instance, an employee may lose a laptop with confidential information, but if proper IG policies are enforced using security-related information technologies, the information can be kept secure. This can be done by access control methods, data or document encryption, deploying information rights management (IRM) software, using remote digital shredding capabilities, and implementing enhanced auditing procedures. Information privacy awareness training (PAT) should also be conducted, including updates on federal, provincial, state, and even possibly municipal legal requirements. Information privacy is closely related to information security and is critical when dealing with confidential information and other sensitive information such as race or religion.
6. Information accessibility. Information accessibility must be balanced with information security concerns. Information accessibility includes making the information as simple as possible to locate and access, which involves not only an intuitive user interface but also utilizing enterprise search principles, technologies, and tools. It further includes basic access controls, such as password management, identity and access management (IAM), and delivering information to a variety of hardware devices. Accessibility to information is essential not only in the short term but also over time. Maintaining records for perhaps decades requires consideration of long-term digital preservation (LTDP) planning, tools, and methods in accordance with international, technology-neutral standards. Today, LTDP capabilities can be provided through cloud services providers that keep a number of copies of the information (typically five to six) on Amazon or Microsoft cloud servers, spread around the world, to reduce the risk of loss. There are privacy implications to this global approach, especially with GDPR legislation, and they must be researched.
7. Information control. An enterprise RRS is a key foundational element of IG programs. Non-record information must also be categorized and scheduled. Then a standardized, automated LHN process must be put in place to assign data stewards and lock down information that may be requested in legal proceedings. In addition, key information control technologies must be deployed to control the access, creation, updating, and printing of data, documents, and reports. These technologies include several types of software: enterprise content management (ECM) and enterprise file synch and share (EFSS), document management, document analytics, report management, and workflow. Additional security software including encryption should be deployed to protect confidential or sensitive information.
8. Information governance monitoring and auditing. Early on in the development of an IG program a concerted effort must be made to develop metrics to objectively measure program progress and employee conformance with IG polices. To ensure that guidelines and policies are being followed, especially regarding customer privacy and cybersecurity hygiene, information access and use must be monitored. To guard against claims of legal spoliation, the use of e-mail, social media, cloud computing, and report generation should be logged (recorded or archived) in real time and maintained as an audit record. Technology tools such as document analytics can track how many documents users access and print and how long they spend doing so.
9. Executive sponsorship. Once again, due to the cross-functional, collaborative nature of IG programs, this is the most crucial factor in IG program success. This is especially true in the healthcare arena, where various clinical specialties that may have their own proprietary information systems are represented. No IG effort will survive and be successful if it does not have an accountable, responsible executive sponsor. The sponsor must develop the business case for IG early on, establish a budget, then assemble the steering committee and drive the effort. The executive sponsor must pay periodic attention to the IG program, monitoring progress based on metrics and milestones. The IG program lead, or perhaps even a chief IG officer, manages the IG program on a day-to-day basis, bringing in the executive sponsor only when support is needed for a particular issue. The executive sponsor must clear obstacles for the IG program lead and IG steering committee while actively communicating the goals and business objectives that the IG program addresses, and at the same time keeping upper management informed on progress, particularly when accomplishing milestones.
10. Change management. IG programs require leveraging information as an asset and breaking down functional siloed approaches to managing information. IG programs also often involve changing the way users interact with systems to streamline search and retrieval and improve productivity. These changes must be “sold” to the stakeholders, with an emphasis on how the IG program efforts will help the organization achieve its business objectives. These changes must be clearly communicated and reinforced to employees and change must occur at the core of the organization or target department. This all requires that a purposeful change management initiative accompany the IG program implementation.
11. Continuous improvement. IG programs are not one-time projects but rather ongoing programs, akin to a workplace safety program. (In fact, the information security aspects of an IG program could actually be termed “information safety.”) The IG program is a major change management effort, which requires a major training and communications effort. Progress in the IG program must be reviewed periodically and adjusted to account for gaps or shortcomings as well as changes in the business environment, technology usage, or business strategy.

Using these 11 principles as guidelines will help to communicate with stakeholders and IG steering committee what IG is, why it is needed, what it involves, and how to fashion an IG program that is successful. It is essential to continually reinforce the importance of these principles during the course of an IG program, and measure how well the organization is doing in these 11 critical areas.

There are also other sets of principles that apply to IG efforts and can help provide a more complete understanding of IG programs, especially early in the IG program development process. These IG principles reflect, reinforce, and expand on the previous set.

Accountability Is Key

According to Debra Logan at Gartner Group, none of the proffered definitions of IG include “any notion of coercion, but rather ties governance to accountability [italics added] that is designed to encourage the right behavior…. The word that matters most is accountability” [italics in the original]. The root of many problems with managing information is the “fact that there is no accountability for information as such.”²

Establishing policies, procedures, processes, and controls to ensure the quality, integrity, accuracy, and security of business records are the fundamental steps needed to reduce the organization's risk and cost structure for managing these records. Then, it is essential that IG efforts are supported by information technologies (IT). The auditing, testing, maintenance, and improvement of IG is enhanced by using electronic records management (ERM) software, along with other complementary technology sets such as workflow and business process management system (BPMS) software and digital signatures.

Generally Accepted Recordkeeping Principles®

Contributed by Charmaine Brooks

A major part of an IG program is managing formal business records. Although they account for only about 7–9% of the total information that an organization holds, they are the most critically important subset to manage, as there are serious compliance and legal ramifications.

Records and recordkeeping are inextricably linked with any organized business activity. Through the information that an organization uses and records, creates, or receives in the normal course of business, it knows what has been done and by whom. This allows the organization to effectively demonstrate compliance with applicable standards, laws, and regulations, as well as plan what it will do in the future to meet its mission and strategic objectives.

Standards and principles of recordkeeping have been developed by records and information management (RIM) practitioners to establish benchmarks for how organizations of all types and sizes can build and sustain compliant, defensible records management (RM) programs.

Assessment and Improvement Roadmap

The Generally Accepted Recordkeeping Principles maturity model can be leveraged to develop a current state assessment of an organization's recordkeeping practices and resources, identify gaps and assess risks, and develop priorities for desired improvements.

The Principles were developed by ARMA International to identify characteristics of an effective recordkeeping program. Each of the eight principles identifies issues and practices that, when evaluated against the unique needs and circumstances of an organization, can be applied to improvements for a recordkeeping program that meets recordkeeping requirements. The principles identify requirements and can be used to guide the incremental improvement in the management and governance of the creation, organization, security, maintenance, and other activities over a one- to five-year period. Fundamentally, records management and information governance are business disciplines that must be tightly integrated with operational policies, procedures, and infrastructure.

The Principles can be mapped to the four improvement areas in Table 3.2.

As an accepted industry guidance maturity model, The Principles provide a convenient and complete framework for assessing the current state of an organization's recordkeeping and developing a roadmap to identify improvements that will bring the organization into compliance. An assessment/analysis of the current record management practices, procedures, and capabilities together with current and future state practices provides two ways of looking at the future requirements of a complete RM (see Table 3.3).

Information Security Principles

The information security aspects of your IG program should be guided by established principles.

Privacy Principles

The Generally Accepted Privacy Principles (GAPP) were developed jointly by the Canadian Institute of Chartered Accountants (CICA) and the American Institute of Certified Public Accountants (AICPA) through the AICPA/CICA Privacy Task Force. These principles can be used to guide the privacy aspects of an IG program. The field of information privacy is rapidly changing, and the International Association of Privacy Professionals (IAPP) is quite active globally with conferences, workshops, and training. IAPP's membership exploded in 2017–2018, when GDPR came into effect. Nevertheless, the 10 Generally Accepted Privacy Principles have been accepted by the privacy profession. The 10 Generally Accepted Privacy Principles and their criteria are:⁷

1. Management
   • The organization defines, documents, communicates, and assigns accountability for its privacy policies and procedures.
   • Criteria:
     • Privacy policies define and document all 10 GAPP.
     • Review and approval of changes to privacy policies are conducted by management.
     • Risk assessment process is in place to establish a risk baseline and regularly identify new or changing risks to personal data.
     • Infrastructure and systems management take into consideration impacts on personal privacy.
     • Privacy awareness training
2. Notice
   • The organization provides notice of its privacy policies and procedures. The organization identifies the purposes for which personal information is collected, used, and retained.
   • Criteria:
     • Communication to individuals
     • Provision of notice
     • Use of clear and conspicuous language
3. Choice and consent
   • The organization describes the choices available to the individual. The organization secures implicit or explicit consent regarding the collection, use, and disclosure of the personal data.
   • Criteria:
     • Communicating the consequences of denying/withdrawing consent
     • Consent for new purposes/uses of the personal data
     • Explicit consent for sensitive data
     • Consent for online data transfer
4. Collection
   • Personal information is only collected for the purposes identified in the notice (see #2).
   • Criteria:
     • Document and describe types of information collected and methods of collection
     • Collection of information by fair and lawful means, including collection from third parties
     • Inform individuals if information is developed or additional information is acquired
5. Use, retention, and disposal
   • The personal information is limited to the purposes identified in the notice the individual consented to. The organization retains the personal information only for as long as needed to fulfill the purposes, or as required by law. After this period, the information is disposed of appropriately.
   • Criteria:
     • Systems and procedures in place to ensure personal information is used, retained, and disposed appropriately
6. Access
   • The organization provides individuals with access to their personal information for review or update.
   • Criteria:
     • Confirmation of individual's identity before access is given to personal information
     • Personal information presented in understandable format
     • Access provided in reasonable time frame and at a reasonable cost
     • Statement of disagreement; the reason for denial should be explained to individuals in writing
7. Disclosure to third parties
   • Personal information is disclosed to third parties only for the identified purposes and with implicit or explicit consent of the individual.
   • Criteria:
     • Communication with third parties should be made known to the individual.
     • Information should only be disclosed to third parties that have equivalent agreements to protect personal information.
     • Individuals should be aware of any new uses/purposes for the information
     • The organization should take remedial action in response to misuse of personal information by a third party.
8. Security for privacy
   • Personal information is protected against both physical and logical unauthorized access.
   • Criteria:
     • Privacy policies must address the security of personal information.
     • Information security programs must include administrative, technical, and physical safeguards.
     • Logical access controls in place
     • Restrictions on physical access
     • Environmental safeguards
     • Personal information is protected when being transmitted (e.g. mail, Internet, public, or other nonsecure networks).
     • Security safeguards should be tested for effectiveness at least once annually.
9. Quality
   • The organization maintains accurate, complete, and relevant personal information that is necessary for the purposes identified.
   • Criteria:
     • Personal information should be relevant for the purposes it is being used.
10. Monitoring and enforcement
    • The organization monitors compliance with its privacy policies and procedures. It also has procedures in place to address privacy-related complaints and disputes.
    • Criteria:
      • Individuals should be informed on how to contact the organization with inquiries, complaints, and disputes.
      • Formal process is in place for inquires, complaints, or disputes.
      • Each complaint is addressed and the resolution is documented for the individual.
      • Compliance with privacy policies, procedures, commitments, and legislation is reviewed, documented, and reported to management.

Source: American Institute of Certified Public Accountants, https://www.aicpa.org/InterestAreas/InformationTechnology/Resources/PRIVACY/DownloadableDocuments/10252-346_Records%20Management-PRO.pdf.

These 10 privacy principles can be applied by organizations to establish and maintain the privacy aspects of their IG programs.

Utilizing the various sets of complementary IG principles to help educate stakeholders and guide the IG program will help to keep the scope of the program focused by providing some guidelines to keep it on track that help assure the success of the program.

Who Should Determine IG Policies?

When forming an IG steering committee or board, it is essential to include representatives from cross-functional groups, and at differing levels of the organization. It must be driven by an executive sponsor (see later chapter on securing and managing executive sponsorship), and include active members from key business units, as well as other departments or functions including privacy, cybersecurity, IT, legal, risk management, compliance, records management, and possibly finance. Then, corporate training/education and communications must be involved to keep employees trained and current on IG policies. This function may be performed by an outside consulting firm if there is no corporate education staff.

Knowledge workers, those who work with records and sensitive information in any capacity, best understand the nature and value of the records they work with as they perform their day-to-day functions. IG policies must be developed and also communicated clearly and consistently. Policies are worthless if people do not know or understand them, or how to comply. And training is a crucial element that will be examined in any compliance hearing or litigation that may arise. “Did senior management not only create the policies, but provide adequate training on them, on a consistent basis?” This will be a key question raised. For these reasons, a training plan is a necessary piece of IG, and education should be heavily emphasized.⁸

The need for IG is increasing due to increased and tightened regulations, increased litigation, increased data volumes, and the increased incidence of theft and misuse of internal documents and records. Organizations that do not have active IG programs should reevaluate IG policies and their internal processes following any major loss of records, the inability to produce accurate records in a timely manner, or any document security breach or theft. If IG teams include a broad cross-section of critical players on the IG committee, and strong executive sponsorship, they will be better preparing the organization for legal and regulatory rigors, as well as unlocking new value in their information.