Compliance &Ethics - Society of Corporate Compliance and Ethics

FeatureCompliance & Ethics Professional May/June 2013and, in some cases, developing customizedapproaches for separate audiences.1. Create a cross-functional teamWe recommend that a cross-functional teambe formed to oversee an information governanceproject. It would include representativesfrom the Recordsand InformationManagement (RIM),Legal, and IT departments,as well asexecutives and endusers.Once eachgroup understandsthe severity of theissues at hand andthe “win” that’s in itfor them, they’ll bemore willing to participateor at least not sabotage the effort.2. Know what you haveStart by creating an information “map.”Automated tools can help, but some manualeffort will be required to determine the locationand the value of information. Employeesmake great use of unstructured data (e.g.,email, SharePoint, files, etc.) in daily work andin business processes. Such information is oftenhidden in underground archives, so be sure toinclude the data that resides on employees’ laptops,tablets, smartphones, and workstations,as well as in production systems. All of it carriespotential for exposure to regulatory, legal,or eDiscovery risk and the associated costs.3. Manage document retention anddeletion policiesUp-to-date retention schedules specify just howlong information should be retained. Early inthe process, strive for agreement among thecross-functional team members about retentionand deletion rules. Be sure that policies identifyThe objective ofan informationgovernance program,on the other hand,is to modify user andorganizational behavior.processes and the “authority” (e.g., a legal ruling,business practice, or regulatory mandate) whichjustifies retaining and deleting documents.4. Enforce consistent legal hold policiesand processesThe deletion process is often complicated byongoing litigation andlack of a process foridentifying which dataare and are not underlegal hold. Create aclear and consistentlegal hold process thatclearly delineates databeing held, preventsthe purging of datathat by policy mightotherwise be deleted,and allows the routinedeletion of data not under hold. The moreclear and unambiguous a legal hold process is,often the more aggressively older, non-relevantdata can be deleted.5. Keep it simple for end-usersOur surveys indicate that without clear direction,more than 90% of employees tend to savemore documents than they need. Their reasoningis that no one ever got in trouble for notdeleting a document. On the other hand, wefound that when given clear guidance, 80% ofemployees will follow a reasonable, intuitivepolicy.6. Apply psychology and technologyHelp employees accept and embrace changesto their current working environment. Whileintroducing the program:··Provide options: Let employees makedecisions within the boundaries of policy.··Keep documents accessible: The mereperception of “taking information away”encourages underground archiving.28 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977