Blogs HomeDear {employee name}
Congratulations. You just spent the last two years defining, validating and publishing our global retention schedule. Your team did an excellent job coordinating the cross functional meetings and incorporating all the requirements from legal, business users, compliance, and IT into our information governance policies. Everyone in the company now has access to the retention schedule on our Intranet because of your team’s hard work. Job well done and please extend my congratulations to the rest of the team for completing our information governance project. Enjoy the rest of the year off…
Sincerely,
Information Governance Officer
Completing a global retention schedule is certainly a significant and very important milestone, but you are not done. There is more – so much more. After you are done with step one, it’s now time to roll up your sleeves and begin implementing the retention schedule across the entire organization. Most companies have a very complex IT infrastructure – running hundreds of applications across a plethora of technology platforms. These technology platforms support business critical processes, back office operations, and a variety of business applications. To complicate matters, you have to manage these applications across different jurisdictions. Before you continue, you must first recognize you can’t do everything right away. This must be done in phases – typically subject to business cases, funding and resource availability.
Step Two – Map Information Governance Policy to Applications, Processes, and Jurisdictions
Start with the department or business unit in a jurisdiction with the biggest risk exposure. For example, some customers selected their accounting/finance department as the primary target for implementation while others selected product safety. Once this is selected, you need to map the information governance policies that apply to the business unit and “jurisdiction”. You cannot and should not do this alone. For the purpose of this article, let’s use the UK jurisdiction as an example. You need to sit down with the head of your UK operation, compliance manager for UK, the person responsible for all the records for the UK (can be the the same person) and someone from the IT organization who understands all the applications used within the UK operation. It’s also very helpful to have business representation in this exercise. You then need to select and map the information governance policies that apply to UK – internal email, financial records, human resources, customer records, etc, etc, etc.
The goal is to create a UK “information governance file plan” that includes the entire information governance hierarchy for the UK, along with its security and templates. Corporate records in the UK are grouped according to their file plan, so file plans are implemented as “easy to navigate” folders. The file plan also carries with it a set of rules for evaluating new records that must be properly governed. As new information is being created by the UK operation, the information governance rules are applied which guarantees compliance at content creation time.
Stay tuned for step three to learn how these policies are enforced.
Photo is courtesy of jeanlouis_zimmermann from Flickr.
Follow RSD on Twitter
RSD Web Site
Subscribe
About RSD