Piling On: How Information Governance Rules the World

"Companies are actually welcoming the investment," insisted Phil. "The solutions that help them manage information from end-to-end, or in the cloud or whatever are seen as benefits to the company... and rightly so. When applied properly, technology can reduce risk AND operating costs. So technology is seen as a good thing."

But getting it done has led to many organizational challenges. "Yes," said Phil. "There are tensions among players in a company. But those tensions can be addressed by getting all these players together and collaborating on an information governance strategy. Then, as a group, they can implement a top-down approach. That's the ‘human element.' Then, after they've developed a strategy, then you can deploy technology, such as archiving software, e-discovery software, records management technology, to execute the policies," Phil said.

One question being begged here is: is top management aware of this turmoil in the ranks... and do they care? "If they don't, they should!" said Theresa. "The people I know in the financial service industries are terrified by the SEC. And they don't have to be large multinational firms. Smaller companies also are aware of the risks and dangers," she said. "There are fines, and business losses and even jail time at stake. And it's not the records manager or the data entry clerk; it's the higher-ups who are vulnerable. They're the ones who sign off on policies, so they are the ones at greatest risk. There are plenty of companies who, for example, store printouts in filing cabinets that turn out to be of discovery interest in a litigation, and it's not the filing clerk who takes the heat. It's the boss. So, as I said, if they're not concerned, they should be."

"There are three ways that technology can help enforce information governance," said Phil. "First is to get rid of ‘.PST' (personal storage table) files. (Note: .PST files are the Microsoft Exchange Server's way of storing copies of messages, calendar items, etc. created in Outlook). They cause nightmares for IT, because of the size they consume, and for legal, since they are outlying documents nobody knows about. With the right archiving solution, a company can disable its users' ability to create .PST files altogether. Secondly," Phil continued, "apply the automated functions of archiving software to enforce retention policies. And three, use the archive software's ability to implement a legal hold. These are all technological solutions for matters of strategy and policy. It's up to the company to develop the plan, but it requires technology to make it happen."

Theresa agrees that automation is a big part of the business strategy. Or should be, at least. "You can set up systems that force every document, every scanned piece of paper, every communication of any kind to ‘hit something' before it is delivered to the ultimate consumer. Then you have a record of what that information was originally. But just as important, you can develop policies that people have to sign as employees that explain and define what their rights and responsibilities are. Both methods are valuable ways to protect yourself. But if someone wants to deliberately get something out there, they will. Nobody can lock down everything all the time. But you can mitigate your risk to a great degree by having clearly defined policies and using technology where it's necessary... and that goes for the CEO as well as the guy in the mailroom," she said.

"That's correct," added Phil, "and the policies you have in place will often have a significant bearing on the court's decision. If you have no clear policies, and insufficient or no technology support, the courts have little choice except to issue what is called an ‘adverse inference instruction,' which is a fancy way of saying that the judge has to tell the jury that the defendant destroyed evidence," explained Phil. (Lawyers have a way of clarifying the complicated jargon they made up in the first place, don't they?)

"It works the other way, too," added Phil. "If you have a retention policy in place, observe it properly, then take action to suspend it if it looks as though litigation is coming down the road, then the courts reward you for that. So it's clear that policy and technology—or the lack of them—have a great effect on the outcome of litigations. The courts are very savvy. They expect companies to come into court with more than the old ‘my dog ate my homework' excuse. I am confident that companies that follow the rules and have the tools in place to enforce them are going to come down on the right side of the law," he said.

"Employees are just human," said Theresa. "Sometimes they are slack. Sometimes they get overwhelmed. That's why matching technology with the problem your company faces is very important. But the policy has to be trainable and consistent. And consistency is key—make sure you have all stakeholders, from legal and business to records and management, executing consistently across the board. But ‘consistent' doesn't necessarily mean ‘static.' It's also wise to check periodically for any change that MIGHT have come down from on high... wherever ‘on high' happens to be."