An information governance framework helps organisations manage their data and information, and ensure they are used effectively to meet needs and add value. A good information governance framework will help you manage your information throughout its lifecycle. The best will put information security, risk management, and assurance of good information governance at their core.
Plan and Seek
An important part of any information governance framework, and one that is frequently overlooked, is planning. Planning is important because there are a number of costs and risks associated with collecting and managing information. For example, when you identify a business need that may require new information to fulfil it, there may be a price for the data required. There are likely to be some costs associated with having it in your systems (and some data requires special IT systems to process it). Carefully evaluating the data you may need will help you ultimately decide if you are happy to accept these costs to meet identified needs. Only then are you in a legitimate position to seek the data you need.
Outcome: We know what data we need, what it’s for, and how and when we will get it
Review and Assess
The next step in the process is deciding whether to accept the data when it is received. You must ensure that what you get meets your needs, in terms of quality and risk. It must be what you have paid for. You should not be afraid to reject data that is inadequate. Simply accepting it would mean you put the delivery of your underlying business objectives at risk. It is important to benchmark what you got against what you planned for.
You should now be in a position to perform the analyses and create the products you need to fulfil your objective.
Outcome: Information received is on time and of the expected quality and risk-profile
Exploit and Manage
This is where you put your information to work, analysing it and generating the products that will address the reasons your obtained the information in the first place. This part of the framework also covers any instances when you may need to share or publish the data, or the products of your data analysis. Examples include disclosure under Freedom of Information legislation, publication as Open Data, or working with partners such as customers or suppliers.
Outcome: The right people have ownership of and access to the right information at the right time
Archive or Disposal
When the business need you sought information for has been met, you should decide whether to archive that information or delete it. Retaining information has costs but it may be useful to repurpose or reuse information for future needs. Your decision about keeping information, and for how long, will be based on factors like cost, risk, and commercial sensitivity. Quite often, for example, if you use information from a client to create a product for that client they will expect you to destroy any information they have given you once your work is done.
Outcome: We are disposing of or archiving information at the right time
Assurance, Security and Risk Management
One of the main advantages of breaking down an information governance framework into the key stages set out above is that they enable assurance. If, for example, information you obtain is not of the expected quality you can review why not, learn from it, and improve your processes. Similarly if you cannot achieve the outputs you wanted with the information you obtained something has gone wrong. Assurance will help you work out what, and why, so it doesn’t happen again.
Similarly security and risk management are overarching activities that support information governance throughout the information lifecycle. If, for instance, your business need required you to obtain and process sensitive personal information about people you would need to do a Data Privacy Impact Assessment before you get it – at the planning stage – to help manage risk.
Outcome: We have ensured and maintained appropriate information security and information risk management. We have evidence information management is robust and effective.
Building your Framework
Underpinning each of the key stages of the framework should be process documents supported by corporate policies and templates. These will spell out what good looks like, and the key roles and functions in delivering information governance. It is important to remember that good information governance is an enabler of effective information use, and the delivery of organisational objectives. A good information governance framework should be a practical guide for how people should treat information and manage it effectively. Crucially it should hold people accountable for the decisions they make and the actions they take to deliver your information governance requirements. Overall your Framework should be a useful resource for anyone who needs to get or use information within your organisation, whoever they may be, so be sure to write it with your audience in mind.
Learn more about Information Governance
Do you want to know more about information governance? Try one of our information governance courses available online, in person or in house. Click here to find out more.