Documents, records, and other unstructured content represent risk to an organization. Managing this risk and getting value from this information both require governance. Drivers include:

• Legal and regulatory compliance
• Defensible disposition of records
• Proactive preparation for e-discovery
• Security of sensitive information
• Management of risk areas such as email and Big Data

Principles of successful Information Governance programs are emerging. One set of principles is the ARMA GARP® principles (see Section 1.2). Other principles include:

• Assign executive sponsorship for accountability
• Educate employees on information governance responsibilities
• Classify information under the correct record code or taxonomy category
• Ensure authenticity and integrity of information
• Determine that the official record is electronic unless specified differently
• Develop policies for alignment of business systems and third-parties to information governance standards
• Store, manage, make accessible, monitor, and audit approved enterprise repositories and systems for records and content
• Secure confidential or personally identifiable information
• Control unnecessary growth of information
• Dispose information when it reaches the end of its lifecycle
• Comply with requests for information (e.g., discovery, subpoena, etc.)
• Improve continuously

The Information Governance Reference Model (IGRM) shows the relationship of Information Governance to other organizational functions. The outer ring includes the stakeholders who put policies, standards, processes, tools and infrastructure in place to manage information. The center shows a lifecycle diagram with each lifecycle component within the color or colors of the stakeholder(s) who executes that component. The IGRM complements ARMA’s GARP®.

Sponsorship by someone close to or within the ‘C’ suite is a critical requirement for the formation and sustainability of the Information Governance program. A cross-functional senior level Information Council or Steering Committee is established that meets on a regular basis. The Council is responsible for an enterprise Information Governance strategy, operating procedures, guidance on technology and standards, communications and training, monitoring, and funding. Information Governance policies are written for the stakeholder areas, and then ideally technology is applied for enforcement.