Information Governance Considerations for Corporate Legal Departments

Transcription

1 ESG Solution Showcase Information Governance Considerations for Corporate Legal Departments Date: July 2015 Authors: Jason Buffington, Senior Analyst; Dan Conde, Analyst; and Monya Keane, Research Analyst Abstract: Translating compliance and information governance concepts into actionable strategies can be challenging for decision makers supporting corporate legal departments. However, it is definitely a priority for them. To face the challenge, they should follow a phased approach that encompasses communication, a degree of cultural evolution, and of course, leveraging good information technology. Overview IT managers in the private sector including those who support corporate legal departments frequently mention regulatory compliance, improving data backup, and BC/DR as major priorities (see Figure 1). 1 FIGURE 1. Top Priorities for IT Managers Working in the Private Sector Top 10 most important IT priorities over the next 12 months for private-sector organizations. (Percent of respondents, N=538, ten responses accepted) Information security initiatives Improving data backup and recovery Managing data growth Increasing use of server virtualization Using cloud infrastructure services Desktop virtualization Regulatory compliance initiatives Improving collaboration capabilities Data integration Building a private cloud infrastructure 0% 5% 10% 15% 20% 25% 30% 35% These decision makers know that it s vitally important to make sure that their organizations follow good information governance habits, including ensuring that the proper people have access to the proper data and that retention schedules are strictly followed. The overarching effort often involves implementing initiatives for: Policy-driven data analysis. Cleaning up ( grooming ) legacy data stores appropriately. 27% 27% 26% 26% 25% 23% 22% 22% 22% 33% 1 Source: ESG Research Report, 2015 IT Spending Intentions Survey, February This ESG Solution Showcase was commissioned by Hewlett-Packard and is distributed under license from ESG.

2 Solution Showcase: Information Governance Considerations for Corporate Legal Departments 2 Deleting stored information in a defensible manner. Following well-established best practices for proper records management. Information governance isn t a technology-specific priority either. Governance considerations often factor into businesslevel decision-making when these organizations are investigating whether or not to make an IT investment (see Figure 2). 2 FIGURE 2. IT Managers Most Important Considerations for Justifying IT Investments in 2015 Which of the following considerations do you believe will be most important in justifying IT investments to your organization s business management team over the next 12 months? (Percent of respondents, N=601, three responses accepted) Improved security/risk management Return on investment Business process improvement Reduction in operational expenditures Improved regulatory compliance Reduction in capital expenditures Reduced time-to-market for our products or services Speed of payback 18% 17% 22% 27% 30% 36% 35% 40% What Governance and Compliance Mean to Corporate Legal Departments 0% 10% 20% 30% 40% 50% Translating terms such as regulatory compliance and information governance into actionable strategies can be daunting for IT professionals especially because they also need to make sure the legal department is adhering to legal process. For them, policy-driven information governance centers on knowing exactly what content they have, where that data lives, and whether it is being retained for the right time and the right reasons. Information Governance for the Right Reasons The right reasons are straightforward, and a big one centers on productivity. Simply put, better information management increases business productivity, and that boost brings benefits of its own: Serving internal and external clients effectively. According to ESG research, IT managers regard proper long-term data retention as valuable to overall e-discovery preparedness: Their primary reason for long-term retention is regulatory compliance (31%), with end-user enablement (21%), e-discovery (18%), and BC/DR preparation (17%) also showing importance. 3 With proper archiving and good metadata, a company s internal legal professionals can more quickly locate data to support a case or refute evidence. Fortunately, today s purpose-built data management systems are far better at indexing/cataloging archival data than traditional production stores ever could be. Decreasing dependence on expensive outside legal firms. Good information governance/data management reduces a legal department s need to bring in pricey outside counsel to supplement internal resources. That s because the 2 ibid. 3 Source: ESG Research Report, Backup and Archiving Convergence Trends, April 2014.

3 Solution Showcase: Information Governance Considerations for Corporate Legal Departments 3 internal team can be more proactive and empowered to handle challenges that arise, rather than being forced to scramble to react after the fact with an all hands on deck, plus more approach to locating data. Improving efficiency through knowledge sharing and data reuse. Superior data retention and management procedures could reduce the need for in-house attorneys or paralegals to recreate a document and all its associated research. Essentially, every hour that corporate lawyers must sit down and rewrite a brief on a topic that they know they ve written about before but cannot find is an hour lost. Enhancing collaboration across legal-specialty teams and individuals. If data is managed better, more end-users are able to do more with it, which ultimately helps both the in-house teams and the company as a whole. Aside from the productivity benefits, another right reason to retain data relates to enabling corporate legal teams to better manage the risk exposure of their organization. If they know exactly what data the business is retaining, then they can better control its risk level, which translates into less exposure. It s important to recognize that in corporate legal departments, not all data retention/deletion mandates stem from external regulatory compliance statutes. In-house policies also factor into the equation. IT is the custodian of much of the organization s data, but their directives regarding retaining that data come from multiple sources. However, all of those sources relate to being responsible about retaining the right data for the right reasons, such as: To adhere to various industry-specific regulations. These regulations may cover standards of professional practice or even operations not directly connected to legal work. To follow mandates for data preservation and e-discovery preparedness due to being a publicly traded company. This reason is similar to but distinct from compliance in that the standard to be met may be less clear. (But failing to meet it might actually be even more onerous and expensive.) To properly track ongoing and past litigation efforts, as well as to prove adherence to internal policies (e.g., equalemployment opportunity or similar HR policies). To conform to larger-scale governance initiatives related to the organization at large. Every company depends on internal insights (i.e., good data) to pursue its strategic direction and define its standards as a business entity. Although multiple independent industry watchdog bodies exist, translating their various compliance and information governance rules into actionable strategies can be challenging for the compliance/risk managers, the legal department, and IT. That s because: The internal groups responsible for information governance and regulatory compliance are not always (or only) the IT people. They work in multiple business units and use different vocabularies. To the backup administrator, compliance may translate as proper data retention. To the company s executive vice president and general counsel, compliance may mean not violating legal codes. A company s size or age can affect its approach to information governance. A large corporation will be more accustomed to following mandates and will approach the challenge with relatively more preparation, sophistication, and breadth most likely with dedicated staff. Smaller/newer companies (or newer counsel or risk managers on staff) may have fewer resources and less experience. But they still have an obligation to meet compliance requirements.

4 Solution Showcase: Information Governance Considerations for Corporate Legal Departments 4 Fortunately, though, every corporate legal department probably already has elements it can build upon in meeting these challenges. Pursuing Information Governance Records management, archiving, e-discovery, file analysis, data protection, and related efforts boil down to managing information proactively. The emphasis is on gaining mastery over data and deriving insight/value from it using technology that can identify the data, permit or restrict access to it, and retain or delete it according to compliance and governance mandates. The effort is worthwhile because appropriate information governance: Alleviates data hoarding. No company should keep all its data forever, but identifying and preserving the right data is crucial. Supports e-discovery. No one likes to be reminded of the costs and risks associated with a legal discovery procedure. However, preparation makes the process less painful while reducing costs. Supports productivity. As mentioned, good information governance helps any organization operate more efficiently and can even improve individual productivity. What Is the Right Information to Govern? To be sure, the right information to govern includes much more than . According to ESG research, companies are often required to retrieve the following data as part of a record-request (e.g., e-discovery) event (see Figure 3): 4 FIGURE 3. Types of Data Specifically Requested as Part of a Legal Proceeding or Regulatory Inquiry Record types that private-sector organizations have been asked to produce specifically for a legal proceeding or regulatory inquiry. (Percent of respondents, N=215, multiple responses accepted) Financial statements Database records (and attachments) Invoices and other customer records General office productivity documents Digital images Telephone call recordings and other audio files Instant messages Video files 42% 40% 36% 35% 58% 57% 56% 50% 49% 0% 10% 20% 30% 40% 50% 60% 70% Of course, not every data-retrieval effort is tied to e-discovery, but the fact remains that myriad types of information are being requested. For internal legal teams within large corporations, this finding is particularly applicable: They need to avoid exposure risks, reduce unnecessary cost outlays, and limit the employee-hours spent rectifying noncompliance problems. 4 ibid.

5 Solution Showcase: Information Governance Considerations for Corporate Legal Departments 5 Many organizations use a governance, regulatory, and compliance (GRC) system to help manage their governance efforts. But sometimes they learn that automation alone isn t enough. Good governance often requires human intervention for example, someone in IT may have to make certain data available to an opposing legal team while protecting that data against all other external access. The threat of monetary penalties can be an impetus to compliance. But equally important is avoiding the reputational penalties and potential loss of revenue associated with poor information retention or gaps in data-access protocols. Facing the Challenge Again, information governance and compliance involves retaining the right data, in the right manner, for the right reasons. By now, most IT managers who support corporate legal departments have invested in improving the organization s ability to manage information. However, a number of less-than-capable legacy systems and sometimes even manual systems and processes are still being used to adhere to data governance directives. As a result, legal departments may have difficulty responding to requests quickly, mitigating risk, and controlling costs. The discipline of practice management, or enterprise legal management (ELM), has arisen to address these needs. Responsible information governance may sound daunting. But it becomes less so by following some easy steps. Step One: Communicate Information governance is not IT driven; it is committee driven (see Figure 4). All relevant technical and nontechnical stakeholders must take part to ensure that governance requirements across the company are met. Stakeholders include: Records managers and data protection specialists who understand archiving and preservation principles. IT operations administrators who are familiar with the server infrastructure in use. Backup administrators responsible for overseeing the mechanisms by which digital data is protected. Application administrators who understand their production platforms and the data those workloads generate. Legal department employees responsible for litigation readiness and responsiveness. Compliance officers responsible for adhering to corporate, industry, and regulatory requirements. Risk managers responsible for identifying and mitigating any risks presented by the information. Business unit leaders who understand the organization s requirements for and usage of information. FIGURE 4. Information Governance Is Committee Driven

6 Solution Showcase: Information Governance Considerations for Corporate Legal Departments 6 Step Two: Cultural Evolution In legal departments, some undertakings are tactical. Others, like governance, are strategic-level activities with long-term implications. Pursuing any strategic initiative takes planning, preparation, and in some cases, outside expertise. However, in the case of information governance, thinking may need to progress from a tactical check-box-driven starting point to something more nuanced and impactful. After everyone is communicating, a shared culture shift is the next step for companies that want to establish or improve their approach to information governance. It s the responsibility of the risk management team to ensure adherence. The IT team is responsible for much of the execution. The leadership team must communicate the requirements. The lawyers must make sure all activities are legally on solid ground. A lot of teams have responsibilities; it s unwise to assume that one discrete compliance team handles all tasks. Additionally, the company s senior leaders may need to approve the retaining of consultants who are capable of assessing the current situation, authorizing a gap analysis, and approving/initiating risk assessments to uncover vulnerable areas. Clearly, this is a cultural evolution, not an IT-only endeavor. Step Three: Technology The technologies that shore up information governance cover more than just backup. Actually, they have two defining characteristics. Intelligence About the Data To ensure good governance and compliance, legal departments need to understand what data they have. ESG believes that by 2016, one measure of the usefulness of a given data protection and data management/information governance solution will be the quality of its catalog. When an organization knows what information resides in its repositories, it can be smarter about how to retain it. It might seem tempting to just keep everything to satisfy all possible governance-related requirements, but that route is impractical as well as economically and operationally risky. When an organization knows what data it has, what it should retain, and what it should delete, then CapEx (i.e., storage footprint) and OpEx (i.e., the operational costs of managing that storage hardware) both shrink. A GOOD METADATA CATALOG provides many benefits. Without that rich catalog showing you what you have, you will be doing the e-discovery equivalent of searching for a needle in a haystack. Creating, storing, and managing the metadata catalog (the information about data that assists in its retrieval, indexing, auditing, and use) is extremely important. Without good metadata, the corporate attorneys will find it hard to find a particular piece of data at all, and IT will find it hard to manage the data s lifecycle properly potentially, over many decades. 5 Easy Integration with the Environment An information governance solution that satisfies regulatory requirements cannot exist in a vacuum. According to ESG research, five of the top six features needed in a long-term data retention solution involve integration with some aspect of an existing IT architecture (see Figure 5). 6 Integration with the organization s governance, risk management, and compliance (GRC) platform will usually be necessary, too. 5 To get an idea of the retention and destruction requirements that corporate documents can be subject to, peruse the suggested records retention schedule published by the U. S. Better Business Bureau based on guidance from the Internal Revenue Service. Some records should be retained for just two years, then deleted/destroyed. Others must be preserved for exactly seven years, then destroyed. Still others must somehow be safely preserved forever. 6 Source: ESG Research Report, Backup and Archiving Convergence Trends, April 2014.

7 Solution Showcase: Information Governance Considerations for Corporate Legal Departments 7 FIGURE 5. Most Important Features of Purpose-built Archiving Software What features in your organization s purpose-built archiving software application are most important? (Percent of respondents, N=110, three responses accepted) Cloud storage option Integration with data backup software Integration with archive storage systems Integration into existing production applications Integration with data backup hardware Enterprise search Basic search Offline archive access Mobile device access Option for connection to (third-party) service provider 37% 32% 31% 26% 21% 20% 20% 15% 13% 61% IT managers supporting legal departments need to think about how the software and hardware dedicated to datapreservation compliance will coexist with the production IT infrastructure to ensure full compliance and agility. Neither production systems nor employees should ever be burdened. The Bigger Truth 0% 20% 40% 60% 80% Information governance and regulatory compliance are terms that amount to storing the right data, for the right reasons, for the right time span. Those right reasons are especially important to a business entity because so many internal and external end-users have a stake in the company s ability to deliver service, to be profitable, and of course, to ensure propriety. That being said, information governance and regulatory compliance are only hard because IT administrators do not have all the insight necessary to deliver those goals on their own. Like any other transformation powered by IT, good information governance requires communication between technical and non-technical stakeholders it needs active participation by IT, in-house legal staff, and the business unit leaders and application owners whose platforms generate data mandated for retention. After every stakeholder is aware of and aligned to the organization s requirements, IT, together with the other departments, can implement technology that powers good governance. The solution chosen must include a rich catalog that lists what data resides within the organization. It also must integrate easily with the IT framework already in use. With the technology in place and the dialogs continuing, successful adherence to governance requirements by the legal team will simply be part of how the broader organization functions. Governance and compliance are hard to achieve only while they remain foreign and unfamiliar. When the organization collectively becomes conversant with the requirements and establishes a comprehensive catalog, governance rapidly becomes more doable. With technology in place and communication ongoing, adherence to legal record-retention schedules, e-discovery policies, and similar governance and regulatory compliance objectives eventually just becomes part of how the organization functions organically.

8 All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at Enterprise Strategy Group is an integrated IT research, analysis, and strategy firm that is world renowned for providing actionable insight and intelligence to the global IT community. This ESG Solution Showcase was commissioned by Hewlett-Packard and is distributed under license from ESG by The Enterprise Strategy Group, Inc. All Rights Reserved. P