| PROCESS | LEVEL 1: Ad Hoc, Manual, Unstructured |
LEVEL 2: Manual, Structured |
LEVEL 3: Semi-Automated within Silo |
LEVEL 4: Automated and Fully Integrated Across Functions |
| I. Establish Retention Program, Catalog Applicable Laws |
Define retention periods only for physical records. | Updated retention schedule for physical and electronic records. | Established retention period for all information, define country/jurisdiction specific schedules (without over- or under-retention of records). | Value-based retention appropriate for business, country operations. Library of country protocols for discovery, privacy, retention. Alert program, department staff when laws change, schedules are impacted. |
| J. Manage Departmental Information Management Procedures |
No knowledge of actual procedures, information, location, use, value. | Conduct inventory of departmental practice and information. | Define retention schedules and stores for departmental information based on value and regulatory requirements; enable change request workflow to master schedule and department/country schedules. | Alerts IT and department delegates when systems, business objectives change. Legal, IT and department delegates continuously access accurate retention schedules, legal holds , privacy procedures. Federate schedules to information repositories enabling routine disposition. |
| K. Routine Disposal |
IT 'keeps everything' because it has no systematic way to determine obligations or value. | IT receives email when events require IT action, such as when an employee is on hold. | IT performs routine disposal with self-service awareness of preservation or retention obligations; looks up any asset or employee to determine value, current legal requirements. | IT performs routine disposal with self-service awareness of preservation or retention obligations; looks up any asset or employee to determine value, current legal requirements. |
| L. Disposition Legacy Data |
No hold release notification, no lookup ability. | Email hold release communication from Legal to IT. | Closed loop between Legal, IT clearly defines legacy data subject to hold. Systematic disposition - of legacy tapes by cross referencing by org, time, and employees with open matters - of terminated employee data by cross reference with legal matters. | Legacy data is dispositioned and no additional legacy data is accumulated. Routine disposition process on terminating employees; tape recycling process is consistent and defensible. |
| M. Information Policy Audit |
We hope no one audits — we'd never pass. | Audit of records limited to physical records. | Annual audit of retention program across electronic and physical records. | Audit of retention, privacy, data protection and discovery processes across physical and electronic information. |
Process Maturity Model
This new model was introduced to corporate practitioners across legal, RIM and IT functions on January 20, 2010 at the 6th Annual CGOC Summit in Phoenix, Arizona. The CGOC, or Corporate Governance and Oversight Council, is a practitioners' forum started in 2004; it provides corporate leaders with educational seminars, benchmarking surveys, group workshops, white papers by expert faculty, and a professional networking web site in addition to the annual Summit and executive retreat. Speakers from Bank of America, Novartis, Abbott, and others focused on information governance, integrated processes across legal, RIM and IT and best practices for discovery and information management.
Using this model, companies can assess the level of maturity of the thirteen key information governance processes and the impact of their maturity level on legal risk, discovery cost, and data management cost. The information governance process maturity model is the first to tightly couple e-discovery and information management processes under an information governance umbrella and to define risk and cost values for each process and level of maturity.
Using the Process Maturity Model
Let us show you how you can reduce your cost and risk! Contact us for an interactive maturity assessment with a risk and cost profile that reflects your unique environment.
