September, 2023 | Article
Building A Team-Based Approach To Information Governance In Your Law Firm - Part 1
Why and how should you build effective information governance (IG) in your law firm? Over two articles, Chris Giles offers a sector-wide perspective and Chris Hockey draws on his experience of implementing IG at a mid-sized US firm. In Part I we cover IG’s role, who should own it and creating an IG policy.
It should go without saying that since information is among the few assets that most law firms have, it’s critical it’s well managed. These days, this is done through information governance, which is simply how firms control their information assets across the entire organization to help achieve business objectives and mitigate risk.
Business objectives
IG contributes to business objectives in several ways. It should increase productivity by enabling lawyers to retrieve data quickly and accurately to get work done. It should ensure that colleagues and clients can collaborate securely and seamlessly, helping elevate the quality and speed of legal service provision.
IG should facilitate efficient e-discovery processes that reduce costs and enable straightforward compliance with court requirements. It should embed effective record lifecycle management, including processes that systematically purge redundant data to keep storage costs under control.
IG is also about identifying gaps in systems or procedures that when filled will make information flow more effectively. It’s about creating an environment that encourages and facilitates the timely adoption of beneficial emerging technologies and innovations.
IG should also put firms in a stronger position to exploit knowledge management, which involves creating and using knowledge to the firm’s benefit. This might include the timely analysis of information that supports better-informed decision making. Or capturing, preserving and leveraging the value of institutional knowledge.
Risk mitigation
As for risk mitigation, IG should cover how the firm protects client confidentiality and maintains compliance with regulations (GDPR, CCPA, PIPEDA, etc.), with client requirements (letter of engagement, OCGs) and with professional obligations (ABA). The failure to adequately protect sensitive and confidential information can incur costly regulatory fines, professional censure, and perhaps most catastrophically of all, loss of client confidence, from which it’s extremely hard to recover.
IG should also play a part in business continuity and disaster recovery planning. When the firm’s information assets are well organized and protected, with back-ups and rehearsed disaster recovery procedures, recovery from major incidents (fire, flooding, pandemic, cyberattack) will be much quicker.
So whether it’s about exploiting the gains or avoiding the pitfalls, more and more firms are recognizing the need for coherent, firm-wide information governance. How, then, should they make it happen?
Where IG belongs
In practice, IG boils down to a series of policies, processes procedures, roles and controls that the firm puts in place to meet its information-related operational, regulatory, legal and risk requirements.[1] But who takes responsibility for this? Chris Giles, CEO and Founder at LegalRM, observes that law firms vary widely in structure, capacity and approach. “Each is its own unique fiefdom,” he notes, “so one of the stumbling blocks when it comes to adopting IG is who in the senior management team will take ownership? The danger is it either falls between the cracks or becomes a bone of contention.”
Giles also routinely sees IT focused on application efficiency, security, backups and business continuity, while Records Management specialists are focused on dealing with issues like matter mobility and content lifecycle management. General Counsels and Risk Management are another discipline that have a significant part to play in putting in place IG policies, as are Heads of Practice Groups. However, unless there is cross departmental discussion and agreement between all interested parties there will be a disjoint between policy and its application within the law firm, or worse still, no movement at all.
The role of an IG Director
An approach that more and more firms are adopting is to create an Information Governance Director role. Chris Hockey was formerly the Director of Information Governance and Management at an AMLAW 200 firm in upstate NY. He notes that his prior firm didn’t consider itself large. “Nevertheless,” he says, “the firm could see a clear need for greater information governance control.”
To that end, his role was created within IT, and he reported to the CIO. Notwithstanding, Hockey notes it’s critical that the reach of IG activity extends across the whole firm. “Successful IG implementations,” he says, “take a village, or a community, at least, within the firm, that shares a single vision on the need to get it done.”
His first task was the creation of an information governance policy. Hockey reached out to a range of people in the info-gov world for ideas and inspiration and then applied what he learned to the context of his former firm. The information governance policy exists to establish the fundamental high-level principles of IG at the firm, set responsibilities and reporting guidelines for steering committee members and other personnel, and to provide a framework for IG across the firm.
How an IG Director or senior manager takes IG forward, from policy and steering committee to procedures and enforcement, will be covered in Part II of this series.
To find out more watch our ILTA Masterclass where Chris Hockey, outlined the approach he’s taken at his firm, while Chris Giles of Legal RM supplied a sector-wide perspective. Click here to watch on demand.
[1] See: ISO 24143:2022 Information and documentation – Information Governance – Concept and principles