Episode Transcript
[00:00:00] Speaker A: Why do you need IG policies? Welcome to the Lightning Round on Information Governance.
We will discuss how do you would we did we should you. Why do you. I think I said that already. Anyway, over a variety of interesting topics.
Hello, welcome to what Counts. Every organization hides a story in their data.
This is a podcast that digs into the governance problems that people inherit, ignore or discover too late. I'm Lee and as always, this is my special co host, Maura Dunn.
This Lightning Round we're going to talk about why do you need IG policies?
[00:00:38] Speaker B: I love the way you've been saying every story, every business hides data. What did you say? Every organization hides a story in their data. Yeah, yeah.
I like how you've been saying that, even if I can't say it.
And I think it's a good, it's a good lead into why do we need policies?
So we talked on one of these other episodes and we've talked many times before about being able to consistently manage your data, that consistency is important. Consistency is important.
[00:01:14] Speaker A: So let's be careful, though you weren't going there. And I know you know the difference because we had an episode on this, between a policy and a process, because I was going to jump to process right away.
Standard operating procedures, those are different.
[00:01:27] Speaker B: Those, those are different. We're not talking about them in this episode.
So consistent policy is important because you want to be able to demonstrate, and we talked before about the reason for record keeping is to be able to demonstrate and provide evidence that you have a transaction of a contract, of an agreement or an obligation that you were in compliance with a law or a regulation.
That's why you have records, is to be able to provide evidence of all those things.
The policy side of it is consistently creating, managing and destroying records so that every time you've created a record, it's dependable because you're treating them all the same. You are consistently creating the records that you need to demonstrate and provide evidence of all those things that we talked about.
You are maintaining those records, you're securing them, you're storing them, you're making them accessible for all of them and then you are destroying them consistently in accordance with a policy, a policy that's written down. And the point of the policy side of this is it sets up the framework.
It sets the expectations not just for you internally, but for anybody outside who is depending on your, your organization to carry out the things you said you would carry out. So the obligations and the compliance with law and the safe operations and fiscal responsibility and all those Things that your records demonstrate. Compliance.
The policy framework is the glue that says, okay for this company.
We know that they create records and we can depend on them. We know that when they say they've got a contract, they have a contract and they carry out the obligations of the contract because they've got it right here and they know what they're supposed to do or they are providing a service, a public service even, and they are doing it equally and in accordance with the law because they've said so. And they can prove it because they have all the records. So that's the reason you need policy, is because it takes the guesswork out of it.
[00:03:51] Speaker A: I interpret. Well, you're not.
[00:03:53] Speaker B: Every time stepping out.
[00:03:55] Speaker A: Sorry, but I interpreted a few of the words that you said and. And it was.
[00:04:01] Speaker B: Made you laugh.
[00:04:01] Speaker A: Okay, you need a policy because you can point to something and say, because it says so, why do I have to do it? Because the policy says so anyway, so.
[00:04:16] Speaker B: No, that's not what I meant. I mean, that might be a training or a disciplinary approach, but what I'm saying is that you as an organization, policy protects you because you're telling the world, this is what we do with our information and this is how we do our work. And our records prove that that's how we did our work. And so the policies are the foundation of that.
They are. What enable you to say, we thoughtfully developed a policy. We agree that these are the things we're going to do and we are creating and maintaining records that prove that we did it. So you public can count on us when we tell you, this is what we're going to do, this is what we're going to do. So that's the reason for policy internally. Yes. You can say to somebody, this is the policy, so you need to follow it. Because we as an organization depend on this policy to support our place in the community.
[00:05:21] Speaker A: What if you have a policy and you don't follow it?
Is that worse than just not having a policy at all?
[00:05:28] Speaker B: It's worse from a. Well, it's. Yes, it's worse in a lot of ways. It's worse in court because if you go to court and say, oh, we have a retention schedule and it says we can delete these records. So we did. And then they say, prove it. And you say, well, we deleted these records, the ones that we didn't want you to see. But actually we have 75 years of records that we didn't delete, following our policy, then the court's going to say, yeah, we think you deleted these records because they would approve the other guy's case. That would be an adverse inference finding. And so we're going to tell the jury, assume that these records they destroyed would have proved the other guy's case. So that's bad, but that's a very personal bad to have a policy that you don't follow.
But it's, but I think in a more altruistic sense it's also bad to have policies you don't follow because the point of the policy is to make sure your business is running the way that you want it to run.
It's running to provide the product or the service that you are promising to your customers or to the world or to your local community.
And to do it in a safe and, you know, cost effective and, and, and profitable way if you're a for profit company. Those policies are designed to make sure that happens. And when you skip a policy step, what happens are things like the long list of food recalls we have right now, because I guarantee you, and I don't know the list of all the companies, but all the companies that are, that are out there that have got a food recall going, they had a policy that says, make sure the equipment is clean, make sure the packaging is sterile, make sure that there are no stray bits of metal or glass in the final step of grinding or processing the food.
Not one of them has a policy that says, yeah, we don't care if it's dangerous for people, peanuts are in our food, or if peanuts are in our food, because we don't care if people with a peanut allergy eat it.
Not one of them has a policy that says that.
So what they have are policies that they're not following.
And, and inspectors would be looking at records saying, where's the, where did the problem come in? Where was the, where was the gap? Where was the, where was the missed step?
So that's worse for you as a business, even if nobody sues you, because now everybody's like their process isn't. Their process doesn't follow their policy all
[00:08:10] Speaker A: up in the air.
[00:08:11] Speaker B: They're not, they're not following their policy because their policy says we provide safe food from start to finish. And they don't.
And that, that is a reasonable conclusion to draw there.
[00:08:26] Speaker A: So the anarchy.
[00:08:28] Speaker B: So the reason for the anarchy that is, yes, it is anarchy.
It is, it is a anarchy and not in a good way because, because then you don't depend on it, then you don't buy that, the food from that company, maybe for a long Time because their brand is tainted for you.
No pun intended.
[00:08:54] Speaker A: No, I think you were intended because I don't know when I'm going to eat lettuce next.
[00:08:59] Speaker B: If you don't, if you don't know where it came from.
Right. Lettuce in a bag. It's tricky right now.
[00:09:05] Speaker A: Got the old salad spinner out and
[00:09:07] Speaker B: I'm washing everything or you're grilling it. I like grilled lettuce.
Kill some germs that way.
Grilled romaine. Very nice. So the, so it has an impact. It has a bigger impact than the minute that it took that you skipped that step in your, in your policy that you didn't follow the policy and the, the individuals who don't follow policy. If the company has a, has a internal, you know, str culture of we don't check.
The point is bottom line, then that's a problem.
Think about a whole different area. Not food banking, big bank. A few years ago, they didn't have a policy that said defraud the customer. They had a policy that said know your customer, follow the law. Know your customers when you're setting up accounts. And they had an incentive program that said set up as many products as you can with each customer.
And the incentive program won over the policy because the policy wasn't being checked and enforced.
And they got in big trouble for that, as they should. But also a lot of customers were defrauded and that is bad.
So the policies protect everybody, but the policies protect everybody. In our world, information underlies every part of a business.
And that's why we're in this information governance space, because it's important.
But you don't want so many policies that nobody can figure out what to do.
[00:10:52] Speaker A: Right. So what's important from an information governance perspective?
[00:10:56] Speaker B: So I think the.
[00:10:57] Speaker A: We already said one in this conversation.
[00:11:00] Speaker B: The single most important one is the retention schedule, which outlines the type of information that you have, how long it's should be kept.
A good retention schedule probably also includes a level of classification around it. Is it public information, is it internal only information? Is it internal to. Restricted to a small group information?
Those are kind of the three levels you're looking at.
And your retention schedule should be able to tell you that.
Then you're there the next. And it tells you how long you have to keep it, how long you keep it from a, how long it's active and things can be added to the record or be changed. And then when it becomes inactive, how long does it have to be kept for regulatory purposes? Audit purposes, any type of look back kind of thing. And there are different rules around that, both operationally and legally.
That's the single most important one.
I think the second most important one is a legal hold policy.
Because in the event we didn't actually talk in the information governance risk lightning round, we did not talk about the risk of a litigation profile. We kind of danced around it by talking about regulatory requirements in industry.
But depending on your litigation profile, depending on how likely it is in your business that you're going to get sued, everybody has a chance of getting sued, but some businesses get it more than others.
Businesses with a lot of employees tend to have a higher level of litigation because there's employee litigation.
That's often the most common type of litigation in a very large company.
Consumer product companies also may have a high level of litigation because they have product safety or other consumer litigation. They might all be small claims, but it's still litigation. So the more litigation you have, the more important it is to have a legal hold policy which says when there's a litigation coming, it can be foreseen or an audit, then stop destroying things in accordance with the retention schedule. It doesn't say change the retention schedule. It just says this set of things that might be subject to some kind of discovery or review in relation to a litigation, to a litigation matter can't be destroyed yet.
And that's important.
And then the third thing I think, because it is one of the ways that information is proliferating right now and it is largely uncontrolled, is around electronic communications.
And it started with email, which is a whole thing unto itself.
And then it went to chat functions, you know, used to be, could be on your. Let's not even talk about the texting, but text is a real thing. And whether you should use personal phones with texting for business or not has gotten people in trouble.
The BP Deepwater Horizon case a few years ago was one of the, one of the landmark cases there because people on the scene had deleted text, probably because their texts were full and they couldn't send anymore because so much was happening.
But it looked, it was a problem because then data was lost.
But also you have your teams or Gchat or Slack or any of those where informal conversations are happening and people think about them as just a conversation in the hallway. But it's not.
Remember back to our. What is a record?
It's recorded. It's capable of being recorded because it's written down in that system.
You can share data, you can share pictures and files and other things there. So, so those.
The chat feature is often a gateway to a collaboration feature. And that's a whole new way of working. And it has created different types of records, different records that may not have existed before, that might have been a meeting before and you would have had a formal agenda, materials attached for review, formal meeting minutes and action items.
Now you're having that meeting asynchronously all day long.
Different people come in and out, different things get said.
Context is lost by the end of the day and that becomes a risk. So a policy around that, what's appropriate and what are we doing with it as a company and whether you should, if you've somehow reached a decision there, that should be documented somewhere else. How do you do that?
How do collaboration sites get. Get managed the same way that other record repositories get managed.
Think. Taking the time to think all that through and write it into a policy I think is the third most important thing to do, especially for large businesses.
[00:16:10] Speaker A: I know this is jumping ahead, but I think taking into consideration the AI prompts, your writing and giving a definitive cutoff period for how long they should be kept is something too, that should be added to that communication into the whole.
[00:16:30] Speaker B: In that communication section. AI has to be part of the world of electronic communications.
Yes, I'm going to say yes to that part. I'm not going to jump ahead to a definitive cutoff on how long the prompt should be kept because no, we got to get to how are you using the prompts, what records is it creating, what business processes it's supporting? Like it's some of the.
The thought process around each of these policies has to take those things into account. That's why the retention schedule comes first, because that needs to flow to the others.
Yeah, I know you really want to talk about AI and we will.
[00:17:08] Speaker A: No, I won't.
Nope. I'll tell you this seven times out of 10, the email that the AI wrote for you is wrong.
So write it in your own language.
[00:17:21] Speaker B: And also, you won't sound like a robot, right?
[00:17:26] Speaker A: Yeah. You think using those big words are cool. They're not you, they're just not you.
Anyway, if you have any questions, please send us an email at info trailblazer.us.com or look us up at the web at www.trailblazer.com or on the Microsoft Store, on the Apple Store or the Google Play Store.
Check out the Learning academy@trailblazer learning academy.com thank you for listening. Please tune in to our next episode if you like. This episode. Please be a champion. Share it with people in your social media network or like or subscribe. Those are important pieces, too. We appreciate you, the listeners. Special thanks goes to. Jason Blake created our music.
[00:18:10] Speaker B: All right, thanks, everyone. See you next time.
