Information governance

Information governance sets decision rights over information: who may keep, share or delete it, and on whose authority. It writes the schedule; information lifecycle management runs it. This is not an information security policy, nor how a site is organised.

Think of it as the rulebook behind the rules. Governance decides who signs off a retention schedule, who may release a file to a client, and who answers for it when that goes wrong.

It is deliberately boring work — the value only shows up in a dispute, an audit or a breach. At that point somebody has to say who was allowed to make the call that was made.

The word covers more ground than most job titles suggest. Contracts, recordings, spreadsheets, chat threads and scanned paper all count, which is why the authority question gets answered once rather than system by system.

An AI governance framework is the same instinct applied to models and training data rather than documents.

Key takeaways

• Governance assigns decision rights over information: who decides, under what authority, and with what written record.
• It produces classifications, schedules and approvals, then hands the running of them to lifecycle management.
• A named owner beats a written rule with nobody standing behind it.
• Scope covers every form of recorded information, paper and digital alike.

How it works

Governance works by writing authority down. You classify information by sensitivity, give each class an owner, set the rule for keeping and releasing it, then record who approved that rule and the date it is next read again.

Scope is wider than most teams assume. Under United States federal law, records include all recorded information, regardless of form or characteristics, made or received in the transaction of public business.

The same statute settles who decides. The Archivist’s determination of whether something counts as a record binds every federal agency, which is governance in its purest form: one office, one call — no local opt out.

Accountability lands on a named person, not a department. Under the same chapter of United States law, the head of each federal agency must establish and maintain an active, continuing program for managing the agency’s records.

That is the governance move in statutory form. Section 3301 says what counts as a record; this section says who has to run the programme, and it adds a duty to set safeguards against records being removed or lost.

Classification does most of the heavy lifting. Once information is sorted into three or four sensitivity tiers, every later rule can hang off the tier instead of being rewritten for each new system.

Authority has to live where people will actually find it. A rule recorded only in a board minute is not a rule a team leader can act on at four o’clock on a Friday afternoon.

Exceptions deserve as much design as the rules themselves. Name who may grant one, put an expiry date on it, and keep the running list somewhere a reviewer can read in a single sitting.

Training is part of the output rather than an extra. A classification scheme nobody has been taught produces confident misfiling, which takes far longer to unpick than no filing discipline at all.

Most firms hand the standing job to a compliance officer or a small board that meets on a fixed cycle. Firms without that bench buy it in through compliance outsourcing.

Examples

Four settings show governance doing work no tool can do for you. What changes is the sector and the regulator; what stays constant is the question of who holds the authority to decide.

Hospital groups. A hospital rarely asks whether a patient record can be released — it asks who is allowed to say yes. The follow-up questions are on what grounds, and where that approval gets written down afterwards.

Banks and insurers. Disclosure requests arrive constantly, from regulators, courts, auditors and clients. Compliance program design is where a bank decides which of those a duty officer may answer alone.

The point is speed as much as caution. A disclosure routed to a committee that meets monthly is a disclosure the regulator will chase you about before you have answered it.

Outsourced contact centres. A client keeps governance while the provider runs operations. Rules like TCPA compliance show how specific that gets, because the authority to call a number sits with the brand, not the dialler.

Public sector suppliers. A vendor handling government records inherits the client’s schedule rather than writing its own. The contract usually names the clause, the retention period and the office allowed to vary either of them.

The pattern repeats across sectors. Governance without a named owner is a wish — and an auditor can tell the difference in about ten minutes.

Related terms

• ESG environmental social governance: governs environmental and social conduct rather than decisions about information.
• Data engineer: builds the pipelines that governance rules then constrain.
• Compliance officer: usually owns the governance calendar and the exception log.
• AI governance framework: extends decision rights to models, training data and model outputs.
• Compliance outsourcing: buys in the governance bench a firm does not employ directly.

FAQ

How is information governance different from data governance?

Data governance is usually the narrower of the two, covering structured data held in systems and databases. Information governance covers every recorded form, including email, contracts, call recordings, chat logs and scanned paper.

Who should own information governance?

A named executive, supported by a board drawn from legal, technology, records and the business lines. Ownership that sits with a project team ends when the project does, which is why the role is held permanently rather than assigned for a cycle.

Does information governance require a committee?

Not always. Small firms can run it through one accountable officer and a short written schedule, provided the decisions, the approvals and their dates are recorded somewhere a reviewer can find them later.

What does a governance programme actually produce?

A classification scheme, a retention schedule, an approval route for disclosures, a register of exceptions and a dated review cycle. Everything else is implementation, and most of it belongs to other teams.

Can information governance be outsourced?

The work can be, but the accountability cannot. A provider can run the schedule, the registers and the paperwork while the client keeps the authority to decide what each rule should actually say.

Shortlist vetted providers in the Outsource Accelerator directory before you hand regulated information to anyone.