IG Solutions - Comprehensive Information Governance Auditing Made Easy by Craig Grimestad

Easy and Comprehensive? Aren't these at opposite ends of the spectrum? They don't need to be. Iron Mountain has an auditing process that is fully comprehensive, with minimum effort from the workforce, and the auditing team. Labor intensive interviews and investigations are only performed as warranted by the data. But before we get into more detail on this, let's establish some parameters:

Information Governance audits are performed at the pleasure of the company. These are internal audits with no legal or regulatory required processes to follow or even any requirement to perform the audit in the first place (one reason why many companies haven't matured their program to this level yet).

Information Governance audits are conducted against requirements. It is a good thing to check yourself against Best Practice (and Iron Mountain can help with that also), but checking against best practice is an assessment of the maturity of your program, not a measure of workforce compliance with your requirements.

Requirements are found in policies and procedures with specific requirements language such as must, shall, and will. Using words like should, might, or could provides the opportunity for variation of activity, including no activity at all. It also invites time wasting non-productive discussions on definition and intent. Much better to preclude all of that with clear, non-negotiable requirements language. If you need assistance with developing or re-writing policies with requirements language , Iron Mountain can help with that also.

Audits are a way of life; a regular, normal, ongoing business activity. Audits should be designed and conducted in a way that not only provides a snapshot in time of where you are, but are foundational for necessary corrective follow-up and the next audit.

Iron Mountain Consulting has matured its audit offering to be a business comprehensive, minimally intrusive, cost effective assessment of the status of an IG program. This technique is extremely flexible such that it is equally effective addressing the entire program across the entire business, or focusing in on a program sub-set, or a business area subset. Questions are developed from your operational requirements and each individual (that is all employees within your targeted area of interest) is given a questionnaire that to fill out and return that will clearly identify their compliance status. No interviews, investigations, or collection of evidence unless warranted by the returned data. Those who are compliant can say so and be left to do their other job activities. The IG auditing team reviews the returned data and selectively follows up as directed by the data and their priorities to improve compliance. This process is outlined in more detail in a prior blog on the subject Who Needs Auditing to do an Audit? As that title suggests, while you will want to conduct these audits in partnership with your auditing department, you do not need auditing resources to conduct these audits. The process is simple enough and straight forward enough that the audit can be conducted and processed with minimal (if any) Audit supporting resources. It can also be accomplished with external resources, partially or completely, to minimize the impact on scarce IG team resources.

Iron Mountain offers 4 levels of service to meet you where your needs are, and what your budget allows:

Provide audit training: Audit development instructions, training, and sample audit forms.

Develop audit questions: Audit questions (from your requirements documents), audit forms, audit findings templates, instructions, communications and training.

Develop audit program: Audit questions (from your requirements documents), audit forms, audit findings templates, instructions, communications, training, recommended remedial actions and audit summary report templates.

Develop and conduct audit: Development of audit questions (from your requirements documents), audit forms, communications, audit program status reports, audit distribution, audit collection, audit collection follow-up, audit findings, recommended remedial actions, audit summary reports and recommendations for next steps.

Or if you prefer a custom approach, Iron Mountain is happy to help with that as well.

Have you put off auditing your IG/RIM program because of lack of resources, or fear of consequences for disrupting the normal flow of business activity? An IG program will never reach maturity without a feedback process that determines where the workforce is operating as required and where it is not, providing remedial action to bring about full compliance. I expect most of you have read many articles in numerous places about conducting Information Governance (IG) or Records and Information Management (RIM) audits. Most of them are resource intensive, intrusive to other business operations, time consuming, and are not comprehensive. I have found no other process that is as comprehensive, time efficient, and resource effective as Iron Mountain's auditing process. You might be interested to know that I helped to develop this process, but more importantly I have used it, and IT WORKS! Whether you just re-read my prior blog on the subject and independently develop your audit program, or reach out to Iron Mountain for support - this process can be a game changer for you. It enables companies to finally move forward with this all important step in the maturity of their program in a practical, common sense, comprehensive and efficient (minimal resources with maximum results) way.

Follow me on Twitter @CGrimestad

LINK:	http://blogs.ironmountain.com/2015/service-lines/records-management-an...
	See more stories from ironmountain

Most recent headlines