The Gold Standard of Information Governance

Information governance is the set of decisions, roles, rules and evidence by which an organisation makes information useful, trustworthy, appropriately protected and accountable throughout its life. The subject includes records, documents, datasets, messages and knowledge embedded in systems. A file is not governed merely because somebody has put it in a folder; a governed information asset has an identified purpose, responsible owner, meaningful description, appropriate access and a known retention or disposal decision.

The immediate question is not which software package to buy. It is what the information is for, whose interests it affects, who is authorised to decide about it, and what would count as a reliable record of the decision. Poor governance can leave staff unable to locate a valid policy, identify the approved contract, correct a mistaken customer record or explain why an old dataset still exists.

Distinguish information governance from neighbouring activities. Data governance concentrates on the quality, meaning, stewardship and responsible use of data. Records management ensures evidence of activities can be created, captured and preserved appropriately. Cybersecurity protects systems and information against threats. Privacy management addresses personal-data handling and individuals’ rights. Information governance connects these responsibilities; it does not replace the expertise of any one discipline.

Start with an inventory of information that matters to actual work. Identify the business process, system of record, owner, storage location, sensitivity, users, downstream recipients, applicable obligations and dependency on other records. A payroll spreadsheet, a research consent form, a maintenance log and a public policy notice all carry information, yet they need different controls and should not be forced into one undifferentiated rule.

Separate the authorised copy from convenient working copies. The approved version of a procedure should have a clear location and version. Repeated exports of the same dataset can create inconsistent evidence and spread sensitive fields. An inventory should record how duplication arises and whether a secondary copy has an independent purpose rather than assuming every apparent duplicate must be deleted immediately.

Ask a practical diagnostic question: if the named team leader left tomorrow, could an authorised colleague discover what information exists, understand its meaning and use the correct version without relying on a private inbox? If the answer is no, knowledge has not yet become governable institutional information. Inventories are maintained processes, not one-time catalogues.

Information governance fails when accountability is assigned only to the technology department. Senior leadership must approve risk appetite, responsibilities and exceptions; process owners define business purposes; stewards maintain classifications and quality rules; security specialists manage protection controls; legal and privacy functions interpret applicable duties; records professionals define capture and retention practices. One person can fulfil multiple roles in a small organisation, but the decisions still need to be explicit.

Use a decision table rather than ceremonial job titles. Who may create or amend the record? Who approves a new use? Who judges whether a retention period has expired? Who can correct inaccurate data? Who grants an exception, for how long, and where is it recorded? The escalation route matters especially when a department wants to reuse information for a purpose that conflicts with an earlier assurance.

A good charter allocates decision rights without pretending that it makes every conflict disappear. Owners should be able to show their decisions, supporting reasons and review dates. Stewardship is measured through resolved problems, controlled changes and reliable access, not the number of meetings or committee members.

Classification links information to the consequences of misuse, loss, unavailability or alteration. Useful labels often distinguish public information from internal material and more restricted records, but the exact scheme should be proportional to the organisation. An overly intricate classification hierarchy may be ignored; an oversimplified one may put a public brochure and a sensitive clinical file under the same treatment.

Evaluate confidentiality, integrity and availability independently. A public emergency instruction may require little secrecy but very high integrity and availability. A sealed investigation file may require strong confidentiality and a tightly controlled chain of custody. Define the consequence before selecting the label, then ensure the label produces actual requirements for access, encryption, approvals, backups, monitoring and onward sharing.

A classification also needs an expiry or review trigger. Drafts may become public after approval, a contract may move to archive after closure, and an incident record may be subject to a legal hold. Context changes; a label should not become a substitute for reconsidering why access is needed.

An information lifecycle begins when a record is created or received. It continues through capture, use, sharing, updating, secure preservation, archiving and eventual authorised disposition. Capture metadata such as provenance, timestamp, authorising action and relationship to a business process. Without these, future readers may see words and figures but lack the evidence needed to understand what they meant at the time.

Retention decisions require a documented basis. Different rules may apply to financial documents, contracts, personnel material, medical records and public administration; jurisdiction and purpose matter. In Singapore, section 25 of the Personal Data Protection Act limits retention of personal data when the collection purpose and other legal or business needs have ceased. It does not impose a single universal retention duration on every category of record.

Disposition should be both defensible and demonstrable. Identify eligible records, check for an active dispute or legal hold, secure approval, remove unnecessary live and replicated copies according to policy, and retain an appropriate audit trail of what was disposed of and under which authority. Conversely, destroying records to evade an investigation is not defensible governance. The gold standard is controlled action supported by a traceable reason.

Consider a fictional information team reviewing 10,000 active customer records. It finds 840 records flagged as duplicates and 520 flagged as missing a required classification field. Among those two sets, 140 records suffer from both problems. Simply adding 840 and 520 would count the overlapping 140 twice, making the quality problem look larger than it is.

The number of distinct records failing at least one test is 840 + 520 − 140 = 1,220. Therefore 10,000 − 1,220 = 8,780 records pass these two tests, giving a restricted two-check pass rate of 87.8%. The calculation is precise under the stated fictional definitions; it is not an organisation-wide accuracy score, a privacy compliance percentage or proof that the passing records are otherwise correct.

Next establish whether duplicates mean repeated unique identifiers, duplicated people, or legitimate separate transactions. These definitions change the remediation. The team should also preserve the audit denominator and maintain the overlap as a separately recorded category. A second reviewer using the same snapshot and rules should be able to reproduce 1,220, not merely accept a dashboard that says quality is improving.

Demonstration: 840 + 520 − 140 = 1,220 distinct exceptions; 8,780 ÷ 10,000 = 87.8% passing these two stated checks. All numbers are invented for teaching.

Access decisions require an explicit link between role and legitimate purpose. Least privilege means people and services receive the capabilities they actually need, not every permission that might be convenient. Evaluate not just who can read information but who can modify, export, combine, publish and delete it. External collaborators may require time-limited access, controlled agreements and a process to remove access when the relationship ends.

Track movement across systems. A well-managed source file can become uncontrolled through email attachments, analytics exports, shared drives and vendor integrations. The receiving system should inherit necessary restrictions and provenance. When data is combined, a field that looks harmless alone may identify a person in a small subgroup. A transfer register or interoperable access log can expose these changes better than a static policy statement.

Suppliers introduce a second layer of governance. Organisations should understand contractual duties, the location and permitted uses of information, sub-processors where relevant, incident reporting and what happens at contract termination. Encryption and authentication are important, but a secure transfer to an unauthorised recipient remains a governance failure.

Auditability is not the same as logging everything forever. Start with the decisions most important to accountability: creation or approval of a controlled document; changes to access; alteration or correction of significant records; disclosure outside the organisation; retention holds; and authorised disposal. Capture who acted, under which authority, on which information, and when, using tamper-resistant controls appropriate to risk.

Then decide how the trail will be reviewed and tested. A control that exists only as a checkbox is fragile. Sample real actions: can a reviewer reconstruct a version history, verify that a disclosure had approval, or demonstrate that a user who left had their permissions revoked? Exceptions should be assigned, prioritised and closed with evidence, while persistent causes should trigger redesign rather than endless individual reminders.

Do not convert audit data into an uncontrolled surveillance archive. Logging itself creates information needing purpose, access control, retention and privacy review. Proportionate accountability includes the right to question what is collected, not just the ability to collect it.

Imagine a fictional team reviews 250 project files. Eighty lack a confirmed owner and 35 lack a classification label. Fifteen files have both problems. What proportion passes both tests? First write the denominator: 250 files, not the number of file properties reviewed. Find distinct failures with the inclusion–exclusion principle rather than counting the overlap as separate files.

Eighty plus thirty-five minus fifteen equals 100 affected files. This leaves 150 files passing both checks; 150 divided by 250 equals 60%. This exercise tests ownership and classification only. It does not test whether the assigned owner is appropriate, whether each label is correct, whether records remain necessary or whether users obey the access rule.

Now change the context. Suppose the missing-owner problem is concentrated in one confidential archive while the unlabeled files are mostly public drafts. A single 60% pass figure hides differing risk and remediation priorities. Stratify the files by type and impact, state which checks each metric includes, and report serious exceptions separately. That is how numerical accuracy becomes useful governance rather than attractive but empty measurement.

Practical check: What is the pass share if 80 and 35 failures overlap by 15 among 250 files? Answer: 250 − (80 + 35 − 15) = 150; 150 ÷ 250 = 60%.

Information governance becomes stronger when learners follow the discipline behind each decision. Data Governance develops ownership, data meaning and quality. Information Systems explains the technical and organisational environments in which records operate. Cybersecurity examines control against digital threats, while Law provides a starting point for distinguishing documented obligations from internal policy preferences.

To understand organisational authority, continue through Institutions. To evaluate reported exception rates and incomplete samples, consult Statistics. Information also acquires new governance demands when used in business strategy and markets; Industrial Organisation provides that neighbouring perspective.

The learning transfers into daily life as well. A student selecting a source for a project, a parent managing school documents, and an employee reviewing an AI-generated summary all need to ask: who created this, which version is authoritative, what may I do with it, and what evidence would show a correction? Such habits connect information governance to The Gold Standard of Education. The complete standard is neither secrecy nor storage at any cost; it is information that remains intelligible, legitimate, available to authorised users and defensibly managed.