LEXSHIFT BLOG SERIES: THE GOVERNANCE INVESTMENT: PLANNING AND FUNDING FOR THE YEAR AHEAD
Week 2 of 12
The first article in this series made the case for funding governance proactively, during planning season, instead of reactively, after an incident forces the conversation. That case only works if it starts from an honest picture of where the organization stands. You cannot plan what you have not assessed, and you cannot fund what you cannot describe.
Most organizations skip this step, or shortcut it. They plan from the policy manual, from what the last audit said two years ago, or from what leadership believes to be true based on how the program looked when it was built. None of those sources reflect current state. They reflect a version of the program that may no longer exist.
Why Assessment Has to Come First
A governance investment sized against the wrong starting point fails in predictable ways. It underfunds a gap nobody realized had grown that large. It overfunds a capability that was already further along than assumed. It sequences work in the wrong order, addressing a visible symptom before the structural issue underneath it. And when the investment is reviewed for renewal, the numbers do not hold up, because they were never built on an accurate baseline to begin with.
Assessment is not a formality that precedes the real work. It is the foundation the rest of the plan stands on. Skipping it does not save time. It moves the cost of getting the baseline wrong to a later point in the process, where it is more expensive and more visible to fix.
What a Maturity Lens Actually Looks At
A useful governance maturity assessment does not ask whether policies exist. Most organizations already have retention schedules, classification frameworks, and disposition policies on paper. The more revealing question is whether those policies are executed consistently, across business units, systems, and data types, or whether execution depends on which team happens to be paying attention this quarter.
That distinction points to the dimensions worth assessing directly: whether retention practice matches documented policy in the systems that actually hold the data; whether the organization has visibility into what data exists and where, particularly outside the systems that were built with governance in mind; whether ownership and accountability for governance outcomes are assigned to specific roles, or diffused across a committee that meets quarterly; and whether the technology in place enables consistent execution, or requires manual effort to compensate for what the systems cannot do on their own.
Each of these can be scored honestly, on a simple scale from ad hoc to managed to consistently operational, without turning the exercise into a multi-month audit. The goal is a clear, defensible picture, not an exhaustive one.
Consider a retention schedule that looks complete on paper but is enforced in only two of the twelve systems that hold the data it covers. A policy review alone would score that program well. A maturity assessment focused on execution would score it accurately: strong on documentation, weak on operational consistency, and exposed everywhere the schedule is not actually applied. That is the gap planning season needs to see.
The Honesty Problem
The hardest part of this exercise is rarely technical. It is organizational. Teams that have worked hard to manage around a gap tend to describe that gap as smaller than it is, not out of dishonesty, but because the workaround has become normal. A retention schedule enforced manually by one diligent records manager looks, from a distance, like a functioning program. It is not the same as a program that would keep functioning if that person left tomorrow.
An accurate assessment must separate what the organization has documented from what would happen under audit, litigation, or a regulatory inquiry. That separation is uncomfortable to surface internally. It is far more comfortable to surface it now, during planning, than to have it surface itself later, during an incident.
A Practical Way to Locate Gaps
The most useful version of this assessment is one leadership can act on, not one that sits in a binder. That means keeping it focused on a small number of dimensions, scoring each one against current practice rather than stated policy, and pairing every gap identified with a plain description of what it costs the organization to leave unaddressed. A gap without a cost attached rarely survives the next round of budget prioritization.
It also means resisting the instinct to assess everything at once. A maturity lens applied narrowly to the areas most exposed to risk or most central to the next planning cycle, produces a picture leadership can use immediately. A maturity lens applied everywhere produces a report that takes months to finish and arrives after the budget conversation has already happened without it.
The assessment also works best as a shared exercise rather than a single function’s report. Legal sees exposure that IT does not. IT sees where data lives in ways records management assumptions often miss. Business units know where workarounds have quietly become standard practice. Bringing those perspectives together before the numbers go to leadership produces a picture that holds up when it is questioned, rather than one that unravels the first time someone outside the exercise looks closely at it.
What This Sets Up
An honest maturity picture does more than support a smarter plan. It becomes the evidence base for everything that follows in this series: the cost of the status quo, the business case that gets funded, and the roadmap leadership can approve with confidence. Every one of those depends on starting from where the organization really is, not where it was assumed to be.
The Bottom Line
Planning season rewards organizations that show up with an accurate picture of their own governance program, not the most polished one. An honest maturity assessment, focused on execution rather than policy language, gives leadership something they can act on and something the program can be held to later. That is a stronger position than a confident guess, and it is the only foundation a governance investment can be built on.
Next in the series: The Real Cost of the Status Quo, a practical look at what unaddressed governance gaps are already costing the organization.
The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.