LEXSHIFT BLOG SERIES: THE GOVERNANCE INVESTMENT: PLANNING AND FUNDING FOR THE YEAR AHEAD
Week 3 of 12
The second article in this series focused on the value of an honest maturity assessment before developing a governance plan. Once the gaps are understood, the next question is practical: what does leaving them unaddressed cost the organization? Understanding those costs helps turn the findings into an investment discussion.
That connection is often missing. Governance teams can describe the operational problem but may not have translated it into costs, exposure, and business consequences that leadership can weigh against other priorities.
Doing Nothing Is Not Free
The status quo can feel safer because it is familiar and does not require a new investment decision. But maintaining current practices can carry costs and exposure that are spread across the organization and rarely assessed together.
Those costs can grow over time. As unnecessary information accumulates and workarounds become routine, addressing the underlying gaps may require more effort. Deferring the decision does not necessarily preserve the current position.
The following four areas provide a practical starting point for estimating that cost and exposure, using information the organization may already have.
Over-Retention
Information retained beyond approved requirements, without a documented reason, can create avoidable cost and exposure. The impact may extend beyond storage to the effort required to locate, preserve, and review information during litigation, regulatory inquiries, or other requests. The business case should account for those consequences rather than treating over-retention solely as a storage issue.
Manual Effort
Manual governance work takes many forms. Records managers track exceptions in spreadsheets. Legal reviews hold populations manually. IT fields recurring requests to locate information. Manual controls may be appropriate. The question is how much recurring effort is necessary and how much results from inconsistent processes, missing information, or systems that do not support the work.
Estimate the hours spent on recurring tasks and apply the fully loaded labor cost of the people performing them. This makes the resource commitment visible, including time that could be redirected to other work.
Risk Exposure
Not every consequence appears in current spending. Some involve potential future events, such as a breach, a preservation failure, or the consequences of an unresolved audit issue. Where there is a reasonable basis for estimating that exposure, use a range and document the assumptions. Where there is not, describe the risk clearly rather than assigning a number that cannot be supported.
Storage and Infrastructure
Review the costs of storing, backing up, and securing information that is no longer required. Use actual invoices and pricing arrangements to identify which costs would change if that information were removed. The potential benefit may extend beyond storage, but the estimate should distinguish achievable savings from costs that will remain.
From Cost to Case
These costs do not need to be modeled with false precision to be useful. A defensible range can be built from available evidence, including storage invoices, legal spending on discovery and holds, and time spent on manual governance tasks. The goal is a baseline with clear sources, assumptions, and limitations that leadership can understand and challenge.
These areas overlap, so count each cost once and distinguish current spending, staff effort, and estimated future exposure. The baseline should make those different consequences visible, not combine them into a single figure that overstates the case.
Start with a single business unit and bring together the available information on storage costs, manual effort, legal response costs, and risk exposure. Compare the costs and exposure that the proposed work could realistically reduce with the investment required, using the same timeframe and clearly stated assumptions. That comparison gives leadership a more useful basis for deciding what to fund, what to sequence, and what to defer.
The Bottom Line
The status quo has a price, even when that price is spread across budgets, staff time, and unmanaged exposure. Making those costs visible gives the organization a stronger basis for deciding where to invest. The next step is prioritization: identifying which improvements will deliver the greatest value and sequencing the work accordingly.
Next in the series: Not Everything at Once: How to Prioritize Governance Investments.
The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.