Know Where You Stand: Assessing Governance Maturity Before You Plan
LEXSHIFT BLOG SERIES: THE GOVERNANCE INVESTMENT: PLANNING AND FUNDING FOR THE YEAR AHEAD Week 2 of 12 The first article in this series made the case for funding governance proactively, during planning season, instead of reactively, after an incident forces the conversation. That case only works if it starts from an honest picture of where the organization stands. You cannot plan what you have not assessed, and you cannot fund what you cannot describe. Most organizations skip this step, or shortcut it. They plan from the policy manual, from what the last audit said two years ago, or from what leadership believes to be true based on how the program looked when it was built. None of those sources reflect current state. They reflect a version of the program that may no longer exist. Why Assessment Has to Come First A governance investment sized against the wrong starting point fails in predictable ways. It underfunds a gap nobody realized had grown that large. It overfunds a capability that was already further along than assumed. It sequences work in the wrong order, addressing a visible symptom before the structural issue underneath it. And when the investment is reviewed for renewal, the numbers do not hold up, because they were never built on an accurate baseline to begin with. Assessment is not a formality that precedes the real work. It is the foundation the rest of the plan stands on. Skipping it does not save time. It moves the cost of getting the baseline wrong to a later point in the process, where it is more expensive and more visible to fix. What a Maturity Lens Actually Looks At A useful governance maturity assessment does not ask whether policies exist. Most organizations already have retention schedules, classification frameworks, and disposition policies on paper. The more revealing question is whether those policies are executed consistently, across business units, systems, and data types, or whether execution depends on which team happens to be paying attention this quarter. That distinction points to the dimensions worth assessing directly: whether retention practice matches documented policy in the systems that actually hold the data; whether the organization has visibility into what data exists and where, particularly outside the systems that were built with governance in mind; whether ownership and accountability for governance outcomes are assigned to specific roles, or diffused across a committee that meets quarterly; and whether the technology in place enables consistent execution, or requires manual effort to compensate for what the systems cannot do on their own. Each of these can be scored honestly, on a simple scale from ad hoc to managed to consistently operational, without turning the exercise into a multi-month audit. The goal is a clear, defensible picture, not an exhaustive one. Consider a retention schedule that looks complete on paper but is enforced in only two of the twelve systems that hold the data it covers. A policy review alone would score that program well. A maturity assessment focused on execution would score it accurately: strong on documentation, weak on operational consistency, and exposed everywhere the schedule is not actually applied. That is the gap planning season needs to see. The Honesty Problem The hardest part of this exercise is rarely technical. It is organizational. Teams that have worked hard to manage around a gap tend to describe that gap as smaller than it is, not out of dishonesty, but because the workaround has become normal. A retention schedule enforced manually by one diligent records manager looks, from a distance, like a functioning program. It is not the same as a program that would keep functioning if that person left tomorrow. An accurate assessment must separate what the organization has documented from what would happen under audit, litigation, or a regulatory inquiry. That separation is uncomfortable to surface internally. It is far more comfortable to surface it now, during planning, than to have it surface itself later, during an incident. A Practical Way to Locate Gaps The most useful version of this assessment is one leadership can act on, not one that sits in a binder. That means keeping it focused on a small number of dimensions, scoring each one against current practice rather than stated policy, and pairing every gap identified with a plain description of what it costs the organization to leave unaddressed. A gap without a cost attached rarely survives the next round of budget prioritization. It also means resisting the instinct to assess everything at once. A maturity lens applied narrowly to the areas most exposed to risk or most central to the next planning cycle, produces a picture leadership can use immediately. A maturity lens applied everywhere produces a report that takes months to finish and arrives after the budget conversation has already happened without it. The assessment also works best as a shared exercise rather than a single function’s report. Legal sees exposure that IT does not. IT sees where data lives in ways records management assumptions often miss. Business units know where workarounds have quietly become standard practice. Bringing those perspectives together before the numbers go to leadership produces a picture that holds up when it is questioned, rather than one that unravels the first time someone outside the exercise looks closely at it. What This Sets Up An honest maturity picture does more than support a smarter plan. It becomes the evidence base for everything that follows in this series: the cost of the status quo, the business case that gets funded, and the roadmap leadership can approve with confidence. Every one of those depends on starting from where the organization really is, not where it was assumed to be. The Bottom Line Planning season rewards organizations that show up with an accurate picture of their own governance program, not the most polished one. An honest maturity assessment, focused on execution rather than policy language, gives leadership something they can act on and something the program can be held to later. That is a stronger position than a confident guess, and it is the only foundation a governance investment can be built on. Next in the series: The Real Cost of the Status Quo, a practical look at what unaddressed governance gaps are already costing
The Governance Conversation Nobody Schedules Until It’s Too Late
LEXSHIFT BLOG SERIES: THE GOVERNANCE INVESTMENT: PLANNING AND FUNDING FOR THE YEAR AHEAD Week 1 of 12 Most governance programs are not planned. They are triggered. An audit finding surfaces a retention gap that should have closed years ago. A breach investigation reveals that nobody can say with confidence what data exists, where it lives, or why it is still there. A litigation hold turns into a six-month search because the organization never built the infrastructure to answer basic questions about its own records. In each case, governance gets funded, eventually, after the cost has already been paid in a different form. This pattern is familiar to nearly everyone who has worked in information governance, records management, or compliance. It is also avoidable. Planning season, the annual window when budgets are built and priorities are set for the year ahead, offers a predictable chance to plan and fund governance before an incident drives the decision. A Timing Problem, Not an Awareness Problem The gap between knowing and funding shows up the same way in most organizations. Legal flags the retention exposure. IT flags the volume of unstructured data with no clear owner. Compliance flags the audit finding that never fully closed. Each function raises the issue on its own timeline and competes against other priorities that already have a budget line and a sponsor. Without a coordinated case, governance often loses that competition because it reaches the table without a clear, fundable plan. The gap is rarely about awareness. Most legal, compliance, and IT leaders already know their retention practices are inconsistent, that structured and unstructured data have grown faster than any plan to manage them, and that AI initiatives are advancing without the governance foundation to support them safely. The knowledge exists. What is usually missing is a process that turns that awareness into a funded plan before an incident forces the issue. Reactive funding carries a cost beyond the incident itself. It compresses a program that should be built deliberately into a response that has to move immediately. Governance becomes crisis management instead of infrastructure, and point solutions are often built to close a single gap quickly without creating a program that can hold up over time. Why This Series, and Why Now Publishing this series from late summer into fall is intentional. It lines up with the planning and budget cycles most organizations are already running. The goal is practical: to give readers language and frameworks they can use directly to build the internal case for governance. This series is a guide to that work: assess honestly, prioritize what matters most, build the case in terms leadership can act on, and sequence the work into a program leadership can approve and sustain beyond the first year. It then applies that same discipline to the newest pressure on the data environment: AI and the governance foundation it needs to scale responsibly. This builds directly on the previous series, which made the case for treating retention as infrastructure instead of a project with an end date. That foundation is the starting point here. This series picks up the next question: how do you plan and fund the program needed to put that foundation into practice? From there, we will look at extending it across the broader data environment and, ultimately, into AI. What Honest Assessment Requires None of this works without an honest look at where the organization stands. Not where the policy says it stands. Not where it stood at the last audit. Where it stands today, across retention practice, data visibility, and the operational discipline to execute consistently rather than in pockets. That assessment can be uncomfortable for organizations that have managed around gaps instead of closing them. It is worth doing anyway. A governance investment based on an inflated view of the current state will be sized and sequenced incorrectly, making it difficult to defend when renewal comes up. An accurate assessment gives the investment a far better chance of being funded, sustained, and credited when it works. The second article in this series focuses on that work. It provides a practical assessment leaders can use to identify gaps and gauge readiness before taking a plan or dollar figure to leadership. What This Means for Planning Season For organizations heading into budget cycles this fall, the opportunity is straightforward. Planning season already asks every function to make its case for the year ahead. Governance can enter that conversation with a clear picture of its current state, a cost-of-inaction baseline, and a sequenced roadmap. Waiting leaves the next incident to make the case and set the timeline. This is also the moment to bring retention, unstructured data, and AI readiness into a single conversation. A shared foundation and sequenced plan strengthen the case for investment and make the program easier to sustain once it is approved. The weeks ahead in this series will work through each part of that path: assessing the current state, quantifying the cost of the status quo, prioritizing where risk and value are highest, building the business case, sequencing the roadmap, budgeting for people, process, and technology, proving the investment works, and sustaining it beyond year one. The series closes by applying that same discipline across the broader data environment and into AI, where the strongest investment is often the governance foundation beneath it. The Bottom Line Governance does not have to wait for a crisis to get funded. Planning season is the window to make that case proactively, with a clear-eyed assessment, a defensible cost baseline, and a roadmap leadership can actually approve. The organizations that use this window well spend the rest of the year executing a plan. The ones that do not spend it responding to whatever surfaces next. Next in the series: Know Where You Stand: Assessing Governance Maturity Before You Plan. The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.
Why Late Summer Is the Right Time to Plan for Governance
We recently closed a series with a simple idea. Retention, and operational governance more broadly, is becoming infrastructure. Foundational, continuous, and something the rest of the business depends on. Infrastructure has one defining characteristic that is easy to overlook. It is planned. It is budgeted. It is built on purpose, ahead of need, rather than assembled in a hurry after something breaks. Which raises a timely question. If governance is becoming infrastructure, when should you plan for it? For most organizations, the answer is now. Governance Rarely Makes the Budget on Time For a lot of organizations, late summer into early fall is when planning for the year ahead begins. Priorities are set. Budgets take shape. Cases are made for where next year’s investment should go. Governance often misses that window. Not because it does not matter, but because it competes with initiatives that feel more urgent and are easier to quantify. Governance tends to enter the budget conversation later, and usually for the wrong reason: an audit finding, a regulatory inquiry, a breach, or a piece of litigation that exposes a gap. By then, the conversation has changed. You are no longer planning an investment. You are justifying a scramble. Planning Ahead Changes the Conversation There is a meaningful difference between funding governance proactively and funding it reactively. Reactive funding happens under pressure. The scope is set by whatever went wrong. The timeline is compressed. The spending is defensive. Proactive funding happens on your terms. You get to frame governance as a strategic investment, tie it to business priorities, and sequence it sensibly. You can make the case with evidence rather than urgency. The difference is largely a matter of timing. And the timing is set by the planning calendar, which is why late summer matters. Why This Year in Particular Two forces make the case more pressing than usual. The first is data. Volumes keep growing, information keeps spreading across more systems, and regulatory expectations keep expanding. The cost of an unmanaged information environment compounds quietly, year over year. The second is AI. Responsible adoption depends on being able to answer basic questions about your information: what you have, how it is classified, and how long it should be kept. Organizations that want to move on AI next year will find that the governance foundation underneath it is not optional. It is a prerequisite. Both are planning problems before they are execution problems. They are far easier to address in a budget cycle than in a crisis. What Starting Now Looks Like Planning for governance does not mean committing to a large program overnight. It means using this window to get ready to make the case. A few practical starting points: None of these require a budget to begin. They require time, and time is exactly what the planning season provides. A Closing Thought: Build It Before You Need It Infrastructure is not something you improvise. You plan it, fund it, and build it before the moment you depend on it arrives. Governance is no different. The organizations that treat it as a deliberate investment, planned into the cycle rather than forced by an incident, are the ones that enter each year with a foundation they can build on. Late summer is when that planning starts. It is a good time to bring governance into the conversation, while there is still room in the plan to do it well. Over the coming weeks, we will explore how to do exactly that: how to assess, prioritize, fund, and sustain a governance program built for the year ahead. If governance is on your roadmap for next year, this is the moment to start shaping it. The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.
You Do Not Have Governance, You Have Documentation
Ask most organizations with an IG program if they have governance over their information, and the answer is yes. There’s a policy. There’s a retention schedule. There’s a framework, usually well written, sometimes benchmarked against a recognized standard, occasionally reviewed by outside counsel. By any reasonable definition of “having governance in place,” the box gets checked. None of that is governance. It’s documentation. Governance is what happens after the document is written, when a person somewhere in the organization makes a decision about a piece of information and that decision matches what the document says should happen. Too often, it doesn’t, and most organizations don’t find out until something forces the question. The current state Gartner estimates that 80 percent of organizations trying to scale digital business will fail because they lack a modern, execution-led approach to data and analytics governance, not because they lack policies. Separately, surveys of data management professionals consistently find that even among organizations with a formal governance program already in place, data quality and governance issues remain among their biggest ongoing challenges. The pattern is consistent across the industry: the documentation exists almost everywhere. The execution not so much. That gap isn’t really about effort. Most governance teams work hard, and most policies are reasonably well constructed. The problem is that a policy describes an intention, and intentions don’t enforce themselves. A retention schedule says how long a category of content should be kept. It doesn’t move that content into the right folder, apply the right label, or delete it on schedule. A person, or a system acting on that person’s behalf, must do that, every time, across every system where the content lives. The observation This is the distinction that gets lost in most governance conversations: a document is a statement of what should happen. Governance is the process that executes what’s in the documents and preserves the evidence of what happened. Those are not the same thing and treating them as interchangeable is how organizations end up confident about their governance posture right up until an audit, a breach, or a discovery request asks them to prove it. The confidence is usually genuine, which is what makes the gap dangerous. Leadership reviews the policy, sees that it’s thorough, and reasonably concludes the organization is in good shape. Nobody in that review is lying or cutting corners. They’re evaluating the wrong artifact. A well-written policy tells you what good behavior looks like. It tells you nothing about whether that behavior is occurring across the thousands of daily decisions people make about where information goes, who has access to it, how long it stays, and when it gets deleted. Why this happens Documentation is easier to produce than execution, and it’s easier to measure. A policy has a clear finish line: it gets drafted, reviewed, approved, and published. Execution doesn’t have a finish line. It’s an ongoing operational discipline that must hold up across every system, every team, and every new employee who never read the policy in the first place. Organizations naturally gravitate toward the work that can be finished and signed off on, and governance documentation fits that description far better than governance operations do. There’s also an accountability problem underneath this. Writing the policy usually belongs to one team, records management, legal, or a governance committee. Following the policy belongs to everyone else, spread across every department, none of whom were involved in writing it and few of whom have any real incentive to prioritize it over their actual job. Nobody owns the gap between the document and the daily decision, so the gap persists. Why this matters The moment this gap becomes visible is rarely convenient. It shows up during litigation, when opposing counsel asks whether the retention schedule was actually followed and the honest answer is “inconsistently.” It shows up during a regulatory exam, when an examiner asks for evidence that a control was operating, not just that a policy described the control. It shows up during a breach investigation, when the organization discovers that sensitive data was sitting in a location the policy explicitly said it shouldn’t be. In each of these cases, the organization isn’t caught because it lacked governance intentions. It’s caught because the intentions and the reality had quietly diverged, sometimes for years, without anyone measuring the distance between them. The document held up fine under review. The operation underneath it didn’t. Common mistakes A few habits show up repeatedly in organizations that mistake documentation for governance. The most common is treating policy approval as the finish line for a governance initiative, rather than the starting point for an operational one. A close second is measuring governance maturity by the quality of the written policy rather than by evidence of how consistently it’s been followed. A third is assuming that training people on a policy is the same as building a system that makes the right behavior the easy behavior. And a fourth is reviewing the policy on a regular cycle while never actually testing whether real-world practice still matches it. The recommendation Closing this gap requires treating execution as its own workstream, with its own accountability, rather than as something that automatically follows once the policy is published. Assign explicit ownership for operational compliance, separate from ownership of the written policy. The person or team accountable for whether the retention schedule is being followed should not be the same as, or subordinate to, the team that simply drafted it. Build measurement directly into the program. Sample actual practice against the documented policy on a regular basis, the same way an internal audit function would, rather than assuming compliance because the policy exists and training was delivered. Where possible, move enforcement into the systems people already use, so following the policy is the default behavior rather than something an individual has to remember to do correctly every time. This is where classification, automated retention triggers, access reviews, and workflow-based controls do more good than another round of policy training. Report on execution, not just documentation, to leadership. A governance update that only covers policy status gives leadership a false sense of where the organization stands. A governance update that includes evidence of operational compliance gives them something they can rely on. What this looks like when it works A mature governance program doesn’t necessarily look different on paper. It looks different in what leadership can point to when someone asks a hard question. Instead of
AI Governance Is Now Judged by Evidence, Not Principles
Many organizations already have the beginnings of an AI governance program. There’s an acceptable use policy, a responsible AI statement, maybe a committee that meets quarterly to talk about risk. For some time now, that’s been enough to say the organization “has AI governance.” That’s changing, and it’s changing faster than most governance programs have adjusted for. The shift isn’t about whether organizations have the right principles written down. Most do. It’s about whether they can prove, on demand, that those principles were followed for a specific system, on a specific date, by a specific person. The current state Regulators, auditors, and courts are no longer satisfied with a policy document. They want to see documented processes and evidence: risk assessments for specific systems, logs of human review, records showing who approved a given use of AI and when. The EU AI Act’s transparency requirements, state AI laws working through legislatures across the country, and the broader shift toward mandatory compliance frameworks all point the same direction. AI governance in 2026 is being judged by evidence of what really happened, not by the quality of the principles written down in advance. That’s a meaningful shift in what “good governance” requires. A well-written policy used to be most of the job. Now it’s the starting point. An organization can have a strong acceptable use policy, a responsible AI committee, and a public commitment to ethical AI, and still fail an audit, because none of those things produce a record that a specific system was reviewed, approved, and monitored the way the policy said it would be. The artifacts regulators are asking for are specific: model risk assessments, data protection impact analyses, logs showing a human reviewed a high-stakes output before it was used, and a record of who signed off on a system before it went into production. These aren’t new concepts. Most of them have existed in some form in financial services model risk management or in privacy impact assessments for years. What’s new is the expectation that this kind of documentation exists for AI systems specifically, at the pace those systems are being adopted. The observation This shift exposes a structural problem that most organizations haven’t addressed: no single function wholly owns the full evidence trail for AI governance. Legal typically owns risk interpretation and regulatory response. IT owns the tools themselves, along with access and usage logs. Privacy owns questions about what data an AI system touches. Records management and information governance own retention, classification, and the underlying question of what must be kept and for how long. Each of these functions holds a piece of what a regulator or a court would eventually ask for. None of them holds the whole thing. That fragmentation doesn’t show up as a problem day to day. Everyone is doing their job. It shows up the moment someone asks a specific question: show me that this AI system was reviewed before deployment, show me who approved it, show me that a person exercised oversight over its output. Answering that requires pulling evidence from four different functions that don’t currently coordinate around a shared record. Why the gap exists This isn’t a failure of any one team. It’s a byproduct of how these functions were built in the first place. Legal, IT, privacy, and information governance each grew up around a different mandate, at different points in time, usually well before AI was a factor. Legal’s processes were built around litigation and regulatory response. IT’s were built around uptime, security, and access control. Privacy’s were built around personal data handling, largely in response to GDPR and its successors. IG’s were built around retention schedules and regulatory obligations that predate AI by decades. When AI arrived, most organizations didn’t redesign ownership across these functions. They added AI-related tasks to each function’s existing workload instead: legal reviews new AI vendor contracts, IT manages access to AI tools, privacy assesses data flows into AI systems, IG and Records figure out what to keep. That’s a reasonable short-term response, but it means the evidence produced by each function was never designed to connect to the others. Nobody owns the seam between them, and the seam is exactly where regulators are now looking. Why this matters The organizations that struggle here aren’t the ones without governance. They’re the ones with governance spread across departments that each did their part correctly, without anyone responsible for assembling the whole picture. When a regulatory inquiry or a discovery request lands, what should be a straightforward production often becomes a multi-week scramble to reconstruct a history that was never centrally documented in the first place. This is the same pattern that shows up in other parts of information governance: policy defines the rules, but nobody has ownership of proving the rules were followed. The difference with AI is that the number of systems, the pace of adoption, and the specificity of what regulators are asking for all make that gap far more expensive to leave unaddressed. A single ungoverned shared drive is a cleanup project. A portfolio of AI systems without a documented evidence trail is a recurring exposure that grows every time a new tool gets adopted. Common mistakes A few patterns show up consistently in organizations that get caught flat-footed. The most common is assuming that committee minutes or a policy sign-off count as evidence of ongoing oversight, when what’s needed is a record tied to a specific system, not a general statement of intent. A close second is treating evidence collection as one department’s responsibility rather than a shared obligation with defined handoffs, which is exactly the fragmentation problem described above. A third is building the evidence trail reactively, after an incident or an inquiry, rather than as a standing part of how new AI tools get adopted. And a fourth is assuming that because a system was reviewed once at launch, that review still reflects how the system is being used a year later. The recommendation Closing this gap starts with ownership, not with more policy. Assign a single accountable role, not necessarily a new department, but one function responsible for assembling and maintaining the complete evidence trail for each AI system in use. This role doesn’t need to do the underlying work of every other function; it needs the authority and the mandate to pull the pieces together and know when something is missing. Map which function currently owns each type of evidence: risk assessments with legal, usage logs
Retention as Infrastructure: Why Operational Governance Is Becoming a Foundational Enterprise Capability
This series began with a simple claim. If information governance exists only in policy, it is not really governance. From there, we followed a single thread: what it actually takes to move retention from documentation to practice. Across every topic, from structure and consistency to AI, defensibility, disposition, and visibility, the same conclusion kept surfacing. Governance only works when it becomes operational. This final piece is about where that leads. Because when retention becomes truly operational, it stops being a compliance artifact and starts becoming something more foundational. It becomes infrastructure. The Path From Document to System It is worth retracing the path briefly, because the destination only makes sense in light of the journey. We started by separating documentation from governance. A policy describes intent. On its own, it does not control information. We looked at why spreadsheets cannot carry that weight, and why retention has to move from a static document to a structured system. We examined execution: applying policy consistently across systems, maintaining it across jurisdictions, and governing information created and processed by AI. We explored what makes governance defensible: tracking decisions, managing change over time, and closing the loop through disposition. And we made the case that visibility is a form of control, that structure is the foundation, that a good platform supports governance as a capability, and that an operating model is what makes all of it stick. Each topic approached the problem from a different angle. Each arrived at the same place. Retention has to function as a system, not a document. What “Infrastructure” Really Means Calling retention infrastructure is not a figure of speech. Infrastructure is the set of foundational systems that everything else quietly depends on. Roads. Power. Networks. Inside an enterprise, it includes financial controls, security, and data architecture. Infrastructure shares a few defining traits. It is foundational, because other capabilities are built on top of it. It is continuous, because it operates all the time rather than in bursts. And it is largely invisible when it works, noticed mainly when it fails. Retention is beginning to fit that description. Done well, it runs quietly beneath the organization, supporting compliance, risk management, and increasingly the responsible use of information. Done poorly, the failure eventually becomes visible, often at the worst possible moment. Why Retention Is Becoming Foundational Now Retention has always mattered. What has changed is how much now depends on it. Data volumes continue to grow. Information is spread across more systems than ever. Regulatory expectations keep expanding. And AI has introduced both new kinds of information and new speed at which information is created and processed. In that environment, ad hoc retention does not just create inefficiency. It undermines the things built on top of it. Consider AI. Responsible adoption depends on understanding what information exists, how it is classified, and how long it should be kept. An organization that cannot govern its information consistently cannot confidently feed that information into AI systems, or explain the results afterward. Retention, in other words, has moved upstream. It is no longer only a downstream compliance task. It is becoming a precondition for doing other things well. Infrastructure Is Built, Not Declared There is an important implication in all of this. You do not get infrastructure by writing a better policy or buying a tool. Infrastructure is built deliberately, over time. That is what this series has really been describing. Structure gives retention a durable foundation. A platform gives it a place to operate. An operating model gives it ownership, decisions, and process. Visibility gives it accountability. Together, these elements turn retention from a document into a dependable system. None of it happens by declaration. It is the result of sustained, coordinated work across legal, compliance, records, IT, and the business. A Shift in How Organizations Think Perhaps the biggest change is one of mindset. For a long time, retention was treated as a periodic obligation. A schedule to be written, approved, and revisited occasionally. Something to satisfy an auditor. Treating retention as infrastructure reframes the question. It is no longer simply “Do we have a retention schedule?” It becomes “Does our retention function as a system the enterprise can rely on?” That is a higher standard. It is also the standard that modern data environments increasingly demand. A Closing Thought: Governance That Holds Up This series has made one argument in many forms. Governance becomes real when it becomes operational. Retention is where that idea becomes concrete. It is one of the most established elements of information governance, and one of the most difficult to operationalize at scale. That is exactly why it is such a clear test of whether governance is actually working. When retention is treated as infrastructure, built on structure, supported by the right platform, and sustained by a real operating model, it becomes something an organization can depend on. It supports compliance. It reduces risk. It enables responsible innovation. And it holds up under scrutiny. The organizations that recognize this are not just improving a compliance process. They are building a foundational capability that will shape how well they adapt to whatever comes next. At LexShift, this is the work we care about most: helping organizations turn governance intent into operational practice, so that retention becomes not just a document they maintain, but a foundation they can build on. The conversation does not end here. It moves to what organizations choose to build on top of that foundation. The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.
Operational Governance Platforms: What “Good” Looks Like
In the last post, we made the case that retention schedules need structure—that operational governance depends on managing retention as connected information rather than static text. That raises a practical question. If structure is the foundation, what should an organization look for in a platform built to support it? It is an increasingly common question. As more organizations move away from spreadsheets and toward dedicated tools, the options have multiplied. Nearly everyone promises to modernize governance. But “good” is not always easy to define. Most evaluations focus on features. The more useful question is whether a platform lets governance function as an operating capability—consistently, defensibly, and at scale. A long list of capabilities does not make a platform effective. What matters is whether it supports the way governance works. Start With the Right Question It is tempting to evaluate platforms by comparing capabilities. Side-by-side feature charts. Checklists. Long lists of what each tool can technically do. Features are easy to compare. They are also easy to overweight. A platform can offer an impressive set of capabilities and still fail to support governance in practice, because the real test is not what a tool can do. It is whether it helps an organization apply policy consistently, maintain it over time, and explain it when asked. So, the better question is not “What can this platform do?” It is “Does this platform let our governance program operate?” With that question in mind, a few characteristics consistently separate effective platforms from the rest. 1. It Treats the Schedule as a System, not a File The most important quality is also the least visible. A good platform manages the retention schedule as a structured system, with a single authoritative source and clear relationships between categories, rules, jurisdictions, and the requirements behind them. This is the difference between a tool and a better-looking spreadsheet. If a platform simply digitizes the document without making the underlying information connected and maintainable, it inherits the same limitations the organization was trying to escape. Structure is the foundation everything else depends on. 2. It Keeps Pace with Changing Requirements Retention is not static. Regulations change, business operations evolve, and new systems appear. A platform that cannot absorb that change gradually drifts out of alignment with reality. Good platforms make change manageable rather than disruptive. They track what changed, when, and who approved it. They preserve the history behind each decision. And they keep retention requirements current as regulatory obligations shift, rather than leaving that burden entirely to manual research. A schedule that reflects last year’s requirements is not defensible, no matter how well it is structured. 3. It Scales Without Multiplying Complexity Many tools work well in a single environment and break down across a global enterprise. As jurisdictions, business units, and data sources accumulate, the schedule either fragments into duplicate versions or becomes too complex to maintain. A strong platform absorbs that complexity instead of passing it on. It allows global standards and local variations to coexist within one model, so the organization can manage difference without duplicating effort. The goal is not to eliminate complexity. It is to keep it from becoming unmanageable. 4. It Connects to Where Information Lives A retention schedule only matters if it reaches the information it governs. Policy that cannot connect to real data environments stays theoretical. Good platforms are built to integrate, providing a path from defined policy to applied execution across the systems where information resides. The platform that holds the rules and the layer that applies them across data should work together rather than in isolation. Integration is what turns a schedule from a reference into a control. 5. It Makes Governance Visible Governance that cannot be observed cannot be proven. As we explored earlier in this series, visibility is itself a form of control. Effective platforms make governance measurable. They show where policy has been applied and where it has not, surface exceptions rather than burying them, and give stakeholders a clear view of how the program is performing. This visibility supports defensibility. It allows an organization to demonstrate, with evidence, that governance is actively managed rather than simply documented. 6. It Is Usable by the People Who Depend on It A platform can be powerful and still fail if only a few specialists can use it. Governance involves legal, compliance, IT, records teams, and the business, and many of the people who need answers are not governance experts. Good platforms are usable across the organization. They make retention guidance easy to find, easy to understand, and easy to act on. Adoption is not a secondary concern. A platform that sits unused provides no governance value at all. Beware the Feature Trap It is worth naming the most common evaluation mistake. Some of the most capable-looking platforms end up underused, while simpler tools that fit how an organization works deliver more value. Capability is not the same as fit. The objective is not to acquire the longest list of features. It is to support a governance program that operates consistently and holds up under scrutiny. The questions that matter are practical ones: Will this be maintained? Will it be used? Will it help us explain our decisions later? What This Looks Like in Practice These principles are the same ones that shaped how we built mosaIQ Orchestrate. It was designed to manage retention as a structured, defensible system rather than a document, to keep policy aligned with current requirements across jurisdictions, and to remain usable across the organization as programs scale. Paired with execution across data environments, that structure becomes the bridge between policy and practice. But the underlying point is broader than any single tool. Whatever platform an organization chooses, the test is the same. A Closing Thought: Good Platforms Disappear into the Work The best operational governance platforms are not the ones with the most visible features. They are the ones that quietly do their job—keeping policy current, consistent, and explainable while supporting the business rather than slowing it down. Much like the structure that holds together any complex operation, a good platform tends to go unnoticed when it is working. It becomes part of how the organization functions, not a system people have to work around. That is what “good” looks like.
Visibility as Control: Monitoring Governance at Scale
Governance is often measured by what organizations define. Policies are written. Retention schedules are approved. Procedures are documented. Controls are established. But governance is not proven through documentation. It is proven through visibility. Organizations cannot effectively govern information they cannot see, cannot measure, or cannot explain. As data volumes continue to grow and information spreads across systems, repositories, and jurisdictions, visibility becomes one of the most important capabilities in a mature governance program. Without visibility, governance relies on assumptions. With visibility, governance becomes operational. The Challenge of Scale Most governance programs begin with a relatively straightforward objective: define how information should be managed. As organizations grow, the challenge shifts. Information exists across cloud platforms, collaboration tools, shared drives, enterprise applications, email systems, archives, and legacy environments. New repositories emerge while older systems remain in operation. Business units adopt new technologies. Data moves between platforms and jurisdictions. The governance framework may remain centralized. The information environment does not. As complexity increases, it becomes more difficult to answer basic governance questions. The inability to answer these questions consistently creates risk. You Cannot Govern What You Cannot See Many organizations assume governance controls are working because policies have been defined and responsibilities assigned. That assumption is often difficult to validate. Without visibility into information assets and governance activities, organizations may have limited understanding of: Governance programs frequently discover gaps only after a regulatory inquiry, audit, litigation event, or security incident exposes them. At that point, the absence of visibility becomes apparent. Visibility Creates Accountability One of the most important benefits of visibility is accountability. When governance activities can be observed, measured, and reported, stakeholders gain a clearer understanding of their responsibilities and performance. Information governance teams can identify inconsistencies. Legal and compliance teams can evaluate risk. Technology teams can monitor implementation. Business leaders can understand how governance objectives align with operational realities. Visibility turns governance from a policy exercise into a management discipline. It creates a shared understanding of what is happening and where attention is required. Monitoring Is Not the Same as Governance Organizations sometimes equate monitoring with governance. They are related, but not identical. Monitoring provides information. Governance provides direction. Dashboards, reports, and metrics can highlight issues, but they do not resolve them. Visibility is most valuable when it supports decision-making and action. A governance program should be able to identify where controls are operating effectively, where gaps exist, and what corrective actions are necessary. Monitoring creates awareness. Governance creates accountability and response. The Importance of Exception Management No governance program operates without exceptions. Legal holds may suspend disposition. Business requirements may justify extended retention. Regulatory obligations may create jurisdiction-specific variations. The existence of exceptions is not a problem. The inability to identify and manage them is. Visibility allows organizations to distinguish between intentional deviations and unrecognized governance failures. It provides context for why certain decisions were made and whether those decisions remain appropriate. At scale, exception management becomes a critical governance capability. Organizations need to know not only where policies are being followed, but also where they are not and why. Metrics That Matter Governance programs often collect large amounts of information but struggle to identify meaningful measures. Effective governance metrics should support decision-making rather than simply reporting activity. Examples may include: The goal is not to create more reporting. The goal is to create insight. Metrics should help organizations understand whether governance objectives are being achieved and where intervention may be necessary. Visibility Supports Defensibility Earlier in this series, we explored the importance of defensibility. Visibility plays a critical role in that effort. Organizations are increasingly expected to demonstrate how governance decisions are implemented and monitored over time. Auditors, regulators, courts, and business stakeholders often want evidence that governance controls are operating as intended. Visibility provides that evidence. It helps organizations demonstrate not only that policies exist, but that governance activities are actively managed and monitored. Defensibility depends on more than documentation. It depends on awareness and oversight. Governance Requires Continuous Observation Governance is not a point-in-time activity. It is an ongoing process. Information environments continue to evolve. New systems are deployed. Regulatory requirements change. Business processes adapt. AI introduces new information flows and governance considerations. Visibility helps organizations keep pace with this change. Rather than relying on periodic reviews alone, mature governance programs establish mechanisms for ongoing observation and evaluation. This creates a more dynamic and resilient governance model. From Assumption to Evidence One of the most important transitions in governance maturity occurs when organizations move from assumptions to evidence. Instead of assuming retention policies are being applied, they can verify it. Instead of assuming disposition is occurring appropriately, they can measure it. Instead of assuming governance controls are effective, they can demonstrate it. Visibility enables this shift. It transforms governance from something that is believed to be working into something that can be proven. ⸻ A Closing Thought: Visibility Is a Governance Control Organizations often think of visibility as a reporting function. It is a governance control. Visibility enables accountability. It supports defensibility. It identifies risk. It informs decision-making. It helps ensure that policies are translated into operational outcomes. As information environments become more complex, visibility becomes increasingly important. You cannot govern what you cannot see. And the ability to see, understand, and act is what ultimately allows governance to scale. Next in the series: Why Retention Schedules Need Structure: The Case for Database-Driven Governance. The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.
From Policy to Action: Why Disposition Remains One of the Hardest Parts of Operational Governance
Most organizations have retention schedules. Many have documented policies, established governance frameworks, and clearly defined retention requirements. Yet when it comes to disposition, the story often changes. Information that should be deleted remains in place. Repositories continue to grow. Legacy data accumulates. Retention periods expire without action being taken. The challenge is not usually a lack of policy. It is the difficulty of turning policy into action. Disposition remains one of the most challenging aspects of information governance because it is where governance moves from planning and documentation into operational execution. And execution is where complexity becomes visible. Retention Defines Intent. Disposition Executes It. A retention schedule establishes how long information should be maintained. Disposition is the process that follows. In theory, the relationship is straightforward. Information reaches the end of its retention period and appropriate action is taken. Records are destroyed, archived, or transferred according to policy and regulatory requirements. In practice, it is rarely that simple. By the time disposition decisions need to be made, information may reside across multiple systems, repositories, and jurisdictions. Ownership may be unclear. Classification may be inconsistent. Legal holds may exist. Business stakeholders may be reluctant to approve deletion. The retention policy remains clear. The operational path forward often does not. Organizations Tend to Be Better at Retaining Than Disposing Many organizations have developed strong processes for preserving information. The same cannot always be said for disposition. Part of the challenge is cultural. Deleting information can feel riskier than keeping it. Teams worry about removing something that may be needed in the future. Business users often view retention as protection and disposition as exposure. As a result, organizations frequently default to preservation. Data remains in place because the risk of deletion feels more immediate than the risk of over-retention. Unfortunately, that assumption is often incorrect. Information retained beyond its required lifecycle can increase legal, regulatory, privacy, and cybersecurity risk. It can also increase storage costs and reduce visibility into what information actually matters. Keeping everything is not a governance strategy. It is often a governance failure. Disposition Requires Confidence One reason disposition is difficult is that it requires confidence in the underlying governance framework. Organizations must be confident that: If confidence in any of these areas is lacking, disposition often stalls. The issue is rarely the disposition process itself. It is uncertainty about the decisions that support it. The Visibility Problem Disposition depends on understanding what information exists, where it resides, and how it is governed. Many organizations struggle with this level of visibility. Information may be distributed across shared drives, cloud repositories, collaboration platforms, email systems, and legacy applications. Duplicate content may exist in multiple locations. Ownership may be fragmented or unclear. Without visibility, disposition becomes difficult to execute with confidence. Organizations may know what their retention schedule requires while having limited understanding of which information is eligible for action. This disconnect is common. It is also one of the primary reasons disposition programs fail to scale. Manual Processes Create Friction Disposition often depends on manual processes. Lists are generated. Stakeholders review content. Approvals are requested. Exceptions are documented. Decisions are revisited. These activities may be necessary, but they also introduce delay. As data volumes increase, manual processes become increasingly difficult to sustain. Backlogs grow. Reviews take longer. Governance teams spend more time managing exceptions than executing disposition. Eventually, the process becomes so burdensome that action slows to a crawl. The retention schedule remains active. The disposition program does not. Disposition Is a Cross-Functional Process Disposition is not solely an information governance responsibility. Legal, compliance, records management, privacy, cybersecurity, technology, and business stakeholders all have a role to play. Legal teams evaluate hold requirements and litigation risk. Compliance teams assess regulatory obligations. Technology teams support execution. Business owners provide operational context. Without coordination, disposition becomes fragmented. One group may be ready to proceed while another lacks the information necessary to make a decision. Effective disposition depends on alignment across these functions. Defensibility Matters at the Point of Action Earlier in this series, we discussed the importance of tracking, versioning, and explaining retention decisions. Disposition is where that work becomes particularly important. Organizations should be able to explain: This documentation supports defensibility. Disposition should never appear arbitrary. It should reflect a clear and repeatable governance process. The ability to explain why information was deleted can be just as important as the ability to explain why it was retained. Operational Governance Closes the Gap Many retention programs stop at policy. Disposition requires moving beyond policy into execution. This is where operational governance becomes critical. Retention schedules must connect to information inventories. Classification frameworks must support consistent decision-making. Governance processes must provide visibility, accountability, and traceability. When these elements work together, disposition becomes more manageable. The goal is not simply deleting information. The goal is applying governance decisions consistently and defensibly throughout the information lifecycle. Disposition Is Where Governance Becomes Visible Many governance activities happen behind the scenes. Policies are developed. Retention periods are defined. Requirements are reviewed and documented. Disposition is different. It produces a visible outcome. Information is retained, archived, transferred, or removed. Governance decisions become tangible. The effectiveness of the program can be measured through action rather than documentation. This is why disposition often serves as the clearest test of governance maturity. Organizations that can dispose of information confidently and consistently typically have strong governance foundations. Organizations that cannot often discover weaknesses that were previously hidden. A Closing Thought: Governance Requires Action A retention schedule without disposition is incomplete. Policies define expectations. Retention establishes requirements. Governance provides structure. Disposition is where those elements become operational. It is also where many organizations encounter their greatest challenges. The path from policy to action is rarely simple, but it is essential. Governance ultimately depends not on what organizations intend to do with information, but on what they actually do. And disposition is where that difference becomes clear. Next in the series: Visibility as Control: Monitoring Governance at Scale. The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.
Retention Is Not Static: Managing Updates, Change Control, and Governance Over Time
A retention schedule is not a one-time deliverable. At least, it shouldn’t be. Many organizations invest significant time defining retention categories, aligning legal and regulatory requirements, and publishing formal schedules. Once approved, the schedule is treated as authoritative and complete. But governance does not stand still. Regulations evolve. Business operations change. Systems are introduced and retired. Data types expand. Organizational structures shift. AI introduces new workflows and new governance considerations. The question is not whether retention will need to change. It is whether governance processes are built to manage that change in a disciplined way. A Retention Schedule Reflects a Point in Time Every retention schedule represents a set of decisions made within a specific context. Applicable laws were interpreted based on current understanding. Business processes were evaluated as they existed at that moment. Information categories reflected the systems and workflows in place at the time. That context changes. A retention schedule that was accurate and defensible when published may become misaligned over time if it is not actively maintained. This is not a failure of the original work. It is the reality of governance. Retention schedules are not static reference documents. They are governance frameworks that require active stewardship. Change Happens From Multiple Directions Retention updates are not triggered by a single type of event. Legal and regulatory developments may introduce new requirements or alter existing obligations. Business units may launch new products, adopt new processes, or restructure how information is managed. Technology teams may implement new systems that change where data resides and how it is handled. Some changes are obvious. Others are gradual. A jurisdictional privacy update may require immediate review. A collaboration platform adopted informally by business users may introduce governance implications long before anyone formally addresses them. Without a structured process for identifying and evaluating change, governance drifts. Governance Drift Is a Real Risk One of the most common governance failures is not a missing policy. It is a policy that no longer reflects operational reality. A retention schedule may remain formally approved while business processes evolve around it. New repositories emerge. Legacy systems remain in use longer than expected. Retention categories no longer align neatly with how information is created or managed. Over time, the gap between documented policy and actual operations widens. Because the policy still exists, the problem may go unnoticed, creating a false sense of control. Governance drift is particularly dangerous because it often appears stable until scrutiny reveals otherwise. Change Control Is a Governance Discipline Retention updates should not be treated as informal edits. They are governance decisions. Changes to retention periods, category definitions, jurisdictional logic, or policy interpretation can affect compliance obligations, litigation exposure, privacy risk, and operational processes. That requires discipline. Effective change control should address: Without this level of rigor, retention changes may be made inconsistently or without sufficient oversight. Ad Hoc Updates Do Not Scale In many organizations, retention updates happen reactively. A regulatory issue triggers a revision. A business stakeholder requests a change. A governance team updates a spreadsheet and circulates a revised version. The immediate issue may be addressed. The broader governance problem remains. Ad hoc change management creates inconsistency. Different teams may act on different versions. Supporting rationale may be poorly documented. Related categories may be overlooked. Downstream operational impacts may not be considered. As governance complexity increases, informal update models become increasingly difficult to sustain. Operational Governance Requires Lifecycle Management Retention governance should be managed as an ongoing lifecycle. That means governance teams need repeatable processes for identifying change, evaluating impact, approving updates, and coordinating implementation. Lifecycle governance includes: This is not administrative overhead. It is how governance remains aligned with reality over time. Technology Can Support Discipline, But Process Comes First Technology can make change management significantly more effective. Structured governance platforms can improve version control, preserve historical decision-making, and create more disciplined workflows for review and approval. But technology alone does not solve governance drift. Without clear ownership, defined governance processes, and accountability for maintenance, even strong platforms become passive repositories. The objective is not simply documenting change. It is governing change. Retention Maintenance Is a Cross-Functional Responsibility Retention does not evolve in isolation. Legal teams monitor regulatory developments. Compliance teams assess control impacts. Information governance and records management teams structure policy updates. Technology teams evaluate implementation requirements. Business stakeholders provide operational context. If these groups are disconnected, governance updates become fragmented. Retention maintenance requires coordination. The strongest governance programs treat updates as cross-functional governance work, not isolated policy administration. A Mature Program Plans for Change Governance maturity is not measured by how polished a retention schedule looks when it is published. It is measured by how effectively the organization maintains it over time. Mature programs assume change will happen. They build governance structures designed to absorb that change without losing consistency, visibility, or defensibility. That is the difference between a static document and an operational governance capability. A Closing Thought: Governance Is a Continuous Process A retention schedule is not finished when it is approved… It enters a new phase of governance. Organizations that treat retention as a static deliverable will eventually find policy and practice drifting apart. Organizations that treat retention as a managed governance lifecycle are better positioned to adapt as regulations, technology, and business operations evolve. Retention is not static. Governance should not be either. Next in the series: From policy to action: why disposition remains one of the hardest parts of operational governance. The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.