By this point in the series, the framework is clear.
Information governance is broader than records management. It enables innovation rather than constraining it. It can be implemented through a phased strategy.
Technology makes enforcement consistent.
But even with structured systems in place, governance will not sustain itself without coordinated ownership.
This is where many firms encounter their most persistent challenge. They do not lack commitment. They lack clarity around responsibility.
The reality
Mid-sized firms rarely have a dedicated information governance department. Governance responsibilities are distributed across existing teams:
- IT manages infrastructure and system controls.
- Records oversees retention schedules and disposition workflows.
- Risk or Compliance interprets regulatory obligations.
- Finance tracks matter lifecycle from a billing perspective.
- Operations coordinates cross-departmental processes.
Each of these functions touches the information lifecycle, but no one owns it end-to-end.
That fragmentation is rarely intentional. It develops as firms grow organically. Systems are implemented at different times. Responsibilities evolve and new compliance expectations emerge.
Over time, governance becomes everyone’s concern - and no one’s direct accountability. So, execution weakens not because of resistance, but because of ambiguity.
Why shared ownership is necessary
Unlike many operational disciplines, information governance cannot sit entirely within one department.
IT cannot decide retention policy.
Records cannot enforce technical controls independently.
Risk cannot operationalize workflows without system alignment.
Finance cannot manage lifecycle discipline beyond billing status.
Governance sits at the intersection of all of them. Shared ownership is not a compromise — it is structural necessity and the challenge is making that shared ownership deliberate rather than informal.
Defining roles without creating bureaucracy
A sustainable governance model does not require new titles or additional layers of hierarchy. It requires clarity in three areas.
-
Who defines and maintains governance standards? This may sit with Risk or a Governance committee, but it must be explicitly assigned.
-
Who ensures system controls reflect policy? Typically, this involves coordination between IT and Records, supported by Operations.
-
Who monitors compliance metrics and reports them to executive leadership?
When these roles are defined, governance decisions stop drifting.
The executive layer: quiet but essential
Governance becomes sustainable only when it reaches the executive layer.
In many firms, governance discussions remain operational. Records and IT coordinate and Risk advises. But executive leadership sees governance only when a client audit or incident surfaces. That reactive visibility limits momentum.
Executive oversight does not need to be intrusive. It needs to be structured. When leadership receives periodic reporting on:
- Dormant matter volumes
- Retention enforcement activity
- Disposition trends
- Data growth patterns
- Access review completion
Governance becomes part of firm management. Shifting from background activity to operational infrastructure.
For firms competing for sophisticated mandates, this executive visibility strengthens credibility. It signals that governance is not an afterthought - it is embedded oversight.
Cultural considerations
Shared ownership must also reflect firm culture. Firms often operate with consensus-driven leadership and strong partner autonomy. Governance models that appear top-down or punitive can generate quiet resistance.
Execution succeeds when governance is positioned as protective rather than restrictive and I’ve found that Partners are more receptive when they understand:
- Structured closure reduces risk of unnecessary data exposure.
- Consistent retention supports defensibility.
- Access validation narrows cyber vulnerability.
- Lifecycle discipline strengthens client trust.
Shared ownership helps reinforce that governance decisions are not imposed by a single department. They are coordinated safeguards aligned with firm interests.
Turning governance into workflow
Shared ownership must extend beyond meetings and policy discussions. It must translate into workflow.
For example:
At matter intake, classification accuracy is critical. That may involve collaboration between practice groups, Records, and IT to ensure fields are completed properly. At closure, confirmation of lifecycle status must be coordinated between Finance, Records, and operational teams.
When retention eligibility arises, disposition review must follow documented approvals, supported by system reporting. When access reviews are triggered for dormant matters, IT and practice leadership must collaborate to validate permissions.
Governance becomes real when it is embedded in these operational touchpoints and without workflow integration, shared ownership remains theoretical.
Avoiding the "shadow responsibility" trap
One of the more subtle risks in governance execution is shadow responsibility.
In some firms, governance tasks are quietly absorbed by diligent individuals within IT or Records. They monitor lifecycle issues, prompt closure reviews, and track retention manually.
While this demonstrates commitment, it creates vulnerability. Governance becomes dependent on specific people rather than structured roles and when those individuals change roles or leave the firm, governance weakens.
Defined shared ownership prevents this. It ensures responsibilities are institutional, not personal.
Aligning people and systems
In the previous article, we explored how technology supports governance consistency.
Shared ownership ensures that people reinforce system discipline. Systems may surface dormant matters, but leadership must decide how to prioritize review. Platforms may trigger retention eligibility, but designated approvers must authorize disposition. Reporting may highlight data growth trends, but executive oversight must determine corrective action.
Execution depends on coordination between human decision-making and technological structure. One without the other is insufficient.
From initiative to infrastructure
When shared ownership is clear, governance stabilizes. It no longer depends on periodic campaigns. It no longer competes for attention only during audits. It no longer stalls due to unclear accountability.
It becomes infrastructure. Infrastructure is rarely dramatic. It operates consistently. It supports growth. It reduces friction. It enables innovation. It strengthens resilience.
For firms balancing growth, regulatory expectations, and evolving client scrutiny, this stability is strategic.
Preparing for the business conversation
With strategy defined, technology aligned, and ownership clarified, governance becomes operationally sound. The next stage of maturity involves articulating its value more explicitly.
- How does governance align with leadership priorities?
- How does it support cost control?
- How does it reduce measurable risk?
- How does it strengthen competitive positioning?
In the next article, we will shift the focus to leadership persuasion - exploring how to build a compelling business case for information governance within your firm.
Because even the strongest operational framework must ultimately align with strategic priorities.
About the author
Kandace Donovan is VP of North American Operations at LegalRM.