We invite and encourage contributions to our blog from
our network of consultants to share their expertise relating to Information
Management best practices. The commentary that follows below is from Valarie
Findlay, an independent security consultant with HumanLed Inc. The commentary focuses on an exploration of the challenges associated
with the cost of maintaining and valuing information assets.
_________________________________________________________________
In 2009, the Treasury Board of Canada issued a
directive to ensure effective recordkeeping practices that enable departments to
create, acquire, capture, manage and protect the integrity of information
resources of business value in the delivery of Government of Canada programs
and services.
The directive addresses the identification of information resources
of business value based on analysis of departmental functions and activities,
the establishment and implementation of key methodologies, mechanisms and tools
that support departmental recordkeeping requirements, proper documentation of
recordkeeping practices of accountability, stewardship, performance
measurement, reporting and legal requirements, and timely communication with
departmental managers and employees on the risks associated with poor
recordkeeping.
This article explores an inferred but often overlooked exercise
– the determination of the true cost (storage, security, disposition, etc.) of information
recordkeeping, the value of that information and why it’s important to go
beyond the longstanding standards of sensitivity and classification (secret,
top secret, etc.) of information. (For the
purposes of this article, recordkeeping refers to the creation, duplication,
storage, security and overall management of information.)
Understanding the value of information and the costs associated with it
are generally notional concepts and establishing measurable criteria is an
exercise unto itself but it is feasible to develop this into a modeled approach
which can be implemented into any departmental system, independent of
technology. Industry and private sector have already recognised valuation as a
critical step in not only justifying spending on recordkeeping initiatives but
also to ensure that the value of information is congruent with the
countermeasures applied to storing, sharing and securing it.
First, let’s take a look at the cost of
recordkeeping and what industry findings on recordkeeping and information
management have revealed.
The Keeping Cost: Hidden and Unburdened Impacts
Companies spend a significant amount of
their revenue on managing document production, distribution and associated
devices – IDC estimated that it is up 10% of
revenue or budget. A recent study by BAE Systems discovered that “about 80% of
all workers waste an average of half an hour every day, retrieving information
while almost 60% expend an hour or more duplicating the work of others”. An
InfoTrends/CAP Ventures Study indicated that organizations estimated spend an
average of 3% of their annual revenues on duplication - copying, printing and
faxing; other research reveals that actual document expenditures (including
hardware, supplies, and “people” costs) averaged 6% of annual revenues across
all industries.
An independent breakdown of the data revealed that only 10% of office
document burdened costs relate to equipment, supplies, and service expenses - for
every $1 spent on equipment, supplies, and service, another $9 is spent on
other burdened costs: IT support and infrastructure, procurement, facility costs,
end-user interaction time and document management expense. [1]
Finally, IDC estimates that an organization with 1,000 knowledge workers wastes
between $2.5 - 3.5 million a year in superfluous or erroneous document related
activity.[2]
To bring this spending into perspective, ask yourself: would you go to
the same lengths – effort and cost – to secure and protect a possession that is
of no appreciable or inherent value, as you would for one that is? We do this
all of the time in recordkeeping and information management: we hoard
information and data as if it were all of the same business value often with
the overused refutation, “space is cheap”. But it is more than space that makes
up the cost of recordkeeping and information management.
True Value: The Courage to Peel the Onion
In
formulating information value, meaningful criteria is crucial, therefore, I
utilize the Seven Laws of Information[3],
among other industry mainstays, and develop categorical elements that increase
and decrease the value of information and then I apply the cost of that information
as a formula to establish it as a cost-valued asset.[4]
As an example, the Seven Laws of Information state, in general, that, all
information would follow these Laws:
- The sharing (where it is deemed to
be required and necessary) of information multiplies its value; the more
people who use it, the more value/benefit can be extracted from it.
- The duplication of information
does not increase its value but instead increases the costs associated
with it and replication and redundancy increases maintenance costs.
Therefore, the need to duplicate and store multiple copies of information
acts as a decrease to its value.
- The more integrated information is
or where there is a dependency on it by other information, the more
valuable it is.
- The more accurate information the
more valuable it is.
- Unlike most assets, information is
subject to reverse depreciation in that the more it is used, the more
valuable it becomes;
- Unlike most assets, information is
subject to the laws of abundance;
- Overabundance reduces information
value. Psychological evidence shows that humans have a strictly limited
capacity for processing information and when the amount of information
exceeds these limits, information overload ensues and comprehension (Lipowski,
1975) and decision making ability degrades rapidly at the saturation point
(O’Reilly, 1980; Driver and Mock, 1975; Jacoby et al, 1974).
Based on these laws of information comparative value and cost criterion
can be developed into a model that follows a prescriptive framework that
reveals the cost benefit and return on investment. But it doesn’t stop there: this
data should then become the “business case” used to drive and apply counter
measures, such as operational, infrastructure, policy and procedure controls
and enhancements to help management implement optimum information management
best practices. In this climate of cost savings, government and business can no
longer afford to dismiss the importance of revisiting and properly assessing
information value and recordkeeping costs and auditing current, long-standing
practices for appropriateness and effectiveness. Often change will not occur
until “the pain of staying the same exceeds the pain of making the change
itself”.
All rights reserved. © Copyright 2013
Valarie Findlay is an independent
security consultant with HumanLed Inc. and holds several security accreditations
and is completing her Masters degree in Terrorism Studies. She can be contacted
at: vfindlay@humanled.com.
