Improve Your Company’s Health Through Information Management
Today’s business environment involves more information than ever before, along with more regulations, rules, and risks associated with information management. The risks come in the form of data breaches, data privacy violations, or massive litigation budgets — all situations that can occur when companies keep too much information, for too long, and in too many undocumented or uncontrolled ways. Reducing that risk requires implementing plans and processes that are functional, defensible, and customized to the company’s culture. These plans and procedures are interchangeably called information management policies or document/records retention plans. Implementing a strong document retention plan reduces the amount of data being stored, improves risk mitigation for cybersecurity and data privacy, and creates potential long-term cost savings. For private equity (PE) firms, these efforts must be even broader and consider not only information utilized for their own operations, but also that used by and for their portfolio companies. Like an individual embarking on a new health regimen, PE firms preparing information management plans should take a close look at their current health and then make educated changes to create long-lasting, healthy habits for the future.
The first problem that companies face is identifying and locating all possible sources of business information. Because PE firms have access to important strategy information and client data, this identification process is incredibly important. Business is conducted and information is shared in new and different ways that seem to change daily, which makes management of business records complex and fluid. There are ever-changing storage locations, including mobile devices, cloud-based sources, and third-party data from contractors and subcontractors, and constantly growing volumes of files being created within each company’s networks. Communications are made not only via email but in texts or ephemeral messaging and even across social media, collaborative workspace tools, and other evolving technologies that were never anticipated when creating information management policies or data retention schedules. Identifying what information exists, where it exists, how it is used, and who’s in charge of it is a huge hurdle. And every day, the volumes and types of information expand exponentially.
In the PE world, the owners and creators of the information are also overlapping and sometimes confusing — especially when factoring in the PE funds, management companies and portfolio companies. It is not uncommon for personnel, information, and sometimes even litigation to pass across many of these companies. This network of information and personnel must be included in considerations about how information, communications, and business records are tracked, stored, maintained and ultimately destroyed at the end of their useful life.
The next hurdle is to determine what — in all of those mounds of files, masses of communications, and heaps of records — is actually useful, needs to be protected, needs to be retained for business, legal, or regulatory requirements, and what can be destroyed. There are many complicated demands that impact these decisions. How should the data be classified for retention, what regulations are at play for legal, privacy, or industry requirements, and who has actual control of this data ? Can we create a plan that our employees will follow?
The answers to these questions require a thoughtful approach to updating or creating a records retention policy that factors in everything from the requirements for company employees in various countries, regions or departments, to the contractual obligations of third party contractors. Input will be required from personnel in legal, IT, and other departments to create the foundation for the records retention policy that is not only functional as guidance but practical in its application by all company employees. Support from senior-level operations or C-Suite will be crucial. And a thorough education plan for all employees will help to ensure that the policy is actually understood and practiced, not just shelved or ignored. (Having a records retention policy that is not followed is often worse than not having a policy at all!)
Nothing about the development of information management policies and practices is easy or fun, but undertaking these efforts is similar to embarking upon a new exercise plan in several important ways, and just as important for the health of your firm and your portfolio companies.
- A good coach makes a big difference. When beginning the process of revamping your company’s information management systems, engage outside help to ask the hard questions about the who/what/where/when/why of your business records and policies. (V&E has resources who have effectively coached multiple clients through these efforts.) Having an outside, experienced eye is very similar to having a good coach assist with improving the form and function of your weight-lifting or cross-fit program.
- Starting is the hardest part. In very real ways, putting off exercise just packs on the pounds. Delays in handling your information governance and retention plans result in more and more records piling up in both digital corners and actual corners of offsite storage. Don’t put this off.
- Creating new habits for the long term is key. Just as you cannot create a plan, exercise once or twice, and hope for a lifelong change, changing the practices of how your company, portfolios, and individual employees handle information they generate and receive will require a committed effort, education, enforcement, audit and follow-up.
In preparing and implementing a document retention plan, the company’s goal should be to create something that is workable within the culture and customs of the company, and to communicate to all employees the importance of complying with that plan. Just like a personal exercise regimen, following the company’s document retention plan is essential for the health of the company and, unless they just really like lawyers and love the idea of being a witness in litigation, benefits employees, too!
This information is provided by Vinson & Elkins LLP for educational and informational purposes only and is not intended, nor should it be construed, as legal advice.