Effective governance: shareholder and brand protection
The effects of damaging emails to an organization's reputation are well documented. Less widely publicized, but equally damaging, can be an organization's information management policies and controls.
Frequently overlooked is the fact that users in most organizations are able to freely delete emails at will. This means that newly received emails can be deleted or modified and resaved prior to the nightly back-up run, with the effect that official records can not be relied upon to reflect actual communications.
In your organization, when it comes to meeting data retention requirements, who determines the correct retention duration for each email? Do you even apply data retention policies to email? What safeguards exist for averting premature deletion? Is everybody who makes storage and retention decisions adequately trained? Can you keep up with the hundreds, thousands or millions of emails passing through your organization every day?
Where litigation is anticipated or has begun, deliberate destruction of documents is a criminal offence. What technical measures have you put in place to prevent unauthorized deletion and modification of records?
Responsible management have a duty to be able to investigate the facts of any potential wrong doing and either make suitable amends quickly or defend wrongful claims rigorously. Archiving systems which allow data to be added or removed arbitrarily or without clear audit controls, obstruct the process of getting to the facts and risk compounding what might already be a serious problem. The situation is more acute for larger organizations with more valuable brands and with responsible senior executives intermediated by more layers of management.
During a discovery exercise, be it for internal or external purposes, reliable access to email records is necessary. Can you support this today? Can you satisfy discovery requests inexpensively? Do you have access to all email and messaging data? What steps have you taken to ensure no 'holes' or modifications exist in your formal records?
Data protection requirements must also not be overlooked