Amy,

I was part of the team that wrote the Principles (GARP at the time). There
was no intent to mandate where in an organization the RIM / IG function
sits. In my most recent organization, RIM was first in Law, then moved to
Information Security (under IT) where my program morphed into an
Information Governance role (by my definition). I wasn't thrilled initially
by that move, but from a personal standpoint, it worked out fairly well for
me -- mainly because I had a sponsor (the CISO) who wanted the program for
the right reasons and expanded my role.

The "right place" for RIM is a matter of organizational culture. While I
think many of us would tell stories or where we thought the "wrong place"
might be, it ultimately depends upon your organization and your leadership
to set the right tone.

My recommendation is that you use the Principles to benchmark your program.
You may also want to look to ISO 15489 (which is older) as another
benchmark. However, all these will show is whether or not you have the
right components in place for your program, not where it should be.

In terms of ownership, you have to work within your organization's culture
and structure. I don't think it is a good strategy to start in a place that
says, "Don't make us report to IT" and then try to find evidence to support
that end result. Nor will you find an approach that says, "The best RIM
programs report to Law / GC". While you can find evidence to support that,
a savvy person could find just as much evidence to counter your position.
The best starting place is to find the right sponsor who wants to own the
program and enroll them to manage the politics. Ultimately, that's how you
will succeed in your organization. Be open to possibilities if someone
unexpected wants to take ownership of your program -- it might just work
out better than you think.

Patrick Cunningham, CISM, FAI

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]