AI Glossary / Data engineering and architecture / Beginner

Information governance

Definition

Information governance is the coordinated system of responsibilities, policies and oversight through which an organization manages information throughout its lifecycle. It addresses how information is created, used, shared, protected, retained and disposed of. The aim is to support useful, trustworthy information while managing obligations and risks. Governance sets direction and accountability; operational teams carry out the required work.

What it means

An organization may have excellent storage tools yet still be unable to answer who owns a dataset, whether a document is authoritative or when old copies should be removed. Information governance addresses these decision gaps. It spans structured data, documents and other information assets, with participation from business, technology, records, security and relevant advisory functions. It is broader than a filing convention and should connect policies to actual behavior and evidence.

How it works

A program identifies information assets and accountable roles, assesses needs and establishes approved policies. Teams translate those policies into procedures and system controls, such as classification, access review and retention workflows. Oversight checks whether controls operate as intended and manages exceptions. Changes in business use or technology trigger review. ARMA's Information Governance Implementation Model provides one framework for organizing this work; a framework guides implementation but does not replace organization-specific decisions or establish legal compliance by itself.

Three practical examples

• A project assigns owners to shared datasets and records who approves changes to definitions and permitted uses.
• A document team distinguishes approved policies from working drafts and defines how obsolete versions are handled.
• An AI program documents which information may enter a retrieval system, who reviews access and how corrections reach indexed copies.

Think of it this way

Think of the rules and responsibilities that keep a shared library usable: who acquires material, who may borrow it, which edition is authoritative and when items leave the collection. This captures coordinated decisions across a lifecycle. Digital information is more complex because copies spread easily, automated systems reuse content and obligations may depend on context rather than a single visible shelf.

Worked example

Suppose a fictional organization inventories 100 shared information collections. It finds 70 with a named owner, 20 with an identified team but no accountable owner and 10 with no clear responsibility. Its owner-coverage measure is 70%, not 90%, under a rule requiring a named accountable role. After resolving 15 collections, coverage becomes 85%. This measure tracks one governance control only. It does not establish that access is appropriate, records are accurate or retention decisions are correct. A useful dashboard keeps those separate questions visible.

Illustrative case study

In a fictional company, Rowan Services prepares an internal AI assistant. The pilot retrieves conflicting instructions from current and obsolete policy documents. A cross-functional group establishes authoritative sources, names content owners and defines a process for updating the assistant's index. It also tests whether restricted material stays unavailable to unauthorized users. The case illustrates governance turning into operational decisions, without claiming that a committee or policy document alone makes an AI system trustworthy.

Common misconceptions and mistakes

Information governance is not simply an IT project or a security checklist. It should address useful access as well as protection. Keeping everything forever is not automatically responsible governance, and deletion without an approved basis is not a sound substitute. A policy that cannot be implemented or checked may create an appearance of control. Data governance and records management overlap with information governance, but terminology and program boundaries vary between organizations and professional frameworks.

Business use

Start with a concrete business problem such as conflicting customer definitions, inaccessible knowledge or uncontrolled document copies. Establish decision rights and a manageable inventory rather than producing policy without ownership. Link each requirement to a process, control and evidence source. For AI, clarify the treatment of prompts, retrieved content, generated outputs and evaluation records. Changes to access or content should propagate to dependent systems. Involve qualified advisers for applicable legal obligations; a glossary description cannot determine retention periods or permissions for a particular jurisdiction.

People also ask

Does governance mean every action requires a committee?

No. Clear delegated responsibilities and approved rules should make routine decisions easier while reserving escalation for exceptions.

Can software deliver governance by itself?

No. Tools support controls, but people must define purposes, responsibilities and acceptable behavior.

Is a completed policy proof that governance works?

No. Evidence of implementation, monitoring and correction is needed to assess whether the policy has an effect.

Check your understanding

A dataset has an owner listed in a catalog, but nobody can explain who approves external sharing. Is ownership coverage enough?

Answer: No. The relevant decision rights and process remain unclear. Governance should identify both accountability and the practical authority for the decision being made.

Related terms

• Data governance
• Access Control
• records management
• information lifecycle
• data stewardship
• retention policy
• information quality

Learn next

Select one information collection and map its lifecycle from creation to disposal. Identify the accountable owner, allowed uses and evidence that controls operate. Then test a change scenario, such as a corrected policy or revoked access, to see whether every dependent copy and application responds appropriately.

More in Data engineering and architecture

• Independent multivalued fact - An independent multivalued fact is a set of values associated with an entity that varies independently of another set associated with that same entity.
• Indexed access - Indexed access retrieves data through an index that organizes searchable values and points to, or otherwise identifies, relevant records.
• Industry standard data model - An industry standard data model is a shared description of important data concepts, attributes and relationships for a particular sector, established...
• Information integration - Information integration brings information from different sources into a coherent form or view so that people and applications can use it together.
• Information model - An information model describes the concepts in a chosen domain, their properties and relationships, and the rules that give them meaning.
• Information repository - An information repository is an organized environment for storing, describing, managing and retrieving information.

Sources

Sources: ARMA International, “Information Governance Implementation Model,” https://arma.org/igim; ARMA Magazine, “Introducing the Information Governance Implementation Model,” https://magazine.arma.org/2019/12/introducing-the-information-governance-maturity-model-igim/; ARMA International, “State of the Association Highlights,” https://arma.org/arma-news/arma-international-state-of-the-association-highlights. Primary association search excerpts consulted; full framework and editorial review remain pending. This is general organizational guidance, not a statement of jurisdiction-specific legal duties or a certification assessment.

Previous: Information gathering action Next: Information integration