Guidance for Building an Effective Enterprise-wide Electronic Records Management (ERM) Governance

Electronic Records Management (ERM) Initiative
November, 2005

Guidance for Building an Effective Enterprise-wide Electronic Records Management (ERM) Governance
Structure

(PDF Version Available)

The nature of electronic records management (ERM) projects-with issues of ownership and access at the core-makes them ideal candidates for development and operation within an effective governance structure. This document provides guidance to federal agency records management staff as they work with information technology (IT) officials and other agency stakeholders to implement and manage enterprise-wide ERM.

By using appropriate governance structures, project managers will increase the likelihood that their ERM system will operate efficiently and be fully integrated with agency architecture and infrastructure. This document relies on existing Office of Management and Budget (OMB) policies as expressed in OMB Circulars A-11, Preparation, Submission and Execution of the Budget (Revised 06/21/2005), and A-130, Transmittal Memorandum #4, Management of Federal Information Resources (11/28/2000), and on other OMB guidance for managing information systems and IT projects. These circulars establish a comprehensive approach for executive agencies to improve the budgeting process, acquisition, and management of their information resources, establishing a broad mandate for agencies to perform their information resources management activities in an efficient, effective, and economical manner (http://www.whitehouse.gov/omb/circulars/index.html).

This document defines governance and its importance to the success of IT projects, the purpose and function of that governance, how project-specific governance (such as those instituted for enterprise-wide ERM) fits within and alongside other established governance structures, and the risks attendant in the absence of good governance. It is organized to help those considering improvements to their existing governance structure identify additional mechanisms and approaches that they can employ on ERM and other IT projects. The guidance is composed of five sections, followed by an Appendix of Resources for Governance Structures:

1. Introduction
    
2. Application of this Guidance Document
    
3. Governance Structures
   
   What is IT Governance?
   Why IT Governance Structures are Needed
   Governance Bodies: Executive, Operational, Technical
   Essential Elements: Leadership, Accountability, and Oversight
   Governance Bodies at Work: An Illustrative Model
    
4. Lessons Learned
    
5. Summary

Appendix: Resources for Governance Structures

1. INTRODUCTION

The strategic focus of the Electronic Government (E-Gov) Initiative is to utilize commercial best practices in key government operations. The National Archives and Records Administration (NARA) is the managing partner for the ERM E-Gov Initiative. NARA's ERM Initiative provides a policy framework and guidance for electronic records management applicable government-wide. NARA's ERM Initiative is intended to promote effective management and access to federal agency information in support of accelerated decision making. The Initiative will provide federal agencies guidance in managing their electronic records and enable agencies to transfer electronic records to NARA. These documents form the structural support for ensuring a level of uniform maturity in both the Federal government's management of its electronic records and its ability to transfer electronic records to NARA.

This is the fourth of six documents to be produced under the Enterprise-wide ERM Issue Area, providing guidance on implementing electronic records management.

• The first document provides guidance for Coordinating the Evaluation of Capital Planning and Investment Control (CPIC) Proposals for ERM Applications
   
• Electronic Records Management Guidance on Methodology for Determining Agency-unique Requirements offers a process for identifying potential ERM system requirements that are not included in the Design Criteria Standard for Electronic Records Management Applications, DOD 5015.2-STD (v.2)
   
• Recommended Practice for Evaluating Commercial Off-the-Shelf (COTS) Electronic Records Management (ERM) Applications, summarizes the Environmental Protection Agency's (EPA) experience determining agency-wide Electronic Records and Document Management System (ERDMS) requirements and identifying the COTS products that would best meet the needs of agency staff for both Electronic Document Management (EDM) ¹ and Electronic Records Management (ERM) ² functionality.

Subsequent documents will consist of guidance for developing and launching an ERM pilot project, and a "lessons learned"l paper from EPA's proof of concept ERM pilot as well as other agencies' implementation experience. The guidance documents are aimed at helping federal agencies understand the technology and policy issues associated with procuring and deploying an enterprise-wide ERM system.

2. APPLICATION OF THIS GUIDANCE DOCUMENT

This advisory guidance defines IT governance, providing illustrations as to effective governance mechanisms and the benefits derived by agencies when employing them. It should be used in conjunction with existing Office of Management and Budget (OMB) policies in OMB Circulars A-11 and A-130, and in other OMB guidance for managing information systems and information technology (IT) projects, and with other NARA records management regulations and guidance. Roles and responsibilities, particularly with regard to the essential elements of governance structures-Leadership, Accountability, and Oversight-are addressed in terms of their contribution to the success of IT project governance.

The primary audience consists of those agencies that are implementing an enterprise-wide Electronic Records Management (ERM) system and wish to ensure its success by adopting good governance practices. As the principles of good governance apply to any IT project, this document has wider application than ERM.

3. GOVERNANCE STRUCTURES

Governance structure ensures that the voices of stakeholders are heard, formalizes quality decision-making, and is the vehicle through which complex IT projects are effectively implemented. The governance structure will assist those responsible for enterprise-wide ERM projects:

• Articulate a united vision and determine the scope and focus of ERM within the agency
   
• Identify legal, policy, administrative, funding, and technical requirements and other obstacles to achieving integration with existing repositories and systems
   
• Define and sanction project objectives, tasks, and timetables
   
• Garner support from other agency decision-makers
   
• Monitor planning, implementation, and management activities
   
• Define ERM operational requirements
   
• Oversee commercial off-the-shelf (COTS) evaluation and implementation
   
• Resolve obstacles to implementation
   
• Review system performance and make recommendations concerning systems improvements, enhancements, and next phases (Harris, 2000, p. 23).

What is IT Governance?

The term "lgovernance"l can be applied to the public arena (i.e., governments), corporate entities, and information technology (IT). For the purposes of this guidance document, we have adopted the definition employed by the U.S. Department of Justice, Office of Justice Programs (n.d.) "as the set of organizational regulations and standards exercised by management to provide strategic direction and ensure that objectives are achieved, risks are managed appropriately, and resources are used responsibly."

Governance is achieved through organizational structure and performance measurement, which define boundaries, authorities, responsibilities, and tasks (United States Army, n.d.). The goal is to create an enterprise-wide structure for managing IT that will advance the strategic mission of the agency, setting priorities for IT projects that are aligned with the agency's objectives, and funding initiatives that are highly valued by the agency, its staff, and the public. On the project level, a governance model identifies and defines the activities and relationships among groups established to ensure that projects such as ERM are successfully implemented and continue to function over time, with enhancements made to continuously improve an agency's approach to ERM. It establishes the decision-making authority of those groups and makes them accountable for their undertaking. This structure facilitates ample consideration of ownership and access concerns likely to arise throughout the information lifecycle (production, collection, use, management, maintenance, preservation, and disposal or permanent retention).

Governance models include formal components (e.g., Memoranda of Understanding, charters, statutes, and administrative directives) that provide the authority for the enterprise-wide ERM and the establishment of a governing body, for instance; informal aspects (e.g., collaboration, culture, and effective communication) must also be addressed. (NASCIO, 2005). Governance responsibilities may be exercised through (advisory) boards, (executive) steering committees, councils or commissions. These mechanisms are not mutually exclusive and are usually present in combination.

The types of governance structures put in place depend on:

• The requirements of the business
   
• The size of the agency, how it is organized, and its culture
   
• Its approach to IT and ERM (centralized vs. decentralized or distributed)
   
• Its existing technology infrastructure (as well as anticipated changes in the information architecture)
   
• The number, availability, and expertise of staff, including the skill sets required for development of an ERM operational strategy and ultimate deployment. An agency should select the governance arrangement that best supports its business strategy while being compatible with its culture. No matter what IT governance mechanism is used, it must facilitate decision-making, ensure alignment between technology and business goals, and communicate governance principles and decisions. (Ross & Weill, 2004). This communication includes not only those directly involved in the project as members of the team or advisory boards, but the rest of the agency as well, whose staff both produces and uses the records involved in the ERM project.

The most effective approach for project-specific governance is one where IT and business management make decisions together. While joint decision-making can take longer and requires a great deal of management attention, particularly when members of committees or work groups are geographically dispersed, the mixed approach makes the most sense for projects such as ERM where issues concerning ownership and access are paramount.

Tips for good ERM project governance

• Develop a compelling business case for your ERM project, a set of business and functional requirements for ERM, and specify programs and record types/formats that are both in- and out-of-scope.
   
• Build on existing IT project governance structures that guide and oversee their strategic and operational missions within your agency.
   
• Actively design IT governance structures (as opposed to letting governance occur by default). This ensures that those who ought to have input into the decision-making process are included (senior management; IT; records managers, producers, and users).
   
• Develop a system for communicating project status and developments reporting to the ERM team, management, and stakeholders (producers and users of agency records).
   
• Maintaining a central repository for decisions made with regard to your ERM project will help newcomers to the team understand the rationale for prior decisions.
   
• Adopt simple governance structures that are easily understood by all. This encourages people to utilize the mechanisms in place to resolve any issues that may arise during the project (e.g., ownership of and access to records).
   
• Limit the number of decision-making structures to minimize confusion as to whom to consult when.
   
• Resist frequent redesigns of your governance structure so that staff can easily remember those with whom they need to confer/consult.
   
• Establish specific project deliverables and a timetable for delivery that has been agreed to by all staff affected by the shift to ERM at your agency.
   
• Design processes for handling exceptions so that all major decisions relating to the project will be made within the governance structure.
   
• Educate managers as to how to use governance mechanisms.
  
  Sources: P. Weill (2004, March); P. Weill and R. Woodham (2002, April); J. Ross and P. Weill (2004, June 15); & Deloitte, Touche, Tohmatsu (2004, December)

Why IT Governance Structures are Needed

Planning complex IT projects involves an array of political, organizational, legal, technical, cultural, and personnel issues best dealt with by a team charged with the responsibility for the successful outcome of those projects. By subjecting each project to a series of questions designed to assess dissimilar projects, governing bodies can compare projects against agency priorities, apportioning resources accordingly.

Appropriate governance processes are critical to managing IT projects properly. ERM governance structures and policies assist leadership in making critical decisions to guide the work. Committees comprised of all stakeholders working with IT professionals ensure that the ERM solution meets the needs of the agency, in terms of legislative and regulatory requirements, and all its users.

The benefits that ERM governance brings to an agency include:

• Joint responsibility for planning and executing ERM, shared by document producers, users, agency management and staff working alongside IT personnel
   
• Clearer understanding of objectives and expectations for ERM
   
• Clearer visibility of issues and priorities associated with ERM, such as ownership and versioning of documents; unified file plans, records schedules and retention periods; access to records; security classifications; and privacy considerations
   
• Transparency and better comprehension of ERM-related activities and performance
   
• Alignment of ERM with business needs of the agency, demonstrated by the selection of priority record groups in initial phases of ERM implementation
   
• Improved value delivery through business process and workflow improvements
   
• Optimized costs for IT investments in ERM solution
   
• Management of records management-related risks
   
• Improved quality of service by a staff able to identify and retrieve required records efficiently.

These benefits are illustrated in Figure 1.

Figure 1. Benefits of having an IT governance structure

When employed with IT projects such as ERM, governance structures:

• Assure that all IT projects further the goals and priorities of the agency
   
• Improve the ability of an agency to share data and establish common systems
   
• Clarify and enforce policies equally across all projects
   
• Reduce the conflicts that arise when roles and responsibilities are not clearly defined
   
• Ensure that corrective actions are taken with regard to problematic IT projects, reducing the number and severity of failures through oversight and appropriate management.

Governance Bodies

Appropriate governance processes are critical to managing IT projects properly. IT governance structures and policies assist ERM leadership in making critical decisions regarding resource allocation, setting meaningful, measurable targets to guide the work. Committees comprised of all stakeholders working with IT professionals ensure that the technology solution meets the needs of the agency, in terms of legislative and regulatory requirements, information architecture and infrastructure, and all its users, within the agency, other agencies, and the general public.

Agencies will take different approaches to governance. Some will have a permanent steering committee operating as an umbrella under which all project-specific governance structures operate. Governance models employed for ERM should be as simple as possible. The simpler the governance model-the easier for staff to understand-the more frequently staff will utilize the recommended practices and not look for ways to circumvent the prescribed processes. In a straight-forward manner, the structure should clarify roles and responsibilities for all participating in the governance of an agency's ERM project.

An effective approach for ERM governance consists of three components: One group charged with strategic decisions for ERM, committing agency resources to the project; another responsible for operations, including the development of procedures related to ERM; and a third that addresses technical issues associated with the ERM solution. Each should have broad representation, with care taken in terms of overall composition (comprehensive and appropriate, with all members able to contribute to the conversation in a substantial way) and individually, with members selected to participate able to do so without compromising other projects or duties.

Whatever name you choose to give to these groups (e.g., boards, committees, councils), each has its own set of responsibilities and recommended composition, as described below.

• The executive committee establishes vision, scope, and objectives for enterprise-wide ERM, making key decisions by allocating adequate financial resources and appropriately trained staff, sanctioning tasks and timetables, and setting meaningful, measurable targets for the project. This committee oversees the planning, implementation, operation, and management of ERM.
   
  • Defining scope establishes realistic boundaries so that milestones can be reached. This is particularly important during initial planning stages and ERM projects designed for phased implementation, manifesting itself in decisions such as the types of records or departments chosen for inclusion in the pilot testing of the ERM solution.
     
  • Establishing realistic boundaries permits all to understand who is responsible for what in relation to the ERM project and the degree of authority a group has in making decisions regarding ERM. This can minimize problems encountered regarding such issues as ownership of records and perceived infringement on traditional turf.
     
  • Analyzing the agency-wide operational benefits sought through ERM will help measure performance against objectives.
     
  • Ensuring that standards and "best practices" are met. For ERM, this includes:
     
    • Department of Defense's 5015.2-STD (v.2), Design Criteria Standard for Electronic Records Management Software Applications (released June 2002) http://jitc.fhu.disa.mil/recmgt/standards.html
       
    • American National Standards Institute (ANSI) Framework for Integration of Electronic Document Management Systems and Electronic Records Management Systems (ANSI/AIIM TR48-2004) http://www.ansi.org
       
  • Depending upon the agency's governance policy and structure, decision-making authority may rest with the ERM executive committee or this committee may make recommendations to an IT steering committee responsible for all enterprise-wide IT projects.
     
  • Members of the ERM executive committee should include your agency's Chief Information Officer (CIO), senior financial official, a senior records manager, and executive level managers who approach ERM in the context of other major agency-wide IT initiatives and the business of the particular agency. These are the people with "the power to designate agency resources and commit personnel to get the job done. They have the ability to drive the project forward," removing barriers along the way (Harris, 2000, p. 28).
     
• The operational committee, such as a records council, defines ERM for the agency from a business perspective. Its members understand the role ERM plays in allowing the agency to function effectively and efficiently.
   
  • The operational committee develops an agency's ERM policy infrastructure, obtaining the executive committee's approval for the initial project design. Over time, this committee is responsible for recommending enhancements to the system. These recommendations are likely to center on business processes and changes in workflow.
     
  • The operational committee is responsible for updating processes as they relate to evolving document and records management standards.
     
  • Members of the ERM operational committee consists of representatives from IT, legal, compliance, finance, records management, human resources, and key program officers. All approach ERM from the perspective of their primary function and appreciate how the project will affect their work and that of their colleagues, both as producers of documents and records and as users of them.
     
• The technical committee assesses the current technical environment and the technical policies and solutions that enable ERM. Its members are responsible for day-to-day activities regarding electronic records management and are responsible for monitoring system performance, making recommendations concerning systems improvements and enhancements from a technical standpoint. Another primary responsibility of this committee is the integration of the ERM solution into the agency's existing information architecture, assuring that it work with the other major systems deployed in the agency.
   
  • The technical committee must make recommendations to the executive committee with regards to levels of technical staffing expertise required by the ERM project. In addition, it is responsible for assuring that the staff is trained to participate in the project.
     
  • Members of this committee will have knowledge of prior enterprise-wide projects and "llessons learned"l from those installations. These can help avoid problems that can arise in technology-driven projects.

Subcommittees, work groups, and ad hoc committees may be established as necessary, focusing on particular issues, to carry out research related to ERM, or produce detailed documentation required by the project. These groups provide most of the recommendations for the ERM initiative, bringing the results of their research and determination to the appropriate governing body for review and endorsement (Harris, 2000, p.26).

Membership in these work groups/ad hoc committees should consist of a cross-section of representatives from the agency, at various levels-upper and middle management, agency staff, users, records managers, and technologists. Engaging key stakeholders in the early stages of ERM planning so that they help define the effort can prove invaluable as the project moves forward. As with any committee structure, operating procedures must be developed that address how they will conduct business and make decisions (e.g., elect chairs, establish procedures for voting, resolve conflicts, deal with changes in committee membership as individuals are reassigned within their agencies).

Governance mechanisms can be useful in addressing the tensions between central (headquarters) and local control. Recognizing that this will be more important for some agencies than others, the composition of these committees and teams should include representatives from offices around the country. This will assure that issues affecting non-headquarters offices are raised and addressed.

Operational and technical committees can minimize these tensions by explaining the rationale for retaining central control over certain ERM functions, for example:

• Loading the records schedules and retention periods
   
• Establishing the folders
   
• Required metadata
   
• Glossary of terms
   
• Templates for Web pages and standardized options for menus.
   

Other ERM-related activities are best left to local control. Examples include:

• Individual access and password assignment/management
   
• Program training
   
• Help desk functions.
   

The governance structure employed by your ERM project must provide for continuous communication among the various committees involved. Assuring appropriate leadership, accountability, and oversight of your ERM project will provide some of the necessary channels of communication, preventing some of the surprises inherent in large-scale IT projects. This is an effective way to break down barriers that exist within an agency, with individuals from different departments and locations working together to implement ERM.

Essential Elements: Leadership, Accountability, and Oversight

Governance structures are used to organize the process of on-going leadership and oversight of IT projects. The size and scope of enterprise-wide ERM projects demand considerable Leadership, Accountability, and Oversight to support and manage the resources required for successful implementation. This section of the guidance describes how these three essential elements for good governance relate to one another if properly embedded within the governance mechanisms described above.

Leadership provides direction and guidance on how an agency will employ ERM and administer its IT investment in the enterprise-wide initiative. It resides not in one individual but at multiple levels, each with clearly defined leadership roles that can be described as follows:

• The executive committee provides a leadership role by setting goals for ERM that are in line with the agency's business needs and priorities. This manifests itself in the selection of areas and/or types of records to be included in the initial phases of ERM implementation. It is the executive committee that will drive your ERM project forward, removing impediments to successful implementation.
   
• The operational committee provides leadership by developing plans for ERM, i.e., the specific policies and processes that are associated with all non-technical aspects of the project.
   
• The technical committee takes a leadership role by setting in place the technical policies and solutions that make enterprise-wide ERM possible.

Leadership must also come from department executives, program administrators, and IT managers. These individuals can offer commitment, sponsorship, and support for enterprise-wide or inter-agency IT projects, commenting on the benefits of agency-wide benefits of ERM in a variety of venues. Many of these individuals will be asked to sit on a committee providing input and/or oversight for your ERM project.

The person who chairs the executive committee is the most visible representative of the project. The executive committee chairperson articulates the vision for enterprise-wide ERM and advocates its goals and objectives. He/she has a particular responsibility to field inquiries concerning initiative deficiencies or failures in addition to touting its successes. It is essential that the chairperson of the executive committee have ready access to senior management within the agency who can leverage financial and other resources in support of the project. (National Criminal Justice Association, 2001)

Accountability at all levels is an essential aspect of IT project governance. Roles and responsibilities for each member of every committee and team involved in an enterprise-wide IT project such as ERM must be clearly understood. Tasks that must be performed by individuals and groups involved in the ERM project should be documented and the groups held responsible for accomplishing those tasks within the required timeframes and allowable budget. Ultimately, the public will hold agencies accountable for use of their tax dollars for projects that allow them to request and obtain records within a reasonable amount of time and a minimum of effort.

Specific authority and powers must be designated so that individuals and groups can accomplish their assigned tasks. It should be clear:

• The degree to which a group can make decisions on its own, when a group or individual should be asked to provide input to a decision, and when it is more appropriate to refer the decision to the executive committee.
   
• When and how each committee exercises the powers granted to it. The executive committee bears the responsibility for defining roles and responsibilities of each group and the way in which the groups interact with one another. Clarifying these collaborative efforts minimize the likelihood that traditional turf wars will impede the progress of the project.

The responsibility for documenting accountability goes into the plans for ERM created by the operating committee. This group updates procedures, sees that the training deemed necessary for ERM at the agency is carried out, and makes all of this information available to the agency through a shared mechanism, such as an internal Web page.

The technical committee is generally held accountable for the smooth operation of the ERM solution, whether managed in-house or outsourced. The obligations of these contractors must be spelled out in governance documents produced for the project with mechanisms for dealing with conflicts that may arise also included. This is particularly important where the technical expertise is lacking at the local level and other offices may have to assume responsibility for ERM in several locations.

Expectations of accountability are often expressed as performance goals. Some agencies have employed operational scorecards to establish expected outcomes and report results. Performance measures for the early stages of technology project implementation are necessarily different from measures employed for those that have been operational for some time; the individuals/groups involved are likely to be different as are the skill sets required at these stages. These must be delineated and modified over time and made available for all to consult.

Oversight ensures that IT operations and projects result in efficient operations and improved services from a strategic, tactical, and program-specific vantage point. ((California) Legislative Analyst's Office, 2003). Oversight of ERM projects is provided by senior management teams, often subsets of the executive committee, who:

• Review the expected outcomes of a project against the realities. While the executive committee will have set the objectives of the ERM project, all who participate would have agreed that these were reasonable objectives to be accomplished, given the time, budget, and number of trained personnel assigned to the project. Continuous monitoring of progress, with assistance provided when subtasks encounter delays, can keep the overall project on-schedule.
   
• Verify compliance with procedures, standards, and requirements, legislative or otherwise.
   
• Monitor expenditures for IT project, intervening when expenditures exceed benefits of the project. This monitoring effort serves to inform the overall IT budgetary process and other policy decisions.

Oversight for ERM projects rests heavily on records managers who must delineate proper management processes for agency staff (document and records producers and users), specifying the additional procedures required for ERM, such as metadata tagging. Records managers, in conjunction with IT, will want to modify existing training for ERM as the new system is brought on-line. Oversight for the smooth operation of the ERM solution lies with IT who may recommend some modification of process or customization of software to the operational committee. Figure 2 provides a summary of the Leadership, Accountability, and Oversight responsibilities for each of the governance bodies.

Figure 2. Responsibilities of Governance

Project managers may want to model their ERM governance structures on those used by others and can do so by consulting:

• Governance documents that your agency employs for non-technical projects
   
• IT governance documents from other agencies
   
• Governance documents that your IT department has employed with other projects similar to ERM that have been successful.

Governance Bodies at Work: An Illustrative Model

An agency's information technology (IT) policies should document:

• Recommended governance structures for information technology projects, including the functions, roles, and authorities of each person (position) in the structure and the rules that each component group must follow to bring the project to a successful conclusion (or maintain its success throughout its lifecycle).
   
• Descriptions of each committee established to provide input and/or oversight for IT projects should include its charge or mission (primary responsibilities), frequency and timing of scheduled meetings (in person or virtual), and its composition (members identified by name and function).
   
• A graphical presentation that indicates the relationships among the various groups within the governance structure and can serve to clarify ownership issues and indicate collaborative efforts.

The following graphic (Figure 3), incorporating these elements, illustrates the governance structure of EDOCKET, the Environmental Protection Agency's (EPA) online public docket and comment system designed to expand access to public information ³ . Through EDOCKET, the public can search selected Headquarters materials available for public review, view content, and submit comments online. EDOCKET contains collections of documents related to rulemakings and various non-rulemaking activities for EPA's Headquarters programs. The graphic depicts the responsibilities for each committee, its membership, frequency of meetings, and inter-relationship with one another. Representing the structure on one page has proven particularly helpful to new members of the project and others throughout the agency who inquire about the project.

Figure 3. EDOCKET/EPA Docket Center Governance Structure

No single governance approach will meet the needs of every IT initiative. Each requires a governance process that will work within the culture of the agency and is appropriate for that particular project. Whatever model your agency recommends for its IT projects can be adapted to ERM and include the pronged approach (executive, operational, and technical), incorporating the qualities of leadership, accountability, and oversight mechanisms expected to be exhibited at each level.

4.   LESSONS LEARNED

Federal agencies that have established a governance structure for their ERM projects have identified several key elements that must be present for the structure to provide its intended outcome. These include a strong project management officer (PMO), a two-tiered governance structure, optimal composition of the committees, and the use of small workgroups.

• A strong project management officer (PMO) provides day-to-day support of the project, making decisions at a level of detail at which the members of a committee would not want to involve themselves.
   
• Having a two-tiered governance structure--a staff level group that meets regularly and a senior group that meets once or twice a year-can prove edifying. Senior manager meetings provide the necessary impetus for engaging the staff group. In turn, staff may be more comfortable having senior managers make funding and resource decisions.
   
• The composition of the committees is important to the success of your ERM project. Having the right mix of individuals is critical and their ability to work together as a team can be enhanced by the collaboration tools employed by the project. Each committee should have representatives from a variety of levels within agency management. Duties of the various functions that need to be filled within the guidance structure must be clearly defined before individuals are sought to fill those positions. Individuals must be willing to participate, have the requisite expertise, and have the ability to speak for their department/organization.
   
• The use of small workgroups--subsets of committees set up to tackle specific issues and disbanded quickly once the situation has been resolved--increases the productive nature of committee meetings. Shifting discussion of the topic to another, smaller group meeting does not take up valuable meeting time of full committees where many present will not be able to provide meaningful input. Individuals whose input is vital to a particular issue may not be present at a particular meeting, leading to decisions based on incomplete information.

5. SUMMARY

Governance is the set of organizational regulations and standards exercised by management to provide strategic direction, ensuring that objectives are achieved, risks are managed appropriately, and resources are used responsibly. The complex nature of enterprise-wide and inter-agency information projects requires more sophisticated governance approaches than those utilized to oversee the functions of individual Information Systems (IS)/Information Technology (IT) departments.

IT governance is a framework that addresses the authority and decision-making structure that an agency has put in place to oversee the implementation of an IT project. Establishing IT governance policies and processes serves to align projects such as ERM with the enterprise architecture, solutions aligned to business objectives. Mechanisms for measuring performance ensure that expectations for IT are met, its resources are managed and risks mitigated.

Effective governance mechanisms are those that:

• Have been actively designed (as opposed to those that are established only after an "event," such as a large initiative launch gone awry).
   
• Engender close collaboration between stakeholders, users, and IT professionals, breaking down artificial boundaries established in the past that created silos and islands of information and systems that do not work with one another.
   
• Are a way of coordinating numerous complex projects, balancing conflicting needs.
   

Formalized governance facilitates ongoing collaboration and decision-making structures specific to the enterprise-wide nature of Electronic Records Management (ERM) that includes stakeholders from many offices and regions and involves a number of programs within an agency. Effective governance mechanisms are used to organize the process of on-going leadership and oversight of ERM projects, ensuring that each person's role and responsibility is understood, delineating the degree of authority that an individual or group has in making decisions concerning the ERM project, as well as those who provide input to those decisions.

A three-pronged approach to ERM governance consists of an executive committee, operational committee, and a technical committee addressing, respectively, the strategic issues, procedures, and system-specific challenges of ERM. These groups should consist of a cross-section of representatives from the agency, at various levels-upper and middle management, agency staff, users, records managers, and technologists-and locations assuring that issues affecting non-headquarters offices are raised and addressed. Leadership, accountability, and oversight exhibit themselves in different ways within each of the groups established to provide governance for your ERM project and are essential for successful deployment and continued operation of ERM systems.

Governance structure for ERM projects should fit within the IT governance structure and processes already established in your agency. In some cases, an executive council or steering committee will be in place to provide oversight for all IT projects, including enterprise-wide ERM. Using governance structures of other IT projects within your agency as a guide will help you develop the optimum governance structure for your ERM project.

The most effective graphic presentations of governance structures illustrate the relationship among groups (such as committees and councils) providing strategic direction and program oversight, noting the responsibilities and composition of each, as well as meeting schedules. This visual depiction communicates the inter-dependence of groups, making it easier for individuals to identify the proper authorities to consult when situations demand, encouraging staff to work within the governance structure for the specific IT project, such as enterprise-wide ERM.

APPENDIX:   Resources for Governance Structures

The following documents were used in the development of this guidance and will provide additional guidance and models for those agencies wishing to establish or improve governance structures for their enterprise-wide ERM projects.

(California) Legislative Analyst's Office. (2003). Information technology governance.
     Retrieved July 1, 2005, from Analysis of the 2003-2004 Budget Bill Web site:
      http://www.lao.ca.gov/
analysis_2003/general_govt/gen_7_cc_it_governance_anl03.htm

California State Auditor. (2003, February). Information technology: Control structures
     are only part of successful governance. Retrieved July 12, 2005, from Bureau
     of State Audits Web site: http://www.bsa.ca.gov/
pdfs/reports/2002-111.pdf

Deloitte, Touche, Tohmatsu. (2004, December). CIO 2.0: The changing role of the
     chief information officer. Retrieved July 5, 2005, from
      http://www.deloitte.com/dtt/cda/doc/content/cio2sp.pdf

Fonstad, N. and Robertson, D. (2004, October). Realizing the IT-enabled change:
     The IT engagement model. CISR Research Briefing, IV, Article 3D. Retrieved
     July 1, 2005, from Center for Information Systems Research (CISR) Web site:
      http://web.mit.edu/cisr/working papers/cisrwp351.pdf

Gable, J. (n.d.). What CIOs should know about records. IT Update. Retrieved July 25,
     2005 from ARMA International Web site:
      http://www.arma.org/pdf/articles/WhatCIOsShouldKnow.pdf

Gonzales-Meza Hoffman, F. & Weill, P. (2004). Banknorth: Designing IT Governance
     for a Growth-Oriented Business Environment. Retrieved July 1, 2005, from
     Center for Information Systems Research (CISR) Web site:
      http://web.mit.edu/cisr/working papers/cisrwp350.pdf

Gray, H. (2004, June). Is there a relationship between IT governance and corporate
     governance? What improvements (if any) would IT governance bring to the
     LSC? Retrieved July 5, 2005 from the IT Governance Institute Web site:
      http://www.itgi.org/template_ITGI.cfm?template=/
ContentManagement/ContentDisplay.cfm&ContentID=16236

Harris, K. J. (2000, September). Integrated Justice Information Systems Governance
     structures, roles and responsibilities: A background report. Retrieved October
     6, 2005, from http://www.search.org/files/pdf/Governance.pdf

IT Governance Institute. (2004). Board Briefing on IT Governance, 2d ed. Retrieved
     July 1, 2005, from
      http://www.itgi.org/Template_ITGI.cfm?Section=
Business,_Management_and_Governance1&Template=
/ContentManagement/ContentDisplay.cfm&ContentFileID=4667
      (also available through the Information Systems Audit and Control Association at
      http://www.isaca.org/Template_ITGI.cfm?Section=
Business,_Management_and_Governance1&Template=
/ContentManagement/ContentDisplay.cfm&ContentFileID=4667)

IT Governance Institute. (n.d.). Objectives of IT governance. Retrieved July 1, 2005
     from http://www.itgi.org/template_ITGI.cfm?Section=
Objectives&Template=/ContentManagement/
HTMLDisplay.cfm&ContentID=19661

Information Systems Audit and Control Association. (n.d.). CobiT executive summary.
     Retrieved July 21, 2005, from
      http://www.isaca.org/Template.cfm?Section=Home&Template=/
ContentManagement/ContentDisplay.cfm&ContentID=18489

Massachusetts Institute of Technology Sloan School of Management. (n.d.).
     Research projects. Retrieved July 1, 2005, from Center for Information
     Systems Research (CISR) Web site:
http://mitsloan.mit.edu/cisr/r-main.php

National Association of State Chief Information Officers. (2005, June). Connecting the
     silos: Using governance models to achieve data integration. NASCIO
     Research Brief. Retrieved July 21, 2005, from
      https://www.nascio.org/nascioCommittees
/interoperability/connectingSilos.pdf

National Criminal Justice Association. (2001). Who decides? --- An overview of how
     states are addressing delegation of authority and decision making in
     managing integrated justice information systems. Report prepared in
     collaboration with SEARCH, the National Consortium for Justice Information
     and Statistics for the Bureau of Justice Assistance. Retrieved July 1, 2005,
     from Office of Justice Program Information Technology Initiatives Web site:
      http://it.ojp.gov/manage/files/Who_decides.pdf

Ross, J. & Weill, P. (2004, June 15). Recipe for good governance. CIO Magazine,
     Retrieved July 1, 2005, from
http://www.cio.com/archive/061504/keynote.html

U.S. Department of Justice Office of Justice Programs. (n.d.). Governance. Retrieved July 1,
     2005, from Information Technology Initiatives Web site:
      http://it.ojp.gov/topic.jsp?topic_id=28

United States Army. (n.d.). Army enterprise transformation guide. Retrieved July 1,
     2005, from Army Enterprise Integration Oversight Office Web site:
      http://www.army.mil/aeioo/erp/aetg_act.htm#act3

United States General Accounting Office. (2002, October). Highlights of a GAO
     Roundtable: The Chief Operating Officer Concept: A Potential Strategy to
     Address Federal Governance Challenges. Retrieved July 1, 2005
     from http://www.gao.gov/new.items/d03192sp.pdf

Weill, P. (2004, March). Don't just lead, govern: How top-performing firms govern IT.
     Retrieved July 1, 2005, from the Center for Information Systems Research
     Sloan School of Management Web site at
      http://web.mit.edu/cisr/working papers/cisrwp341.pdf

Weill, P. & Foglia, C. (2003, July). Who makes better IT decisions-Business or IT
     managers? Center for Information Systems Research (CISR) Briefing.
     Retrieved July 1, 2005, from
      http://web.mit.edu/cisr/working papers/cisrwp340.pdf

Weill, P & Ross, J. (2004, November). IT governance on one page. Retrieved July 1,
     2005, from Center for Information Systems Research (CISR) Web site:
      http://web.mit.edu/cisr/working papers/cisrwp349.pdf

Weill, P. & Woodham, R. (2002, April). Don't just lead, govern: Implementing effective
     IT governance. Retrieved July 1, 2005, from Center for Information Systems
     Research (CISR) Sloan School of Management Web site at
      http://web.mit.edu/cisr/working papers/cisrwp326.pdf

¹ Electronic Document Management (EDM) is the computerized management of electronic and paper-based documents. It includes a system to convert paper documents to electronic form, a mechanism to capture documents from authoring tools, a database to organize the storage of documents, and a search mechanism to locate the documents.

² Electronic Records Management (ERM) uses automated techniques to manage records, regardless of format. It supports records collection, organization, categorization, storage of electronic records, metadata, and location of physical records, retrieval, use, and disposition.

³ EPA's EDOCKET is being replaced by the E-Gov Federal Docket Management System (FDMS).