GARP Maturity Model, Information Governance Maturity Model, Metrics, accountability

ARMA International Maturity Model for Information Governance

A Picture of Effective Information Governance

The Maturity Model for Information Governance begins to paint a more complete picture of what effective information governance looks like. It is based on the eight GARP ® principles as well as a foundation of standards, best practices, and legal/regulatory requirements.

GARP ®
Principle

Level 1
(Sub-Standard)

Level 2
(In Development)

Level 3
(Essential)

Level 4
(Proactive)

Level 5
(Transformational)

Accountability
A senior executive (or person of comparable authority) oversees the recordkeeping program and delegates program responsibility to appropriate individuals. The organization adopts policies and procedures to guide personnel, and ensure the program can be audited.

No senior executive (or person of
comparable authority) is responsible
for the records management
program.

The records manager role is largely
non-existent or is an administrative
and/or clerical role distributed
among general staff.

No senior executive (or person of
comparable authority) is involved in
or responsible for the records management
program.

The records manager role is
recognized, although he/she is
responsible for tactical operation of
the existing program.

In many cases, the existing
program covers paper records only.

The information technology function
or department is the de facto
lead for storing electronic information,
but this is not done in a
systematic fashion. The records
manager is not involved in
discussions of electronic systems.

The records manager is an officer
of the organization and is responsible
for the tactical operation of
the ongoing program on an
organization-wide basis.

The records manager is actively
engaged in strategic information
and record management initiatives
with other officers of the organization.

Senior management is aware of the
program.

The organization has defined
specific goals related to
accountability.

The records manager is a senior
officer responsible for all tactical
and strategic aspects of the
program.

A stakeholder committee representing
all functional areas and chaired
by the records manager meets on a
periodic basis to review disposition
policy and other records management-
related issues.

Records management activities are
fully sponsored by a senior
executive.

The organization’s senior management
and its governing board place
great emphasis on the importance
of the program.

The records management program
is directly responsible to an individual
in the senior level of management,
(e.g., chief risk officer, chief
compliance officer, chief information
officer) OR,

A chief records officer (or similar
title) is directly responsible for the
records management program and
is a member of senior management
for the organization.

The organization’s stated goals
related to accountability have been
met.

For each principle, the maturity model associates various characteristics that are typical for each of the five levels in the model:

Level 1 (Sub-standard): This level describes an environment where recordkeeping concerns are either not addressed at all, or are addressed in a very ad hoc manner. Organizations that identify primarily with these descriptions should be concerned that their programs will not meet legal or regulatory scrutiny.

Level 2 (In Development): This level describes an environment where there is a developing recognition that recordkeeping has an impact on the organization, and that the organization may benefit from a more defined information governance program. However, in Level 2, the organization is still vulnerable to legal or regulatory scrutiny since practices are ill-defined and still largely ad hoc in nature.

Level 3 (Essential): This level describes the essential or minimum requirements that must be addressed in order to meet the organization's legal and regulatory requirements. Level 3 is characterized by defined policies and procedures, and more specific decisions taken to improve recordkeeping. However, organizations that identify primarily with Level 3 descriptions may still be missing significant opportunities for streamlining business and controlling costs.

Level 4 (Proactive): This level describes an organization that is initiating information governance program improvements throughout its business operations. Information governance issues and considerations are integrated into business decisions on a routine basis, and the organization easily meets its legal and regulatory requirements. Organizations that identify primarily with these descriptions should begin to consider the business benefits of information availability in transforming their organizations globally.

Level 5 (Transformational): This level describes an organization that has integrated information governance into its overall corporate infrastructure and business processes to such an extent that compliance with the program requirements is routine. These organizations have recognized that effective information governance plays a critical role in cost containment, competitive advantage, and client service.