Some years ago, during a major enterprise data remediation exercise, I became interested in a peculiar contradiction. Organisations could explain, sometimes with remarkable precision, how much they intended to spend acquiring new technology, yet struggled to explain the economic consequences of the information already sitting within their systems. Investment proposals were supported by financial models, implementation milestones and anticipated returns. The continued retention of millions of historical records, however, rarely received comparable scrutiny.
I have since come to regard this as one of the more revealing weaknesses in corporate information governance. Businesses have become increasingly sophisticated at acquiring, processing and monetising data, but considerably less disciplined at determining when information has ceased to justify the cost of keeping it. The distinction matters because information does not become economically harmless simply because its storage costs appear insignificant.
When cheap storage becomes expensive governance
Imagine a financial institution preparing to replace its ageing customer management platform. The executive committee has approved the business case, technology vendors have been evaluated, and management expects the investment to improve operational efficiency and customer engagement. Buried within the migration scope, however, are millions of inactive customer records, duplicate profiles and historical documents whose retention has never been properly challenged.
The immediate instinct may be to migrate everything. After all, storage is relatively cheap, historical information might prove useful, and nobody wants to be responsible for deleting something the business later discovers it needs. This apparently cautious approach can create a rather expensive contradiction. The institution is investing in modern technology while preserving the information management failures of its legacy environment.
Every unnecessary record introduces potential work. Information must be classified, mapped, cleansed, migrated, reconciled, secured and, where appropriate, made available for retrieval. Poorly governed records may complicate testing, increase programme dependencies and delay the retirement of legacy infrastructure. In some circumstances, the organisation ends up operating two environments for longer than anticipated, weakening the financial assumptions underpinning the original investment.
The board may subsequently receive an explanation for the programme’s deteriorating economics without appreciating that some of the expenditure was avoidable before implementation began.
The balance sheet question
It is tempting to describe unnecessary information as a balance sheet liability. Economically, that description captures something important, but technically it requires qualification. Under financial reporting standards, an obligation does not become a recognised liability simply because information is being retained. Recognition depends on the existence of a qualifying obligation and the applicable accounting requirements.
Nevertheless, the financial consequences of excessive retention are substantial enough to warrant board attention.
Consider three areas. First, operating expenditure increases where unnecessary information requires additional infrastructure, backup capacity, licensing, administration and security controls. Second, capital expenditure on transformation programmes may be inflated when obsolete information is included in migration and modernisation activities. Third, failures involving retained information can generate investigation costs, litigation expenses, customer remediation obligations and regulatory exposure.
Depending on the facts, some consequences may require recognition as provisions, disclosure as contingent liabilities, or assessment for impairment. Others will simply reduce profitability and operating cash flow. In every case, the economic question is broader than the price of a terabyte of storage.
The relationship between retention and financial exposure can be illustrated through a hypothetical business case. Suppose a company plans to migrate ten million customer records at a total programme cost of £2 million. A preliminary assessment establishes that 30 percent of the records are duplicates, obsolete or no longer required, subject to legal and regulatory verification. If the organisation can safely remove those records before migration, it may avoid certain cleansing, processing, reconciliation and ongoing support costs. The savings will not necessarily equal 30 percent of the programme budget because many transformation costs are fixed. However, a properly constructed cost model could identify genuine reductions in variable expenditure, delivery complexity and future operating costs.
That is the analysis finance directors should expect before approving the investment.
Retention is also a question of risk appetite
There is another consideration that deserves more attention. Information retention decisions are frequently made at an operational level, although their consequences can extend across the entire enterprise.
A business unit may prefer indefinite retention because historical information offers convenience. Technology teams may resist deletion because dependencies are poorly understood. Legal and compliance functions may understandably insist on preservation where statutory obligations, contractual requirements, litigation holds or regulatory expectations apply.
Each position may be defensible individually. The problem arises when nobody reconciles them into a coherent enterprise decision.
Under data protection laws, the storage limitation principle requires personal data to be kept in identifiable form for no longer than necessary for its purposes, subject to applicable exceptions. The law does not prescribe one universal retention period, nor does it require indiscriminate deletion. Effective governance therefore depends on documented purposes, appropriate retention rules, defensible exceptions and evidence that those rules operate in practice.
For boards, the central issue is accountability. Who decides that information has ceased to serve a legitimate purpose? Who authorises exceptions? Who challenges retention decisions that impose costs on the wider business? More importantly, who provides assurance that information scheduled for deletion has actually been deleted, rather than merely hidden from ordinary users?
A retention policy is an expression of management intent. Evidence of controlled deletion is proof of operational execution. The difference is significant.
What directors should demand from management
The solution does not begin with purchasing another governance platform. It begins with understanding the information estate and making deliberate decisions about its economic and regulatory value.
I would recommend that boards require management to establish a baseline of retained information across critical systems, including the volume, age, ownership, sensitivity and documented purpose of relevant records. This exercise should identify systems with excessive retention, duplicate information, uncertain ownership and material dependencies on legacy infrastructure.
The second priority should be financial transparency. Finance and technology leaders should jointly develop a credible cost model covering storage, backup, licensing, retrieval, administration and transformation expenditure. The objective is not to attach an arbitrary price to every record, but to distinguish genuinely avoidable expenditure from fixed costs and to identify opportunities for measurable savings.
Third, organisations should integrate retention and deletion requirements into technology investment governance. Before approving a major CRM migration, cloud transformation or data platform investment, investment committees should receive evidence that the proposed information scope has been challenged. Migrating unnecessary information should be a conscious, justified decision rather than the default position.
Fourth, deletion controls should be tested. Management should demonstrate that approved schedules translate into operational processes, that exceptions are documented, and that disposal activities produce reliable evidence. Where automation is feasible, it should reduce dependence on manual intervention. Internal audit and second-line assurance functions should assess whether those controls operate effectively.
Finally, boards should demand management information that connects information governance to enterprise outcomes. Useful indicators include the proportion of records with approved retention rules, overdue deletion volumes, the age of unresolved exceptions, verified disposal completion rates, and the financial benefits attributable to remediation.
These measures allow directors to assess whether the organisation is reducing exposure or merely producing another set of attractive governance dashboards.
A different understanding of information value
The modern corporation has spent years being encouraged to regard information as an asset. There is considerable truth in that proposition. High-quality information can strengthen customer relationships, improve decision-making, support innovation and generate commercial advantage.
But an asset is valuable because of the economic benefits it can deliver, not because an organisation has accumulated a large quantity of it. Information that has become inaccurate, irrelevant, legally unjustified or operationally burdensome may no longer contribute positively to enterprise value.
There is a lesson here for boards contemplating increasingly expensive investments in artificial intelligence, analytics and enterprise data infrastructure. The commercial benefits of sophisticated technology depend, in part, on the quality and governance of the information supporting it. Enlarging an already poorly governed information estate may amplify existing weaknesses rather than resolve them.
The responsibility of directors is therefore not simply to ask whether their organisations are collecting enough information to compete. They must also ask whether management understands the cost, value and risk associated with information already held.
Good governance is not measured by how much information a company can preserve. It is demonstrated by its ability to justify what it keeps, account for what it costs, and dispose of what no longer serves a legitimate purpose.
For boards concerned with sustainable enterprise value, that is not a technical discussion. It is financial stewardship.
- business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.comÂ
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
A mortgage market to tackle Nigeria’s housing challenge