1. © Huron Consulting Group. All rights reserved Confidential Information. Experience. Redefined. BOSTON CHARLOTTE CHICAGO HOUSTON LOS ANGELES NEW YORK SAN FRANCISCO WASHINGTON D.C. RIM Risk Assessment What is it? Why does it matter to you and your organization? What can you do about it? Presentation to ARMA Charlotte, NC Chapter May 15, 2008 Edward Nwachi, JD, CRM Manager, Legal Consulting (202) 585-6834 enwachi@huronconsultinggroup.com

2. © Huron Consulting Group. All rights reserved Confidential Information. 2 RIM Risk Assessment Defined Probability + Adverse event + Negative impact = Risk

3. © Huron Consulting Group. All rights reserved Confidential Information. 3 RIM Risk Assessment Defined A methodology...... for identifying risk factors present in an organization... evaluating probability and severity of potential loss,... and recommending actions required to control risks

4. © Huron Consulting Group. All rights reserved Confidential Information. 4 RIM Risks: What are we really assessing? Information Management Risks? –Information risk –Operational risk –Legal risk –Strategic risk

5. © Huron Consulting Group. All rights reserved Confidential Information. 5 RIM Risks: What are we really assessing? Consider corporate interests and priorities: –Productivity –Profitability –Aggressive growth –Downsizing –Fighting off competition –Community goodwill –Mergers & Acquisition preparation –Surviving adverse publicity –Advancing/Protecting legal rights –Protecting assets

6. © Huron Consulting Group. All rights reserved Confidential Information. 6 Why does it matter? Information risk assessment helps mitigate risks from poor RIM practices Awareness of corporate risks enables RIM professionals to: –Align with the interests and priorities of the organization –Understand corporate risks that drive the need for good RIM practices –Show how good RIM practices can help mitigate these risks

7. © Huron Consulting Group. All rights reserved Confidential Information. 7 Why does it matter to you? Position your RIM program as a strategic asset Lay a more solid foundation for your RIM initiative Be a more effective advocate

8. © Huron Consulting Group. All rights reserved Confidential Information. 8 What can you do? Know your organization Assess findings against “best practices” and corporate interests/priorities Ensure that recommendations are practical and reflect corporate priorities

9. © Huron Consulting Group. All rights reserved Confidential Information. 9 What can you do? Know your organization –10K filings (for publicly traded companies) –AMLaw 100/200 (for law firms) –Pacer, Lexis-Nexis, Westlaw and other legal research tools –Business/Trade journals –General internet research –Internal policies –Personnel interviews –Data/Systems inventory

10. © Huron Consulting Group. All rights reserved Confidential Information. 10 What can you do? Assess findings against “best practices” and corporate interests/priorities –“Best practice” is useful but relative –Leverage knowledge of corporate interests/priorities in your analysis

11. © Huron Consulting Group. All rights reserved Confidential Information. 11 What can you do? Ensure that recommendations: –Are practical –Leverage your knowledge of the organization –Reflect corporate priorities

12. © Huron Consulting Group. All rights reserved Confidential Information. 12 Use Cases FindingsRisksBest Practices / Recommendations? E-mail is retained on backup tapes indefinitely. Increasing costs. Increasing discovery risk for unrelated matters. (1) Implement backup procedures designed for business continuity and disaster recovery purposes only (2) Implement discovery mgt. software solution for targeted preservation that does not rely upon use of backup tapes (3) Rotate backup tapes every 30 days (4) Review legacy backup tapes

13. © Huron Consulting Group. All rights reserved Confidential Information. 13 Use Cases FindingsRisksBest Practices / Recommendations? No guidance for the storage and management of e-records, so users default to their own personal preferences. Information retrieval for business operations and eDiscovery are adversely impacted by the variety of ways in which information is managed. (1) Implement uniform document storage and management practices (2) What would you recommend? (3) What would you recommend?

14. © Huron Consulting Group. All rights reserved Confidential Information. 14 Questions?

15. © Huron Consulting Group. All rights reserved Confidential Information. 15