Content uploaded by Valarie Findlay
Author content
All content in this area was uploaded by Valarie Findlay on Jan 03, 2015
Content may be subject to copyright.
What’s It Worth to You? Determining the True Cost and
Value of Information
In 2009, the Treasury Board of Canada issued a directive to help ensure effective
recordkeeping practices enabling departments to create, acquire, capture, manage and
protect the integrity of information resources of business value to Government of
Canada programs and services. Currently, numerous departments are engaged and
work is well in hand on this directive and several aspects are being systematically
addressed under the scope of effective recordkeeping practices.
This directive addresses the identification of information resources of business value
based on analysis of departmental functions and activities, the establishment and
implementation of key methodologies, mechanisms and tools that support the
departmental recordkeeping requirements, proper documentation of recordkeeping
practices of accountability, stewardship, performance measurement, reporting and legal
requirements, and timely communication with departmental managers and employees
on the risks associated with poor recordkeeping.
Along this line of thinking, this article explores an inferred but often overlooked exercise
– the determination of the true cost (storage, security, disposition, etc.) of information
recordkeeping, the value of that information and why it is important to go beyond the
longstanding standards of sensitivity and classification (secret, top secret, etc.) of
information. (Note, for the purposes of this article, recordkeeping refers to the creation,
duplication, storage, security and overall management of information.)
On top of information security considerations and defining correct threat-based
assessments and countermeasures (as opposed to risk-based), understanding the value
of information and the costs associated with it is crucial. Generally notional concepts,
establishing measurable criteria can be an exercise unto itself.
However, it is entirely feasible to develop this into a modeled approach which can be
implemented into any departmental system, independent of technology. Industry and
private sector has already recognised valuation as a critical step in not only justifying
spending on recordkeeping measures but also to ensure that the value of information is
congruent with the countermeasures applied to storing, sharing and securing it.
First, let’s take a look at the cost of recordkeeping and what industry findings on
recordkeeping and information management have revealed.
The Keeping Cost: Hidden and Unburdened Impacts
A significant amount of revenue is spent on managing document production, distribution
and associated devices – IDC estimated in up 10% of revenue of private companies.
Government departments would see a similar number.
Further to that, a recent study by BAE Systems discovered that “about 80% of all
workers waste an average of half an hour every day, retrieving information while almost
60% expend an hour or more duplicating the work of others” and a InfoTrends/CAP
Ventures Study indicated that organizations estimated that they spend an average of 3%
of their annual revenues on duplication - copying, printing and faxing. Other research
reveals that actual document expenditures (including hardware, supplies, and “people”
costs) averaged 6% of annual revenues across all industries.
An independent breakdown of the data revealed that only 10% of office document
burdened costs relate to equipment, supplies, and service expenses - for every $1
spent on equipment, supplies, and service, another $9 is spent on other burdened
costs: IT support and infrastructure, procurement, facility costs, end-user interaction
time and document management expense. 1 Finally, IDC estimates that an organization
with 1,000 knowledge workers wastes between $2.5 - 3.5 million a year in superfluous or
erroneous document related activity.2
To bring this spending into perspective, ask yourself: would you go to the same lengths
– effort and cost – to secure and protect a possession that is of no appreciable or
inherent value, as you would for one that is? We do this all of the time in recordkeeping
and information management: we hoard information and data as if it were all of the same
business value often with the overused refutation, “space is cheap”.
But it is more than space that makes up the cost of recordkeeping and information
management.
1 Assessing & Benchmarking Document Costs: Developing a Future Strategy
2 MetricsStream
2 D. Moody, 2004-5; Glazer, 1993
True Value: The Courage to Peel the Onion
In formulating information value, meaningful criteria is crucial, therefore, I utilize the
Seven Laws of Information3, among other industry mainstays, and develop categorical
elements that increase and decrease the value of information and then I apply the cost
of that information as a formula to establish it as a cost-valued asset.4 As an example,
the Seven Laws of Information state, in general, that, all information would follow these
Laws:
1. Sharing: The sharing (where it is deemed to be required and necessary) of
information multiplies its value; the more people who use it, the more
value/benefit can be extracted from it.
2. Duplication: The duplication of information does not increase its value but
instead increases the costs associated with it and replication and redundancy
increases maintenance costs. Therefore, the need to duplicate and store multiple
copies of information acts as a decrease to its value.
3. Integrated Data: The more integrated information is or where there is a
dependency on it by other information, the more valuable it is.
4. Accuracy: The more accurate information is, the more valuable it is.
5. Depreciation: Unlike most assets, information is subject to reverse depreciation
in that the more it is used, the more valuable it is, known as increasing value to
use.
6. Depletion: Unlike most assets, information is not depletable.
7. Overabundance: Overabundance reduces information value. Psychological
evidence shows that humans have a strictly limited capacity for processing
information and when the amount of information exceeds these limits, information
overload ensues and comprehension (Lipowski, 1975) and decision making
ability degrades rapidly at the saturation point (O’Reilly, 1980; Driver and Mock,
1975; Jacoby et al, 1974).
4Peter Walsh and Daniel Moody, Measuring The Value Of Information: An Asset Valuation Approach
Using sharing, duplication, integration, accuracy, reverse depreciation, lack of depletion,
and human-driven overabundance as markers that can be comprehensively valued and
scored sets the foundation for valuation.
Modelling Cost and Value
Comparative value and cost criterion can be developed into a model that follows a
prescriptive framework that reveals the cost benefit and return on investment. But it
doesn’t stop there: this data should then become the “business case” used to drive and
apply counter measures, such as operational, infrastructure, policy and procedure
controls and enhancements that constrain information management practices.
The broad scope of change should allow for the supports to institute appropriate
securing of information, appropriate role-based access and controls, targeted training,
and if necessary the implementation of information classification based on value and
cost scoring.
In this climate of charged security and resource reductions and emphasis on cost
savings, government and business can no longer afford to dismiss the importance of
revisiting and properly assessing information value and recordkeeping costs and
auditing current, long-standing practices for appropriateness and effectiveness.
Not for the faint-of-heart and often change will not occur until “the pain of staying the
same exceeds the pain of making the change itself”. But it appears we are all standing at
the edge of this abyss sided with equal pain – but one has cost and the other has value.
All rights reserved. © Copyright 2013
Valarie Findlay is an independent security consultant with HumanLed Inc. (www.HumanLed.com).
She has over a decade of experience as a federal government consultant in the security arena.
Ms Findlay holds several security accreditations related to infrastructure, resources, information
and technology and keeps up to date on federal initiatives relating to information management,
cyber-security and identify assurance and federating . She has completed a University certificate
in Critical Infrastructure Protection and is currently completing her masters degree in Terrorism
Studies. She can be contacted at vfindlay@humanled.com or 613-798-3746.