Improving Information and Document Governance in Financial Services

Financial services businesses hold sensitive client information across multiple systems. LOOKUP helps firms create a governed, searchable and structured information environment — one that supports collaboration, compliance, security and AI readiness without becoming a document management burden.

The two-minute answer

How should a financial services business manage client information and documents? By creating a governed information environment with clear authoritative systems, consistent ownership, appropriate permissions, searchable structure, controlled sharing, lifecycle governance and reliable retrieval.

Financial services information typically exists across CRM, practice or advice platforms, Microsoft 365, email, SharePoint, OneDrive, client portals, document systems, accounting and other SaaS applications. Without governance, information becomes fragmented, duplicated and difficult to find — and permissions accumulate over time until access no longer reflects actual business responsibility.

The objective is not simply to move files to SharePoint. It is to create an information architecture where documents are easy to find, appropriately protected, consistently structured, easy to collaborate on, governed throughout their lifecycle and ready to support future automation and AI.

Why information becomes fragmented

Information fragmentation is rarely deliberate. It accumulates as businesses grow, adopt new systems and adapt to changing workflows. Common causes include:

Define authoritative systems

Not every system should become the system of record. A financial services business should define which platform is authoritative for each information type — and ensure staff understand where information belongs.

For example, the CRM may be authoritative for client relationships and contact details. A practice or advice platform may be authoritative for advice records and compliance files. SharePoint may be authoritative for collaborative documents and internal knowledge. Email is communication, not a record system.

Defining authoritative systems reduces duplication, clarifies ownership and makes it easier for staff to find the right information in the right place — rather than searching across email, drives and multiple platforms.

Client-centric information architecture

Financial services information should be organised around the entities the business actually works with — clients, relationships, services, records, documents and communications. The precise structure should reflect how the firm operates, not an arbitrary filing model.

This page does not prescribe a universal folder structure. The right architecture depends on the firm's systems, workflows, regulatory obligations and service model.

CRM, specialist systems and Microsoft 365

Financial services businesses commonly use CRM, practice or advice platforms, document management systems, accounting and Microsoft 365. These systems play complementary roles — and information governance should span all of them, not just one.

The CRM may hold client relationships and contact data. A practice platform may hold advice records and compliance files. Microsoft 365 — SharePoint, Teams and OneDrive — may hold collaborative documents, internal knowledge and communication. Each system has a role, and the objective is to improve the workflow between them rather than force every information type into a single platform.

LOOKUP does not recommend replacing specialist financial-services software unnecessarily. The right approach is to define which system is authoritative for each information type, then improve integration, permissions and governance across the ecosystem.

SharePoint and financial-services information

According to official Microsoft documentation, SharePoint provides document libraries, metadata, permissions, version history, external sharing controls and retention policies. When properly configured, SharePoint can serve as a governed collaboration and document layer for financial services businesses.

However, SharePoint does not automatically satisfy regulatory recordkeeping obligations. Firms should review their specific obligations and configure retention, permissions and information protection accordingly. Poorly governed SharePoint can create oversharing risk — broad permissions inherited across sites and libraries may expose sensitive information more widely than intended.

Learn how LOOKUP helps financial services businesses optimise Microsoft 365 →

Email should not become the only information repository

Email is a communication tool, not a record system. When client documents, advice records and service information live primarily in inboxes, the business loses visibility, governance and control.

Email is difficult to search, govern, secure and retain. Attachments create duplicate copies. When staff leave, their mailbox goes with them. And when a client asks for a document, staff often cannot find it without searching through months of correspondence.

The objective is not to eliminate email — it is to ensure that authoritative information lives in governed systems, with email used for communication and linking rather than storage.

Version control and authoritative records

Version uncertainty is one of the most common information problems in financial services businesses. When documents are emailed as attachments, multiple copies circulate and staff cannot identify which version is current. This creates risk — particularly for advice documents, compliance records and client agreements.

Co-authoring, version history and controlled review within governed systems — SharePoint, a specialist DMS or a practice platform — reduce version uncertainty. Linking to documents rather than attaching them ensures everyone works from the current version.

The business objective is to reduce uncertainty over which document is authoritative — not to eliminate human error entirely, but to create an environment where the authoritative version is clear.

Permissions and sensitive information

Permissions accumulate over time. Staff change roles, take on new responsibilities and leave the business — but their access is not always reviewed or reduced. Broad, inherited permissions create unnecessary risk and make it harder to demonstrate appropriate information governance to clients, insurers and regulators.

Financial services businesses should implement least-privilege access, review permissions regularly, and manage joiners, movers and leavers promptly. Sensitive client information may require additional access restrictions beyond standard permissions.

For deeper guidance on protecting client information through identity, access and governance controls, see our guide to protecting client information in a financial services business.

Secure client collaboration

Financial services businesses need to share information with clients — documents, advice, statements and correspondence. The method of sharing matters as much as the information itself.

The right approach depends on the firm's systems, risk profile and client requirements. Not every client needs portal access — but every client should have a secure way to receive and share sensitive information.

Retention and disposal

Information retention is a governance issue, not just a storage issue. Keeping information longer than necessary increases risk and clutter; disposing of it too early may breach regulatory or professional obligations.

Retention requirements differ by entity type, licence, activity, record type and regulatory regime. A financial advice practice, a credit business, an APRA-regulated entity and a mortgage broker may all have different retention obligations. There is no single universal retention period for all financial services businesses.

Businesses should confirm their specific retention obligations with appropriate professional advisers and configure retention and disposal policies accordingly. This page does not prescribe retention periods and is not legal, regulatory or compliance advice.

Information governance is an AI-readiness issue

AI tools such as Microsoft 365 Copilot work within a user's existing permissions. According to official Microsoft documentation, Copilot accesses information based on the user's existing Microsoft 365 permissions.

This means that information governance directly affects AI usefulness and risk. If information is poorly structured, permissions are overly broad or documents are scattered across ungoverned locations, AI may produce less useful results and increase the risk of oversharing. Good governance — permissions, quality, authority, structure and searchability — is a prerequisite for effective AI adoption.

For a broader treatment of AI readiness for financial services businesses, see our Preparing a Financial Services Business for AI Business Outcome.

Information governance improves workflow

Information governance and workflow efficiency are connected. When information is structured, searchable and governed, staff spend less time searching, duplicating and re-keying — and more time on client service and advice.

For guidance on reducing administrative friction through better workflows and automation, see our guide to reducing administrative overhead in a financial services business.

For guidance on structuring the client onboarding journey with secure information collection, see our guide to improving client onboarding and service workflows.

How this maps to the LOOKUP Business Modernisation Framework™

Information and document governance is not a one-off project. It follows the same structured approach as every LOOKUP engagement.

What success looks like

Strong information and document governance creates qualitative business outcomes — not just a tidier filing system.

Research and regulatory context

The Australian Securities and Investments Commission (ASIC) provides guidance on cyber resilience for financial services licensees, including expectations around information security and governance.

The Office of the Australian Information Commissioner oversees the Privacy Act and the Notifiable Data Breaches scheme. Whether these obligations apply depends on the organisation, the information held and the business activities undertaken.

The Australian Prudential Regulation Authority (APRA) publishes prudential standards on information security applicable to APRA-regulated entities. CPS 234 does not apply to every financial adviser or financial-services business.

Microsoft's official documentation details SharePoint permissions, sharing and information governance capabilities. Microsoft Purview provides information protection capabilities including sensitivity labels, data loss prevention and information classification — with capabilities dependent on configuration and licensing.

See how information governance connects to AI readiness for financial services businesses →

For broader guidance on cyber security, recovery and operational resilience, see our guide to strengthening cyber and operational resilience in financial services.

For industry-specific technology guidance, see our Financial Services industry page.

Illustrative business outcome

Frequently asked questions

What business leaders should do next

To bring information governance into a coordinated technology strategy, see our guide to building a technology roadmap for a financial services business.

Executive guides

How LOOKUP can help

LOOKUP helps financial services businesses understand their current information environment, design better document structures, improve Microsoft 365 governance, strengthen permissions, improve collaboration, integrate workflows, prepare information for AI and develop a practical technology roadmap.

Sources & Further Reading

Turn Business Information Into a Governed Business Asset

LOOKUP helps financial services businesses improve information and document governance, strengthen Microsoft 365, reduce administrative friction and build better foundations for secure automation and AI.