The Quiet Risk in Every Shared Drive
Almost every organization has one, and almost everyone trusts it more than they should: the shared drive. The G: drive, the team folder, the cloud workspace that "has everything." It feels like order - a single place where the work lives. But a shared drive is not a records system. It is a room with no walls, filling up for years with whatever anyone dropped in, and the longer it runs, the more it quietly becomes the biggest un-owned liability in the building.
The risk is hard to see precisely because the drive works well enough day to day. You can usually find the file you touched last week. What you can't see is the accumulation underneath: the duplicates, the stale versions, the folders belonging to people who left, and the sensitive documents sitting in plain view of everyone with access. That accumulation is the liability, and it only announces itself at the worst possible moment - a breach, an audit, a legal hold, a records request.
What's actually in there
Pull apart a shared drive that has run for a few years and the contents are remarkably consistent across organizations:
Duplicates - the same document saved three times, in three folders, at three slightly different stages, with no way to tell which is current.
Orphans - files and whole folders owned by people who have left, that no one has looked at or can vouch for in years.
Stale versions - the "final," the "final_v2," the "final_ACTUAL," living side by side so the wrong one is always one click away.
Sensitive documents - contracts, personnel files, banking details - readable by far more people than anyone intended, because access was granted broadly and never revisited.
Why convenience became exposure
The shared drive got this way for an understandable reason: it optimized for the wrong thing. It made saving easy and finding easy for the person who just saved. It never made ownership clear, never expired anything, never checked who could see what. Convenience compounded, year over year, into exposure - and because nothing ever broke visibly, no one had a reason to look. The drive's greatest danger is that it feels safe right up until the moment it very much isn't.
The point isn't to fear your shared drive; it's to stop mistaking it for a system of record. A real records system knows who owns each document, which version is current, when something should be disposed of, and who is allowed to see it. A shared drive knows none of that. The question worth sitting with is simple and uncomfortable: if a regulator, a lawyer, and a departing employee all reached into your shared drive tomorrow, what would they find - and who, exactly, would be accountable for it?
That question has an answer today, whether or not anyone has asked it. The organizations that sleep well are the ones that answered it on their own terms first - by treating their records as something governed, not just something stored. That is the entire difference between a drive and a system, and it is the difference that shows up on the day the records finally matter.
This is the through-line behind everything we publish - more from The Records Test is here.
