Institutional knowledge: capture is only half the job

Institutional knowledge is the working memory of a company. It is the reason a system was built the way it was, the exception that applies to one client, the step that never made it into the manual. Most of it sits with people. Some of it is written down. Very little of it carries a name and a date.

Every guide on the subject gives the same advice: capture it before the person leaves. That advice is sound, and it is incomplete. Capture is where the work starts.

What institutional knowledge is, and what it is not

Institutional knowledge is the mix of documented procedure and undocumented judgment a company actually runs on. Some of it lives in files. Some lives in habit. The line that matters is not written against unwritten. It is governed against ungoverned.

An ungoverned document is one nobody owns. No approver, no review date, no link back to the source it came from. It may well be correct. The point is that you cannot tell, and neither can anything reading it on your behalf.

The capture wave is real, and it has been measured

The numbers behind the current interest are not vague. APQC surveyed 1,000 organizations in a study sponsored by eGain and found that 92 percent do not consistently capture knowledge from soon to be retirees, and that 85 percent have not operationalized AI to automate knowledge management work. APQC also found that 58 percent of C suite respondents were very worried about the loss. See the survey summary.

Deloitte frames the same shift demographically. More than 30 million Americans will turn 65 within four years, and average job tenure has fallen from 4.6 years to 3.9 over the past decade. Read the analysis. Deep organizational memory is being drawn down faster than it is being rebuilt.

Capture is where most programs stop

A capture program produces artifacts. Interview transcripts. Process write ups. Recorded walkthroughs. A folder that did not exist last quarter, filling steadily.

None of that answers the questions a reviewer asks. Who signed off on this. Which version of the source did it come from. Has anything changed underneath it since. An artifact missing those fields is a record of what one person said once, and it ages without telling anyone.

This is the quiet failure mode of a successful capture push. The program hits its target, the documents exist, and the organization is now carrying a larger body of material that nobody has attested to.

Regulators have always asked more of written knowledge

This standard was not invented for AI. The MHRA's guidance on GxP data integrity expects records to be attributable, legible, contemporaneous, original and accurate, which is another way of saying that a document is worth only as much as the name, date and source attached to it. See the guidance.

Regulated industries have applied that test to procedures, batch records and training files for decades. Nothing about it softens when the reader is a model rather than a person.

What changes when an AI assistant reads it

An assistant does not weigh a document's credibility. It retrieves what matches the question and writes fluent prose around it. A superseded procedure and the current one look much alike to a retrieval system. Whichever it reaches first becomes the answer.

So the weakness in a capture only program does not stay contained in a folder. It gets restated, in confident language, to whoever asked, and now it is an answer your organization gave.

What the instruments actually require

Regulators are describing the same concern from the system side. The EU AI Act sets data governance expectations for high risk systems in Article 10 and requires automatic logging across a system's lifetime in Article 12. Article 10 and Article 12 are both short and worth reading in full.

NIST's Generative AI Profile goes further and names information integrity as a risk category in its own right, distinct from privacy or security. See the profile.

A note on what software can and cannot claim

These instruments describe what an organization has to be able to demonstrate. Software can align with them and supply the evidence that supports a demonstration. No product, this one included, confers compliance on the company using it, and any vendor saying otherwise is selling you a sentence rather than a control.

What usable institutional knowledge carries

The difference between a captured document and a usable one is a small set of fields, applied consistently.

• An approver. A named person who signed off, not a team inbox or a shared drive.
• A date. When it was approved, and when it next falls due for review.
• A source. The document, system or conversation the entry was drawn from.
• A version. Which one the answer drew on at the moment the answer was given.
• A signal when that source moves, so a person can decide what the change means.

The last one deserves care. A governed knowledge base should tell you when something it depends on has changed. It should not quietly rewrite itself and present the result as current. A system that edits without telling you has removed the one thing the approver was there to provide, which is a person standing behind the wording.

That is the shape of the Cognatum Knowledge Loop, where AI does the maintenance work across eight steps and a named human still approves what goes out.

Where to start

Start narrow. Deloitte's recommendation is to resist documenting everything and instead find the areas that are both mission critical and poorly documented, then work those first. Their five step process is a reasonable map.

Apply the fields above to that narrow set before widening it. A small governed knowledge base is more useful to an AI assistant than a large ungoverned one, because the assistant can say where the answer came from and who stands behind it.

Capturing institutional knowledge keeps it from walking out the door. Governing it is what makes it answer for itself. Knowledge governed. Intelligence everywhere.