Public Records Act 2005 Audit Tool

Engagement Overview

March 2009

Kate Jones, Senior Advisor, Government Recordkeeping Programme

Environment

• Recordkeeping (especially digital) at a low base• Agencies are putting in a lot of effort (… but the operating

environment is becoming more complex)• Large IT re-developments provide the opportunity to embed

good recordkeeping practices into business systems• We are all learning how to undertake ‘fit for purpose’ digital

recordkeeping• Improving awareness of the business benefits of good

recordkeeping• Audits are new and we need to ensure that they are a

productive recordkeeping tool and not seen as something in addition to good business practice

• Adverse economic outlook reinforces the need for a focus on recordkeeping productivity

Public Records Act 2005

• Democratic accountability (Crown to the public)

• Management accountability (agencies to the Crown)

• Collective memory and historical heritage

• Good management

Public Records Act Compliance Framework

Audit

Standards

Inspection

Direction to report

Annual Report to Parliament

Archives New Zealand must undertake independent audits of recordkeeping in public offices from 2010(PRA s33)

The Chief Archivist may issue standards in relation to public records. It must be stated who they apply to and if they are mandatory or discretionary. Consultation must be undertaken before issue (PRA s27)

Archives New Zealand has the right to inspect the archives and records of public offices and local authorities (PRA s29)

The Chief Archivist must report annually to Parliament on the state of recordkeeping in public offices (PRA s32)

Public offices can be directed to report on any aspect of recordkeeping or on the records they control (PRA s31)

Reminder of the Audit Process

• The Public Records Act requires Archives New Zealand to commission audits of recordkeeping in public offices

• Audits to begin 2010/2011

• 200 core state sector entities will be audited

• Audits occur on a 5 year cycle• Audits based on key requirements of the Public Records Act

– Create and maintain public records

– Disposal (destroy and transfer etc) of public records

• Audit programme includes state schools. Approach to auditing schools is yet to be determined. Schools are not subject to the mandatory standards

• Local authorities are not covered by the audit programme

Audit Programme Positioning

• Audits should support good productive recordkeeping practices that add business value

• Audits should support continuous improvement

• Audits should support ongoing self assessment

• Audit expectations will change over time (10 -15 years) once recordkeeping capability becomes well established and public offices integrate recordkeeping requirements within timetabled business system redevelopment

Some Challenges

• Recordkeeping is organisationally pervasive – assessment of overall capability will ultimately be a matter of auditor judgement

• Constrained audit resources

• Wide range of public offices (i.e. size and functions)

• Variable recordkeeping practices within agencies

Audit Tool Objectives

• Reflect and represent requirements of the Public Records Act and related mandatory standards

• Facilitate a constructive self assessment process (i.e. the PRA audit process should not be a “mystery or a surprise”!)

• Encourage continuous improvement against ongoing recordkeeping action plans

Audit Tool Structure

• The Audit Tool reflects a high level recordkeeping solution• 8 functional areas that reflect generic business practices e.g.

planning, resourcing, training etc

• The Audit Tool has 3 assessment levels for each functional area• A discriminating assessment rather than a binary assessment

(i.e. pass/fail) e.g. initiation, establishment, improving capability

• Audit effort will depend on the function of the public office

Overview of Audit Tool

PRA &

Mandatory Standards

Business Themes

Attributes Evidence

Requirements are vertically represented (i.e. not horizontal / immediate compliance approach)

8 Areas:

Planning

Resourcing

Training

Reporting

Create / Capture

Access / Security

Maintain / Storage

Disposal / Transfer

3 Levels:

Reflecting increasing capability (consistent with good business practices)

Broadly describe applicable operational recordkeeping practice

Representative or indicative (not exclusive!)

Audit process essentially testing either 100% (policy) or sampling (process)

Outcomes for Each Functional Business Area

1. Planning Recordkeeping functions and activities are systematically defined and have a planned outlook (forward work programme)

2. Resourcing The public office has defined and provided the necessary resources to achieve appropriate level of recordkeeping capability

3. Training Staff are adequately trained to achieve the public office’s recordkeeping requirements

4. Monitoring & Review The public office regularly monitors and effectiveness of its recordkeeping practices

5. Create & Capture The public office’s business activities and decisions are appropriately recorded

6. Retrievability & Security

Records are secure and can be used when required

7. Maintenance & Storage

Records are maintained in a manner consistent with their format and value

8. Disposal & Transfer Records are only retained by the public office for as long as required and are disposed of appropriately

Functional Area Structure - Training

Level One A recordkeeping training needs analysis has been undertaken

Level Two A recordkeeping training plan has been implemented

Level Three Staff recordkeeping training is regularly reviewed

Functional Area Structure – Create & Capture

Level One An analysis of the public office’s functions and business activities has been undertaken to identify recordkeeping requirements

Level Two Physical and electronic records are systematically captured as part of business-as-usual activities in a way that meets the public office’s business requirements

Level Three Disposal authorities are linked to the public office’s business classification scheme so record sentencing is possible at the time of record creation

Audit Reporting Approach

Multi-level (hierarchical) reporting structure involving:

• Straightforward audit assessment matrix showing current position and development / planned direction

• Supporting report based on audit tool with section commentary (capturing multi-dimensional assessment of public office’s position (in terms of progress / coverage / intentions)

• Annual Parliamentary Report

Audit Reporting Matrix Concept

Level

Business Area

One(Initiation)

Two(Establishment)

Three(Improving

Capability)

Planning Resourcing Training Monitoring & Review Create & Capture Retrievability & Security Maintain & Storage Disposal & Transfer

Audit Methodology

• Audit Tool will be calibrated for each particular public office • Evidential requirements will be collated and organised into a logical audit plan (an

interactive self assessment version of the Audit Tool will be developed and available for public offices to use, prior audits)

• Audit testing will range from 100% (source document) to sample tests (system test)• For each audit it will be clear how recordkeeping practices will be observed and

sampled and what documents etc will be required• A multi-dimensional review will be undertaken to assess in relation to each Audit Tool

attribute the public office’s: – Progress – Coverage– Future intentions

• Audit testing of larger multi-site public offices will be practically orientated and determined in discussion with the public office concerned. 

Independent Advisory Panel

• An independent panel of people with senior public service experience

• Provides an independent review function• Provides a broad management perspective

• Panel would meet a few times a year to discuss draft audit reports and provide input

Selection of Public Offices for Audit

• Still being decided but will

• Be a representative mix (by size and function) of public offices

• First two years there will weighting towards public offices who have demonstrated effective recordkeeping

• In the first two years Archives New Zealand may not audit public offices who are considered not to be making good progress to avoid wasting resource

Audit Concept Development Process

Development of Audit Tool currently underway to ensure early and substantive engagement with key stakeholders and experts, including:• Road tests held in October 2008• Public office workshops November 2008

– 6 sector based workshops– 2 senior management workshops– Not exhaustive coverage

• Consultants workshop 17 December 2008• Full public engagement from March 2009

– Exposure draft available 9 March – 1 May– Workshops in Auckland, Wellington, Christchurch and Dunedin

Next Steps

• March - May 2009, 8 week consultation on exposure draft• Will inform Chief Executives• Web page for the Audit Tool

• June 2009 Final Audit Tool release (NB Audit Tool may be subject to change following pilot audits)

• July 2009 initiation pilot audit programme

• July 2010 initiation of formal PRA audits

Summary

• The Public Records Act controls creation, maintenance, and disposal of public sector records

• Three mandatory standards have been issued to support the Act

• Archives NZ is developing a recordkeeping audit programme to support the Act

• Over time, the PRA will raise standards and expectations for government recordkeeping

• See the Continuum website for a copy of the Audit Tool Exposure Draft, feedback forms and copy of presentation:

http://continuum.archives.govt.nz/public-records-act-audit-strategy.html

• Contact:

Kate Jones

kate.jones@archives.govt.nz

04 894 6002