State Records NSW - Recordkeeping in the Electronic Business Environment

Standard on Recordkeeping in the Electronic Business Environment

Executive Summary

The need to address the recordkeeping aspects of on-line business has become critical in recent years. Changes to the regulatory framework such as the introduction of the Electronic Transactions Act 2000 (NSW) and the implementation of Government policy relating to electronic service delivery have been key drivers behind the introduction of the Standard on Recordkeeping in the Electronic Business Environment.

This standard forms part of the framework of rules and guidance issued by State Records to help public offices meet their obligations under the State Records Act 1998. In particular, it aims to assist each public office to 'make and keep full and accurate records of the activities of the office'(s. 12 (1)), specificallywithin the electronic business environment.

The purpose of this standard is to ensure that full and accurate records are made and kept of business conducted by public offices in the electronic business environment. It achieves this purpose by requiring that:

proper evidence of business conducted using e-mail applications is captured and managed as part of the official record, and that
public offices plan for, acquire and implement electronic information systems that can make and keep the electronic records necessary to support and provide evidence of the relevant business. This includes systems required to support electronic service delivery.

To achieve this purpose, the standard comprises two principles that should be taken into account by public offices in the conduct of electronic business. Each principle is explained and followed by minimum compliance requirements. Information on sources of further guidance and a compliance checklist are also provided.

This standard is issued under the terms of s.13 of the State Records Act and applies to public offices, as defined in s.3 of the Act, except for those public offices to which Part 2 of the Act does not apply.

Definitions

For the purposes of this standard the following definitions apply. The definitions are taken from the Australian Standard AS 4390-1996, Records Management, Part 1: General unless otherwise stated.

Electronic mail

A computer based message sent over a communications network to one or more recipients which may be transmitted with attachments such as electronic files containing text, graphics, images, digitised voice, digitised video or computer programs. (Government Information Management Division, Information Management & Technology Blueprint, February 1997)

Electronic records

Records communicated and maintained by means of electronic equipment.

Electronic service delivery

The online delivery of information and services. (State Records, December 2000)

Information systems

Computers, communication facilities, networks, data and information that may be stored, processed, retrieved or transmitted by them, including programs, specifications and procedures for their operation, use and maintenance. (NSW Office of Information Technology, Security of Information Systems Guideline - Overview, September 1996)

Records

Recorded information, in any form, including data in computer systems, created or received and maintained by an organisation or person in the transaction of business or the conduct of affairs and kept as evidence of such activity.

Recordkeeping

Making and maintaining complete, accurate and reliable evidence of business transactions in the form of recorded information.

Recordkeeping requirements

Requirements for evidence that may be satisfied through recordkeeping. (State Records, Glossary of Recordkeeping Terms, November 1998)

Recordkeeping systems

Information systems which capture, maintain and provide access to records over time.

Records management

The discipline and organisational function of managing records to meet operational business needs, accountability requirements and community expectations.

Records management systems

Specific applications used to maintain, manage and provide access to an organisation’s record resources. (State Records, December 2000)

State record

Any record, made and kept, or received and kept, by any person in the course of the exercise of official functions in a public office, or for any purpose of a public office, or for the use of a public office. (State Records Act 1998, s. 3(1)).

Introduction

Background

An increasing proportion of the business of public sector bodies in NSW is being conducted in the electronic environment, using electronic mail and a variety of other electronic tools and systems. This has been given further impetus by the NSW Government's commitment, reaffirmed in Premier's Memorandum 2000–12, that all appropriate government services should be available electronically by December 2001. In this rapidly evolving environment, the conduct of accountable and efficient electronic business depends on reliable and effective recordkeeping.

At the same time, a growing range of practical tools has become available which can help public sector bodies to capture and manage records in electronic form. These include records management systems which can interface with an increasing variety of e-mail and other common business applications or which can be adjusted to integrate with more specialised systems. Detailed practical guidance on designing and implementing systems and practices to capture and manage the necessary records in the electronic business environment is available from State Records and other sources.

Under s.12 of the State Records Act, each public office must make and keep full and accurate records of its activities. In addition, many kinds of business activity are subject to specific recordkeeping requirements, whether to meet legal requirements, the practical needs of ongoing business, or internal or external accountability. These requirements apply as much to business conducted in the electronic environment as to business conducted in more traditional ways.

Premier's Memorandum No. 98–16, issued in June 1998, established a clear policy direction in which agencies should implement effective practices for recordkeeping in the electronic environment. The direction was set out in more detail in two policy documents, on Electronic Recordkeeping and Electronic Messages as Records, respectively, issued under that Memorandum.

This standard is issued under s.13(1) of the State Records Act. Section 13 of the Act empowers State Records to approve standards and codes of best practice for records management by public offices. Records management extends to include all aspects of the making, keeping and disposal of records, in all business environments. By setting minimum requirements in relation to key aspects of managing records in the electronic business environment, this standard is intended further to encourage public offices to implement effective electronic recordkeeping strategies in keeping with the Government's policy direction as set out in Premier's Memorandum No. 98–16 and the two policy documents noted above. This standard should be read and implemented in conjunction with those documents.

The standard is outcomes oriented and does not mandate specific technological solutions. It refines and focuses existing requirements for making and keeping official records for the electronic business environment, rather than introducing new obligations.

Purpose

proper evidence of business conducted using e-mail applications is captured and managed as part of the official record, and that
public offices plan for, acquire and implement electronic information systems that can make and keep the electronic records necessary to support and provide evidence of the relevant business. This includes systems required to support electronic service delivery.

Mandate

This standard is issued under s.13(1) of the State Records Act.

Application

This standard applies to public offices as defined in s.3 of the State Records Act, except for those public offices to which Part 2 of the Act does not apply.

Scope

For the purposes of this standard, 'electronic business' is a broad term which encompasses all forms of business activity carried out using electronic means. This includes all forms of electronic service delivery and electronic commerce, the sending and receiving of e-mail and the use of other electronic business tools and information systems for administrative or agency-specific purposes. This standard addresses the capture and management of electronic records created or generated in this environment. This standard is, in particular, focussed on addressing the recordkeeping needs associated with the capture and management of electronic mail and on the planning for and acquisition of new information systems to support electronic business.

The minimum compliance requirements of the standard do not apply to existing information systems.

Structure

The standard outlines two principles relating to specific aspects of recordkeeping in the electronic business environment, each followed by an explanation and minimum compliance requirements. The principles are followed by information on sources of further guidance and a compliance checklist.

Responsibilities

Implementing effective strategies for recordkeeping in the electronic business environment requires the commitment of chief executives and senior management and coordinated effort by a multidisciplinary team including Corporate Records Managers, Chief Information Officers, Information Management and Technology Managers and Electronic Service Delivery Managers.

For more information

For further information about this and other recordkeeping standards and codes of best practice and associated guidance, contact State Records.

The Principles

1 Electronic Mail

Electronic mail that needs to be kept as evidence of business activity should be captured systematically and managed in official recordkeeping systems.

Explanation

Electronic mail is routinely used for communication and the transaction of business in the NSW public sector. Transmitted e-mail provides evidence of business transactions and should therefore be managed appropriately.

Implementation of this principle does not mean that all e-mail should automatically be kept, but rather that requirements for evidence should be met by the integration of electronic messaging systems and electronic records management systems. These requirements for evidence, or recordkeeping requirements, should be determined by an analysis of the business conducted by the organisation and by identifying the accountability, business and social expectations for evidence arising from this business. For more information on determining recordkeeping requirements, see State Records' Strategies for Documenting Government Business: The DIRKS Manual.

It is also important to note that electronic messages are subject to the same requirements for lawful disposal as other State records, as set out in Part 3 of the State Records Act. That means they should generally be disposed of only in accordance with an approved retention and disposal authority or as part of the normal administrative practice of the public office. Schedule 1 of the Act provides guidelines on normal administrative practice.

Records management policies and procedures can be used to establish rules for capturing, arranging and storing e-mail in corporate recordkeeping systems. Applications can now be acquired that manage e-mail as records in their electronic form rather than having to print them for attachment to a file. These systems can also link the appropriate disposal information to messages to ensure they are disposed of lawfully and in accordance with the relevant retention and disposal authority.

This principle relates to electronic mail as it is commonly used in Government, for the sending of computer based messages to one or more recipients. It does not refer to the transmission of electronic information in other formats, such as the automated transfer of data from computer to computer, sometimes referred to under the umbrella term 'electronic messaging'. These types of business transactions are covered by Principle 2.

Minimum compliance requirements

Internal policies on the management of electronic mail reflect Government-wide policy as enunciated in the Policy on Electronic Messages as Records.
Systems and procedures are in place, and operating routinely, for capturing and managing electronic mail as records of the public office.

2 Acquisition of Information Systems

Information systems acquired by public offices for the transaction of business, including electronic service delivery, should help satisfy the recordkeeping requirements affecting the business supported by the systems.

Explanation

Public offices acquire information systems (sometimes referred to as business systems) to support all sorts of business activities. These activities can include common administrative activities such as the management of finances or assets, human resources management or reporting, or they may be activities which are specific to the public office. Increasingly, public offices are acquiring systems to support electronic service delivery initiatives in line with the Government's commitment to the widespread provision of information and services on-line. In order to ensure that such business operates efficiently and that public offices are accountable in the short and long term, transactions conducted using any of these types of systems should be suitably documented to provide the necessary evidence of the business activity concerned.

Requirements for evidence of the business conducted using new information systems should be identified and assessed during the initial system analysis and design stage and included in the functional requirements for the systems. Such requirements for evidence ('recordkeeping requirements') will vary widely, from short term business needs to more substantial, longer term requirements. Advice on how to determine recordkeeping requirements is provided in the 'DIRKS' Manual. The New South Wales Recordkeeping Metadata Standard is also an important source to be considered in the development of functional requirements for new information systems.

Recordkeeping requirements described in functional requirements for proposed systems may then be met in the actual systems by a variety of means. They may, for example, be incorporated into the final design and implementation of the system as an integral part of the system itself or through an interface with an electronic records management system. The 'DIRKS' Manual can again be used as a guide for ensuring that recordkeeping requirements are met in the design and implementation stages of new systems.

Minimum compliance requirements

Requirements for evidence of business to be conducted electronically using new information systems, including systems used for electronic service delivery, are identified and documented.
These requirements are documented as part of the functional requirements for the proposed systems.
The systems as implemented can be demonstrated to satisfy these requirements.

Appendix A: Compliance checklist

1	Electronic Mail
1.1	Internal policies on the management of electronic mail reflect Government-wide policy as enunciated in the Policy on Electronic Messages as Records	Yes	No
1.2	Systems and procedures are in place, and operating routinely, for capturing and managing electronic mail as records of the public office	Yes	No
2	Acquisition of Information Systems
2.1	Requirements for evidence of business to be conducted electronically using new information systems, including systems used for electronic service delivery, are identified and documented	Yes	No
2.2	These requirements are documented as part of the functional requirements for the proposed systems	Yes	No
2.3	The systems as implemented can be demonstrated to satisfy these requirements	Yes	No

Appendix B: For more information

State Records, Managing the Message: Guidelines on managing formal and informal communications as records, 2005. Available online: http://www.records.nsw.gov.au/recordkeeping/guideline_7_managing_the_message_7106.asp

Provides specific advice about managing email and electronic communications as records, including guidance on policy development and on ensuring messages are captured into reliable recordkeeping systems.

State Records, Recordkeeping in Brief 42: Checklist for assessing business systems, 2005. Available online: http://www.records.nsw.gov.au/recordkeeping/rib_42_assessment_4593.asp

This guide provides a checklist against which an existing or new business system may be assessed to determine:

whether the business the system supports is subject to any recordkeeping requirements
how well the system is currently meeting recordkeeping requirements
what action may be required to enable the system to meet recordkeeping requirements.

State Records, Recordkeeping in Brief 18: Introducing recordkeeping metadata, 2001. Available online at: http://www.records.nsw.gov.au/recordkeeping/rib_18_introducing_recordkeeping_metadata_3443.asp

Explains the purpose of recordkeeping metadata and lists the minimum required elements from the NSW Recordkeeping Metadata Standard (NRKMS) for basic records control.

State Records, Strategies for Documenting Government Business: The DIRKS Manual, 2003. Available online: http://www.records.nsw.gov.au/recordkeeping/dirks-manual_4226.asp

Provides detailed information on the application of the methodology for the design and implementation of recordkeeping systems which is articulated in the Australian Standard AS ISO 15489 - 2002 Records Management, including how to identify recordkeeping requirements and develop strategies for meeting them.

© State of New South Wales through the State Records Authority of New South Wales, 2000. Minor updates 2007.
This work may be freely reproduced for personal, educational or government purposes. Permission must be received from State Records Authority for or all other uses. See our copyright notice for contact details.
ISBN 0-7313-5363-3