Monitoring records management
Under Principle 5 'Monitored and reviewed' of the Standard on managing a records management program public offices are required to ensure that 'All aspects of the records management program are regularly reviewed against performance objectives.' (see compliance requirement 5.1)
The Monitoring Framework outlines the purpose of monitoring and the roles and responsibilities of both State Records and public offices.
Public offices should regularly monitor the management of records within the organisation to ensure the effectiveness and efficiency of recordkeeping systems and processes, and conformity with the State Records Act and associated standards and codes of best practice.
Generally, organisations undertake two types of monitoring activities to understand how the organisation is performing and to identify those areas which require further attention. The two types of monitoring activities are performance monitoring and compliance monitoring.
Performance monitoring involves an in-depth analysis of a process or project, to determine whether it is efficient and effective. It involves developing criteria, conducting interviews and examining documentation to determine how the process or project is conducted. This type of monitoring is also referred to as a process audit (CB029 - 2003, The Audit Skills Handbook, section 1.8).
Organisations typically measure performance to determine if a process or practice is effective and whether objectives or targets are being met, and thus satisfactory performance. Measuring performance allows the organisation to not just measure whether an outcome is being achieved, but how well or the degree of satisfaction of the outcome; in this way it is a 'qualitative' form of measurement.
Public offices should regularly assess the effectiveness and efficiency of their recordkeeping systems and processes to ensure that they are satisfactory and meeting the public office's business needs.
Performance monitoring activities can range from monitoring:
- overall performance of the organisation's records management program
- records management processes
- records management systems, and
- assessing the records management capability of the organisation.
Performance monitoring can also include targeted assessments of recordkeeping, for example assessing high risk business areas to ensure that records are being created and captured, and that records are adequate (ie are the records being created and captured adequate for providing evidence of the business of the organisation?).
The starting point for some performance monitoring activities may be the identification of a business issue/problem. The organisation can analyse the problem using the relevant tool and develop a solution which may involve updating processes or developing new processes.
Organisations can monitor their performance by:
- conducting assessments using the plans, goals and objectives of the records management program
- assessing feedback from clients of the services provided by the records management program
- benchmarking against standards such as AS/ISO 15489 and standards issued by State Records
- assessing the level of understanding and use of records management policies and procedures by staff
- assessing progress against the organisation's Disposal Implementation Plan
- using the Government Chief Information Office's Information Asset Management (IAM) Assessment Tool to assess the maturity, capability and healthiness of records management in the organisation
- conducting an internal audit of recordkeeping and/or management of records
- using Steps B and C of the Designing and Implementing Recordkeeping Systems (DIRKS) methodology to assess the adequacy of records and recordkeeping
- using the Records Management Assessment Tool, and
- conducting detailed reviews of high risk business areas to confirm that records are being created and captured into the recordkeeping system.
Organisations may also seek independent or external performance monitoring of their organisation's recordkeeping and management of records, for example, auditors can undertake both performance and compliance monitoring.
For more information on the tools that can be used in performance monitoring, click here.
Compliance is defined as 'adhering to the requirements of laws, industry and organizational standards and codes, principles of good governance and accepted community and ethical standards'. (AS 3806 - 2006: Compliance Programs, section 1.3.3)
Compliance monitoring and compliance auditing aim to establish whether a process or procedure is carried out in conformance with relevant external requirements, whether set through legislation, regulations or directions. It involves examining, at a fairly straightforward level, how organisations 'do something' and confirming 'compliance' with criteria. (CB029 - 2003, The Audit Skills Handbook, section 1.8)
Public offices should regularly assess their conformity with the obligations of the State Records Act and the associated standards and codes of best practice to ensure that the organisation is compliant and that issues of non-compliance are corrected.
Compliance monitoring activities can range from:
- assessing compliance with obligations in the State Records Act
- assessing the records management program
- assessing recordkeeping
- assessing the management of records, and
- assessing records management system and business systems that create and capture records.
Documenting compliance monitoring activities is an important component in demonstrating the organisation's compliance with the State Records Act and associated standards and codes of best practice. Public offices may be asked about their monitoring activities by other organisations with an interest in good records management (eg ICAC) or when responding to follow up on a recordkeeping issue by State Records. Section 5.2.1 of the Australian Standard AS 3806 - 2006: Compliance Programs advises that
'Accurate, up-to-date records of the organization's compliance activities should be maintained to assist in the monitoring and review process and demonstrate conformity with the [compliance] program.'
Organisations can monitor their compliance by:
- using the Records Management Assessment Tool
- assessing compliance against the requirements of each standard issued by State Records (there are compliance checklists at the end of each standard)
- benchmarking against previous records management surveys or audit results to assess improvements or to identify issues of non compliance
- undertaking a compliance audit using internal auditors or an external party to provide an independent assessment of the organisation's records management program, practices and systems, and
- using the Government Chief Information Officer's Information Asset Management (IAMS) Assessment Tool to undertake a 'health check' and assessment of levels of compliance with requirements.
Public offices may consider using the services of a consultant, internal or external auditors, or the Internal Audit Bureau to conduct compliance monitoring activities.
For more information on the tools that can be used in compliance monitoring, click here.
There are a range of tools which public offices are able to access to assist in monitoring records management programs and recordkeeping performance.