Recordkeeping Capability: Public Records Act Audit Programme Darrin Goulding, Project Manager, Public Records Act Audit Strategy Kate Jones, Senior Advisor, Government Recordkeeping Programme

PRA Audit Programme2 Overview PRA Compliance Framework Background Audit Concept Audit Methodology Audit Reporting Next Steps

PRA Audit Programme3 Public Records Act Compliance Framework Audit Standards Inspection Direction to report Annual report to Parliament Archives New Zealand must undertake independent audits of recordkeeping in public offices from 2010 (PRA s33) The Chief Archivist may issue standards in relation to public records. It must be stated who they apply to and if they are mandatory or discretionary. Consultation must be undertaken before issue (PRA s27) Archives New Zealand has the right to inspect the archives and records of public offices and local authorities (PRA s29) The Chief Archivist must report annually to Parliament on the state of recordkeeping in public offices (PRA s32) Public offices can be directed to report on any aspect of recordkeeping or on the records they control (PRA s31)

PRA Audit Programme4 PRA Audit Fundamentals The Public Records Act (s33 and s35) requires Archives New Zealand to commission audits of recordkeeping in public offices Audits to begin 2010/2011 Audits to cover 2700 entities 200 public offices (approx) 2500 public schools (approx) Audits occur on a 5 year cycle Audits based on key requirements of the Public Records Act –Create and maintain public records (s 17) –Dispose (destroy and transfer etc) of public records legally (s 18)

PRA Audit Programme5 PRA Audit Outcomes The audits are designed to support desired outcomes 1.Information management that supports good business practice 2. Public confidence in government accountability and operational integrity 3. Assurance to the Chief Archivist and public office Chief Executives regarding organisational recordkeeping practices

PRA Audit Programme6 Development of PRA Audit Programme PRA Audit Programme has three key enablers: Development of audit concept (tool) Recruitment and procurement of audit capability (December 2008 – June 2009) Development of audit process (public office engagement and testing process)

PRA Audit Programme7 Audit Concept (Tool) Audit Delivery Key focus of post 2010 Audit Programme is on providing recognition for recordkeeping operations and promoting forward focused continuous improvement momentum Reflect and represent fundamental framework requirements of the Public Records Act and related standards (i.e. avoid short- term focus on functional requirements) Facilitate ongoing constructive self assessment process (i.e. the PRA audit process should not be a mystery or a surprise!)

PRA Audit Programme8 Audit Concept Development Process Development of audit concept (tool) currently underway: 1.Road tests held in October Public office workshops November sector based workshops 2 senior management workshops Not exhaustive coverage 3.Consultants workshop 17 December Full public consultation late January/February 2009 Exposure draft Workshops around country

PRA Audit Programme9 Structure of Audit Concept PRA & Mandatory Standards Business Themes AttributesEvidence Requirements are vertically represented (not horizontal / immediate compliance approach) 8 Areas: Planning Resourcing Training Reporting Create / Capture Access / Security Maintain / Storage Disposal 3 Levels: Reflecting increasing capability (consistent with good business practices) Broadly describe applicable operational recordkeeping practice Representative or indicative (not exclusive!) Audit process essentially testing either 100% (policy) or sampling (process)

PRA Audit Programme10 Initial Workshop Feedback Greater consolidation of attributes into the respective functional areas - providing greater consistency / less duplication (e.g. planning, training, reporting) Re-ordering (down / up) of some attributes across the levels to better reflect capability development (e.g. personal responsibility for recordkeeping) Repositioning of some functional areas (Access and Security) and split out of Disposal as a separate functional area Re-wording and/or greater elaboration of some attributes or evidence to improve clarity or fit with operational practices Grouping together of similar attributes (e.g. metadata, storage) Explanatory level descriptions (i.e. initiation, establishment and good practice)

PRA Audit Programme11 Audit Methodology Audit concept (tool) will be calibrated for each particular public office Testing will range from 100% (source document) to sample tests (system test) Audit testing of larger multi-site public offices will be practically orientated and determined in discussion with the public office concerned. For example, core functions reviewed and a small sample of pre-determined remote sites reviewed with a view of providing a perspective of the spread of recordkeeping

PRA Audit Programme12 Audit Reporting Multi level reporting structure involving: Straightforward audit assessment matrix showing current position and development / planned direction Supporting report based on audit concept with section commentary Annual parliamentary report

PRA Audit Programme13 Audit Reporting Matrix Concept Level Business Area OneTwoThree Planning  Resourcing  Training  Reporting / Review Create and Capture  Access and Security  Maintain and Storage  Disposal 

PRA Audit Programme14 Audit Reporting Lifecycle Audit expectations will change over time ( years) once recordkeeping capability becomes well established and public offices integrate recordkeeping requirements within timetabled business system redevelopment

PRA Audit Programme15 Next Steps December 2009 consultant/vendors workshops December – January recruitment of Audit Manager January 2009 formal audit tool consultation May 2009 audit tool release June 2009 pilot audit programme April 2010 initiation of formal PRA audits

See the Continuum website for more information: act-audit-strategy.html