1. Public Records Act 2005 Audit Tool Engagement Overview March 2009 Kate Jones, Senior Advisor, Government Recordkeeping Programme

2. Environment Recordkeeping (especially digital) at a low base Agencies are putting in a lot of effort (… but the operating environment is becoming more complex) Large IT re-developments provide the opportunity to embed good recordkeeping practices into business systems We are all learning how to undertake ‘fit for purpose’ digital recordkeeping Improving awareness of the business benefits of good recordkeeping Audits are new and we need to ensure that they are a productive recordkeeping tool and not seen as something in addition to good business practice Adverse economic outlook reinforces the need for a focus on recordkeeping productivity

3. Public Records Act 2005 Democratic accountability (Crown to the public) Management accountability (agencies to the Crown) Collective memory and historical heritage Good management

4. Public Records Act Compliance Framework Audit Standards Inspection Direction to report Annual Report to Parliament Archives New Zealand must undertake independent audits of recordkeeping in public offices from 2010 (PRA s33) The Chief Archivist may issue standards in relation to public records. It must be stated who they apply to and if they are mandatory or discretionary. Consultation must be undertaken before issue (PRA s27) Archives New Zealand has the right to inspect the archives and records of public offices and local authorities (PRA s29) The Chief Archivist must report annually to Parliament on the state of recordkeeping in public offices (PRA s32) Public offices can be directed to report on any aspect of recordkeeping or on the records they control (PRA s31)

5. Reminder of the Audit Process The Public Records Act requires Archives New Zealand to commission audits of recordkeeping in public offices Audits to begin 2010/2011 200 core state sector entities will be audited Audits occur on a 5 year cycle Audits based on key requirements of the Public Records Act –Create and maintain public records –Disposal (destroy and transfer etc) of public records Audit programme includes state schools. Approach to auditing schools is yet to be determined. Schools are not subject to the mandatory standards Local authorities are not covered by the audit programme

6. Audit Programme Positioning Audits should support good productive recordkeeping practices that add business value Audits should support continuous improvement Audits should support ongoing self assessment Audit expectations will change over time (10 -15 years) once recordkeeping capability becomes well established and public offices integrate recordkeeping requirements within timetabled business system redevelopment

7. Some Challenges Recordkeeping is organisationally pervasive – assessment of overall capability will ultimately be a matter of auditor judgement Constrained audit resources Wide range of public offices (i.e. size and functions) Variable recordkeeping practices within agencies

8. Audit Tool Objectives Reflect and represent requirements of the Public Records Act and related mandatory standards Facilitate a constructive self assessment process (i.e. the PRA audit process should not be a “mystery or a surprise”!) Encourage continuous improvement against ongoing recordkeeping action plans

9. Audit Tool Structure The Audit Tool reflects a high level recordkeeping solution 8 functional areas that reflect generic business practices e.g. planning, resourcing, training etc The Audit Tool has 3 assessment levels for each functional area A discriminating assessment rather than a binary assessment (i.e. pass/fail) e.g. initiation, establishment, improving capability Audit effort will depend on the function of the public office

10. Overview of Audit Tool PRA & Mandatory Standards Business Themes AttributesEvidence Requirements are vertically represented (i.e. not horizontal / immediate compliance approach) 8 Areas: Planning Resourcing Training Reporting Create / Capture Access / Security Maintain / Storage Disposal / Transfer 3 Levels: Reflecting increasing capability (consistent with good business practices) Broadly describe applicable operational recordkeeping practice Representative or indicative (not exclusive!) Audit process essentially testing either 100% (policy) or sampling (process)

11. Outcomes for Each Functional Business Area 1. Planning Recordkeeping functions and activities are systematically defined and have a planned outlook (forward work programme) 2. Resourcing The public office has defined and provided the necessary resources to achieve appropriate level of recordkeeping capability 3. Training Staff are adequately trained to achieve the public office’s recordkeeping requirements 4. Monitoring & Review The public office regularly monitors and effectiveness of its recordkeeping practices 5. Create & Capture The public office’s business activities and decisions are appropriately recorded 6. Retrievability & Security Records are secure and can be used when required 7. Maintenance & Storage Records are maintained in a manner consistent with their format and value 8. Disposal & Transfer Records are only retained by the public office for as long as required and are disposed of appropriately

12. Functional Area Structure - Training Level OneA recordkeeping training needs analysis has been undertaken Level TwoA recordkeeping training plan has been implemented Level ThreeStaff recordkeeping training is regularly reviewed

13. Functional Area Structure – Create & Capture Level OneAn analysis of the public office’s functions and business activities has been undertaken to identify recordkeeping requirements Level TwoPhysical and electronic records are systematically captured as part of business-as-usual activities in a way that meets the public office’s business requirements Level ThreeDisposal authorities are linked to the public office’s business classification scheme so record sentencing is possible at the time of record creation

14. Audit Reporting Approach Multi-level (hierarchical) reporting structure involving: Straightforward audit assessment matrix showing current position and development / planned direction Supporting report based on audit tool with section commentary (capturing multi-dimensional assessment of public office’s position (in terms of progress / coverage / intentions) Annual Parliamentary Report

15. Audit Reporting Matrix Concept Level Business Area One (Initiation) Two (Establishment) Three (Improving Capability) Planning  Resourcing  Training  Monitoring & Review Create & Capture  Retrievability & Security  Maintain & Storage  Disposal & Transfer 

16. Audit Methodology Audit Tool will be calibrated for each particular public office Evidential requirements will be collated and organised into a logical audit plan (an interactive self assessment version of the Audit Tool will be developed and available for public offices to use, prior audits) Audit testing will range from 100% (source document) to sample tests (system test) For each audit it will be clear how recordkeeping practices will be observed and sampled and what documents etc will be required A multi-dimensional review will be undertaken to assess in relation to each Audit Tool attribute the public office’s: –Progress –Coverage –Future intentions Audit testing of larger multi-site public offices will be practically orientated and determined in discussion with the public office concerned.

17. Independent Advisory Panel An independent panel of people with senior public service experience Provides an independent review function Provides a broad management perspective Panel would meet a few times a year to discuss draft audit reports and provide input

18. Selection of Public Offices for Audit Still being decided but will Be a representative mix (by size and function) of public offices First two years there will weighting towards public offices who have demonstrated effective recordkeeping In the first two years Archives New Zealand may not audit public offices who are considered not to be making good progress to avoid wasting resource

19. Audit Concept Development Process Development of Audit Tool currently underway to ensure early and substantive engagement with key stakeholders and experts, including: Road tests held in October 2008 Public office workshops November 2008 –6 sector based workshops –2 senior management workshops –Not exhaustive coverage Consultants workshop 17 December 2008 Full public engagement from March 2009 –Exposure draft available 9 March – 1 May –Workshops in Auckland, Wellington, Christchurch and Dunedin

20. Next Steps March - May 2009, 8 week consultation on exposure draft Will inform Chief Executives Web page for the Audit Tool June 2009 Final Audit Tool release (NB Audit Tool may be subject to change following pilot audits) July 2009 initiation pilot audit programme July 2010 initiation of formal PRA audits

21. Summary The Public Records Act controls creation, maintenance, and disposal of public sector records Three mandatory standards have been issued to support the Act Archives NZ is developing a recordkeeping audit programme to support the Act Over time, the PRA will raise standards and expectations for government recordkeeping

22. See the Continuum website for a copy of the Audit Tool Exposure Draft, feedback forms and copy of presentation: http://continuum.archives.govt.nz/public-records-act-audit- strategy.html http://continuum.archives.govt.nz/public-records-act-audit- strategy.html Contact: Kate Jones kate.jones@archives.govt.nz 04 894 6002