ARCHIVED - Horizontal Internal Audit of Electronic Recordkeeping in Small Departments and Agencies

This page has been archived.

Table of Contents

• Executive Summary
• Conformance with Professional Standards
• Background
• Audit Objective, Scope and Approach
  • Objective and Scope
• Detailed Findings and Recommendations
  • Finding 1: Policy and Strategic Direction
  • Finding 2: Retaining Information That Has Business Value
  • Finding 3: Learning and Awareness
• Management Action Plans
• Appendix A: Small Departments and Agencies Included in the Audit
• Appendix B: Links to Applicable Legislation, Frameworks, Policies, Directives and Guidance
• Appendix C: Objectives and Related Criteria
• Appendix D: Recommendations by Department and Agency

Executive Summary

The objective of this audit was to determine whether small departments and agencies (SDAs) and departments that have a central role are fulfilling the requirements of the information management (IM) policy suite, with a particular focus on electronic recordkeeping.

Why This Is Important

The management of information in the Government of Canada impacts all lines of business and is a key component of departmental service delivery. Electronic information is being created throughout government at a rate that is growing exponentially, and without the ability to effectively manage this information, departments may be at risk of losing their ability to identify and retrieve information needed for decision making in an organized and timely fashion. This could result in an inability to meet information requests from Canadians and other obligations.

This audit supports the Treasury Board of Canada Secretariat (the Secretariat) in enabling departments and agencies to meet policy objectives for electronic recordkeeping by identifying systemic issues and common challenges with compliance with the Policy on Information Management.

Key Findings

A government-wide strategy and action plan for IM have been implemented, and these are actively communicated to departments and agencies. Most SDAs do not have IM plans in place and are not monitoring the effectiveness of their IM activities.

Most SDAs have not yet developed a framework for identifying information of business value. This is an important first step so that information of business value can be retained and organized in a manner that makes retrieval for decision making timely and effective.  Most SDAs have yet to define business value as it relates to their IM needs and provide little to no guidance for departmental staff.

Most SDAs do not have retention and disposition processes that reflect the electronic environment. Disposition of electronic records is performed mostly on an ad hoc basis by staff and is not linked to established retention and disposition processes

Electronic recordkeeping systems are inconsistently used by departmental staff. Most SDAs have not made electronic recordkeeping systems mandatory, and instead leave usage up to the individual. This results in some electronic records being saved on shared drives, personal drives, or portable storage devices, rather than on an enterprise-wide system.  While it is possible to effectively manage information of business value outside an enterprise-wide system, doing so decreases the efficiency of retrieval of this information in a timely manner and impedes sharing of information government-wide.

Training for IM practitioners is planned and coordinated government-wide. Departmental employees are being provided with some electronic recordkeeping training. Further analysis should be done to identify learning needs.

Conclusion

While strategic direction for electronic recordkeeping has been established within the Government of Canada, implementation of departmental plans to address the strategy is in the early stages. SDAs have not yet developed a framework for identifying information of business value to support decision making on a timely basis. SDAs are addressing training requirements for their IM practitioners but not for all departmental staff. Electronic records of business value are not being identified, managed, stored and disposed of consistently across SDAs.

Conformance with Professional Standards

The conduct of this engagement was done in accordance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing.[1]

Brian M. Aiken, CIA, CFE
Assistant Comptroller General
Internal Audit Sector, Office of the Comptroller General

Background

The Government of Canada has long made the management of information an operational priority. In the past, paper records were managed by a team of dedicated record keepers who would file what was often the only copy of any one record.

The arrival of the electronic age complicated traditional recordkeeping. Every email or draft document is created and saved as an original file and is thus considered an electronic record. Much of the information generated and managed by the federal government is electronic and can be categorized into two groups: structured and unstructured data.

Structured data represents information maintained in enterprise systems such as financial or human resources systems. Information is often entered into these enterprise systems through pre-defined fields such as “name,” “telephone number”, etc. There are numerous controls to manage the risks associated with this type of information, such as who can enter or edit the information, or what type of information can be entered into specific fields.

Unstructured data, on the other hand, is information that includes working documents such as project plans, spreadsheets, emails, and records of decision. One of the major risks of managing this data is that the controls are frequently much less structured and often ad hoc in nature. This may mean that information is more difficult to track or that multiple versions saved in multiple locations compromise the reliability of the information. However, this data often forms the basis for critical decision making.

The notion of a physical space being used to centrally house all records is no longer a reality. All employees are now tasked with managing a multitude of records they may create every day. The number of records generated by the government has grown exponentially, challenging its previous ability to track and manage its information with certainty and effectiveness.

Acknowledging the changing environment, in 2006 the Treasury Board of Canada Secretariat (the Secretariat) led a government-wide effort to identify challenges in modernizing recordkeeping. Representatives from multiple government departments participated in the exercise, and two reports were produced that laid the foundation for a unified government direction: Information Management in the Government of Canada: The Business Problem Assessment and Information Management in the Government of Canada: The Vision.

In 2007, the Secretariat published a new Policy on Information Management, followed by two new directives: Directive on Information Management Roles and Responsibilities (2007) and Directive on Recordkeeping (2009). While the new policy suite established responsibilities for IM in departments, it was the Government of Canada Information Management Strategy (published in 2008) that aligned IM goals and provided clear objectives for the community as a whole.

Life-cycle management of information is a common thread throughout the IM policy suite and the Government of Canada Information Management Strategy. Specifically, departments must determine which electronic records are worth retaining in the long term (and for how long) and which records should be disposed of after an appropriate period of time. “Business value” is the term used to describe whether or not a record has value for operations. Because so many electronic records are transitory, they are not seen as having long-term value to the interests of the government. Yet these types of records often outnumber more “valuable” records by a significant margin.

Attributing business value to electronic records allows IM practitioners to assign life-cycle parameters according to the long-term requirements. If this process is well established, retention and disposition of records becomes an automated process.

Library and Archives Canada (LAC) is the agency responsible to provide guidance and support to help determine retentions and to provide delegated authorities to allow for disposition of corporate records within government departments. These delegated authorities are required to be in place prior to the disposition of records because they state which records are to be destroyed and which records should be archived for the long-term benefit of the Government of Canada and of Canada's national interest.

Audit Objective, Scope and Approach

Objective and Scope

The objective of this audit was to determine whether SDAs and departments that have a central role are fulfilling the requirements of the IM Policy Suite, with a particular focus on electronic recordkeeping.

For the purposes of this audit, we limited our scope to unstructured electronic data.

Fourteen SDAs were reviewed during the horizontal audit of electronic record keeping. In addition, the Secretariat and LAC were also included in the audit because of their specific responsibilities identified in the IM policy suite:  the Secretariat in providing policy and functional guidance to departments, and LAC in issuing records disposition authorities. The SDA community in the federal government is extremely diverse, varying, for example, in organizational structure and size, budget, nature of work, and relationship with larger departments. The budgets of SDAs do not exceed $300 million per year. Their full‑time equivalents vary from 6 to 500 employees. These factors contribute to the extent of the electronic record keeping systems and controls that SDAs have implemented for decision making and accountability. (Appendix A contains a list of the departments and agencies examined.)

Detailed Findings and Recommendations

Finding 1: Policy and Strategic Direction

We reviewed the Secretariat's strategic guidance provided to SDAs to coordinate IM activities government-wide. We examined the progress implementation of the Government of Canada Information Management Strategy in SDAs, including departmental policies, plans, organization charts, and committee terms of reference. Finally, we assessed how IM practitioners are monitoring the progress of the implementation of their plans.

Common strategic direction across all departments ensures that the government is consistent in its approach to electronic recordkeeping. IM strategies ensure that IM practitioners have an established direction for IM activities in delivering departmental requirements of the IM policy suite. Performance measurement and monitoring assist senior management in determining whether IM plans are being implemented to meet management's objectives.

The strategic direction of IM is being coordinated government-wide.

The Secretariat is leading efforts to strengthen electronic recordkeeping activities government-wide. The Secretariat led the development of the Government of Canada Information Management Strategy – in partnership with LAC and committee members from various departments and agencies – which provides the strategic direction for electronic recordkeeping government-wide. The strategy identified government-wide risks and centrally led activities required to mitigate those risks. An action plan with established timelines was developed to implement the strategy, and multiple guidance documents have been produced to assist IM practitioners and departmental staff.

The SDA community has formed a network of committees designed to discuss common challenges and share information from the perspective of small agencies, which generally have fewer resources and less infrastructure requirements. This network is referred to as the Community of Federal Agencies[2]. Its committees facilitate information sharing and discussions toward developing solutions to common challenges for SDAs in meeting government requirements. None of these committees currently address challenges related to SDAs in IM; however, the Heads of IT Committee have announced this committee's intention to include IM concerns in future meetings. The inclusion of IM within the mandate of this committee will enable SDAs to leverage each others' knowledge and experience in this area.

The management control framework for information management in SDAs incorporates Treasury Board policy requirements.

We found that the requirements of the Treasury Board Policy on Information Management and its associated directives were appropriate given the size and scope of IM activities in SDAs. The policy is principles-based and provides a reasonable framework for roles and responsibilities between central agencies and individual departments and agencies. In accordance with Treasury Board policy, SDAs have established IM as a distinct part of their organization structure. Most have identified an IM senior officer who is in a position to inform senior management of risks to the IM activities and is responsible for the development of related guidance. Some SDAs have established separate committees with specific mandates relating to IM. Most SDAs discuss IM on an as-needed basis at their existing executive or operational committees. To further strengthen their management control frameworks, SDAs would benefit from ensuring that IM is included in the roles and responsibilities of a senior management committee to ensure associated risks and other requirements are discussed as needed. 

IM planning and monitoring of its implementation is in the early stages of maturity.

While some SDAs have IM plans that are in place, most do not. For those SDAs that do have such plans in place, most are not yet monitoring the progress of these plans. One SDA has formalized its IM plan and is monitoring progress on a timely basis. This plan is appropriate to the size and scale of the SDA's IM requirements and provides a degree of formality required to ensure success of initiatives. For those SDAs that have limited IM requirements, it may be appropriate to include their IM planning within their overall departmental plan to ensure needs are accounted for. As significant IM priorities arise that require additional resources, it will be important for SDAs to incorporate these requirements into overall departmental planning activities. SDAs would benefit from the development of performance indicators to assist in monitoring the effectiveness of their IM plans. 

Recommendations

1. SDAs should develop IM plans appropriate to the size and scope of their IM needs, and include measurable performance indicators to be able to monitor the effectiveness of the plans.

Finding 2: Retaining Information That Has Business Value

We examined methodologies that SDAs use to identify the business value of the information they generate. We also examined how electronic record keeping tools and applications are being used in the departments. We examined the retention and disposition processes, and the guidance provided to all staff. Finally, we examined the methodology LAC is using to issue disposition authorities to departments that have demonstrated their ability to track and retain information that has business value, thereby reducing the risk of disposing of information that has longterm benefit to the Government of Canada and to Canada's national interest.

In the absence of identifying information of business value, SDAs could overburden their systems with information that has no long-term value for the operations of the department. This also increases the complexity of finding information of business value when it is needed to support decision making or respond to information requests from Canadians. Without tools and applications to manage information centrally, the retention and disposition processes could become increasingly more complex. After determining the effectiveness of departmental processes for retention and disposition of information, LAC grants records disposition authorities to departments that allow SDAs to dispose of information that has no business value through an established process.  This increases the efficiency of disposition and reduces long-term costs in maintaining information with no long-term value. 

Most SDAs have not yet identified information of business value.

Most SDAs have not yet defined business value as it relates to the IM needs in their organization, and provide little to no guidance for departmental staff. Most SDAs identify only specific products or documents (e.g., Memoranda to Cabinet) but no further guidance that can be interpreted for departmental staff to apply to other documents generated on a daily basis. Most SDAs still classify records based on security and/or access restrictions; business value is not addressed. As a result, SDAs are potentially spending resources tracking, maintaining, and archiving information of no long-term business value to the Government of Canada.

Electronic recordkeeping systems are inconsistently used by departmental staff.

Use of enterprise-wide applications for electronic recordkeeping varies in most SDAs from employee to employee. Most SDAs have not made electronic recordkeeping systems mandatory and instead leave use up to the individual. This results in some electronic records being saved on shared drives, personal drives or portable storage devices, rather than on an enterprise-wide system. Some SDAs are also using multiple enterprise-wide applications for different operational areas, some of which are not interoperable. Because information exists in SDAs across multiple platforms, information may not be readily accessible to decision makers to deliver program objectives. It is important for SDAs to ensure interoperability between systems is addressed when implementing their IM strategy.

It should be noted that effective enterprise-wide electronic record keeping systems can be cost prohibitive for some departments.  SDAs should consider options such as working with partners, including other government departments or shared service initiatives, to make the purchase of effective systems more economical.

One SDA maintains paper-based records as a result of a legislative requirement to do so.  Some SDAs still maintain paper-based systems as they have not yet migrated to complete electronic record keeping. These SDAs often create electronic records which are then duplicated in paper form for inclusion in the physical file. This may hinder efficiency of IM activities, as well as increase the risk of inaccurate records being provided to decision makers. The Policy on Information Management requires that Deputy Heads ensure that electronic systems are the preferred means of creating, using, and managing information within a department. SDAs should put plans in place to be able to meet this requirement.

Retention and disposition processes do not reflect the electronic environment.

Most retention and disposition strategies were developed for paper-based recordkeeping. As SDAs move towards greater use of electronic record keeping systems, SDAs are increasingly challenged to retain and dispose of multiple versions of electronic records. Disposition of electronic records is performed by staff on an ad hoc basis and is not linked to established retention and disposition processes.  In theory, departmental staff could be deleting information that is important for decision makers; conversely, storage capacity could be burdened by electronic records which are unnecessarily retained.

LAC has begun implementing a standardized methodology for issuing records disposition authorities.

LAC's methodology in issuing records disposition authorities was launched in May 2011. It includes an assessment of a department's ability to track and retain information of business value, thereby reducing the risk of disposing of information that may have long-term benefits to the Government of Canada and to Canada's national interest. Prior to this, the process for issuing disposition authorities was performed on an ad hoc basis and often suffered from long delays. The new methodology gives LAC the opportunity to streamline the process and increase efficiency. It will be important for LAC to monitor the progress of its new methodology and continue to improve the process in order to optimize the efficiency of electronic recordkeeping disposal government-wide.

Recommendations

2. SDAs should define information of business value for their organization and develop methods to ensure it is tracked and stored in an effective manner.
3. SDAs should develop strategies to increase the use of enterprise wide electronic recordkeeping systems within their department.
4. SDAs, in collaboration with LAC, should develop formal retention and disposition processes that can be followed by all departmental staff.

Finding 3: Learning and Awareness

We examined the Secretariat's functional guidance for IM practitioners, and the courses developed for the IM community. We examined IM mandatory training that SDAs provide for their IM practitioners. Finally, we also examined IM training provided to all SDA staff outside the IM function, and whether IM practitioners are able to determine if the current training is sufficient to help implement the Government of Canada Information Management Strategy.

Working with the Canada School of Public Service, the Secretariat is in a position to coordinate new developments or methods in electronic recordkeeping training and effectively communicate them to all departments in order to promote consistency throughout government. Training plans help to ensure a professional, well-informed IM function that can help the department deliver the Government of Canada Information Management Strategy. Providing IM training to all departmental staff helps them understand their role in electronic recordkeeping, including understanding how to track and retain information of business value. Since every employee is now considered an electronic record keeper to some extent, it is important that departmental employees have the knowledge and training required to help deliver the IM strategic objectives.

The Government of Canada is leading efforts to strengthen training and awareness in departmental IM functions.

The Secretariat and LAC chair multiple interdepartmental committees and working groups in order to better determine training and outreach requirements for the community, and to share new developments uniformly throughout the community. The Secretariat is leading the development of training courses (with the Canada School of Public Service) for IM practitioners. By working directly with IM practitioners in departments and agencies, the Secretariat and LAC can ensure that centralized guidance is customized to the various working levels that will implement IM strategies.

Training for IM practitioners is planned and coordinated.

Most SDAs have trained and experienced staff within their IM functions.  The staff turnover for IM practitioners is low, and training requirements can be effectively planned over a long term. IM practitioners in SDAs are well positioned to implement further electronic recordkeeping advances for departments. 

Some IM training is being provided to departmental employees but learning requirements have not been identified.

Most SDAs have not developed IM learning strategies for all departmental staff. Most SDAs have developed one or two training sessions for departmental staff but without clearly defined learning objectives. Some SDAs offer new employees individual sessions with departmental IM professionals. One SDA is cross-training IM practitioners with departmental staff and vice versa in order to promote IM awareness throughout the organization. Because SDAs are still implementing their IM strategies, they have not yet fully developed electronic recordkeeping learning needs analyses for departmental staff. IM teams cannot ensure that departmental staff understands their role in implementing the IM strategy, including the need to track and retrieve information of business value and what training may be required.

Recommendations

5. SDAs should perform electronic recordkeeping training needs analyses for departmental staff, and implement actions required.

Management Action Plans

The findings and recommendations of this audit were presented to each of the departments and agencies included in the scope of the audit. The Office of the Comptroller General has asked each department and agency that has received recommendations as a result of the audit to prepare detailed management action plans.

Appendix A: Small Departments and Agencies Included in the Audit

• Canada Industrial Relations Board
• Canadian Environmental Assessment Agency
• Canadian Forces Grievance Board
• Canadian Human Rights Commission
• Canadian Intergovernmental Conference Secretariat
• Financial Transactions and Report Analysis Centre of Canada
• Military Police Complaints Commission of Canada
• National Film Board
• Office of the Commissioner for Federal Judicial Affairs Canada
• Office of the Secretary to the Governor General
• Public Service Labour Relations Board
• RCMP External Review Committee
• Truth and Reconciliation Commission of Canada
• Veterans Review and Appeal Board

The following departments were also included in the audit as they play a central role in the delivery of the Government of Canada Information Management Strategy.

• Library & Archives Canada
• Treasury Board of Canada Secretariat

Appendix B: Links to Applicable Legislation, Frameworks, Policies, Directives and Guidance

Sources of Criteria and Web Link

• Policy on Information Management
• Directive on Information Management Roles and Responsibilities
• Directive on Recordkeeping
• Government of Canada Information Management Strategy
• Strategic Direction for Government: Information Management
• Information Management in the Government of Canada – The Business Problem Assessment, Treasury Board of Canada Secretariat 
• Information Management in the Government of Canada – The Vision, Treasury Board of Canada Secretariat
• Management Accountability Framework VII (2009-2010): Area of Management 12 Effectiveness of Information Management
• Information Management Capacity Check Tool and Methodology, Library and Archives Canada

Appendix C: Objectives and Related Criteria

Objectives and Criteria

The objective of this audit was to determine whether SDAs and departments that have a central role are fulfilling the requirements of the IM policy suite, with a particular focus on electronic recordkeeping.

Departments have governance structures in place to effectively support an IM strategy and IM outcomes.  

• Governance structures, mechanisms and resources are in place to ensure the continuous and effective management of information.
• Monitoring and reporting processes are in place for IM.
• Departments participate in setting government-wide direction for information and recordkeeping.
• TBS supports the alignment of departmental strategy and IM approaches with Government of Canada policy instruments.

Departments are developing highly skilled workforces to ensure that capacity exists to deliver IM outcomes.

• Departments have a common body of knowledge, learning and assessment tools.
• Departments have a common understanding of common policy instruments and assessment tools.
• The Government of Canada has promoted and encouraged a common alignment of departmental IM functions.

Departments are developing information architecture and processes that respect their IM risks and controls, and operational requirements.

• Information and records are identified and managed as valuable assets to support the outcomes of programs and services, as well as operational needs and accountabilities.
• Government programs and services provide convenient access to relevant, reliable, comprehensive and timely information.
• Departments that play a central role in IM are assisting departments to ensure information is shared within and across departments to the greatest extent possible.

IM tools are developed and implemented that respect appropriate control requirements of the department and of the business users, and are compliant with the information architecture within and across departments.

• Departments develop and implement common and enterprise-wide tools and applications.
• The Government of Canada has adopted common and enterprise-wide tools and applications.

Recordkeeping practices ensure that information is timely, accurate, and accessible for departments in the delivery of Government of Canada programs and services.

• All information is managed to ensure the relevance, authenticity, quality, and cost-effectiveness of the information for as long as it is required to meet operational needs and accountabilities.
• LAC issues records disposition authorities pursuant to section 12 of the Library and Archives of Canada Act, to enable departments to carry out their records retention and disposition plans.
• Departmental programs and services integrate IM requirements into development, implementation, evaluation, and reporting activities.

Appendix D: Recommendations by Department and Agency

The applicability of the recommendations below to each department is subject to variability. Some departments may not have begun addressing some these recommendations, while others may be closer to implementing a final action required.

Recommendations	SDAs
	CIRB	CEAA	CFGB	CHRC	CICS	FINTRAC	MPCC	NFB	OCFJA	OSGG	PSLRB	ERC	TRC	VRAB	Risk Ranking
Legend A Applicable N/A Not Applicable CIRB Canada Industrial Relations Board CEAA Canadian Environmental Assessment Agency CFGB Canadian Forces Grievance Board CHRC Canadian Human Rights Commission CICS Canadian Intergovernmental Conference Secretariat FINTRAC Financial Transactions and Report Analysis Centre of Canada MPCC Military Police Complaints Commission of Canada NFB National Film Board OCFJA Office of the Commissioner for Federal Judicial Affairs Canada OSGG Office of the Secretary to the Governor General PSLRB Public Service Labour Relations Board ERC RCMP External Review Committee TRC Truth and Reconciliation Commission of Canada VRAB Veterans Review and Appeal Board
1. SDAs should develop IM plans appropriate to the size and scope of their IM needs, and include measurable performance indicators to be able to monitor the effectiveness of the plans.	A	A	A	A	A	N/A	A	A	A	A	A	A	A	A	High
2. SDAs should define information of business value for their organization and develop methods to ensure it is tracked and stored in an effective manner.	A	N/A	N/A	A	A	N/A	A	A	A	A	A	N/A	A	N/A	High
3. SDAs should develop strategies to increase the use of enterprise-wide electronic recordkeeping systems within their department.	A	N/A	N/A	A	A	N/A	A	A	A	A	A	A	A	A	High
4. SDAs, in collaboration with LAC, should develop formal retention and disposition processes that can be followed by all departmental staff.	A	A	N/A	A	A	N/A	A	A	A	A	A	N/A	A	A	High
5. SDAs should perform electronic recordkeeping training needs analyses for departmental staff, and implement actions required.	A	N/A	N/A	A	A	N/A	A	A	A	A	A	N/A	A	A	Medium

[1]. The Office of the Comptroller General has not undergone an external assessment of its audit activity at least once in the past five years to confirm its conformance with these standards.

[2]The SDA community, as defined by the Community of Federal Agencies, is broader than that defined by the Policy on Internal Audit