Treasury Board of Canada Secretariat
Symbol of the Government of Canada

 

ARCHIVED - Horizontal Internal Audit of Electronic Recordkeeping in Large Departments and Agencies, December 2011

Warning This page has been archived.

Archived Content

Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.





Table of Contents



Executive Summary

The objective of this audit was to determine whether large departments and agencies and departments that have a central role are fulfilling the requirements of the information management (IM) policy suite, with a particular focus on electronic recordkeeping.

Why This Is Important

The management of information in the Government of Canada impacts all lines of business and is a key component of departmental service delivery. Electronic information is being created throughout government at a rate that is growing exponentially, and without the ability to effectively manage this information, departments may be at risk of losing their ability to identify and retrieve information needed for decision making in an organized and timely fashion. This could result in an inability to meet information requests from Canadians and other obligations.

This audit supports the Treasury Board of Canada Secretariat (the Secretariat) in enabling departments and agencies to meet policy objectives for electronic recordkeeping by identifying systemic issues and common challenges with compliance to the Policy on Information Management.

Key Findings

A government-wide strategy and action plan for IM have been implemented, and these are actively communicated to large departments and agencies (LDAs). Most LDAs have developed plans that incorporate the IM policy suite requirements; however, LDAs are currently not monitoring the implementation of these plans.

Most LDAs have not developed a framework for identifying information of business value. This is an important first step so that information of business value can be retained and organized in a manner that makes retrieval for decision making timely and effective. Most LDAs have yet to define business value as it relates to their IM needs and provide little to no guidance for departmental staff.

Most LDAs do not have elaborated retention and disposition processes or guidance for departmental staff. Disposition of electronic records is performed mostly on an ad hoc basis by staff outside of the IM function, as most retention and disposition strategies were developed for paper-based recordkeeping.

Electronic recordkeeping systems and tools are inconsistently used by departmental staff. Most LDAs have not made electronic recordkeeping systems mandatory and instead leave usage up to the individual. This results in some electronic records being saved on shared drives, personal drives or portable storage devices rather than on an enterprise-wide system. While it is possible to effectively manage information of business value outside an enterprise-wide system, doing so decreases the efficiency of retrieval of this information in a timely manner and impedes sharing of information government-wide.

The Government of Canada is developing and delivering training to IM practitioners. LDAs are providing some training to departmental staff but have not identified learning requirements.

Conclusion

While strategic direction for electronic recordkeeping has been established within the Government of Canada, implementation of departmental plans to address the strategy is in the early stages. LDAs have not yet developed a framework for identifying information of business value to support decision making on a timely basis. LDAs are addressing training requirements for their IM practitioners but not for all departmental staff. Most LDAs have not yet developed formal retention or disposition processes. IM tools and applications are not being consistently used in LDAs.

Conformance With Professional Standards

The conduct of this engagement was done in accordance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing.[1]

Brian M. Aiken, CIA, CFE
Assistant Comptroller General
Internal Audit Sector, Office of the Comptroller General

Background

The Government of Canada has long made the management of information an operational priority. In the past, paper records were managed by a team of dedicated record keepers who would file what was often the only copy of any one record.

The arrival of the electronic age complicated traditional recordkeeping. Every email or draft document is created and saved as an original file and is thus considered an electronic record. Much of the information generated and managed by the federal government is electronic and can be categorized into two groups: structured and unstructured data.

Structured data represents information maintained in enterprise systems such as financial or human resources systems. Information is often entered into these enterprise systems through predefined fields such as "name," "telephone number," etc. There are numerous controls to manage the risks associated with this type of information, such as who can enter or edit the information, or what type of information can be entered into specific fields.

Unstructured data, on the other hand, is information that includes working documents such as project plans, spreadsheets, emails and records of decision. One of the major risks of managing this data is that the controls are frequently much less structured and often ad hoc in nature. This may mean that information is more difficult to track or that multiple versions saved in multiple locations compromise the reliability of the information. However, this data often forms the basis for critical decision making.

The notion of a physical space being used to centrally house all records is no longer a reality. All employees are now tasked with managing a multitude of records they may create every day. The number of records generated by the government has grown exponentially, challenging its previous ability to track and manage its information with certainty and effectiveness.

Acknowledging the changing environment, in 2006 the Treasury Board of Canada Secretariat (the Secretariat) led a government-wide effort to identify challenges in modernizing recordkeeping. Representatives from multiple government departments participated in the exercise, and two reports were produced that laid the foundation for a unified government direction: Information Management in the Government of Canada: The Business Problem Assessment and Information Management in the Government of Canada: The Vision.

In 2007, the Secretariat published a new Policy on Information Management, followed by two new directives: Directive on Information Management Roles and Responsibilities (2007) and Directive on Recordkeeping (2009).While the new policy suite established responsibilities for IM in departments, it was the Government of Canada Information Management Strategy (published in 2008) that aligned IM goals and provided clear objectives for the community as a whole.

Life-cycle management of information is a common thread throughout the IM policy suite and the Government of Canada Information Management Strategy. Specifically, departments must determine which electronic records are worth retaining in the long term (and for how long) and which records should be disposed of after an appropriate period of time. "Business value" is the term used to describe whether or not a record has value for operations. Because so many electronic records are transitory, they are not seen as having long-term value to the interests of the government. Yet these types of records often outnumber more "valuable" records by a significant margin.

Attributing business value to electronic records allows IM practitioners to assign life-cycle parameters according to long-term requirements. If this process is well established, retention and disposition of records becomes an automated process.

Library and Archives Canada (LAC) is the agency responsible to provide guidance and support to help determine retentions and to provide delegated authorities to allow for disposition of corporate records within government departments. These delegated authorities are required to be in place prior to the disposition of records because they state which records are to be destroyed and which records should be archived for the long-term benefit of the Government of Canada and of Canada's national interest.

Audit Objective, Scope and Approach

Objective and Scope

The objective of this audit was to determine whether LDAs and departments that have a central role are fulfilling the requirements of the IM policy suite, with a particular focus on electronic recordkeeping.

For the purposes of this audit, we limited our scope to unstructured electronic data.

Sixteen LDAs were reviewed during the audit. In addition, the Secretariat, LAC, and Public Works and Government Services Canada (PWGSC) were also included in the audit because of their specific responsibilities identified in the IM policy suite: the Secretariat in providing policy and functional guidance to departments, LAC in issuing records disposition authorities, and PWGSC in providing access to systems and software solutions. (Appendix A contains a list of the departments and agencies examined.)



Detailed Findings and Recommendations

Finding 1: Policy and Strategic Direction


While strategic direction for electronic recordkeeping is established in LDAs, implementation is in the early stages.

We reviewed the Secretariat's strategic guidance provided to LDAs to coordinate IM activities government-wide. We examined the progress of implementation of the Government of Canada Information Management Strategy in LDAs, including departmental policies, plans, organization charts and committee terms of reference. Finally, we assessed how IM practitioners are monitoring the progress of the implementation of their plans.

Common strategic direction across all departments ensures that the government is consistent in its approach to electronic recordkeeping. IM strategies ensure that IM practitioners have an established direction for IM activities in delivering departmental requirements of the IM policy suite. Performance measurement and monitoring assist senior management in determining whether IM plans are being implemented to meet management's objectives.

The strategic direction of IM is being coordinated government-wide.

The Secretariat is leading efforts to strengthen electronic recordkeeping activities government-wide. The Secretariat led the development of the Government of Canada Information Management Strategy—in partnership with LAC and committee members from various LDAs—which provides the strategic direction for electronic recordkeeping government-wide. The strategy identified government-wide risks and centrally led activities required to mitigate those risks. An action plan with established timelines was developed to implement the strategy, and multiple guidance documents have been produced to assist IM practitioners and departmental staff. The Secretariat's strategies and guidance are complemented with outreach activities that reach all LDAs. Through this coordination of efforts, LDAs are in a position to leverage each other's knowledge and experience.

Most LDAs have developed IM plans that incorporate IM policy suite requirements.

Most LDAs have begun implementing their plans with departmental IM policies that address the government-wide electronic recordkeeping strategy. LDAs have also established champions or IM practitioners who are in positions to inform senior management of risks to IM activities. Management of electronic information has been recognized government-wide as a risk to operational efficiency, and LDAs have recognized the growing risk of insufficient electronic recordkeeping practices. IM requirements and risks are formally discussed by senior management. As significant IM priorities arise that require additional resources, it will be important for LDAs to incorporate these requirements into overall departmental planning activities.

IM practitioners are not monitoring the implementation of their plans.

Most LDAs have not yet developed performance indicators to measure and monitor the progress of implementation in relation to their IM plans. While overall objectives for strategy implementation have been identified in most LDAs, activities that have established timelines have yet to be elaborated. As a result, IM practitioners are not able to assess the effectiveness of their activities, nor can they demonstrate their effectiveness to senior management.

An example of a performance indicator is the completion of identification of information that has business value within each departmental unit and the resulting retention and disposition processes. This could be measured as a percentage of completion of developing formal processes and could be compared across business units within a department.

Recommendations
  1. LDAs should develop performance indicators to assist in monitoring the implementation of their IM plans.

Finding 2: Retaining Information That Has Business Value


Most LDAs have not yet developed a framework for identifying and managing information of business value.

We examined methodologies that LDAs use to identify the business value of the information they generate. We examined the guidance provided to all departmental staff to ensure they understood how to identify business value and the resulting retention and disposition processes. Finally, we examined the methodology that LAC is using to issue disposition authorities to departments that have demonstrated their ability to track and retain information that has business value, thereby reducing the risk of disposing of information that has long-term benefit to the Government of Canada and to Canada's national interest.

In the absence of identifying information of business value, LDAs could overburden their systems with information that has no long-term value for the operations of their department. This also increases the complexity of finding information of business value when it is needed to support decision making or respond to information requests from Canadians. After determining the effectiveness of departmental processes for retention and disposition of information, LAC grants records disposition authorities to departments that allow LDAs to dispose of information that has no business value through an established process. This increases the efficiency of disposition and reduces long-term costs in maintaining information that has no long-term value.

Most LDAs have not yet defined information of business value.

Most LDAs have yet to define business value as it relates to IM needs in their organization, and most provide little to no guidance for departmental staff. Most LDAs identify only specific products or documents (e.g., Memoranda to Cabinet) but no further guidance that can be interpreted for departmental staff to apply to other documents generated on a daily basis. Most LDAs still classify records based on security and/or access restrictions; business value is not addressed. As a result, LDAs are potentially spending resources tracking, maintaining and archiving information of no long-term business value to the Government of Canada.

Most LDAs do not have elaborated retention and disposition processes or guidance for departmental staff.

Disposition of electronic records is performed mostly on an ad hoc basis by departmental staff, as most retention and disposition strategies were developed for paper-based recordkeeping. Because the number of electronic records generated by departmental staff is exponentially greater than that of paper records, LDAs are increasingly challenged by disposing and archiving their electronic records; existing retention and disposition processes are not suitable for electronic records. In theory, departmental staff could be deleting information that is important for decision makers; conversely, storage capacity could be burdened by electronic records that are unnecessarily retained.

Some LDAs have addressed this challenge by creating a handful of record types; when the record is created, its life cycle is predefined based on its record type. These LDAs also provide one-on-one guidance for departmental staff if the record is not clearly linked to a record type.

LAC has begun implementing a standardized methodology for issuing records disposition authorities.

LAC's methodology in issuing records disposition authorities was launched in May 2011. It includes an assessment of a department's ability to track and retain information of business value, thereby reducing the risk of disposing of information that may have long-term benefits to the Government of Canada and to Canada's national interest. Prior to this, the process for issuing disposition authorities was performed on an ad hoc basis and often had long delays. The new methodology gives LAC the opportunity to streamline the process and increase efficiency. It will be important for LAC to monitor the progress of its new methodology and continue to improve the process in order to optimize the efficiency of electronic recordkeeping disposition government-wide.

Recommendations
  1. LDAs should define information of business value for their organization and develop methods to ensure that it is tracked and stored in an effective manner.
  2. LDAs, in collaboration with LAC, should develop formal retention and disposition processes that can be followed by all departmental staff.

Finding 3: Learning and Awareness


LDAs are addressing training requirements for their IM practitioners but not for all departmental staff.

We examined the Secretariat's functional guidance for IM practitioners and courses developed for the IM community. We examined IM mandatory training that LDAs provide for their IM practitioners. Finally, we also examined IM training provided to all LDA staff outside the IM function, and whether IM practitioners are able to determine if current training is sufficient to help implement the Government of Canada Information Management Strategy.

Working with the Canada School of Public Service, the Secretariat is in a position to coordinate new developments or methods in electronic recordkeeping training and effectively communicate them to all departments in order to promote consistency throughout government. Formal training plans help ensure a professional, well-informed IM function that can help the department deliver the Government of Canada Information Management Strategy. Providing IM training to all departmental staff helps them understand their role in electronic recordkeeping, including understanding how to track and retain information of business value. Since every employee is now considered an electronic record keeper to some extent, it is important that departmental employees have the knowledge and training required to help deliver IM strategic objectives.

The Government of Canada is leading efforts to strengthen training and awareness in departmental IM functions.

The Secretariat and LAC chair multiple interdepartmental committees and working groups in order to better determine training and outreach requirements for the community, and to share new developments uniformly throughout the community. The Secretariat is leading the development of training courses (with the Canada School of Public Service) for IM practitioners. By working directly with IM practitioners in LDAs, the Secretariat and LAC can ensure that centralized guidance is customized to the various working levels that will implement IM strategies. Through committee meetings and interdepartmental working groups, electronic recordkeeping knowledge is shared across the community regularly and effectively.

Training for IM practitioners is planned and coordinated.

Most LDAs have identified learning for IM practitioners as a priority. Most LDAs have developed formal training plans for IM practitioners and track progress against learning objectives. IM practitioners are well positioned to implement further electronic recordkeeping advances for departments.

LDAs are providing some training to departmental staff but have not identified learning requirements.

Most LDAs have not developed IM learning strategies for all departmental staff. Most LDAs have developed one or two training sessions for departmental staff but lack clearly defined learning objectives. Because LDAs are still implementing their IM strategies, they have not yet fully developed electronic recordkeeping learning needs analyses for departmental staff. IM teams cannot ensure that departmental staff understand what is required of them to implement the Government of Canada Information Management Strategy, including the need to track and retrieve information of business value and what training may be required.

Recommendation
  1. LDAs should perform departmental staff training needs analyses and implement any actions required.

Finding 4: Information Management Tools and Applications

Implementation and use of IM tools and applications are not coordinated in LDAs.

We examined activities to promote information sharing by departments that play a central role in the delivery of the IM strategy. We also examined whether tools and applications had been developed or procured by departments that have central roles, and how they were provided to LDAs for common use across government. Finally, we examined enterprise-wide systems used to manage electronic records in LDAs.

Many software solutions are expensive for individual organizations to implement, and LDAs could leverage from each other's learning while making progress toward advancing IM activities. Enterprise-wide systems are the tools used by LDA staff to manage electronic records on a daily basis, and without software solutions to centrally manage large volumes of information, electronic records cannot be managed effectively. While it is possible to effectively manage information of business value outside an enterprise-wide system, this decreases the efficiency of retrieval of this information in a timely manner and impedes the sharing of information government-wide.

Departments that play a central role in IM are providing LDAs with access to common tools and applications.

With the direction and guidance of the Secretariat, PWGSC has procured an enterprise-wide electronic recordkeeping solution. LDAs can, and do, choose to procure and implement their own solutions, as the service provided by PWGSC is optional rather than mandatory. The Secretariat is also working with LDAs to develop common enterprise architecture systems to ensure that electronic recordkeeping systems are designed uniformly throughout government. With standardized structures and tools, along with centralized guidance, LDAs have the opportunity to leverage information sharing with colleagues and improve the efficiency and effectiveness of IM functions.

Electronic recordkeeping systems are inconsistently used by departmental staff.

Usage of enterprise-wide applications for electronic recordkeeping varies in most LDAs from employee to employee. Most LDAs have not made electronic recordkeeping systems mandatory and instead leave usage up to the individual. This results in some electronic records being saved on shared drives, personal drives or portable storage devices, rather than on an enterprise-wide system. Most LDAs are also using multiple enterprise-wide applications for different operational areas, some of which are not interoperable. LDAs have addressed different operational or security requirements for different business functions, which may prevent the adoption of one universal application. Because information exists in LDAs across multiple platforms, information may not be readily accessible to decision makers to deliver program objectives. It is important for LDAs to ensure that interoperability between systems is addressed when implementing their IM strategy.

Recommendations
  1. LDAs should develop strategies to increase the use of enterprise-wide electronic recordkeeping systems by LDA staff.

Management Action Plans

The findings and recommendations of this audit were presented to each of the 19 departments included in the scope of the audit. The Office of the Comptroller General has asked each department that participated in the audit to prepare detailed management action plans and discuss these plans with their respective Departmental Audit Committees.



Appendix A: Large Departments and Agencies Included in the Audit

  • Atlantic Canada Opportunities Agency
  • Canada Border Services Agency
  • Canadian Nuclear Safety Commission
  • Canadian Security Intelligence Service
  • Canadian Space Agency
  • Citizenship and Immigration Canada
  • Correctional Service Canada
  • Courts Administration Service
  • Foreign Affairs and International Trade Canada
  • National Defence
  • Privy Council Office
  • Public Safety Canada
  • Royal Canadian Mounted Police
  • Social Sciences and Humanities Research Council of Canada
  • Transport Canada
  • Treasury Board of Canada Secretariat

The following departments were also included in the audit because they play a central role in the delivery of the Government of Canada Information Management Strategy:

  • Library and Archives Canada
  • Public Works and Government Services Canada
  • Treasury Board of Canada Secretariat

Appendix B: Links to Applicable Legislation, Frameworks, Policies, Directives and Guidance

Sources of Criteria

Appendix C: Objectives and Related Criteria

The objective of this audit was to determine whether LDAs and departments that have a central role are fulfilling the requirements of the IM policy suite, with a particular focus on electronic recordkeeping.

Sub-Objectives Criteria

Departments have governance structures in place to effectively support an IM strategy and IM outcomes.

  • Governance structures, mechanisms and resources are in place to ensure the continuous and effective management of information.
  • Monitoring and reporting processes are in place for IM.
  • Departments participate in setting government-wide direction for information and recordkeeping.
  • The Secretariat supports the alignment of departmental strategy and IM approaches with Government of Canada policy instruments.

Departments are developing highly skilled workforces to ensure that capacity exists to deliver IM outcomes.

  • Departments have a common body of knowledge, learning and assessment tools.
  • Departments have a common understanding of common policy instruments and assessment tools.
  • The Government of Canada has promoted and encouraged a common alignment of departmental IM functions.

Departments are developing information architecture and processes that respect their IM risks and controls and operational requirements.

  • Information and records are identified and managed as valuable assets to support the outcomes of programs and services, as well as operational needs and accountabilities.
  • Government programs and services provide convenient access to relevant, reliable, comprehensive and timely information.
  • Departments that play a central role in IM are assisting departments to ensure that information is shared within and across departments to the greatest extent possible.

IM tools are developed and implemented that respect appropriate control requirements of the department and of the business users, and are compliant with the information architecture within and across departments.

  • Departments develop and implement common enterprise-wide tools and applications.
  • The Government of Canada has adopted common enterprise-wide tools and applications.

Recordkeeping practices ensure that information is timely, accurate and accessible for departments in the delivery of Government of Canada programs and services.

  • All information is managed to ensure the relevance, authenticity, quality and cost-effectiveness of the information for as long as it is required to meet operational needs and accountabilities.
  • LAC issues records disposition authorities pursuant to section 12 of the Library and Archives of Canada Act to enable departments to carry out their records retention and disposition plans.
  • Departmental programs and services integrate IM requirements into development, implementation, evaluation and reporting activities.

Appendix D: Recommendations by Department and Agency

The applicability of the following recommendations to each department is subject to variability. Some departments may not have begun addressing some these recommendations; others may be closer to implementing a final action required.

Recommendations LDAs Departments That Play a Central Role
ACOA CBSA CNSC CSIS CSA CIC CSC CAS DFAIT DND PCO PS RCMP SSHRC TC TBS TBS LAC PWGSC
1. LDAs should develop performance indicators to assist in monitoring the implementation of their IM plans. A A A A N/A A A N/A A A A A A A N/A A N/A N/A N/A
2. LDAs should define information of business value for their organization and develop methods to ensure that it is tracked and stored in an effective manner. A A N/A N/A N/A A A A A A A A A A N/A A N/A N/A N/A
3. LDAs, in collaboration with LAC, should develop formal retention and disposition processes that can be followed by all departmental staff. A A N/A N/A N/A A A A A N/A A A A A N/A A N/A N/A N/A
4. LDAs should perform departmental staff training needs analyses and implement any actions required. A A N/A N/A N/A N/A A A A A A A A A N/A A N/A N/A N/A
5. LDAs should develop strategies to increase the use of enterprise-wide electronic recordkeeping systems by LDA staff. A A N/A A N/A A A A A A A N/A A A N/A A N/A N/A N/A

Legend

A
Applicable
N/A
Not Applicable
ACOA
Atlantic Canada Opportunities Agency
CBSA
Canada Border Services Agency
CNSC
Canadian Nuclear Safety Commission
CSIS
Canadian Security Intelligence Service
CSA
Canadian Space Agency
CIC
Citizenship and Immigration Canada
CSC
Correctional Service Canada
CAS
Courts Administration Service
DFAIT
Foreign Affairs and International Trade Canada
DND
National Defence
PCO
Privy Council Office
PS
Public Safety Canada
RCMP
Royal Canadian Mounted Police
SSHRC
Social Sciences and Humanities Research Council of Canada
TC
Transport Canada
TBS
Treasury Board of Canada Secretariat
LAC
Library and Archives Canada
PWGSC
Public Works and Government Services Canada

Appendix E: Risk Ranking of Recommendations

The following table presents the recommendations and assigns risk rankings of high, medium or low. The risk rankings were determined based on the relative priorities of the recommendations and the extent to which the recommendations indicate non-compliance with Treasury Board policies.

Recommendations Priority
1. LDAs should develop performance indicators to assist in monitoring the implementation of their IM plans. High
2. LDAs should define information of business value for their organization and develop methods to ensure that it is tracked and stored in an effective manner. High
3. LDAs, in collaboration with LAC, should develop formal retention and disposition processes that can be followed by all departmental staff. High
4. LDAs should perform departmental staff training needs analyses and implement any actions required. Medium
5. LDAs should develop strategies to increase the use of enterprise-wide electronic recordkeeping systems by LDA staff. High

[1]. The Office of the Comptroller General has not undergone an external assessment of its audit activity at least once in the past five years to confirm its conformance with these standards.