Introduction to the Control Standard Contents 1. 2. 3. 4. 5. 6. 7. Course Aims ..................................................................................................... 4 Why Good Recordkeeping is Important ............................................................ 4 Why We Need Recordkeeping Standards......................................................... 5 VAGO Report on Recordkeeping ...................................................................... 5 About the new Recordkeeping Standards ......................................................... 6 How the Standards Documents Work Together ................................................ 7 Overview of the Control Standard ..................................................................... 8 7.1. Metadata ............................................................................................. 11 7.2. Classification ....................................................................................... 14 7.3. Tracking .............................................................................................. 18 8. Case Studies .................................................................................................. 20 8.1. Hazardous Waste Management .......................................................... 21 8.2. Driver License Management ............................................................... 22 8.3. Council Planning Dispute .................................................................... 23 9. Self Assessment Table ................................................................................... 25 10. Further Information ......................................................................................... 31 10.1. Help Available from PROV .................................................................. 31 10.2. Higher Education ................................................................................ 32 11. Question Answers .......................................................................................... 34 Case Study Answers ............................................................................................... 35 Recordkeeping Standards Training Control Icons used in this course The following icons are used throughout this course: Time: Used to show the time to complete a task. Question: Used for questions in the workbook. Important: Used to emphasise something important. Case Study: Used for the case problem solving (case study) section of the course. Assessment Table: Used to help determine how well your agency is complying with the Standard. Principle: Used to highlight a principle from the Standard. Requirement: Used to highlight requirements from the Specification. Guideline: Used to highlight Guidelines that contain suggestions on how to implement requirements. Public Record Office Victoria Page 3 Recordkeeping Standards Training 1. Control Course Aims The aim of this course is to help you understand the Control Standard and its implications for your agency. During this course, we will: Describe the purpose of the Control Standard and what it mandates; Explain the requirements of the Control Specification; Apply the Control Specification to case studies based on real work situations to familiarise you with the Standard; and Explain the resources available to help agencies comply with the Standard. 2. Why Good Recordkeeping is Important According to the Victorian Auditor-General’s Office (VAGO), sound recordkeeping in government agencies is important because: “The public sector’s ability to deliver efficient and effective services depends upon accurate, up-to-date records that can be readily accessed as needed. The management of public records is an integral part of the effective administration and governance of public sector agencies and facilitates: sound decision-making; efficient and effective customer services; managing business information and resources; meeting legal, evidential and accountability requirements; and documenting significant events and preserving historically and culturally important records. The Public Records Act 1973 assigns primary responsibility for records management to the officer-in-charge of government agencies. Records management is also a core responsibility of all individuals in agencies.”1 1 Victorian Auditor-General’s Office 2008, Records Management in the Victorian Public Sector, viewed 12 May 2010, <http://www.audit.vic.gov.au/reports__publications/reports_by_year/2008/20080312_records/1_executive_summary. aspx>. Public Record Office Victoria Page 4 Recordkeeping Standards Training 3. Control Why We Need Recordkeeping Standards While the Public Records Act 1973 defines the recordkeeping responsibilities of Victorian Government agencies, it also gives the Public Record Office Victoria (PROV) responsibility for helping agencies comply with the Act. The Recordkeeping Standards are part of this responsibility. The Standards developed by PROV help agencies comply with the Act by: Providing advice on how to perform each key area of records management; Enabling agencies to identify areas of records management that need improvement; and Allowing agencies to indentify the resources, relationships and responsibilities they need to establish to manage their records effectively. In this way the Standards act like a map or pathway to guide agencies so they have good records management practices which help them comply with the Act. 4. VAGO Report on Recordkeeping The importance of effective recordkeeping prompted VAGO to conduct an audit in 2007 on how well Victorian public sector agencies were complying with the Public Records Act. The report also examined how well PROV was facilitating this. The report was called Records Management in the Victorian Public Sector. The audit involved asking around 100 agencies to complete a self assessment based on seven principles of good records management practice. From this self assessment, eight agencies were chosen for a more detailed audit. The audit showed agencies were not managing records in the way they needed to, particularly in the following areas: There was a lack of understanding and support by senior management for effective records management; Because most agencies surveyed did not adopt a strategic approach to records management, they were unable to properly advise management of the resources they needed to fulfil their legislative obligations; and The management of electronic records including email and websites was a challenge for agencies. Most agencies were yet to implement a system that ensured their electronic records, such as emails, would be accessible in the long term.2 2 Victorian Auditor-General’s Office 2008, Records Management in the Victorian Public Sector, viewed 12 May 2010, <http://www.audit.vic.gov.au/reports__publications/reports_by_year/2008/20080312_records/1_executive_summary. aspx>. Public Record Office Victoria Page 5 Recordkeeping Standards Training 5. Control About the new Recordkeeping Standards PROV has developed new Recordkeeping Standards which include guidance on how to implement best practice recordkeeping. The new Recordkeeping Standards comprise seven Standards, each dealing with a particular aspect of recordkeeping. While each Standard deals with a particular area, they are designed to work together with aspects of one Standard supporting and having implications for another. Strategic Management Capture Control Storage Access Disposal Operations Management Each Standard is briefly described in the table below. Standard What is covered Strategic Management The formulation, implementation and evaluation of an agency's records management strategy. Operations Management Tasks associated with the efficient day to day management of an agency's records management function. Capture The capture of records into an agency's recordkeeping systems. Control The control of records held in an agency's recordkeeping systems. Storage The storage of physical and digital records of temporary and permanent value. Access The management of access to government records. Disposal The management of records no longer required by an agency through destruction or transfer to the Public Record Office. Public Record Office Victoria Page 6 Recordkeeping Standards Training 6. Control How the Standards Documents Work Together The Standards are made up of four levels of documentation: Standard, Specification, Guideline and Fact Sheet. Each document type provides the information described below: St Standard: contains the principles that must be followed to comply with the Standard and the benefits of following these principles. It also outlines background information such as the purpose and scope of the Standard. For example, one of the principles in the Standard is: Principle: The metadata elements needed for the structure, context and management of business records to be used and understood over time are captured, maintained and connected with the records. Sp Specification: lists a set of requirements that outline what agencies must do to meet each principle. It also provides examples of evidence that gives suggestions on how an agency would know a requirement has been met. For example: Requirement: Current business records, regardless of their format or which system they are in, are classified in accordance with a business classification scheme. Examples of Evidence: Business classification scheme or schemes that cover business records in all systems. Procedures that document how business records are to be classified in accordance with the classification scheme. Audit reports that demonstrate business records are being classified in accordance with the relevant business classification scheme. G Public Record Office Victoria Guidelines contain suggestions on how to implement requirements, for example, how to complete a functional analysis. They differ from the Standard and Specification because the information they provide is more detailed and is optional for agencies to follow. Page 7 Recordkeeping Standards Training FS Control Factsheets are one page quick reference guides containing high level information on an aspect of the Standard. They are designed to be used as handouts or to be placed on notice boards to raise staff awareness. These documents provide different levels of detail so agencies can access information according to their needs and circumstances. Remember, the requirements of each Standard are mandatory for agencies to follow. The processes suggested in the Guidelines are optional. 7. Overview of the Control Standard The Control Standard is about the managing the control of public records through the development and alignment of recordkeeping control mechanisms across an agency. The aim of the Standard is to ensure: The structure, context and history of records can be understood over time; and Records are classified and actions associated with records are tracked. The Standard focuses on control of business records through metadata, classification and tracking. Business records are ones that relate to the activities of the agency rather than ephemeral or personal records. Ephemeral records are records created in the course of business such as draft versions or notes that facilitate the creation of records. These can be disposed of under Normal Administrative Practice. Personal records are records not related to the business of the agency such as emails to organise lunch with a colleague. Public Record Office Victoria Page 8 Recordkeeping Standards Training Control The Standard comprises the documents shown in the following diagram: PROS 11/09 Control Standard Specification 1: Control Guideline 1: Metadata Guideline 2: Classification Guideline 3: Tracking The role of each document is summarised below: Specification 1: Control Lists the requirements to comply with the Control Standard that enable effective management of control activities including: Assigning metadata to business records to maintain the context of records over time; Development and implementation of a business classification scheme that is aligned with business processes, access controls and disposal programmes; and Accurate tracking of the location and actions relating to business records. Public Record Office Victoria Page 9 Recordkeeping Standards Training Control Guideline 1: Metadata This guideline will cover how to determine the agency’s minimum metadata set in accordance with AS ISO 23081Standard on Managing Metadata for Records, PROS 99/007 Standard on the Management of Electronic Records and agency business requirements. [Forthcoming] Guideline 2: Classification This guideline will focus on an overview of classification schemes, development processes, and methods of alignment with or mapping to other records management programmes such as security, disposal and access. [Forthcoming] Guideline 3: Tracking This guideline will focus on an overview of tracking methods and systems in relation to business records. [Forthcoming] The principles and requirements for the Control Standard are listed under three key headings, each with a particular focus: Heading Focus Metadata Enabling the context of records to be understood over time by ensuring the relevant metadata is located within or associated with the record, regardless of the record’s format or system it is held in. Classification Supporting records management practices by implementing one or more business classifications schemes and mapping the schemes to other recordkeeping processes such as security or access restrictions and disposal programmes. Tracking Having records tracking systems that can accurately monitor and report actions relating to records including changes in their physical location. Let’s now look at what this Control Specification says in relation to these three headings. Public Record Office Victoria Page 10 Recordkeeping Standards Training Control 7.1. Metadata Metadata is defined as ‘Data describing context, content and structure of records and their management through time’.3 Metadata is not format based and can be recorded on various media including on hardcopy documents, in related databases and in electronic systems. Metadata is about ensuring business records have connected to them the information needed for the records to be clearly understood and interpreted over time. This information needs to be recorded at the point of capture and at various points throughout the retention period as the record is accessed and modified. The type and amount of metadata connected to records will depend on an agency’s requirements, the types of records it creates, its business and its information systems. The six metadata elements identified as the minimum metadata set may be subdivided into whatever additional categories are necessary, for example in order to meet the requirements of PROS 99/007 Standard on the Management of Electronic Records. Metadata is also required to be consistent with the Australian and International Standard on Managing Metadata for Records (AS ISO 23081)4. The benefits of capturing metadata appropriate to an agency’s needs are: The integrity and validity of business records can be demonstrated; The full story of a record is known and can be explained to others; The relationship between records and business processes are clear; and Recordkeeping processes such as disposal and access controls are more efficient because they can be linked to records from the point of capture. Metadata is based on the following principle that is mandatory for agencies to comply with: Metadata elements needed for the structure, context and management of business records to be used and understood over time are captured, maintained and connected with the records. The Control Specification lists the requirements agencies must follow to ensure this principle is met. These are listed below: 1 Metadata schemes are developed and implemented that meet agency business needs and are compliant with legislative and regulatory 3 Standards Australia, AS ISO 15489:1 Australian standard on records management: Part 1: General, Standards Australia, Sydney, 2002, ss. 3.12, p. 3. 4 The metadata Standards recently issued by National Archives of Australia and Archives New Zealand are also based on AS ISO 23081 and may be useful additional sources of information. National Archives of Australia ‘Australian Government Recordkeeping Metadata Standard’ is available from the NAA website <http://www.naa.gov.au/records-management/publications/index.aspx> Archives New Zealand ‘Electronic Recordkeeping Metadata Standard’ and ‘Technical Specifications for Electronic Recordkeeping Metadata Standard’ are located from the ANZ website: <http://archives.govt.nz/advice/continuum-resource-kit/publications-publication-type#standards> Public Record Office Victoria Page 11 Recordkeeping Standards Training Control requirements, including PROV Recordkeeping Standards. 2 3 4 The minimum metadata collected cover the following metadata attributes.5 - Identity; - Description; - Use; - Event History; - Event Plan; and - Relation. The minimum metadata collected are consistent with the International Standard on Managing Metadata for Records (ISO 23081: 2009) and PROS 99/007 Management for Electronic Records. Controls are implemented to assess and verify the accuracy of metadata. The following documents contain further information relating to Metadata: For information on how to develop and implement metadata schemes, please see the Control Guideline 1: Metadata. [Forthcoming] For information on how to undertake audits, please see the Operations Management Guideline 5: Compliance Audits [Forthcoming]. Refer to the Control Specification to answer the next question. What is the minimum metadata that needs to be collected for business records regardless of format? 5 Please refer to Appendix One for more information about the metadata attributes identified. Public Record Office Victoria Page 12 Recordkeeping Standards Training Public Record Office Victoria Control Page 13 Recordkeeping Standards Training Control 7.2. Classification Classification is defined as ‘Systematic identification and arrangement of business activities and / or records into categories according to logically structured conventions, methods, and procedural rules represented in a classification system.’6 It is about arranging records in a logical and consistent structure and sequence so they can be indentified, understood, accessed and managed according to an agency’s business needs. This is irrespective of whether or not records are in physical or electronic formats. Classification schemes7 may be developed a number of ways, including but not limited to using tools provided in the DIRKS Manual. There are a number of different methods that may be used to develop Classification schemes, such as functional analysis or work process analysis. Classification schemes may be function based or subject based. They may sit across the entire agency or be limited to a particular business system, work unit, or subsection of the agency. Classification schemes can be used to support a variety of records management practices such as: Sentencing of records; Access controls; Timely retrieval of records; Linking, grouping and naming of records; Security protection; and Identification and retrieval of vital records. Connecting specific access restrictions and disposal triggers to specific folders then enables classification of records to include assigning access provisions and disposal sentences to the records. Classification schemes may be mapped to business processes or workflows, business functions, subjects or organisations within an agency. By aligning an agency’s classification scheme to records management processes agencies can: Locate records when information associated with a function or activity is needed as records are consistently arranged according to their business function; 6 AS ISO 15489:1, ss. 3.5, p. 2. Tools for classification include: Standards Australia HB 5031-2011 Records Classification Handbook; AS 5090-2003 Australian Standard: Work Process Analysis for Recordkeeping; DIRKS Manual (for function based schemes) available from NAA (see also the ‘Overview of Classification Tools for Records management) <http://www.naa.gov.au/records-management/publications/index.aspx> or State Records Authority New South Wales websites <http://www.records.nsw.gov.au/recordkeeping/dirks-manual/dirksmanual> 7 Public Record Office Victoria Page 14 Recordkeeping Standards Training Control Demonstrate a continuous record of the agency’s business as the classification provides a clear link between the records and business processes that produced them; and Assign recordkeeping controls when records are classified, for example, having an action performed on a record linked to the appropriate access and disposal triggers associated with records of that type. There may be instances when an agency needs multiple classification schemes, for example, due to the limitations of different business systems. In this case the different terms will need to be aligned to the agency’s main classification scheme so the correct terms to use under different circumstances are clear. When developing a classification scheme, it is important that the following steps are completed: Ensure that all of the business functions of the agency have been covered; Ensure that each function is “mutually exclusive” of all other functions; Decide on the level of detail appropriate for the agency; Assign terms to functions and activities; Create a consistent and comprehensive scheme that will last; Do not create separate schemes for paper and electronic records; Involve stakeholders (for example, records management unit, information technology unit, users, and managers); Consider how the scheme can meet all the different needs of the agency; Note that everyone has an opinion on how their data should be organised; and The agency commits to maintaining it. Public Record Office Victoria Page 15 Recordkeeping Standards Training Control Classification is based on the following principle that is mandatory for agencies to comply with: Business records are classified in accordance with business classification schemes that are aligned and mapped to access controls and disposal programmes. The Control Specification lists the requirements agencies must follow to ensure this principle is met. These are listed below: 5 One or more business classification scheme are developed, implemented and maintained in consultation with stakeholders to meet the agency’s business needs. 6 Business processes, access controls and disposal programmes are assessed to determine what can accurately be mapped to the business classification schemes used by the agency and the results of the assessment are implemented. 7 Current business records, regardless of their format or which system they are in, are classified in accordance with a business classification scheme. 8 Where multiple business classification schemes are used, the language used within these schemes are aligned or mapped with each other. The following documents contain additional information relating to Classification: For information on the development and implementation of business classification schemes, including mapping schemes to disposal and security, please see the Control Guideline 2: Classification. [Forthcoming] For information on how to undertake compliance audits, please see the Operations Management Guideline 5: Compliance Audits [Forthcoming]. For information on developing a Continuous Improvement Programme for records management, please see the Operations Management Guideline 6: Continuous Improvement. Public Record Office Victoria Page 16 Recordkeeping Standards Training Control Refer to the Control Standard to answer the next questions. What are the main benefits of using a classification scheme to arrange records in a logical structure and sequence? Public Record Office Victoria Page 17 Recordkeeping Standards Training Control 7.3. Tracking Tracking is defined as ‘Creating, capturing and maintaining information about the movement and use of records.’8 It can refer to such things as processes, procedures and systems design, both automated and manual, within agencies and between agencies and external bodies. It is about having systems in place to know where records are and what has happened to them. This involves: Tracking the movement history of records including the date and time of movement, location, who has custody and why the record was moved; and Recording actions and decisions associated with the record (for example, access, adjustments to record or reclassification). The benefits of having a system to track record movements and actions are: Records are able to be located quickly, enabling queries to be addressed efficiently; What has happened to the records and why it happened can be determined and answered; and Information security is supported as details of record movements and custodianship are recorded. Tracking is based on the following principle that is mandatory for agencies to comply with: Business records are accurately tracked using systems that create, capture and maintain information about the movement of and actions on records. The Control Specification lists the requirements agencies must follow to ensure this principle is met. These are listed below: 9 The movement of business records are accurately tracked, including when they are migrated from one system to another or transferred to an external location or party. 10 Actions related to business records are accurately tracked and maintained. The following document contains additional information relating to Tracking: For information on methods for tracking records, please see the 8 AS ISO 15489:1, ss. 3.19, p. 3. Public Record Office Victoria Page 18 Recordkeeping Standards Training Control Control Guideline 3: Tracking. [Forthcoming] For information on how to undertake compliance audits, please see the Operations Management Guideline 5: Compliance Audits [Forthcoming]. Refer to the Control Standard to answer the next question. What two types of information should record tracking systems capture? Public Record Office Victoria Page 19 Recordkeeping Standards Training 8. Control Case Studies In this section of the course, we will be working as a group to examine some short case studies. The case studies present typical recordkeeping situations in small and large agencies. They are designed to help familiarise you with the Control Standard. Instructions Please complete the following steps for each case study: Step 1 Read the case study. Step 2 Reflect how well the agency in the case study met the requirements of the Control Specification. Step 3 If you were the records person at this agency, consider what else you would have done or what you would have done differently. Step 4 Share your insights when the case study is discussed as a group. This exercise should take approximately 45 minutes to complete. Public Record Office Victoria Page 20 Recordkeeping Standards Training Control 8.1. Hazardous Waste Management The Department of Hazardous Waste Management is an authority that regulates production and disposal of hazardous waste produced by Victorian industry. As part of this role, they produce waste management standards, issue licenses to industry and monitor compliance with license conditions. Consequently, they collect and produce large amounts of information about the production, disposal and transport of hazardous waste along with information on industry compliance with license conditions. However this information was fragmented across nine separate databases. Some of the databases were supported centrally while others, primarily spreadsheets, were maintained at department level. The spreadsheets used at department level were of particular concern because: They did not have any built in controls such as: o Tracking of alterations, adjustments and deletions; o Tracking of actions related to the records such as decisions and the rationale for them; and o Access restrictions. There was no capacity for data integration with the other databases; and Some contained information on matters other than hazardous waste. This made it difficult to distinguish information relating to hazardous waste. In addition to the database deficiencies, core records could not easily be located. Records were kept in both electronic and hard copy format and there were poor processes around the classification of records. Records relating to a case were often located in multiple departments making it difficult to locate and compile key records. Duplicate and incomplete records were a large problem. There was no central ownership and maintenance of case files. This meant the integrity of the records was also in doubt. Where reports indentified issues of non-compliance, information about remedial action undertaken was not clear in terms of what action was taken, when it was taken and by whom. Likewise, information on enforcement decisions and actions was not clear. The integrity of the records also made it difficult to analyse and report trends which would normally inform compliance and monitoring activities. For example the data in its current state did not allow analysis in areas such as industry types over represented in license breaches, repeat offenders or whether non-compliance with certain conditions was increasing. Public Record Office Victoria Page 21 Recordkeeping Standards Training Control 8.2. Driver License Management The Victorian Motor Board has two key responsibilities: road construction and maintenance of vehicle and driver license registration records. Since the organisation’s inception, the driver license records system had become increasingly important as a means of authenticating identity and as a source of name and address information for commercial and government organisations. However, during this time, fraudulent license records had also become a growing problem. Driver license records were held across four different mainframe systems. Back office staff processing driver license applications and updates had to update data across all four systems. Searches could take a long period of time. If a customer record could not be found quickly, staff would often create a new identity record for a customer in order meet performance targets. There was a strong focus in the Victorian Motor Board on operational efficiency and effectiveness. Staff working in the driver licensing area had to meet strict performance targets where set times were allocated for dealing with queries, including license applications. Time pressures often meant staff rushed through their work. A survey of a sample of 200 new license records revealed: Error rates of more than 50%; In 89% of license applications, the evidence of identity provided by the client was not confirmed; and Copies of documents offered as evidence of identity had not been kept for 78% of licenses sampled. Weaknesses in the way license records were captured included: There were no mechanisms within the systems for validating data entry; Multiple client records could be created for one person; There were thousands of old or redundant client records, e.g., for deceased people. There had been no archiving or cleansing of license records since 2002; Business rules were not built into the systems; Licence record searches took a long time. Under pressure to meet performance targets, staff would created an additional license record rather than waiting for the search results; and Inability for staff to access license information on the one system leading to staff not completing data entry for all the required fields. Public Record Office Victoria Page 22 Recordkeeping Standards Training Control No access controls were established to limit staff access to licensing records. There were no mechanisms for stopping staff from accessing and updating their own records or the records of family. There was clear evidence from the agency’s finance system that licenses had been renewed without payment. While the license systems showed who had last updated a license record, it did not show which parts of the record had been updated. 8.3. Council Planning Dispute The City of Hotham Hill is a council that looks after a large suburban and semi rural area south west of Melbourne. The area is characterised by large scale housing and industrial estate developments that have been created to help meet the demands of a growing population. With all the new development, the council is experiencing a huge increase in the volume of work relating to surveying, planning, subdivision, reviewing and approval of building permits. The volume of new developments has also created a corresponding increase in the number of complaints from residents about inappropriate developments. The following complaint was typical of the kinds of issues the council had to deal with. In 2008 the council received a complaint from residents in one of the new estates about plans to sell an area of vacant land adjacent to their homes. The residents were told by their developers the land would be set aside and retained as park land. They bought their house and land packages on this understanding and had paid the developer a premium for having their house next to the park. They only found out about the land sale after they starting seeing for sale signs on the site. The council had received complaints like this before. They put together a carefully worded letter explaining that unless there was something about the parkland explicitly written in their contracts with the building developer, there was little the residents could do unless they were prepared to try to take legal action against the developer. The residents checked their building contracts and found there was nothing in them about the adjacent land. Since all the complainants had been told the same thing by the developer, they decided to take action against the developer through Victorian Civil and Administrative Tribunal (VCAT). However they knew it would be their word against the developer’s and that some hard evidence was needed to back their case. They used a Freedom of Information request to find out the process the council had used to zone and sell the ‘park’ land. They planned to use this in their submission to demonstrate the council had not followed a transparent process and that they had no reasonable opportunity to be informed of the rezoning and sale. Public Record Office Victoria Page 23 Recordkeeping Standards Training Control The council’s Planning and Building Department provided the complainants with copies of the surveying reports and tendering process for the sale of land. They also provided copies of important supporting documentation such as public notifications and the tender evaluation process. They hoped to demonstrate that the process they had followed was transparent. During the VCAT hearing, the member (person presiding over the case) closely examined the council information. Using the documentation provided by both the council and complainants, the member ascertained: Because of previous problems the council had submitting information for legal disputes, they brought a records management consultant in to establish a records management program for the Planning and Building Department. The Planning and Building Department had set up a classification scheme to ensure electronic and hard copies of documents were created and stored consistently; Hard copies of all relevant records relating to land development projects were registered and stored in a repository with strict procedures for access by council staff and contractors; The data collected for records included key dates, actions, alterations and authors so the location of records was known at all times and the history of records could be understood. All key planning documents had title sheets with dates, authors and version numbers. Electronic documents had strict naming conventions; Once the records management programme was established in the Planning and Building Department, it was progressively rolled out throughout the council. VCAT cleared the City of Hotham Hill of any wrong doing and commended them for their recordkeeping practices in a time when many councils were being caught out with poor work practices. The member concluded there had been sufficient public notification of the land rezoning and sale and the processes used for it were sound. . Public Record Office Victoria Page 24 Recordkeeping Standards Training 9. Control Self Assessment Table This following table is a checklist designed to help you assess whether your agency is complying with the Control Specification requirements. Instructions Using the following ratings, assign your agency a level in the ‘Rating’ column for each requirement listed in the table. If you like, you can use the ‘Priority’ column to identify which requirements are the most important for your agency to deal with. Use the ‘Comments’ column to add any notes or observations about the rating. Rating Level 1 – Ad-hoc No systematic or formal approach exists in relation to this component of records management activity. Processes and practices are fragmented or nonexistent. Where processes and practices exist they are applied in an ad-hoc manner. Level 2 - Managed Processes and practices are defined to varying degrees but are not applied consistently. Basic management controls and disciplines are in place. Level 3 - Standardised Processes and practices are defined, documented, well understood and used consistently across the whole of the agency. Level 4 - Predictable Processes and practices are actively managed and routinely measured to ensure delivery of desired results. Level 5 - Optimised Processes and practices are continuously improved through innovation and organisational learning based on ongoing monitoring and review. Public Records Office Victoria Page 25 Recordkeeping Standards Training Control 2.1 Metadata Principle: The metadata elements needed for the structure, context and management of business records to be used and understood over time are captured, maintained and connected with the records. Requirement Rating Priority Comments 1 Metadata schemes are developed and implemented that meet agency business needs and are compliant with legislative and regulatory requirements, including PROV Recordkeeping Standards. 2 The minimum metadata collected cover the following metadata attributes.9 - Identity; - Description; - Use; - Event History; - Event Plan; and - Relation. 9 Please refer to Appendix One for more information about the metadata attributes identified. Public Record Office Victoria Page 26 Recordkeeping Standards Training Control 2.1 Metadata Requirement Rating Priority Comments 3 The minimum metadata collected are consistent with the International Standard on Managing Metadata for Records (ISO 23081: 2009) and PROS 99/007 Management for Electronic Records. 4 Controls are implemented to assess and verify the accuracy of metadata Public Record Office Victoria Page 27 Recordkeeping Standards Training Control 2.2 Classification Principle: Business records are classified in accordance with business classification schemes that are aligned and mapped to access controls and disposal programmes. Requirement Rating Priority Comments 5 One or more business classification schemes are developed, implemented and maintained in consultation with stakeholders to meet the agency’s business needs. 6 Business processes, access controls and disposal programmes have been assessed to determine what can accurately be mapped to the business classification schemes used by the agency and the results of the assessment have been implemented. 7 Current business records, regardless of their format or which system they are in, are classified in accordance with a business classification scheme. Public Record Office Victoria Page 28 Recordkeeping Standards Training Control 2.2 Classification Requirement Rating Priority Comments 8 Where multiple business classification schemes are used, the language used within these schemes are aligned or mapped with each other. Public Record Office Victoria Page 29 Recordkeeping Standards Training Control 2.3 Tracking Principle: Movements and actions related to business records are accurately tracked using systems that support efficient records management. Requirement 9 Rating Priority Comments The movement of business records are accurately tracked (this includes tracking records migrated from one system to another or those transferred to an external location or party). 10 Actions related to business records are accurately tracked and maintained. Public Record Office Victoria Page 30 Recordkeeping Standards Training Control 10. Further Information 10.1. Help Available from PROV PROV has provided the following resources to help agencies implement the Standards: Recordkeeping Fundamentals e-Learning This course is designed to be used as compliance training to ensure agency staff have a common understanding of basic recordkeeping concepts. The course covers: What is recordkeeping; Benefits of good recordkeeping; Recordkeeping responsibilities; and Principles from the Recordkeeping Standards relevant to all staff. The course includes a multiple choice learning review and a completion certificate that can be printed when the learning review is successfully completed. Basic principles from each Standard will be added to the course and released incrementally as each Standard is issued. To access the e-learning module click: http://www.elearn.com.au/prov/standards/START.htm Standards and Policy page PROV’s website has a dedicated Standards page with Standards, Specifications, Guidelines, Fact Sheets, Forms and Endorsed Tools. http://prov.vic.gov.au/government/standards-and-policy Standards Queries Queries about the Standards can be sent to agency.queries@prov.vic.gov.au. Public Record Office Victoria Page- 31 - Recordkeeping Standards Training Control 10.2. Higher Education For agency staff seeking a formal qualification in records management, there are a number of options available. Records and Information Management Professional Australia (RIM) (http://www.rimpa.com.au) The RIMPA provides a list of accredited university courses and courses available from private providers. Public Record Office Victoria Page- 32 Recordkeeping Standards Training Control Australian Society of Archivists (ASA) (http://www.archivists.org.au) The Australian Society of Archivists provides a list of accredited university courses on their Education page. Public Record Office Victoria Page- 33 Recordkeeping Standards Training Control 11. Question Answers Creation Q. What is the minimum metadata that needs to be collected for business records regardless if format? A. - Identity; - Description; - Use; - Event History; - Event Plan; and - Relation. Classification Q. What are the main benefits of using a classification scheme to arrange records in a logical structure and sequence? A. They can be mapped to records management tools such as retention and disposal authorities and access controls. Information on a function or activity can be more easily located. There are clearer linkages between the records and business processes that produced them. Tracking Q. What two types of information should record tracking systems capture? A. The movement history of a record including the date and time of movement, location, and who has custody of the record. Actions related to the record. Public Record Office Victoria Page- 34 Recordkeeping Standards Training Control Case Study Answers Hazardous Waste Management In this case study, none of the principles from the Control Standard were met. Metadata: The metadata elements needed for the structure, context and management of business records to be used and understood over time are captured, maintained and connected with the records. Information was held over nine separate databases with no control mechanisms or contextual information. Classification: Business records are classified in accordance with business classification schemes that are aligned and mapped to access controls and disposal programmes. There was no classification scheme to ensure records were stored consistently and with clear access rules. It is doubtful this agency would have an effective disposal programme. Tracking: Movements and actions related to business records are accurately tracked using systems that support efficient records management. There were no mechanisms to track movements of records. The capture of actions relating to cases was particularly poor and uncontrolled. Records relating to cases were held in multiple locations making it difficult to locate and compile a history of records relating to a case. Driver License Management In this case study, none of the principles from the Control Standard were met. Metadata: The metadata elements needed for the structure, context and management of business records to be used and understood over time are captured, maintained and connected with the records. License information was held over four mainframe systems with limited access controls and tracking mechanisms. Classification: Business records are classified in accordance with business classification schemes that are aligned and mapped to access controls and disposal programmes. Problems with access controls were compounded by the absence of a classification scheme that could have helped the department manage evidence of identity and the thousands of old and redundant client records. Tracking: Movements and actions related to business records are accurately tracked using systems that support efficient records management. There were limited mechanisms to track movements of and changes to records. In fact all mainframe systems were characterised by a lack of in built business rules. Public Record Office Victoria Page- 35 Recordkeeping Standards Training Control The lack of business rules lead to the creation of duplicate license records and records with incomplete or inaccurate client information. It also enabled staff to renew the licenses if family and friends without payment. Council Planning Dispute The principles met in the case study were: Metadata: The metadata elements needed for the structure, context and management of business records to be used and understood over time are captured, maintained and connected with the records. Tracking: Movements and actions related to business records are accurately tracked using systems that support efficient records management. The council’s business classification scheme and records management procedures ensured the appropriate metadata was captured for all planning records and that they could be tracked at all times. While the council implemented a business classification scheme and aligned it to access controls, it is not clear whether the classification scheme is aligned to the council’s disposal programme. This is outlined in requirement 2 where disposal authority and sentence data is required to be collected as part of minimum metadata capture: The minimum metadata collected for each business record (regardless of format) is as follows: Identity; Description; Use; Event History; Event Plan; and Relation; Public Record Office Victoria Page- 36 Recordkeeping Standards Training Control Appendix One: Metadata Attributes Table Metadata Attribute Description Identity ‘The identity metadata group identifies the entity. Examples of the metadata elements that appear in this category are entity type, aggregation and registration identifier.’10 Description ‘The description metadata group contains elements required to determine that this is the entity that is required for use. Examples of metadata elements that appear in this category include: title, abstract and external identifiers.’ 11 Use ‘The use metadata group contains information that facilitates long-term use of the entity. Examples of metadata elements that appear in this category include: technical environment, access, rights and language.’12 Event Plan ‘The event plan metadata group contains information used to manage the entity. The metadata in this group consist of a linked sequence of metadata and independent metadata elements. Examples of metadata elements that appear in this category relevant to the records entity include: type, description, date/time and relation (linked), event trigger and relation.’13 Event History ‘The event history metadata group documents past records events and other management events on both the entity and its metadata. For each event it specifies the type of event, what happened, when it took place, why it occurred, and who carried it out. The metadata in this element are a sequence documenting a specific event. Examples of metadata elements that appear in this category include: date/time, type, description and relation (linked).’14 Relation ‘The relation metadata group points to a relationship entity or describes the relationships between this entity and other entities.’15 10 International Organisation for Standardisation (ISO) 2009, ISO 23081-2 Information and Documentation – Managing Metadata for Records – Part 2: Conceptual and Implementation Issues, ISO, Switzerland, ss. 8.1 p. 15. 11 ISO 23081-2 2009 ss. 8.1 p. 15. 12 ISO 23081-2 2009 ss. 8.1 p. 15. 13 ISO 23081-2 2009 ss. 8.1 p. 15. 14 ISO 23081-2 2009 ss. 8.1 pp. 15-16. 15 ISO 23081-2 2009 ss. 8.1 p. 16. Public Record Office Victoria Page- 37 Recordkeeping Standards Training Public Record Office Victoria Control Page- 38