Records governance policy

Public authorities must ensure records management is everyone’s responsibility. This means it must be supported across all areas and all levels of the business by:

• assigning formal records management responsibilities to key roles within the business to monitor and support the active implementation of this policy
• providing appropriate advice and guidance to ensure the business is aware of the value of records and information and how this relates to their obligations and responsibilities as an employee
• fostering a positive, innovative and collaborative recordkeeping culture.

Consistent and aligned governance practices provide a strong foundation for systematically managing records and information across all functions of a public authority. Records governance must work within a public authority’s existing structure and governance and strengthen a public authority’s strategic goals and functions.

Public authorities must systematically manage records and information by:

• ensuring records and information governance is aligned with broader business frameworks and incorporated in business strategies and objectives
• developing and implementing appropriate and fit-for-purpose documentation that details how active records management will strengthen business imperatives and strategic goals
• complying with relevant legislation that governs recordkeeping requirements
• measuring how well records governance is supporting business imperatives and strategic goals.

Complete and reliable records provide evidence of activities of a public authority and allow the business to operate effectively. Public authorities must ensure complete and reliable records are made and retained as appropriate by:

• identifying all the records that allow the business to operate – these provide evidence of actions or decisions, support accountability and transparency, mitigate risk, help the public authority meet legislative requirements and reflect the business of the public authority
• specifying how these records must be made, when they must be made, the format they must be made in, who must make them and implementing security and preservation requirements associated with those records
• integrating record making into existing business processes
• ensuring recordkeeping is considered when decisions are made about business systems (particularly decisions around migration and end of life).

Permanent value, in relation to a public record, means that, having regard to any archives appraisal statement—

(a) the record has been identified for retention under a disposal authorisation; or

(b) the record otherwise has enduring value and is appropriate for retention in the custody of the archives.

High value records are those that are important to the business, its operations, or stakeholders.

High-risk records are those that pose a significant risk to the public authority if they were misused, lost, damaged or deleted prematurely. These records should have the highest priority for public authorities when developing and implementing their governance practices.

Public authorities must actively manage permanent, high-value and high-risk records by:

• defining the criteria and processes for identifying permanent, high-value and high-risk records, including transfer of permanent value records to QSA
• formally documenting details of permanent, high-value and high-risk records
• actively maintaining visibility of these records while they are being used, including monitoring processes for permanent, high-value and high-risk records held in business systems and applications.

Discoverable records are those that are in business systems and applications approved for use by the public authority. Accessible records are those that can be located and continuously used. Public authorities must ensure complete and reliable records are discoverable, accessible and are able to be used and re-used for their entire life by:

• keeping records in business systems and applications approved for use by the public authority
• being able to discover and appropriately access records, with confidence in sufficiency of search
• actively monitoring the health of records.

Public authorities must plan for how and when they will dispose of records, using a risk based approach. Records must be disposed of in a planned and authorised way by:

• using the disposal authorisations issued by the State Archivist, that provide proper coverage of the specific records you make and keep
• developing and implementing a disposal plan, which details disposal decisions and actions for the public authority. The plan must, at a minimum, cover:
  • disposal endorsement, including how internal endorsement is given
  • disposal methods, including how records will be disposed of (physical and digital)
  • disposal frequency, including specifying how often certain types of records will be disposed of
• formally documenting the disposal of records.