Assess and manage your recordkeeping risk

Recordkeeping risks are risks that are a direct result of recordkeeping activities such as the making, capture, control, access to, storage or disposal of public records.

The following are examples of recordkeeping risks:

• inability to find public records due to poor controls such as inconsistent titling or being saved haphazardly in multiple locations
• loss or reduction in ability to access public records due to technological obsolescence, disaster, corruption of information, or Machinery of Government (MoG) and administrative change
• unauthorised disclosure of sensitive information due to outdated or ambiguous policies and procedures
• loss or unlawful destruction of public records, including attempts to unlawfully dispose of public records
• public records being accessed externally (e.g. staff accessing from home or remotely) with inadequate security controls
• the authenticity and integrity of public records being compromised
• business systems coming to their end of life (before replacement or migration)
• inability to provide appropriate public access to public records, including in response to Right to Information (RTI) or information privacy applications
• inability to comply with legislative requirements
• loss of government information, corporate memory and part of Queensland's documentary heritage.

Failure to appropriately manage these risks can lead to:

• loss of time and resources
• breaches of confidentiality
• reputational damage
• legal action
• loss of valuable information
• compromised accountability and transparency
• corruption or fraud
• loss of the irreplaceable heritage of Queensland.

Business activity risks are risks that result from normal day-to-day business operations. They may not be linked to recordkeeping activities but may be mitigated through improved recordkeeping.

Examples include:

• risks revealed by an audit into financial practices being addressed through implementation of consistent recordkeeping processes for travel arrangements
• risk of not being able to explain why a particular course of action was taken due to critical business knowledge being lost in staff turnover. May be addressed through capturing decision considerations and other relevant information in public records.

Carry out a risk assessment to determine the acceptability of risks, strategies to minimise them, and the priority of treatment.

You can conduct a risk assessment by:

• identifying risks–review audit reports, interview staff, talk to system users
• analysing risks–consider each risk, and its impact and likelihood
• evaluating risks–prioritise each risk.

Identifying risks

Recordkeeping risks will largely be based on each public authority’s regulatory requirements and business needs. Give priority to areas that expose, or have the greatest potential to expose, your public authority to risk.

Use your risk assessment to determine what risks you can and will mitigate and how you will monitor these risks.

There are multiple ways to identify risks. You can:

• undertake brainstorming exercises and use focus groups
• interview staff and external stakeholders
• use a SWOT (strengths, weaknesses, opportunities and threats) analysis of current recordkeeping practices
• undertake audit activities or prepare/review audit reports
• review existing risk registers, or
• undertake a combination of the above.

For each risk identified, you should be able to articulate:

• what the risk is–the event or set of circumstances
• what causes the risk–the factors that contribute or increase the likelihood of the risk
• the consequence of the risk–the outcome or impact of the event.

We recommend that you document the risks you identify, their level and likelihood, potential impact, and any mitigation or monitoring activities.

Risks to public records will increase during a MoG or administrative change. Potential risks may include:

• inability to transfer public records and all associated metadata to the receiving public authority
• public records and metadata, including the history of the public records, being damaged, lost or corrupted during transfer
• misuse of public records and information by service providers, private entities or other organisation with temporary custody of public records
• reduced or loss of access to public records.

Risks can increase due to differences between recordkeeping systems, information management practices, recordkeeping abilities and maturity in the public authorities involved.

MoG or administrative change agreement

Risk mitigation strategies, recordkeeping requirements, compliance and monitoring information, and responsibilities need to be included in your agreement to reduce and manage potential risks.

If you are outsourcing a function and public records are in the custody of a service provider, or public records are on loan to a private entity as part of a privatisation, you may need to do a periodic risk assessment. Make sure provisions to carry out regular monitoring of recordkeeping are in your agreement.

There are specific risks to public records that need to be considered when digitising, converting or migrating public records.

Do a risk assessment to determine the risks and your level of acceptance of those risks.

Consider:

• if there is a risk that a complete and reliable reproduction of the original public record cannot be made
• your ability to prove the authenticity of the digitised, converted or migrated public record if challenged
• your ability to manage the digitised, converted or migrated public record and ensure it will remain accessible for the full minimum retention period
• the level of risk to vital public records
• what level of loss or change of public record characteristics between the source public record and the converted, digitised or migrated version is acceptable (e.g. content, context, structure, appearance, connections).

If you are digitising, also consider:

• the likelihood that a temporary value public record may become permanent in the future
• whether government, community, and others' expectations will be met by providing access to a digitised image rather than the original
• whether public records could be damaged or lost during the process, particularly fragile and older public records, or public records with intrinsic value.

You may need to develop a strategy to mitigate the identified risks if they are unacceptable.

Risk mitigation may depend on how the migration, digitisation or conversion is done (e.g. through technical specifications and settings).

How you will respond to a risk will depend on level of each risk you have identified and the priority you assign to mitigating each risk.

Permanent, high-risk, high-value records

Policy requirement 4 in the Records governance policy requires all public authorities to actively manage permanent, high-value and high-risk records and information as a priority.

While all high-value records are also high-risk, not all high-risk records are high-value.

Low-risk, low-value records

How you manage low-risk, low-value records depends on your business needs and recordkeeping system.

You should use certain controls, such as metadata, on public records stored in a shared drive to ensure they can be found and are usable.

You may be able to run regular reports in some applications that will take a snapshot of public records. Capturing this snapshot may be sufficient to mitigate risks for some low-risk or low-value records.

Severe, extreme or critical risk

• Operational performance would be compromised to the extent your public authority is unable to meet obligations and liabilities in core activity areas.
• Your public authority would:
  • be rendered dysfunctional
  • incur huge financial losses
  • not be able to meet key reporting requirements
  • not be able to recover from such consequences.
• Stakeholders would face life-threatening consequences.
• Major adverse repercussions would affect large sectors of the State Government and its clients, including the general public.

Must be managed by senior management with a detailed plan.

Major, very high or significant risk

• Operational performance of the function or activity area would be severely affected with your public authority unable to meet a major portion of your obligations and liabilities.
• Your public authority’s asset and resource base may be significantly depleted.
• Your public authority would not be able to comply with the majority of its reporting requirements effectively.
• Recovering from consequences would be highly complicated and time consuming.
• Stakeholders would be unable to pursue their rights and entitlements.
• Public reaction would result in major disruptions.

High risk requires detailed research and management planning at senior levels.

Major risk needs senior management attention.

Significant risk must specify management responsibility.

Moderate or medium risk

• Operational performance of your public authority would be compromised to the extent revised planning would be required to overcome difficulties experienced by function or activity area.
• Your public authority would experience difficulty in complying with key reporting requirements, which would jeopardise some State interests.
• Recovery would be more gradual and require detailed corporate planning with resources being diverted from core activity areas.
• Stakeholders would experience considerable difficulty in pursuing rights and entitlements.
• Considerable adverse public reaction would result in some damage and disruption to your public authority.

Must be managed by specific monitoring or response procedures.

Low or minor risk

• Slight inconvenience or difficulty in operational performance of function or activity area.
• Some accountability implications for the function or activity area, but would not affect your public authority’s ability to meet key reporting requirements.
• Recovery from such consequences would be handled quickly without the need to divert resources from core activity areas.
• Some minor effects on ability of stakeholders to pursue rights and entitlements. For example, other sources or avenues would be available to stakeholders.
• Public perceptions of your public authority would alter slightly, but no significant damage or disruption occurs.

May be managed by routine procedures.

Trivial risk

• Operational performance of the function or activity area would not be materially affected.
• Your public authority would not encounter any significant accountability implications.
• The interests of stakeholders would not be affected.
• Public perception of the public authority would remain intact.

May be managed through routine procedures and is unlikely to require dedicated resources.

The level of risk will depend on:

• the value of the public records
• the security classification applied to the public records
• the complexity of the public records (e.g. format, reliance on technology)
• the functions and activities they document
• your records governance and its functionalities
• if past action with the public records has occurred (e.g. contested in their original format, required for legal proceedings)
• if public records can be sentenced as either temporary or permanent based on significance or other factors.

You may also need to consider any legal proceedings where these public records, similar public records, or public records of the same activity have been required in the past (e.g. all compensation records, all public records relating to claims involving minors).

You can adapt your public authority’s risk management framework to document your assessment or include recordkeeping in your public authority’s broader framework.

How you mitigate identified risks will depend on their priority, your functions, your resources, and your appetite for risk.

You should consider your permanent, high-risk and high-value records and their risks before looking at your low-risk or low-value records.

Mitigating risks can include:

• developing and implementing a Business Continuity Plan that accounts for recordkeeping considerations
• ensuring public authority-wide risk management and records management policies align
• ensuring consistent naming conventions and business classification scheme to improve the ability to find public records
• conducting regular self-assessments and internal audits to monitor and review your recordkeeping
• incorporating public records into your public authority risk register as well as establishing a separate register for the recordkeeping unit
• including recordkeeping training in your public authority's induction program
• considering the level of risk when deciding where and how public records should be captured and managed
• establishing an active public authority disposal program to ensure public records are kept for the appropriate period of time and then legally disposed of
• maintaining an approved retention and disposal schedule covering unique public authority specific functions
• communicating and promoting recordkeeping to staff
• providing regular training to staff on good recordkeeping, and the risks of poor recordkeeping.

If you use a combination of systems and applications, consider which public records need to stay where and the associated level of risk.

When determining how you will mitigate your identified risks, you will also need to consider:

• your recordkeeping requirements
• what to capture and how
• how the parts of your new records governance framework will work together including:
  • framework requirements and functionalities
  • technology and applications
  • recordkeeping tools
  • roles and responsibilities
  • policies and procedures
• how any changes will be implemented
• how you will monitor and review your recordkeeping activities over time.