At risk records notification
Public authorities must ensure the safekeeping and preservation of public records.
When to use this guidance
If your public authority has custody of permanent value public records that are at risk of being lost or damaged, you must notify Queensland State Archives (QSA) as a matter of priority to protect the records. This is a legal requirement under section 21(b) of the Public Records Act 2023 (the Act). It applies to any records that you know—or should reasonably know—are of permanent value, no matter how old they are.
Records may be at risk of loss or damage due to factors such as age, format, software obsolescence or storage conditions. For instance, hard copy records stored in a facility prone to flooding, or digital records in a system scheduled for migration or decommissioning may be particularly vulnerable. QSA can provide advice and guidance to your public authority to ensure public records are properly stored, preserved and protected.
Once you have identified records in your public authority’s custody that are at risk of loss or damage, please use the At-risk records notification form to notify QSA.
Steps to identify and manage risks to your public authority’s physical and digital records
The Assessment Tool – Risks to physical and digital public records 333.9 KB) provides a guide for assessing various risk categories to your public authority’s records, such as water damage, data corruption or poor security.
Common causes of loss or damage are outlined for each risk category, alongside suggested or potential treatments and links to further information, which can used to guide completion of a Risk Treatment Plan in accordance with your public authority’s Risk Management Policy or equivalent.
If risks are identified, it may be useful to take photographs of the interior of physical records storage areas and any existing damage to records when you complete the checklist, as these will be required as part of your public authority’s notification to QSA under s21(b).
Risks to your public authority’s records should be managed in accordance with your public authority’s Risk Management Policy or equivalent, including the development of a risk treatment plan and inclusion of the risks and treatments on your public authority’s risk register.
Potential or suggested treatments in the assessment tool for each risk represent options that your public authority may wish to consider based on your public authority’s specific records, risks, resourcing or physical restraints.
A risk treatment plan usually includes the following components:
- Risk description: A clear statement of the identified risk, including its potential causes and consequences.
- Risk assessment: The level of risk (low, medium, high) based on its likelihood and impact (low, medium, high).
- Treatment options: The specific actions or strategies chosen to address the risk. Potential or suggested treatment options for records at risk of loss or damage are included in the assessment tool.
- Responsibilities: Assigning accountability for implementing the risk treatment actions to specific individuals or teams.
- Resources: Identifying the resources (e.g., budget, personnel, tools) required to implement the treatment actions.
- Timeline: Setting deadlines or milestones for implementing the risk treatment actions.
- Monitoring and review: Establishing processes to monitor the effectiveness of the treatment actions and review the plan regularly to ensure it remains relevant.
- Residual risk: Identifying the level of risk (low, medium, high) that remains after the treatment has been applied and determining whether it is acceptable.
Risks and treatments should be added to your public authority’s risk register to ensure appropriate governance and oversight, and to facilitate ongoing monitoring.
Using the At-risk records notification form , any public authority officer can notify QSA of records at risk of loss or damage in accordance with s21(b) of the Act.
To complete the notification, you will need:
- details about the records that are at risk
- details about the storage of your at-risk records
- photographs of the interior of storage areas for physical records
- details about the risks your records are exposed to and any relevant mitigation actions undertaken by your public authority
- details and photographs/screenshots of any existing damage to records.
When you submit your notification of at-risk records to QSA, we will review the information provided and provide a formal response to your public authority’s Chief Executive regarding the identified risks and treatments.
This response may include advice, additional treatment recommendations to reduce identified risks, or mandatory actions to support the safekeeping and preservation of public records in accordance with s15(1) of the Act.
Notification of at-risk records to QSA does not remove a public authority’s responsibility to take reasonable steps to safeguard and preserve public records. Appropriate risk mitigation measures in accordance with your public authority’s Risk Management Policy or equivalent should continue to be undertaken.
Further information
Further information which can be used to proactively reduce risks to physical and digital public records can be found at Maintain physical records and Maintain digital records.
Contact us
If records in your public authority’s custody have already been damaged or lost, please email us at rkqueries@archives.qld.gov.au for guidance. You can also notify us of this as part of your At-risk records notification.
If you have any questions or require more information, please contact us by emailing discovery@archives.qld.gov.au.