3.1 Risk Management

Recordkeeping can only be successfully undertaken once risk management issues
have been considered and addressed. Organisations should assess their systems and procedures against potential risks and then find ways to mitigate them. The joint Australian and New Zealand standard AS/NZS 4360:2004 Risk management and the explanatory companion guidelines set out a framework for assessing risk which can be applied to recordkeeping issues.

3.1.1 High Level Business Risks

The standard is designed to promote good recordkeeping which can mitigate against business risks such as:

• failure to meet legislative and regulatory requirements
• embarrassment to the organisation’s chief executive, minister, the government and private individuals, especially if inability to manage information competently is highlighted in the media
• poor strategic planning and poor decisions made on inaccurate information and the subsequent risk of misleading the organisation’s minister or other key stakeholders
• business critical information is not accessible for the conduct of business, dispute resolution, legal challenge or evidential purposes
• loss of credibility, lowered public confidence, or financial or legislative penalties through inability to produce records or provide evidence of business activity when required in a timely manner
• inability to provide evidence of the organisation’s activities or undertakings
  with external agencies, clients or contractors
• inconsistent and inefficient conduct of business
• inability to use organisational information and knowledge to full potential
• unlawful disposal of records and inability to fully use corporate knowledge and data
• duplication of effort and poor resource and asset management
• reduced capability of demonstrating good performance or any increased
  efficiencies or service delivery
• organisational embarrassment, and damage to reputation
• responsibility for the loss of information that has enduring value to society and which supports New Zealand’s cultural and national identity.

3.2 Benefits of Good Recordkeeping

The benefits of good recordkeeping include:

• protection and support in litigation including the management of risks
• associated with the existence of, or lack of, evidence of organisational activity
• protection of interests of the organisation and the rights of employees, clients and present and future stakeholders
• improved security of business records and robust management of commercial in confidence, personally sensitive, or confidential information
• the ability to deliver services in an efficient and consistent manner
• support of current and future research and development activities
• improved comprehensiveness and reliability of corporate memory
• the availability of relevant business activity records when required to support
  well-informed decision making and policy development
• reduction of risk of data loss or accidental destruction of records
• reliable performance measurement of business outputs
• increased public confidence in the integrity of an organisation’s activities
• identification of vital records for disaster planning, so that organisations can
  continue to function in the event of severe disruption.

Authoritative and credible recordkeeping is essential to good governance and for
reliable and consistent business practice and service delivery. Organisations may carry out recordkeeping audits and surveys to establish their capability and identify areas of weakness. These processes should form a sound basis for implementing business continuity, contingency and disaster planning programmes.

3.3 Normal, Prudent Business Practice

In the context of the Public Records Act 2005, the phrase ‘normal, prudent business
practice’ appears in s17(1) where it is part of the requirement on public offices and
local authorities to create and maintain full and accurate records of their affairs.

This standard will establish the minimum requirements for developing a recordkeeping framework for the creation and maintenance of records as part of ‘normal, prudent business practice’. Establishing how these principles are applied depends on an organisation’s functions. An organisation’s functions will be defined by an evaluation of core business activities and may be stated in any enabling legislation or foundation documentation.

The standard requires that the public office and local authority create and maintain
records of their affairs to allow them to meet their statutory, contractual and
accountability obligations both for the present, and as an on-going entity. It does
not mean that every work-related conversation or act of correspondence must be
identified, recorded and retained. It is the records which document a transaction,
business action or business decision that must be identified, captured and maintained as evidence of the business process or outcome.

Not every record must be retained. General Disposal Authorities (GDAs) allow routine disposal of records of short-term value or records that do not need to be maintained at all. Further information on GDAs is available online.

Making records in accordance with normal, prudent business practice requires creating and maintaining records which:

• document the carrying out of the organisation’s business objectives, core business functions, services and deliverables
• provide evidence of compliance with current regulatory and legislative standards and/or requirements
• document the value of the resources of the organisation and how risks to the business are managed
• support the long-term viability of the organisation.

3.4 Recordkeeping Framework

3.4.1 What is a Recordkeeping Framework?

The recordkeeping framework is a combination of people, policies, procedures,
resources, methods, technology, institutional culture, data and knowledge. A
recordkeeping framework should be considered as a strategy, not as an automated
system or an off-the-shelf software package. It is a strategy that an organisation
develops to assess needs, implement recordkeeping practices, manage change and
eventually source software or other technological support. An organisation shapes
these components into a structure that supports records creation and management as an output of business activity, actions and transactions.

A recordkeeping framework has a number of key, interconnected elements including: records, procedures, policies, classification, knowledge, resources and technology. Each component can be further defined:

• Records can exist in any format, both physical and electronic (e.g. letters,maps, photographs, email correspondence, word documents, databases). Records provide evidence of business transactions.
• Procedures are the business activities usually carried out manually (i.e.
  not automated), by people. They include such things as the registration of
  correspondence, workflow processes, the manner in which disposal takes place, or the way in which records are created or transmitted in the carrying out of day-to-day business. Sometimes these tasks may also be automated within electronic systems.
• Policies inform procedures and are used to determine the recordkeeping framework at a strategic or high level but may also address specific procedural and operational areas.
• Business classification sets a hierarchy for structuring business functions and activities and subdividing record groups according to context. This supports the structure and titling of records, the assigning of retention and disposal of records, and business continuity priorities.
• Knowledge is needed to ensure that the recordkeeping framework functions properly. Knowledge about the organisation applies to its structural units: what they do, organisational roles, responsibility and authority, and even the physical environment of the organisation. Legal, financial, political and administrative knowledge is necessary to know how the lines of accountability run and which records are therefore required. Technical knowledge is also necessary for the maintenance of electronic records. Knowledge is often captured in manuals, instructions or regulations, but is also held in people’s heads. For the proper management of a recordkeeping framework, it is crucial that the necessary knowledge to carry out tasks and analyse processes is explicitly identified, documented and used.
• Resources are often thought of in monetary terms, but often the key resources are people and their ability to effectively deploy other resources, such as technology or in managing organisational change effectively. Of course, tangible resources will also be required, from storage space and staff time, through to hardware and software resources.
• Technology is required to manage the creation and maintenance of electronic communications and records. Records will not always be stored in electronic recordkeeping systems and will not always be in exclusively electronic formats. Within a recordkeeping framework, many different systems and records formats will have to be integrated, usually in a hybrid configuration. These records may be held within Electronic Document/Records Management Systems (EDRMS), traditional paper filing registries, email storage vaults, shared drives, or systems that were not developed originally as recordkeeping systems. These include business information systems such as e-commerce systems, client relationship
  management systems, finance and human resource management systems. It is worth defining the key processes and technological tools that are typically integrated within a recordkeeping framework.

3.4.2 Management of Hybrid Systems

Records are seldom only in an electronic or paper format within a records class or
aggregation. Organisations typically manage records that span a range of electronic
and non-electronic media. As physical records (such as paper-based files) cannot be physically captured and registered directly into electronic systems, electronic systems may manage a metadata profile of a physical record in order to maintain a link between the physical folders and the electronic folders, or for discoverability and access purposes. Organisations may also consider scanning or otherwise imaging paper-based records so that they may be integrated into electronic systems more easily and accessibly. For further information on the digitisation of paper, or other non-electronic records please see Archives New Zealand’s Digitisation Standard.

3.4.3 Analysis of Business Activity

Business classification/analysis is the systematic identification and arrangement of
business activities and/or records into categories according to logically structured
conventions, methods, and/or procedural rules. A classification system is usually a
hierarchical representation of business activities and functions represented as an
arrangement of headings derived from an analysis (and understanding of) of the
relationship between the organisation’s business and its records.The purpose of this process is to develop a conceptual model of what an organisation does and how it does it. It demonstrates how records relate to both the organisation’s business and its business processes. It will contribute to decisions in subsequent steps about the creation, capture, control, storage, retention and disposal of records, and their access status. This is particularly important in an electronic business environment where adequate records will not be captured and maintained without first being classified and having meaningful metadata persistently attributed to them.

Analysis of business activity provides the tools to undertake and document business
activity in a systematic way and to make best use of its results. The outcomes from this process may include a:

• suite of documentation describing the organisation’s business and business processes
• business classification scheme that shows the organisation’s functions, activities and transactions in a hierarchical relationship
• map of the organisation’s business processes that shows the points at which
  records are produced or received as outputs of business activity
• thesaurus of terms to control the language for titling and indexing records
  in a specific business context
• metadata schema to identify recordkeeping, and other metadata for persistent attribution with the records and business over time
• disposal authority that defines the retention periods and consequent disposal
  actions for records.

Business activity analysis may be undertaken on a subject basis, structural basis (by
organisational hierarchy or business unit), or by functional classification. The system that suits your organisation best will depend on your functions, business and structure, and a combination of approaches may be used.
 

3.4.4 Business Classification Scheme

Context is necessary to establish the authenticity of a record (usually attributed as
metadata in electronic recordkeeping). The record’s contextual relationship with
the business activity that created it, and its relation to other records or business
processes, is usually termed business classification. A business classification scheme is a conceptual, often hierarchical, classification tool which can enable the capture, titling, retrieval, maintenance and disposition of records. It defines the way in which records are grouped together (aggregated) in classes and are linked to the business context in which they were created or transmitted. Within a business classification scheme, a record’s contextual characteristics are attributed through structuring it according to identifiable business processes.

Subject-based classification schemes group together records relating to broad subject areas. For example the transactions and activities that occurred under a single subject, such as a particular property or client. However, under subject-based classification, the focus is on what the item or object is about, rather than on the purpose or activity that the record was created to document. Therefore, the context of the business activity can become disassociated, making disposal actions over subject-based files more difficult as they will contain records with differing retention periods.

Functional classification schemes are based on an analysis of an organisation’s
unique business functions and activities, and are independent of the organisation’s
administrative structure. This makes functional classification more flexible and stable as business units and structures are likely to change over time. This system breaks down traditional organisational information silos and enables easier retention and disposal of records.