Treasury Board of Canada Secretariat
Symbol of the Government of Canada

ARCHIVED - Horizontal Internal Audit of Electronic Recordkeeping in Large Departments and Agencies, December 2011


Warning This page has been archived.

Archived Content

Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.

Executive Summary

The objective of this audit was to determine whether large departments and agencies and departments that have a central role are fulfilling the requirements of the information management (IM) policy suite, with a particular focus on electronic recordkeeping.

Why This Is Important

The management of information in the Government of Canada impacts all lines of business and is a key component of departmental service delivery. Electronic information is being created throughout government at a rate that is growing exponentially, and without the ability to effectively manage this information, departments may be at risk of losing their ability to identify and retrieve information needed for decision making in an organized and timely fashion. This could result in an inability to meet information requests from Canadians and other obligations.

This audit supports the Treasury Board of Canada Secretariat (the Secretariat) in enabling departments and agencies to meet policy objectives for electronic recordkeeping by identifying systemic issues and common challenges with compliance to the Policy on Information Management.

Key Findings

A government-wide strategy and action plan for IM have been implemented, and these are actively communicated to large departments and agencies (LDAs). Most LDAs have developed plans that incorporate the IM policy suite requirements; however, LDAs are currently not monitoring the implementation of these plans.

Most LDAs have not developed a framework for identifying information of business value. This is an important first step so that information of business value can be retained and organized in a manner that makes retrieval for decision making timely and effective. Most LDAs have yet to define business value as it relates to their IM needs and provide little to no guidance for departmental staff.

Most LDAs do not have elaborated retention and disposition processes or guidance for departmental staff. Disposition of electronic records is performed mostly on an ad hoc basis by staff outside of the IM function, as most retention and disposition strategies were developed for paper-based recordkeeping.

Electronic recordkeeping systems and tools are inconsistently used by departmental staff. Most LDAs have not made electronic recordkeeping systems mandatory and instead leave usage up to the individual. This results in some electronic records being saved on shared drives, personal drives or portable storage devices rather than on an enterprise-wide system. While it is possible to effectively manage information of business value outside an enterprise-wide system, doing so decreases the efficiency of retrieval of this information in a timely manner and impedes sharing of information government-wide.

The Government of Canada is developing and delivering training to IM practitioners. LDAs are providing some training to departmental staff but have not identified learning requirements.

Conclusion

While strategic direction for electronic recordkeeping has been established within the Government of Canada, implementation of departmental plans to address the strategy is in the early stages. LDAs have not yet developed a framework for identifying information of business value to support decision making on a timely basis. LDAs are addressing training requirements for their IM practitioners but not for all departmental staff. Most LDAs have not yet developed formal retention or disposition processes. IM tools and applications are not being consistently used in LDAs.

Conformance With Professional Standards

The conduct of this engagement was done in accordance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing.[1]

Brian M. Aiken, CIA, CFE
Assistant Comptroller General
Internal Audit Sector, Office of the Comptroller General

Background

The Government of Canada has long made the management of information an operational priority. In the past, paper records were managed by a team of dedicated record keepers who would file what was often the only copy of any one record.

The arrival of the electronic age complicated traditional recordkeeping. Every email or draft document is created and saved as an original file and is thus considered an electronic record. Much of the information generated and managed by the federal government is electronic and can be categorized into two groups: structured and unstructured data.

Structured data represents information maintained in enterprise systems such as financial or human resources systems. Information is often entered into these enterprise systems through predefined fields such as "name," "telephone number," etc. There are numerous controls to manage the risks associated with this type of information, such as who can enter or edit the information, or what type of information can be entered into specific fields.

Unstructured data, on the other hand, is information that includes working documents such as project plans, spreadsheets, emails and records of decision. One of the major risks of managing this data is that the controls are frequently much less structured and often ad hoc in nature. This may mean that information is more difficult to track or that multiple versions saved in multiple locations compromise the reliability of the information. However, this data often forms the basis for critical decision making.

The notion of a physical space being used to centrally house all records is no longer a reality. All employees are now tasked with managing a multitude of records they may create every day. The number of records generated by the government has grown exponentially, challenging its previous ability to track and manage its information with certainty and effectiveness.

Acknowledging the changing environment, in 2006 the Treasury Board of Canada Secretariat (the Secretariat) led a government-wide effort to identify challenges in modernizing recordkeeping. Representatives from multiple government departments participated in the exercise, and two reports were produced that laid the foundation for a unified government direction: Information Management in the Government of Canada: The Business Problem Assessment and Information Management in the Government of Canada: The Vision.

In 2007, the Secretariat published a new Policy on Information Management, followed by two new directives: Directive on Information Management Roles and Responsibilities (2007) and Directive on Recordkeeping (2009).While the new policy suite established responsibilities for IM in departments, it was the Government of Canada Information Management Strategy (published in 2008) that aligned IM goals and provided clear objectives for the community as a whole.

Life-cycle management of information is a common thread throughout the IM policy suite and the Government of Canada Information Management Strategy. Specifically, departments must determine which electronic records are worth retaining in the long term (and for how long) and which records should be disposed of after an appropriate period of time. "Business value" is the term used to describe whether or not a record has value for operations. Because so many electronic records are transitory, they are not seen as having long-term value to the interests of the government. Yet these types of records often outnumber more "valuable" records by a significant margin.

Attributing business value to electronic records allows IM practitioners to assign life-cycle parameters according to long-term requirements. If this process is well established, retention and disposition of records becomes an automated process.

Library and Archives Canada (LAC) is the agency responsible to provide guidance and support to help determine retentions and to provide delegated authorities to allow for disposition of corporate records within government departments. These delegated authorities are required to be in place prior to the disposition of records because they state which records are to be destroyed and which records should be archived for the long-term benefit of the Government of Canada and of Canada's national interest.

Audit Objective, Scope and Approach

Objective and Scope

The objective of this audit was to determine whether LDAs and departments that have a central role are fulfilling the requirements of the IM policy suite, with a particular focus on electronic recordkeeping.

For the purposes of this audit, we limited our scope to unstructured electronic data.

Sixteen LDAs were reviewed during the audit. In addition, the Secretariat, LAC, and Public Works and Government Services Canada (PWGSC) were also included in the audit because of their specific responsibilities identified in the IM policy suite: the Secretariat in providing policy and functional guidance to departments, LAC in issuing records disposition authorities, and PWGSC in providing access to systems and software solutions. (Appendix A contains a list of the departments and agencies examined.)