Audit of Information Management – Records Management

Office of Audit and Evaluation

The AAFC Audit Committee recommended this audit report for approval by the Deputy Minister on July 4, 2013.

Executive Summary

Agriculture and Agri-Food Canada (AAFC) is heavily reliant on information in order to accomplish its strategic outcomes, and several of the Department's program activities are information intensive. In general, the Information Management (IM) – Records Management (RM) environment throughout the Government of Canada (GC) has been dramatically altered in recent years as technological and other developments have increased the volume and complexity of information that many organizations like AAFC are required to manage. AAFC information management practices are led by the Information Management Services (IMS) group within the Information Systems Branch (ISB).

AAFC must comply with the Treasury Board Secretariat (TBS) Directive on Recordkeeping by March 2015. ISB conducted a maturity self-assessment of AAFC's recordkeeping maturity based on the requirements of the Recordkeeping Directive using TBS guidance. The self-assessment indicated scores of between two and three on a four point maturity scale for all requirements, with a score of three being required to be considered compliant with the Directive. Based on the results of the self-assessment, ISB developed a high-level Recordkeeping Directive Implementation Plan to help AAFC achieve Recordkeeping Directive compliance by March 2015. ISB plays a coordination role for all the activities required throughout AAFC to achieve compliance with the Recordkeeping Directive. Branches and programs are ultimately responsible for managing their information and records, with ISB providing IM-RM support, advice, guidance and tools.

The Office of Audit and Evaluation (OAE) identified the need for an Audit of Information Management – Records Management (IM-RM) in Fiscal Year 2012-13 as part of its 2012-2015 Three-Year Risk-Based Audit Plan (RBAP).

The objective of the Audit of IM-RM was to provide assurance on the adequacy and effectiveness of the Department's implementation of its IM-RM framework, in terms of visibility, awareness and ownership, and to provide an interim progress check on compliance with the TBS Directive on Recordkeeping. The scope of the audit focused on IM-RM activities within the Department from April 2011 to January 2013.

The audit examined the current Departmental IM-RM framework and progress in the implementation of the Recordkeeping Directive Implementation Plan. Four Branches were selected as part of audit activities in order to gain insight into the extent the IM-RM Framework has been implemented at the Branch level. Branches were selected based on performing a high-level preliminary risk assessment of all branches at AAFC, in consultation with ISB. Considering preliminary document review, ISB input and knowledge of IM-RM practices of other federal government departments, sample selection factors included the nature of branch information holdings, the sensitivity and criticality of branch information, estimated branch information volumes, branch use of records management technology and maturity of branch information management processes. The sample of branches was also selected to provide a representative sample across AAFC's activities of research, policy, and operations.

ISB is implementing SharePoint (K-Space Project), initially to be used primarily as a collaboration tool, with the goal of becoming AAFC's Electronic Document and Records Management System (EDRMS). The Business Information Systems Committee (BISC) approved the construction phase of the project in December 2012 with substantial completion planned by the end of Fiscal Year 2012-13. Due to Departmental priorities, the K-Space Project has received implementation priority and has acted as the first step in the Recordkeeping Directive Implementation Plan and subsequent Branch engagement activities, including discussions on determining information of business value.

The audit found that adequate controls were generally in place to support AAFC's IM-RM framework. ISB has developed an IM-Recordkeeping (RK) governance and policy framework for the Department, and is providing IM-RK training and awareness to the Department. An opportunity for improvement was noted in relation to monitoring and supporting the use of AAFC's current EDRMS, known as AgriDOC, throughout the Department. Furthermore, given the current state of recordkeeping practices within AAFC Branches, there are opportunities for improvement specific to the planning and execution of activities related to the Department's ability to achieve compliance with the Recordkeeping Directive by March 2015.

The audit recommended that the ADM, ISB expand engagement with the Branches related to communication on the Recordkeeping Directive, including clarifying roles and responsibilities, and explaining the linkage between the work being done with the Branches for the K-Space Project and the activities required for Recordkeeping Directive Compliance; update the Directive on Recordkeeping Implementation Plan to reflect the work done as part of the K-Space Project and provide guidance to assist the Branches regarding the development of their implementation plans; expand communication and Branch engagement regarding existing and future formal support structures related to the deployment of an EDRMS and collaboration tools to ensure practices are maintained over time; and include as part of its draft IM Performance Measurement Plan, a strategy to expand monitoring of the use of the EDRMS to help ensure that it is used efficiently and consistently, including communication of results to the Branches.

1.0 Introduction

1.1 Background

• 1.1.1 Agriculture and Agri-Food Canada (AAFC) is heavily reliant on information in order to accomplish its strategic outcomes, and several of the department's program activities are information intensive. In general, the Information Management (IM) – Records Management (RM) environment throughout the Government of Canada (GC) has been dramatically altered in recent years as technological and other developments have increased the volume and complexity of information that many organizations are required to manage. AAFC information management practices are led by the Information Management Services (IMS) group within the Information Systems Branch (ISB).
• 1.1.2 AAFC must comply with the Treasury Board Secretariat (TBS) Directive on Recordkeeping by March 2015. The requirements of the Recordkeeping Directive relate to the identification and management of information resources of business value^{Footnote 1}, including how the Department has implemented methodologies, mechanisms and tools to support appropriate recordkeeping practices throughout the information life cycle. This includes the identification of repositories in which the information of business value will be retained, and the classification and management of the records within the repositories.
• 1.1.3 ISB conducted a maturity self-assessment of AAFC's recordkeeping maturity based on the requirements of the Recordkeeping Directive using TBS guidance. The self-assessment indicated scores of between two and three on a four point maturity scale for all requirements, with a score of three being required to be considered compliant with the Directive. Based on the results of the self-assessment, ISB developed a high-level Recordkeeping Directive Implementation Plan to help AAFC achieve Recordkeeping Directive compliance by March 2015. ISB plays a coordination role for all the activities required throughout AAFC to achieve compliance with the RK Directive. Branches and programs are ultimately responsible for managing their information and records, with ISB providing IM/RM support, advice, guidance and tools.
• 1.1.4 The Office of Audit and Evaluation (OAE) identified the need for an Audit of Information Management – Records Management (IM/RM) in Fiscal Year 2012-13 as part of its 2012-2015 Three-Year Risk-Based Audit Plan.

1.2 Audit Objective

• 1.2.1 The objective of the Audit of IM-RM was to provide assurance on the adequacy and effectiveness of the Department's implementation of its records management framework, in terms of visibility, awareness and ownership, and to provide an interim progress check on compliance with the TBS Directive on Recordkeeping.

1.3 Audit Scope

• 1.3.1 The scope of the audit focused on IM-RM activities within the Department from April 2011 to January 2013. The audit examined the current Departmental IM-RM framework and progress in the implementation of the Recordkeeping Directive Implementation Plan.
• 1.3.2 The following AAFC branches were selected to gain insight into the extent the IM-RM Framework has been implemented at the Branch level:
  • Strategic Policy
  • Science and Technology
  • Human Resources
  • Market and Industry Services
• 1.3.3 Branches were selected based on performing a high-level preliminary risk assessment of all branches at AAFC, in consultation with ISB. Considering preliminary document review, ISB input and knowledge of IM practices of other federal government departments, sample selection factors included the nature of branch information holdings, the sensitivity and criticality of branch information, estimated branch information volumes, branch use of records management technology and maturity of branch information management processes. The sample of branches was also selected to provide a representative sample across AAFC's various activities.

1.4 Audit Approach

• 1.4.1 The approach and methodology used for the audit was consistent with the Internal Audit standards as outlined by the Institute of Internal Auditors (IIA), and aligned with the Internal Audit Policy for the Government of Canada (GC).
• 1.4.2 A risk-based audit program was developed that defined audit tasks to assess each audit criterion. Audit evidence was gathered through various methods including interviews, observations, analysis of data related to recordkeeping practices, and document review. The conduct phase of the audit began in November 2012 and was completed by the end of January 2013.

1.5 Conclusion

• 1.5.1 The Office of Audit and Evaluation (OAE) concluded that adequate controls were generally in place to support AAFC's IM–RM framework; however, given the current state of recordkeeping practices within AAFC Branches, there are opportunities for improvement specific to the planning and execution of activities related to the Department's ability to achieve compliance with the Recordkeeping Directive by March 2015. An opportunity for improvement was also noted in relation to monitoring and supporting the use of AAFC's electronic document and records management system (EDRMS), AgriDOC, throughout the Department. These opportunities for improvement are presented in Section 2.0 of the report.

1.6 Statement of Assurance

• 1.6.1 In the professional judgment of the Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided and contained in this report.
  The opinion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed on with management. The opinion is applicable only to the entity examined. The evidence was gathered in compliance with TB policy, directives and standards on internal audit, and the procedures used meet the professional standards of the Institute of Internal Auditors.

2.0 Detailed Observations, Recommendations and Management Responses

• 2.0.1 This section presents the key observations, based on the evidence and analysis associated with the audit, and provides recommendations for improvement.
• 2.0.2 Management responses are included and provide:
  • an action plan to address each recommendation
  • a lead responsible for implementation of the action plan and
  • a target date for completion of the implementation of the action plan.

2.1 Engagement with Branches on the Recordkeeping Directive

• 2.1.1 ISB is required to engage with the Branches to ensure activities are appropriately planned and accountability assigned related to the activities required to be conducted to meet the requirements of the TBS Recordkeeping Directive by the compliance date of March 2015.
• 2.1.2 ISB has developed a high-level Directive on Recordkeeping Implementation Plan and a high-level Recordkeeping Client Engagement Plan to help achieve Recordkeeping Directive compliance by March 2015. These plans outline the need for engagement with Branches, including the forming of Director-level Branch Working Groups.
• 2.1.3 ISB is also implementing SharePoint (K-Space Project) within AAFC, initially to be used primarily as a collaboration tool, with the longer term goal of becoming AAFC's EDRMS. ISB received approval from the Business Information Systems Committee (BISC) in December 2012 to move to the construction phase of the project. The project is on schedule to be substantially completed by the end of Fiscal Year 2012-13. ISB has engaged the Branches through Branch-level working groups as part of the K-Space Project to validate the Business Information Architecture (BIA). The first level of the BIA has been completed and approved, including support and mandated functions of the Department described in terms of activities, subjects, document types, and business groups (i.e., the Division or Branch that owns the information). ISB is currently working with the Branches to refine and validate the other BIA activities, subject and document type vocabularies that may be specific to individual Branches.
• 2.1.5 ISB has also begun activities related to recordkeeping awareness, including assisting with recordkeeping practices within the regions. In terms of communications to the Branches, these activities have not been specifically linked to the Recordkeeping Directive.
• 2.1.6 Due to Departmental priorities, the K-Space Project has received implementation priority and has acted as the first step in the implementation plan for the Recordkeeping Directive. Given this, ISB has not yet engaged the Branches on the communication of the Recordkeeping Directive, including clarification of roles and responsibilities, and explaining the linkage between the work being done with the Branches for the K-Space Project and the activities required for Recordkeeping Directive Compliance.
• 2.1.7 Engagement with the Branches is a key component of the Recordkeeping Governance framework for the Department, and is critical in order to determine the activities, timing, level of effort, and underlying assumptions required to ensure the successful completion of the recordkeeping activities required within the Branches.

Recommendation 1:

• 2.1.8 The Assistant Deputy Minister (ADM), ISB should expand engagement with the Branches related to communication on the Recordkeeping Directive, including clarifying roles and responsibilities, and explaining the linkage between the work being done with the Branches for the K-Space Project and the activities required for Recordkeeping Directive compliance.

  Management Response: Management agrees with the recommendation.

  Recommendation 1

  Action Plan	Target Date	Responsible Leads
  1.1. Detailed RK communication plan completed.	August 30, 2013	DG, IMS
  1.2. Departmental launch of RK communications.	September 30, 2013	ADM,ISB
  1.3. RK Departmental Working Group established; roles and responsibilities defined.	October 15, 2013	ADM, ISB in collaboration with Branch Heads
  1.4. RK Branch Working Groups established; roles and responsibilities defined.	November 15, 2013	ADM, ISB in collaboration with Branch Heads
  1.5. Phase 1 of Business Value Information (BVI) identification completed. As part of the Knowledge Workspace project, all branches have identified what information has business value for them through the development and validation of their Business Information Architecture (BIA). Retention periods have been assigned to each content type.	February 28, 2015	ADM, ISB in collaboration with Branch Heads

2.2 Recordkeeping Directive Implementation Plan

• 2.2.1 Appropriate planning is required to be conducted by ISB to ensure the appropriate initiatives have been developed for the Department to meet the requirements of the TBS Recordkeeping Directive by the compliance date of March 2015.
• 2.2.2 Activities outlined in the Directive on Recordkeeping Implementation Plan that were scheduled to take place in 2012-13, for instance, development of Branch governance structures and the identification of information resources of business value, have been undertaken through the work done on the K-Space Project. Although Directive on Recordkeeping Implementation Plan activities have occurred as part of the K-Space Project, specific Recordkeeping Directive initiatives such as Branch Governance and Branch-related planning specific to the Recordkeeping Directive, and communications on the Recordkeeping Directive to the Department as a whole, have not occurred. Furthermore, the high-level Directive on Recordkeeping Implementation Plan has not been updated to reflect the work done as part of the K-Space Project, or the specific timing, activities, and resource requirements of the work that will still be required to be done once the K-Space Project has been completed.
• 2.2.3 Given that no formal work on identifying information of business value has started as part of the Directive on Recordkeeping Implementation Plan, the findings within the audited Branches reflect their respective IM maturity levels based on a sampling of current practices. Based on this sampling, even with the foundational work done through the K-Space Project, the activities to achieve Recordkeeping Directive compliance may require a significant amount of time given the current RK practices of the audited Branches, specifically:
  1. Information resources of business value have not been formally defined in three out of the four Branches that were included in the audit.
  2. Three out of the four Branches audited still primarily rely on network drives, email, and other repositories for their recordkeeping.
  3. Recordkeeping practices throughout the audited Branches were inconsistent, including naming of documents, retention periods, and document safeguarding practices.
• 2.2.4 Based on the above, it is important for ISB to update plans related to the Recordkeeping Directive to ensure the activities required to achieve compliance can be completed within the timeframe before the compliance date of March 2015.

Recommendation 2:

• 2.2.5 The ADM, ISB should update the Directive on Recordkeeping Implementation Plan to reflect the work done as part of the K-Space Project, and provide guidance to assist the Branches regarding the development of their implementation plans.

  Management Response: Management agrees with the recommendation.

  Recommendation 2

  Action Plan	Target Date	Responsible Leads
  2.1. Directive on Recordkeeping Implementation Plan updated to incorporate K-Space project deliverables.	August 30, 2013	Director, Information Management Program (IMP), IMS
  2.2. Development of Branch implementation plans (RK Branch Working Groups). Implementation plans include deliverables and timelines for achieving the following: Identification of all information repositories currently in use Completion of BVI identification BVI protection Lifecycle management Monitoring and reporting Elements of the implementation plans are documented in RK agreements for each branch.	March 31, 2014	ADM, ISB in collaboration with Branch Heads
  2.3. Departmental RK status review and self-assessment performed and corrective measures undertaken in preparation for the RK compliance deadline (March 31, 2015) and 2015-16 RK compliance audit of all Government Departments.	September 30, 2014	DG, IMS
  2.4 Branch plans implementation complete.	March 31, 2015	ADM, ISB in collaboration with Branch Heads

2.3 IM-RM Governance, Policy and Training

• 2.3.1 ISB is required to develop a comprehensive IM-RM governance and policy framework for the Department, as well as provide appropriate IM-RM training.
• 2.3.2 The Business Information Solutions Council (BISC) has Director General (DG)-level representation from across the Department, and serves as an advisory, consultation and decision making body that helps ensure that departmental IM-RM activities respond to the strategic direction of the Department and address IM-RM issues from a departmental perspective. This includes the K-Space Project and the Directive on Recordkeeping Implementation Plan.
• 2.3.3 ISB has developed an IM-RM Policy Framework, including directives and guidelines to address relevant IM-RM legislative and policy requirements. For example, the IM Exit Directive supports the application of the AAFC Separation Policy by providing the operational level details required to manage departmental information assets upon departure of a human resource. The Electronic Messaging Directive provides guidance to all AAFC staff in regards to the usage of electronic messaging networks. Further guidance on email management and other IM-RM issues is available to staff on the Department's Intranet.
• 2.3.4 IM-RM guidance is supported through training and awareness sessions. AAFC new hire orientation training contains information on IM-RM, and more in-depth IM-RM training is provided to Branches on an as-requested basis. All AAFC staff must complete mandatory training before gaining access to AgriDOC.

2.4 Monitoring and support related to the use of AgriDOC

• 2.4.1 It is important for ISB to establish central monitoring practices to monitor the implementation of the IM-RK Framework throughout the Department, including the utilization of tools such as AgriDOC.
• 2.4.2 AgriDOC has been implemented in approximately 70% of the Department (as indicated by ISB management and the document Directive on Recordkeeping 2012-2015 Discussion Points developed in September 2012), however three out of the four audited Branches still primarily rely on network drives, email, and other repositories for their recordkeeping.
• 2.4.3 Despite guidance documents and communications from ISB, as well as support by ISB during the initial implementation of AgriDOC within Branches, the naming and classification of documents within AgriDOC is not consistent across the Department. Practices within the audited Branches related to the use of AgriDOC have not been maintained since implementation, which for some Branches has been over five years.
• 2.4.4 Current practices have resulted in inefficiencies, such as timely searches for documents and the need to maintain multiple repositories in the audited Branches.
• 2.4.5 Ad hoc monitoring of the utilization of AgriDOC is taking place within ISB, although monitoring practices and communication of results have not been formalized. As such, the development of activities by ISB related to engaging the Branches on the appropriate use of AgriDOC has not been based on formalized monitoring on the relative success of previous activities or guidance.

Recommendation 3

• 2.4.6 The ADM, ISB should expand communication and Branch engagement regarding existing and future formal support structures related to the deployment of an EDRMS and collaboration tools to ensure practices are maintained over time.

  Management Response: Management agrees with the recommendation.

  Recommendation 3

  Action Plan	Target Date	Responsible Leads
  3.1. Governance model presented to Director General Horizontal Management Committee (DGHMC) as a pilot.	May 1, 2013	DG, IMS
  3.2. Knowledge Workspace launch and HMC governance site presented to HMC [presented jointly by ISB and Communications and Consultations Branch (CCB)].	July 15, 2013	ADM, ISB in collaboration with ADM, CCB
  3.3. Formal Knowledge Workspace support structures and services implemented and communicated.	August 30, 2013	DG, IMS
  3.4. Departmental rollout of Knowledge Workspace collaboration tools and document management system: Wave 1 adoption phase for Senior Leadership and early adopters completed External collaboration enabled Business information architecture completed Adoption phase for all branches completed.	September 15, 2013 December 31, 2013 December 31, 2013 December 31, 2014	ADM, ISB in collaboration with Branch Heads

Recommendation 4

• 2.4.7 The ADM, ISB should include as part of its draft IM Performance Measurement Plan, a strategy to expand monitoring of the use of the EDRMS to help ensure that it is used efficiently and consistently, including communication of results to the Branches.

  Management Response: Management agrees with the recommendation.

  Recommendation 4

  Action Plan	Target Date	Responsible Leads
  4.1. Knowledge Workspace progress reporting introduced to DGHMC/ HMC as part of regular ISB updates.	September 30, 2013	ADM, ISB; DG, IMS; A/Director, Integrated Web Solutions, IMS; A/Director, Canadian Agriculture Library, IMS; Director, IMP, IMS
  4.2. Knowledge Workspace usage reporting by branches initiated.	September 30, 2013	Director, IMP, IMS
  4.3. Framework for ongoing branch RK/IM performance monitoring and measurement completed. Measurement activities for adoption as well as quality and effectiveness of use are defined.	April 1, 2014	ADM,ISB in collaboration with Branch Heads
  4.4. Branches begin self-reporting against framework. Reporting is used to generate branch training plans.	June 1, 2014	ADM, ISB in collaboration with Branch Heads
  4.5. Departmental RK status self-assessment performed and corrective measures undertaken in preparation for the 2015-16 RK compliance audit of all Government Departments.	September 30, 2014	ADM, ISB in collaboration with Branch Heads

Annex A: Audit Criteria

• Criterion 1 - A comprehensive information management-recordkeeping framework has been implemented that provides visibility, awareness, and ownership to information management-recordkeeping throughout the Department.
  • 1.1. Governance structure, roles & responsibilities and strategies for information management-recordkeeping are defined, assigned, and communicated throughout AAFC.
  • 1.2. A comprehensive information management-recordkeeping policy framework and related training has been established and communicated throughout AAFC.
  • 1.3. Central monitoring practices have been established to monitor implementation of the information management-recordkeeping Framework, in terms of visibility, awareness, and ownership.
• Criterion 2 – The Department will meet the requirements of the TBS Recordkeeping Directive by the compliance date of March 2015.
  • 2.1. Appropriate planning has been conducted, and accountability assigned, to ensure the appropriate initiatives have been developed for the Department to meet the requirements of the Recordkeeping Directive by the compliance date.
  • 2.2. Current recordkeeping practices throughout the Department have been established to ensure the Department will meet the requirements of the Recordkeeping Directive by the compliance date.