Monitoring recordkeeping performance

Introduction

These guidelines cover performance monitoring of records management programs and recordkeeping within a public office. They provide practical tools and examples to help public offices establish their own monitoring program that meets their own organisation’s recordkeeping objectives.

Public offices should regularly monitor the management of records within the organisation to ensure the effectiveness and efficiency of recordkeeping systems and processes, and conformity with the State Records Act and associated standards and codes of best practice. Principle 1 of the Standard on records management requires all public offices to regularly monitor and review records and information management "to ensure that its performed, accountable and meets business needs."

There is a great deal of literature on monitoring and measuring performance. These guidelines do not attempt to reproduce this but rather to provide some useful guidance and tools for using performance measurement in managing important information assets.

Monitoring activities

Generally, organisations undertake two types of monitoring activities to understand how the organisation is performing and to identify those areas which require further attention. The two types of monitoring activities are compliance monitoring and performance monitoring.

Compliance monitoring

Compliance is defined as 'adhering to the requirements of laws, industry and organizational standards and codes, principles of good governance and accepted community and ethical standards'. (AS 3806 - 2006: Compliance Programs, section 1.3.3)

Compliance monitoring and compliance auditing aim to establish whether a process or procedure is carried out in conformance with relevant external requirements, whether set through legislation, regulations or directions. It involves examining, at a fairly straightforward level, how organisations 'do something' and confirming 'compliance' with criteria. (CB029 - 2003, The Audit Skills Handbook, section 1.8)

Public offices should regularly assess their conformity with the obligations of the State Records Act and the associated standards and codes of best practice to ensure that the organisation is compliant and that issues of non-compliance are corrected.

Compliance monitoring activities can range from:

• assessing compliance with obligations in the State Records Act
• assessing the records management program
• assessing recordkeeping
• assessing the management of records, and
• assessing records management system and business systems that create and capture records.

Documenting compliance monitoring activities is an important component in demonstrating the organisation's compliance with the State Records Act and associated standards and codes of best practice. Public offices may be asked about their monitoring activities by other organisations with an interest in good records management (eg. the Information and Privacy Commission, the Independent Commission Against Corruption, The Audit Office of NSW) or when responding to follow up on a recordkeeping issue by NSW State Archives and Records. Section 5.2.1 of the Australian Standard AS 3806 - 2006: Compliance Programs advises that:

'Accurate, up-to-date records of the organization's compliance activities should be maintained to assist in the monitoring and review process and demonstrate conformity with the [compliance] program.'

Organisations can monitor their compliance by:

• using the Records Management Assessment Tool (under revision - release date to be advised)
• assessing compliance against the requirements of each standard issued by NSW State Archives and Records
• benchmarking against previous records management self assessment surveys or audit results to assess improvements or to identify issues of non compliance
• undertaking a compliance audit using internal auditors or an external party to provide an independent assessment of the organisation's records management program, practices and systems.

Public offices may consider using the services of a consultant, internal or external auditors to conduct compliance monitoring activities.

Performance monitoring

Performance monitoring involves an in-depth analysis of a process or project, to determine whether it is efficient and effective. It involves developing criteria, conducting interviews and examining documentation to determine how the process or project is conducted. This type of monitoring is also referred to as a process audit (CB029 - 2003, The Audit Skills Handbook, section 1.8).

Organisations typically measure performance to determine if a process or practice is effective and whether objectives or targets are being met, and thus satisfactory performance. Measuring performance allows the organisation to not just measure whether an outcome is being achieved, but how well or the degree of satisfaction of the outcome; in this way it is a 'qualitative' form of measurement. Performance measurement can also assist the organisation in determining how capable it is whether current practices and whether the organisation’s capability can be extended to new practices or processes.

Public offices should regularly assess the effectiveness and efficiency of their recordkeeping systems and processes to:

• ensure that they are satisfactory and meeting the public office's business needs
• support continuous improvement in line with the organisation’s business objectives
• identify achievements and successes
• comply with standards issued by NSW State Archives and Records, and
• plan for new services and upgrades to existing tools and services.

This type of monitoring can be undertaken as part of an internal audit process or may be undertaken in cases where there are suspicions of maladministration or fraud.

Performance monitoring activities can range from monitoring:

• overall performance of the organisation's records management program
• recordkeeping by business units, workgroups or individuals
• records management processes
• records management systems
• delivery of records management services by service providers, and
• assessing the records management capability of the organisation.

Performance monitoring can also include targeted assessments of recordkeeping, for example assessing high risk business areas to ensure that records are being created and captured, and that records are adequate (ie. are the records being created and captured adequate for providing evidence of the business of the organisation?).

The starting point for some performance monitoring activities may be the identification of a business issue/problem. The organisation can analyse the problem using the relevant tool and develop a solution which may involve updating processes or developing new processes.

Organisations can monitor their performance by:

• conducting assessments using the plans, goals and objectives of the records management program
• assessing feedback from clients of the services provided by the records management program
• benchmarking against standards such as AS/ISO 15489 and standards issued by NSW State Archives and Records
• assessing the level of understanding and use of records management policies and procedures by staff
• assessing progress against the organisation's storage and disposal plan
• conducting an internal audit of recordkeeping and/or management of records
• using the Records Management Assessment Tool, and
• conducting detailed reviews of high risk business areas to confirm that records are being created and captured into the recordkeeping system.

Organisations may also seek independent or external performance monitoring of their organisation's recordkeeping and management of records, for example, auditors can undertake both performance and compliance monitoring.

Who are the guidelines for?

The guidelines will be useful for records managers or other staff with responsibility for managing the records management program or those responsible for implementing a monitoring program for recordkeeping.

Monitoring should be scalable to your organisation’s needs and resources. If necessary, prioritise areas of concern, eg. target high risk business unit/s, and/or target high risk recordkeeping processes, such as disposal or capturing records.

Stages in monitoring recordkeeping performance

The table below sets out the stages for establishing a monitoring program for recordkeeping. While the stages are generic to any performance monitoring program, the explanation of each stage gives advice and examples specific to recordkeeping.

Recordkeeping failures

Usually performance monitoring should be incorporated into regular activities of the organisation’s records management program and the objectives for monitoring should dovetail with the objectives of the program and the organisation’s business plans and are set at the start of the yearly planning cycle.

However, there may also be times when particular recordkeeping events, for example, work to address critical recordkeeping failures, create the need for special monitoring. These events may be due to NSW State Archives and Records’ monitoring processes, audit reports by The Audit Office of NSW, investigation reports by the ICAC, failure to provide records as part of a GIPA enquiry and subsequent investigation by the Ombudsman or the Information and Privacy Commission, or matters raised informally by staff or members of the public.

The performance monitoring stages outlined below can be followed in these instances.  Whether part of regular monitoring activities or special purpose monitoring, it is important to target your objectives and measures at the issue to be addressed.

Using risk analysis to prioritise activities

Assessing the business of your organisation, determining the high risk business processes and the records created as part of these processes, could be a good starting point for identifying performance objectives and for determining what performance measures you need.  Alternatively you may prioritise monitoring activities by identifying areas of possible risk of recordkeeping failure, such as failure to create records or unauthorised disposal.

Stage 1: Setting performance objectives

Clearly define performance objectives and their relationship to the objectives of the records management program. Planning documentation for the records management program (Ie. the action and strategic planning documentation) should set out the objectives of the program for the period of time covered by the plans. These objectives could relate to very different aspects of the program, including the quality of records management services, to ensuring the creation and capture of records across the organisation.

Some examples of performance objectives are given below.

Deciding what is good practice

To establish what is good practice for recordkeeping and records management in your public office, you need to know what is good practice in the industry and in NSW Government, and also what your organisation can achieve.

There are a number of ways of determining what is good practice for your public office. The table below sets out some useful resources and the reasons why they may be useful in establishing good practice.

Stage 2: Developing performance measures

Performance measures are the yardsticks by which you assess whether you have met, or have gone some way towards meeting, your objectives. They can be a mixture of quantitative and qualitative measures but should be scoped to fit your objectives and resources for monitoring. It is no use having 25 measures requiring daily data collection if you don't have the time to collect the data or to analyse and make use of the results. Don't waste resources collecting elaborate statistics that are never used.

Different types of performance measures are used to measure:

• economy
• efficiency, and
• effectiveness.

What you measure will depend upon the objectives you have set. Usually, it's good to have a mixture of measures that cover the three 'E's above. What you measure will also depend upon the level at which you want to do this, eg. the high level records management program, a business unit, a particular recordkeeping process or service.

Using other business performance measures to monitor recordkeeping

Many business processes are underpinned by good recordkeeping and poor performance in these areas can sometimes indicate that there are recordkeeping issues to address. Examples of areas where it may be worth monitoring include financial management and procurement, GIPA responses, customer services and customer complaints. A high risk area where poor performance is often related to recordkeeping is the ability of the public office to manage any legal challenges (for example, locate subpoenaed records). Note: Not all failures in performance will be caused by recordkeeping.

Establishing the baseline

Baseline data is an example of the close link between planning and monitoring. If you don't know where you are, how can you plan for where you need to get to?

You need to understand where the program, service or system under scrutiny is at in order to monitor any improvements. This 'baseline' should be assessed before you implement any new activities and start program monitoring. This gives you the starting point for setting appropriate targets and for assessing how effective changes have been. The baseline data you collect will depend upon the performance measures you have decided upon.

Set performance targets

Set performance targets against the objectives that are achievable, measurable and time-limited. Performance targets should reflect where the organisation is currently and where it needs to go. For example, it is unlikely that a performance target of 100% of staff receive training in a year will be achieved if the number of staff in your public office is large, there is a high staff turnover and your training program has limited resources.

Some examples of performance targets are given below.

Stage 3: Collecting the data

Do not make obtaining information about performance an onerous task. It should be part of the routine management processes carried out as part of the records management program. Where specific activities do need to be carried out, eg. customer surveys, make sure that the purpose of these activities is clearly defined and well understood, and that they happen only as often as is necessary.

Collection method

The method chosen should be relevant to the type of information you are collecting. The table below sets out some common methods of collecting data.

Stage 4: Analysing results

Having carried out the monitoring, you need to analyse the information you have collected. Check results against current performance targets. It is useful to also review performance against the performance of the records management program in previous years so that you can monitor trends in your services.

If you are getting poor performance results, analyse the records management program elements to find out the cause. Be aware that sometimes the real causes can be beyond the control of the program.

Stage 5: Implementing performance improvements

This is an important stage in the performance measurement process – there is no point monitoring if you are not going to do anything with the results.

Having identified the gaps and the causes of problems then develop strategies to fix these. These may be 'quick wins' or may need to be factored into your longer term planning.

Use the information to report to management and to feed into future planning and review cycles. This is where 'soft' factors may come into play with issues of change management, influencing senior managers to secure adequate resources, to support necessary changes or to upgrade tools.

Having the hard data to back up your analysis will be useful in securing management support. This also reinforces the link to planning, as objectives for the records management program should be closely aligned to higher-level corporate objectives.

Stage 6: Reporting and review

Don't forget this stage. As with any part of a program, you need to make sure that your monitoring activities are focused on the aspects of recordkeeping and the records management program that you need to know about. Do not monitor something just because you always have done in the past. As your public office changes and the records management program develops there will be other aspects about which it becomes more critical to obtain performance data.

Note: Trend data is very useful in demonstrating improvements over time or causes for concern over time. This relies on consistently measuring the same activity over time using the same criteria. Keep these long term measures under review to ensure that they are still relevant to your performance planning.

How do you know if things are going well?

How do you know if individuals are following recordkeeping policy and procedures?

Individuals, workgroups and business units within your organisation are responsible for:

• being aware and understanding organisational policy and rules for managing records
• creating records as part of their work
• capturing records into official recordkeeping systems
• handling hardcopy records with care
• only destroying records when authorised to do so, and
• protecting records from unauthorised access.

Assessing whether individuals are following recordkeeping policy, practice, and the above list of responsibilities can be difficult.  State Records recommends including a statement about the need to create full and accurate records in staff position descriptions and/or in the public office code of conduct. But how do you check whether staff  are meeting policy, practices and responsibilities in regard to recordkeeping?

Some ways of systematically monitoring the recordkeeping performance of individuals are set out below.

For records management staff

The records management staff are responsible for making sure that the systems and tools needed to support individual recordkeeping are in place and operating. In addition, they can:

• Conduct file audits - periodic checks of desks for working files, files not checked out to them, emails printed out and added to files or registered electronically, etc.
• Monitor file creation and document registration statistics - usually for business units but if there are particular problems, then look at individual performance.
• Check sample of file and document titles (if created by the user) to check understanding and appropriate use of corporate language tools.
• Conduct surveys of staff (including records management staff) to identify any training needs, new tools or revisions to existing tools required, etc.
• Confirm that digital records are being captured into recordkeeping systems and business systems that keep records
• Monitor that emails are being captured into the EDRMS (this could include monitoring the size of email accounts and random/selected audits of email users to ensure conformity with organisational requirements to capture email into the recordkeeping system)
• Confirm that digital recordkeeping systems capture read-only versions of records (ie that records cannot be tampered with or altered)
• Confirm that records can be retrieved from digital recordkeeping systems and presented in formats which allow an individual to view and understand the record
• Confirm that access controls on the recordkeeping system, information security and protection mechanisms are in place and working
• Confirm that digitisation processes are resulting in authentic, complete and accessible images of hardcopy records

For business managers

Business managers and superviors are well placed to monitor that business rules, procedures and responsibilities are being followed.  This can occur as part of routine management and performance management processes

Module 7 of the Records Management Assessment Tool has been designed to assist business managers and organisations in monitoring recordkeeping within workgroups and business units to determine whether staff are conforming with organisational policies and rules, and meeting the organsiation’s requirements.

Additionally, records can be checked for completeness and accuracy.  Note: Unless particular problems have been identified, the checking of records is likely to be at an aggregate level, eg. monthly accounting reports, complaints management reports.

How do you know if recordkeeping systems are performing well?

• Check that the recordkeeping requirements of all recordkeeping systems have been identified
• Assess systems against recordkeeping requirements and defined functionality, i.e. is the system capturing records of [name of function] transactions, are unique identifiers assigned to records, etc. Note: This is likely to involve interviews with both system managers and business managers.
• Monitor system downtime (electronic systems)
• Check that records have unique identifiers in the system. Check that the metadata automatically applied by systems are correct, eg. date and time, record creator information, unique transaction numbers, etc.
• Check that records are able to be accessed and retrieved from the system
• Confirm that migrations of records from one system to another are controlled and documented, and that metadata remains  linked to the record when it is migrated
• Check that records managed, stored or returned by outsourced service providers are complete and accessible
• Confirm that recovery and restoration processes for digital records and recordkeeping systems function correctly and that records can be recovered and restored after a disaster

See Step D: Assessment of existing systems of Strategies for Documenting Government Business: 

How do you know if you are providing quality records management services?

• Set up a user group to gather feedback on program performance, eg. the records management software system, tools such as the thesaurus, training courses or material.
• Monitor levels of use of the services. If these drop, it may indicate a problem either with the service itself or promotion of the service.
• Survey customers regularly. Make these purposeful and concise so as not to annoy users.
• Set and monitor service delivery targets.

What if staff aren't using the systems and tools?

Feedback from organisations indicates that a fundamental problem in recordkeeping is that staff do not use the systems and tools provided for them, despite best efforts to make these fit business needs. Performance measures for system use will identify if this is an issue for you.

Fixing this problem requires a number of different strategies including:

• promotion of recordkeeping rules and tools and explain the benefits of the rules and tools for users (eg. using the new collaborative work space means that all team members have access to the information and decisions about the project)
• training programs for management and staff
• providing a help desk service to assist users
• reviewing systems and tools to ensure that they are user-friendly, and
• integrating recordkeeping systems and tools into work processes, so that they aren't seen as an onerous 'add-on' to work tasks.

Appendix A: Examples of performance measures related to particular objectives

Do not use the following table as a checklist – it contains examples which organisations can use to develop their own performance measures. The objectives, activities and performance measures adopted in your organisation must be relevant to your corporate objectives and the services you provide.

Appendix B: Using NSW State Archives and Records' standards to monitor performance

Compliance with NSW State Archives and Records' standards is mandatory for all public offices in NSW.  Each standard has a compliance timetable that can be used by records management staff to identify gaps in compliance.  Each standard has detailed advice which provides some advice on identifying compliance gaps by giving examples of the sorts of records management tools and activities to look for in relation to each minimum compliance requirement.

The Records Management Assessment Tool can also be used to monitor performance and compliance.  The Tool incorporates performance criteria which establish if the organisation has achieved a higher degree of maturity and capability in the records management areas of practice, by working beyond the minimum compliance requirements set in records management standards and the State Records Act.  Brief descriptions of the standards are given below.

Standards

Standard on the physical storage of State records, 2019 (No. 13)

This standard covers the storage of physical State records in the custody of public offices.  It covers the storage of semi-active records, records created and maintained by contractors and service providers on behalf of public offices in the course of outsourced government business.  The requirements of the standard are applicable to all storage areas and facilities which are controlled and managed by the public office. Public offices engaging commercial storage services should ensure that the storage area/facility and services to be provided under a contractual arrangement meet the requirements of the standard.  The standard contains a number of principles and compliance requirements and examples of how a public office can demonstrate compliance with the requirement. The Implementation Guide for the standard provides advice on how to implement and comply with the standard.

Standard on records management, 2015 (No. 12)

This standard establishes the requirements for effective records and information management.  It covers records and information in all formats, including both digital and physical records.  The standard contains a number of principles and minimum compliance requirements.  The Implementation Guide for the standard provides advice on how to implement and comply with these principles.

Published 2003 / Revised 2009 and 2012/ Revised 2015/ Revised February 2019