## Information Management Assessment

# A Review Of Good Practice From The Ima Programme, 2008-16 Report Summary

The IMA programme is central to The National Archives' role as the government's expert in the management, use and re-use of information. Our current strategy is positioned to support *Archives Inspire*, The National Archives' business plan for 2015-19. 

 
Participating in the IMA programme helps public sector bodies to 

•
assess their ability to meet legal and policy obligations 
•
meet the demands of increased volumes for 
transfer under the 20-year rule 
•
address the technical and intellectual challenges raised by the requirements to select, sensitivity review and transfer hybrid and digital records 
With the February 2016 IMA of Northern Ireland Office, we completed IMAs of all the major Whitehall departments 

•
recognise the business benefits of protecting, managing and exploiting 
information effectively 

## The Value Of Information Communicating And Realising Value

IMA Goal: The organisation establishes information's value in principle and supports its realisation in practice 

Setting goals for information and its 
management 
An endorsed and supported information 
strategy is a key means of driving 
increased capability. We recommend a holistic, joined-up vision for the management, protection and exploitation of information.  
 
Links between data, digital and technology, and information and records management goals should be defined. 
Telling staff why information management matters Good information and records management doesn't happen by itself. IT 
systems can automate and simplify processes, but staff will still need to exercise judgement and invest an amount of time and effort to get things right. The first step in helping staff do this is ensuring the value of information is understood. 

## Houses Of Parliament 2016 The Value Of Information Communicating And Realising Value Welsh Government 2014

Information management policy set clear expectations for managers, stating that they must both make sure that staff are aware of their responsibilities and that they are given sufficient time to carry out required tasks. 

## Fco 2014

A clear statement on the value of information was published prominently on the intranet: 
'The knowledge and information we hold is one of our most important assets… Managing and protecting this information - particularly if it is sensitive or personal - is an important part of our role as civil servants.' 

## Fco 2014

Knowledge management was one of the 5 strands of the FCO IT strategy - the most effective example of a joined up approach we have yet found. The IT 
strategy set the clear aim of enabling better KIM through the introduction of an improved IT environment.  

## Bis 2013

FCO appointed their Chief Operating Officer (COO) as a Board-level champion. The COO 
supported the department's knowledge strategy, promoting the importance of good practice and sponsoring key communications. 

The draft strategy set the aim: 'KIM is not an added task, it is how we work.' 

## The Value Of Information

Information asset related guidance can be found on the digital continuity pages of The National Archives' 
website 

## Managing, Protecting And Exploiting Information Assets

IMA Goal: The organisation manages, protects and exploits its information assets to achieve maximum value Defining and cataloguing information assets 
 
Used effectively, the concept of an information asset provides a key means of enabling outcomes for the management and exploitation of information as well as its protection. 

Key tools include Information Asset Registers (IARs): these should record context about information assets such as format, value and retention requirements. Organisations should use the role of Information Asset Owners (IAO) to encourage good practice. 


## The National Archives 2012 [Progress Review] The Value Of Information Managing, Protecting And Exploiting Information Assets

Information assets had been defined on the basis of disposal schedules; unstructured information was included as a matter of course. 

## Ukef 2015 [Progress Review]

IAOs were expected to report on steps taken to support transparency goals. 

The IAR had been expanded; it was no longer simply a list of IT systems.  

## The Houses Of Parliament 2016

UKEF now had a more detailed understanding of its information assets and asset clusters, which had been identified and catalogued following the IMA 

## Dwp 2015 Information And Records Management Was Factored Into Information Asset Governance Through

•
Inclusion of retention on the IAR 
Workshops run by the Information Ownership project encouraged teams to think about how information flows between them. The creation of IARs through the project had encouraged teams to rethink the sensitivity of their information assets and define new disposal schedules. 

•
a question around compliance with the Records Management Policy on Information Asset Assurance Returns 

## Information And Supporting Technology

NOTE: Many departments are moving to Office 365 with SharePoint or to a Google platform with Google Drive. We expect to begin assessing the success of this transition in 2017-18. 

## The Technology Environment Ima Goal: The Technology Environment Supports The Management, Protection And Exploitation Of Information

The Section 46 Code of Practice states IT systems should be 
 
•
set up in a way that enables routine records management processes to take place 
•
easy to understand and use to reduce the effort required of those who create and use the records within them. 
IT systems need to be maintained and developed and organisations should also restrict access to alternative storage locations that are not subject to oversight and control.  

## Information And Supporting Technology The Technology Environment Nio 2016 Hm Treasury 2015

Take up of the EDRMS was better than in many other government departments. This was likely due to the fact NIO had eliminated or controlled alternative areas for storing information. It was working to flatten its file plan to enable automated application of retention criteria. 

A project was set up to address HM Treasury's digital legacy and  
redesign its SharePoint EDRMS to implement better policy compliance (by design) and enable digital preservation. 

## Welsh Government 2016 [Progress Review]

Operations Group approved a project to  

•
identify how to improve the way staff use email and manage records  
•
tackle legacy storage in personal and shared spaces.  
This helped drive a 64% increase in EDRMS usage. 

Requirements included 
mandatory requirements, records 
management requirements and 
business user input. They covered 
metadata, file plans, search, 
access permissions, retention and 
disposal, triggers for disposal and 
transfer to The National Archives. 

## Information And Supporting Technology

Digital continuity is about making sure that your information is complete, available and usable for your business needs. Your information is usable if you can 

## The Continuity Of Digital Information

- find it when you need it 
- open it as you need it - work with it in the way you need it - understand what it is and what it is 
about 
- trust that it is what it says it is. 
IMA Goal: The organisation is taking proactive steps to ensure the continuity of its information, over time and through change Encouraging joined-up planning Organisations need to ensure that the digital continuity of their information is maintained over time and through change. Organisations should also ensure that business requirements for information management are factored into system design from the start. Digital, data, technology and KIM staff should work together to build a shared understanding.  

## Information And Supporting Technology The Continuity Of Digital Information Ministry Of Justice 2016 Department Of Energy And Climate Change 2014 [Progress Review]

Digital continuity was being embedded into existing processes.  
A tailored digital continuity strategy was created ahead of the move to the department's new records system: 
metadata and content could be maintained when information was migrated between systems. 

Risks around legacy systems and digital continuity are recognised as part of the MOJ 
risk management process.  

## Hm Treasury 2015

IAOs are expected to conduct digital continuity risk assessments. 

IT and KIM functions were working closely together. The KIM team had the opportunity to feed in its view as a matter of course in relation to IT procurement and contracts 

## Information And Supporting Technology Recognising Information Risk Ima Goal: The Organisation Defines And Manages Information Risks To Minimise Threats And Maximise Opportunities Defining And Managing Information Risks Risks Relating To The Security Of Information Are Often Better Understood Than Those Related To The Management Of Information.

However, the impact of a failure to capture, keep or dispose of information can be just as significant as that of a physical loss or a leak. Information management related risks need to be defined and recorded at appropriate levels within an organisation's risk management framework. Arrangements for managing this category of risk should be formalised in information risk policy. 

## Dfe 2015 Information And Supporting Technology

Staff were expected to record information risks in business risk registers with an escalation route through unit risk registers.  

## Recognising Information Risk Home Office 2015

A sample risk register included an information and records management risk. Mitigating actions included following good project and records management processes. 

An information availability risk had been separated from an existing information security risk. It was owned by the DRO: it highlighted cultural and systems-related causes that could undermine effective information management. 

## Cabinet Office 2013 Moj 2016

Information security policy recognised the Public Records Act among the significant legal and regulatory requirements placed upon government departments. 

Information risk policy stated: 
MOJ recognised the risk of not storing information and records in the right place or for the right length of time. A range of potential causes were identified. These included: a lack of recognition of the value of good information management; a lack of awareness of required process; and limitations of existing technology provision which makes it hard for staff to manage information well. 

'Poorly managed information can lead to a material impact on an organisation; financially, reputationally and even legally.'  

## Information Risk And Governance Establishing Control Ima Goal: The Organisation Has Effective Governance Structures In Place That Foster Communication And Strategic Planning Governance Structures And Boards Organisations Should Put In Place A Proportionate Governance Framework For Information And Records Management That Includes Defined Roles And Lines Of Responsibility. Support Roles

 
Organisations are likely to benefit from the use of centrally led networks to promote and champion good practice and support staff in effective use of IT systems. However, ongoing effort is required to maintain networks and ensure staff remain engaged and supported by managers to carry out their roles effectively. 

## Department Of Health 2014 Information Risk And Governance Establishing Control Home Office 2015

A quarterly 'Why Information Matters' 
newsletter for Local Folder Managers (LFMs) highlighted training sessions, news stories about forthcoming updates and improvements to the SharePoint IT system, requests for feedback, systems-related features and case studies.  
The newly formed Knowledge and Information Executive Group (KIEG) had a defined escalation route up to Executive Management Board. 

Regular LFM sessions provide an opportunity to promote key priorities and answer questions and concerns. 

## Hm Treasury 2015

It was due to be attended by representatives from Home Office Directorates and Arm's Length Bodies, as well as subject matter experts from Home Office Technology, Corporate Security and the Office of the Chief Digital Officer. 

## The Houses Of Parliament 2016

The Information Management Steering Group was chaired by the DRO and Head of KIM. Membership included the CTO and reps from Internal Communications, IT Services, Knowledge Management, Site Owners, IT security and technical specialists. 

An endorsed customer service charter set expectations for the KIM team in terms of service standards and for the business in relation to compliance with policy. 

## Policy Guidance And Oversight Providing Direction

IMA Goal: The organisation gives 
staff the instruction they need to 
manage, protect and exploit 
information effectively 

## Providing Guidance And Supporting Staff

Information management policy and supporting guidance should be up-to-date, relevant, proportionate, easy to understand and readily available. IT and other related guidance should deliver a single consistent message. 

'Not having KIM as part of induction training means that the opportunity to set out what the standards are and what is expected of staff is missed' 
IMA programme lessons learnt report Once policy is defined it must be actively implemented. Available channels (from staff inductions to poster, leaflet or email campaigns) should be used to promote key messages and educate staff on the importance of information management. 

## Policy Guidance And Oversight Hm Treasury 2015 Providing Direction Department For Work And Pensions 2014

All staff  were expected to complete face-to-face induction training in information and records management. Two sessions were provided.  
Guidance was broken down into 'desk aids' to make it easier to understand and help staff have key principles to hand as they carry out their work. 

## Ministry Of Justice 2016

One was run in the form of a quiz that conveyed key KIM 
messages and tested staff knowledge.  
Guidance was clear and succinct. It was clearly visible on the intranet and there were key KIM messages on the front page.  
The other session gave a more formal, high-level view, addressing the business and compliance value of KIM.  Key helpful tips included 'Don't be a slave to email' and 'Don't leave it until Friday, file as you go.' 
Retention and disposition schedules had been published in line with recommendations made by Sir Alex Allan in his 2014 *Records Review*. Retention schedules had been developed and updated in conjunction with business areas. 

## Policy Guidance And Oversight Measuring Impact

IMA Goal: The organisation gives staff the instruction they need to manage, protect and exploit information effectively Assessing compliance with policy 
 
The Section 46 Code of Practice states that an information and records management policy should 'indicate how compliance with the policy and the supporting standards, procedures and guidelines will be monitored'. 

 
If information and records management performance is understood, then bad practice can be addressed and behaviours can be challenged. Organisations can also identify and share good practice, encouraging others to raise their game. 

## Policy Guidance And Oversight Home Office 2015 Measuring Impact Hm Treasury 2015

The One3M model incorporated information assurance as well as information management. It was introduced to help embed good information management and encourage improved behaviours across the group.  
Each business area scored KIM activities against a maturity model. Business areas that were not performing well had to repeat the process and, if they did not improve, had to meet with the Second Permanent Secretary to explain why.  
Interviewees described One3M 
as 'a flexible model that changes to accommodate new areas of focus'. 

Following benchmarking, business areas were expected to produce an action plan to demonstrate how they were going to improve. 

## The Houses Of Parliament 2016

A programme of health checks drew on face-to-face interviews with Record Officers and other relevant members of staff, and on systems usage statistics. This range of sources provided qualitative and quantitative insights into culture and performance: for example, a small volume of emails being stored could suggest that key context was not being captured. 

## Records Review And Transfer

NOTE: If disposal activities have been 
put on hold, for example, to meet the 
requirements of the Independent 
Inquiry into Child Sex Abuse (IICSA), 
there must be a plan restart them at 
an appropriate point in the future.  

## Oversight Of Records And Implementing Disposal Decisions

IMA Goal: The organisation understands the value of its records and can consistently identify those with enduring historical value IMA Goal: The organisation understands the process for records disposal and consistently implements decisions in line with defined plans Records appraisal and disposal The Departmental Records Officer (DRO) has lead responsibility for compliance with the Public Records Act. 

 
Organisations cannot hold information indefinitely. Information in all formats that no longer has value should be destroyed, while information that has been selected for permanent preservation should be transferred to The National Archives or an alternative place of deposit once reviewed for sensitivity. 


## Records Review And Transfer Home Office 2015 Oversight Of Records And Implementing Disposal Decisions Ministry Of Justice 2016

The DRO was well-placed to exert influence on wider KIM issues, escalate risks and highlight issues.  
Processes were in place to ensure that paper files were disposed of in line with agreed schedules: there was an annual destruction exercise each January.  
The DRO reported to the Director of Performance and Risk who, in turn, reported to the Chief Operating Officer and Senior Information Risk Owner. 

Retention periods had been applied to the EDRMS and could be enacted. Requirements relating to existing disposal schedules had been factored into the move to the new, SharePoint based IT system. 

## Welsh Government 2016 [Progress Review]

Welsh Government was a key participant in The National Archives' Digital Transfer Project pilots became the first organisation to transfer digital records to The National Archives.  
Welsh Government demonstrated a willingness to engage, test The National Archives' 
processes and experiment throughout the project.