## Department For Culture, Media And Sport Contents

|                                       |                                | Statement of commitment     |     |     |     |    02   |
|---------------------------------------|--------------------------------|-----------------------------|-----|-----|-----|---------|
| IMA background                        |                                |                             |     |     |     |     02  |
| Executive summary                     |                                |                             |     |     | 03  |         |
| Good practice areas                   |                                |                             |     |     | 04  |         |
| Recommendations to address risk areas |                                | 05                          |     |     |     |         |
|                                       | Key findings of the assessment |                             |     | 06  |     |         |
| Annex A - Recommendations in full     |                                |                             | 11  |     |     |         |
|                                       |                                |                             |     |     |     |         |

 
 
© Crown copyright 2017. You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk

## Statement Of Commitment

The following statement was provided by the Permanent Secretary of Department for Culture, Media and Sport (DCMS). It is published on GOV.uk. 

 
The Department for Culture, Media and Sport last undertook an Information Management Assessment (IMA) in 2010. This was part of the regular programme of assessments that The National Archives conducts to review information, records and knowledge management standards within government departments. To demonstrate the strength of the department's commitment I have asked The National Archives to carry out an Information Management reassessment in March 2017. The Department for Culture, Media and Sport recognises the importance of meeting its corporate obligations to effectively manage, protect and exploit its information. The report that The National Archives produces will help me to support all aspects of knowledge and information management across the department. It will help to make sure that our information, knowledge and records are appropriately captured, managed and preserved, and information risks and sensitivities are suitably handled. Sue Owen, Permanent Under-Secretary, Department for Culture, Media and Sport 
 
IMA background  
The Information Management Assessment (IMA) entailed a detailed review of supporting documentation followed by interviews with senior staff, specialists and practitioners in the department's London office. These were conducted between 13 - 16 March 2017. The following report provides a summary of good practice and risks identified. IMA reports and departmental action plans are published on The National Archives' website at:   
http://www.nationalarchives.gov.uk/information-management/our-services/imareports-action-plans.htm 
 

## Executive Summary

There are ten performance headings embedded in this IMA report. Department for Culture, Media and Sport (DCMS) achieved one 'Good' rating and a further two 
'Satisfactory' ratings. The report gives particular recognition to the formation of the Knowledge, Information Management and Information Technology committee, appointment of a new SCS KIM Champion and allocation of permanent Departmental Records Officer (DRO) resource at an appropriate level. DCMS has also developed a Records Management Strategy which sets the direction for the records and information landscape between 2016 and 2020. Also notable is the progress that DCMS has made in starting to tackle its backlog of legacy paper records.  
The IMA report identifies seven 'Development needed' ratings with which our core recommendations are aligned. Addressing these will help support continued improvement. In particular DCMS should: 

 Improve its approach to information risk and information asset management 
through identifying, documenting and owning information and records management risks and mitigations, increasing support for Information Asset Owners in their role and improving oversight of information assets.  
 Promote and maintain a good culture of records management by ensuring 
that staff have a clear idea of their responsibilities for managing information and records and are encouraged to demonstrate the right behaviours through 
training, guidance and communications. 
 Develop a process for monitoring compliance with information and records 
management policy.  
 Ensure that its technology environment supports legislative and business 
requirements for managing digital information and records and mitigate risks 
where this is not possible. 
 Continue to ensure that the DRO and team are equipped to discharge 
functions around information and records management and information 
assurance, in particular any legislative obligations, and ensuring that Knowledge Champions are clear on their responsibilities and supported by 
management. 
 Develop a process for the appraisal, selection, sensitivity review and transfer 
of digital information and maintain progress in reviewing and transferring 
paper records in accordance with the Public Records Act and 20-year rule. 
 

## Good Practice Areas

 The following areas of good practice were identified at the time of the assessment. 

They include systems and approaches that other government organisations may find helpful in mitigating information and records management related risks: 

## Highlights Of The 2017 Ima

 Department for Culture, Media and Sport (DCMS) has put in place a governance board: the Knowledge and Information Management and Information Technology (KIMIT) committee. This covers knowledge management, information and records management and IT and includes representatives from these areas and also SCS staff from across the department. This will help to ensure that records management meets the needs of the business and enables joined-up planning and working. KIMIT reports into the Executive Board, providing a route to raise KIM issues to the highest level in the organisation. It was also very encouraging to see that there had been a push around attendance from both the Chair of KIMIT and the Permanent Secretary, highlighting the importance of the committee and instructing senior staff to attend. DCMS has made good progress tackling the legacy paper backlog, interrogating the records held (over 60,000) to ascertain how many were in breach of the Public Records Act (22,000) and how many were in scope for the full review process (6000). An agreement has been established with Department for Communities and Local Government (DCLG) to carry out this work for DCMS. There are documented processes and guidance to support this work and measures in place at both the DCLG and DCMS end for quality assurance. DCLG staff have significant knowledge and experience in review and transfer of paper files. DCMS also demonstrated good practice in carrying out research to understand legacy paper files, including interviewing long standing members of staff and has put significant effort into developing policies/tools to inform selection, such as an Operational Selection Policy. A 
schedule has also been developed outlining DCMS' projected transfers for future years. As a result of this work DCMS has now transferred its first batch of paper records for some time. Blog posts are being used internally to convey the importance of KIM. For example, '**#SortitShareitSaveit**: An Information Management Assessment - 
for the record!', a blog post from the new Departmental Records Officer about his role, the impending IMA, the work of the Knowledge Champions and information management briefings. DCMS has put in place records management and IT strategies, and is about to develop a knowledge strategy. All three strategies are owned by the KIMIT Committee to ensure that strategic goals in these areas are fully aligned. 

## Recommendations To Address Risk Areas

Further detail can be found in Annex A  

## Recommendation 1

 
Department for Culture, Media and Sport (DCMS) should continue to improve its approach to information risk and information asset management. 

Recommendation 2 
DCMS should continue work to promote and maintain a good culture of information and records management across the department. 

Recommendation 3 
DCMS needs to ensure that its technology environment supports legislative and business requirements for managing digital information and records and mitigate risks where this is not possible. 

Recommendation 4 
DCMS should continue to develop and support its KIM team governance and team structures and the service that it provides to the business. 

Recommendation 5 DCMS needs to continue to maintain its progress in appraisal and selecting and transferring paper records in accordance with the Public Records Act and 20 Year Rule. 

Recommendation 6 
 
DCMS needs to develop a process for the appraisal, selection, transfer and sensitivity review of its digital information. 


## Key Findings Of The Assessment 1 The Value Of Information Key Developments Since The Last Ima:

 Senior engagement with information and records management has 
improved significantly since the last IMA and a new SCS Knowledge and Information Management (KIM) Champion has been appointed. 

## Performance Rating

| Communicating and realising value     | Satisfactory       |
|---------------------------------------|--------------------|
| Managing information as an asset      | Development needed |

## 

 We were pleased to see communications by the Permanent Secretary on the 
IMA and a personal push on attendance for the Knowledge and Information Management and Information Technology (KIMIT) committee. The KIMIT committee has helped to drive senior engagement in business areas. 
 Also encouraging is the appointment of a new SCS level KIM Champion, after 
a period where the role was covered on an interim basis by the Departmental Records Officer (DRO). The KIM Champion will be working with the DRO to define the Knowledge Strategy. 
 A Records Management Strategy has been developed which sets the 
direction for the records and information landscape between 2016 and 2020. It is good practice that this is owned by KIMIT (alongside the IT and Knowledge Strategies) and will be updated following the IMA to incorporate 
our recommendations. **See highlights table** 
 We saw evidence of a concerted drive to push the importance of records and 
information management on the intranet (including blogs) and team leads are taking the opportunity to invite the KIM team to meetings to brief staff on 
information and records management. **See highlights table**. It is essential 
that DCMS continue to promote a positive information and records management culture and keep promoting the KIM message. This is due to the risks around knowledge transfer and record keeping resulting from the 
constant process of change both within the department and externally. See 
recommendation 2 
 Information Asset Owners (IAO) are not always fully aware of their 
responsibilities: the staff we interviewed were sometimes unclear on the purpose of the role or who their IAO was. Similarly, we found little evidence that people were aware of the Information Asset Register (IAR) and how it should be used. As a result there is a risk that key information assets will not 
be properly identified, managed and protected. **See recommendation 1** 
 At the time of the IMA, the DRO was due to attend The National Archives' IAO 
Train the Trainer session. DCMS was also starting to look at how it uses its 
IAR and its approach to information asset management in general, which should also help to address this. **See recommendation 1** 
 

## 2 Digital Information And Supporting Technology Key Developments Since The Last Ima:

 DCMS has adopted a Google platform with Cabinet Office acting as 
its IT provider.  

## Performance Rating

| Supporting information through technology    | Development needed    |
|----------------------------------------------|-----------------------|
| Digital continuity and IT change             | Development needed    |
|                                              |                       |

 The move to Google/cloud-based working is raising new opportunities for 
collaborative and mobile work practices. Some staff had even volunteered to act as Super Users to help colleagues get the best out of working with new technology. However, in its current form the Google environment does not enable full lifecycle management of digital information as set out in the S46 Code of Practice for Records Management. As a result, DCMS risks not being able to effectively manage its digital information or fully comply with information legislation. The rollout of AODocs - a records management bolton - will address this in part, enabling greater control over records and more targeted search functionality, although issues around the management of email and the ability to apply retention and disposal will remain. DCMS needs 
to ensure that its technology environment supports its requirements for digital 
records management and mitigate the risks where this is not possible. It will 
need to work closely with IT provider, Cabinet Office, on this. See 
recommendation 3 
 Managing email is particularly problematic in the current environment. The 
process of getting emails into Google Drive is not easy and involves several steps. Also, emails are saved in a PDF format within Google so cannot be readily reused if required. Staff are not always saving emails of business value into Google Drive and there is a risk of gaps in corporate record 
keeping. See recommendation 3 
 Although the staff we interviewed were often aware of the need to manage 
records they were not always doing this in a way that enabled such records to be shared and managed appropriately - for example, some used hard drives or personal areas rather than Google drive. To avoid the risk of unmanaged, information silos, DCMS needs to support staff to ensure that they are using the right systems for the right purpose and in the right way; this is achieved 
through policies, guidance and training. See recommendation 3 
 DCMS is currently reviewing the service that Cabinet Office provides, working 
with Cabinet Office to produce a more detailed breakdown of what it should 
cover. Requirements around information and records management should form a core part of this work. See recommendation 3 

 The DRO does not officially feed into the IT procurement process. The DRO 
has been involved from a records management perspective in the procurement of the 
new correspondence management system (IMA 15) and fed into the recent IT Discovery Project. This now needs to happen more consistently as part of the IT 
procurement process to ensure that tools enable proper records management 
and compliance with information legislation. See recommendation 3 
 Around 80% of legacy digital information was transferred from Livelink to 
Google. The 20% that remains is held outside Google on a separate server. In 
order to avoid the risk of information loss, or keeping information longer than necessary, DCMS needs to have a plan in place to establish what it holds. By doing this it can identify information of business and historical value and 
ensure that this is maintained until the point of disposal. See 
recommendations 3 and 6 

## 3 Information Risk, Governance And Oversight Key Developments Since The Last Ima:

 DCMS has made good progress in establishing a governance 
structure for KIM. 

## Performance Rating

| Recognising information risk    | Development needed    |
|---------------------------------|-----------------------|
| Establishing control            | Good practice         |
| Providing guidance              | Development needed    |
| Measuring Impact                | Development needed    |
|                                 |                       |

 The KIMIT Committee has responsibility for information risks and for 
escalating these when required. Information risks defined on the KIMIT risk register are mainly operational in nature. For instance, there is no risk concerning the potential impact on the business of not capturing and keeping information appropriately - both in terms of limitations of Google environment and cultural factors. These risks need to be properly recognised and 
mitigated. **See recommendation 1** 
 The KIMIT Committee is one of the best examples of governance boards for 
KIM that we have seen across government. **See highlights table** 
 The DRO has so far been supported by a contractor and a part time member 
of staff, both of whom will be moving on in the coming months. DCMS needs to ensure that it continues to meet its responsibilities under the Public 
Records Act when these staff move on.  **See recommendation 4** 
 DCMS has a records management policy but this was produced in 2013, prior 
to the move to Google. The policy must be updated to reflect these changes to ensure that staff properly understand responsibilities for, and requirements around, information and records management in the current technology 
environment. **See recommendation 2** 
 
DCMS has produced practical guidance on information and records management 
and in particular guidance on 'what to keep' in the Google Drive/AO Docs 
environment. This was refreshed in January 2017 and is published on the intranet. 
These pages cover use of AO Docs, Gmail and corporate record keeping. 
 DCMS has a network of Knowledge Champions who are responsible for 
information and records management in their business areas and are playing a crucial role in supporting the use of Google Drive for records management and the rollout of AODocs. There are forums for Knowledge Champions to 
discuss issues and the DRO has brought them together to discuss topics such as the IMA and AODocs.   
 Currently, DCMS risks not getting full benefit from the Knowledge Champions 
network in terms of improving information and records management in the business. Knowledge Champions are not always clear on what their responsibilities are and this needs to be addressed. It is also essential that the importance of these duties is recognised by their line managers, which is not always the case at present. The appointment of the new SCS KIM Champion 
should help to push this work forward. **See recommendation 4** 
 Training in information and records management is limited at present and 
largely relates to the use of systems such as AODocs. There is no formal training at induction for instance. As a result, there is a risk of poor records management practice which will have an impact on the ability to carry out 
business functions and comply with information legislation. See recommendation 2 
 At present there is no formal process for measuring the impact of information 
and records management policies, guidance and training in business areas. DCMS is at risk of not being able to effectively identify and tackle poor records 
management practice. **See recommendation 4** 

## 4 Records, Review And Transfer Key Developments Since The Last Ima:

 A DRO is now in place and DCMS is making good progress in 
starting to tackle the backlog of legacy paper records. 

## Performance Rating Oversight Of Records And Selection Satisfactory

Implementing disposal decisions 
Development needed 

 It is positive to see that DCMS has recruited a permanent DRO at an 
appropriate level. DCMS now needs to ensure that the DRO has the right support in place, otherwise there is a risk that they will not be able to discharge their functions under the Public Records Act, alongside their other 
duties. **See recommendation 4** 
 DCMS has successfully established an agreement with Department for 
Communities and Local Government (DCLG) to carry out work on the appraisal, selection, sensitivity review and transfer of paper records and currently this is working well. A retention instrument is in place to provide legal 
cover for the backlog of records while they are processed. See highlights table 
 Should DCMS or DCLG decide that they no longer wish or are no longer able 
to carry on with this arrangement then DCMS will consider using its off-site 
storage contractor for this work following a similar model to HM Treasury. See 
recommendation 5 
 DCMS is yet to develop an approach for the appraisal, selection, sensitivity 
review and transfer of its digital records. It risks building up a backlog of digital records which will, without appropriate intervention, become increasingly vulnerable as time passes. This needs to be addressed, starting with older collections of digital records transferred into Google Drive and key records such as those of the Olympic Delivery Authority (ODA). It was reported that DCMS is working with the Cabinet Office DRO and The National Archives on 
this. **See recommendation 6** 
 

## Annex A - Recommendations In Full Recommendation 1 Department For Culture, Media And Sport (Dcms) Should Continue To Improve Its Approach To Information Risk And Information Asset Management.

This would be supported by: 

 Identifying risks that reflect the potential impact of not capturing and keeping 
information appropriately - both in terms of limitations of the Google environment and cultural factors - and risks around the loss of digital continuity and usability of information. Ensure that these are documented and owned at an appropriate level to drive action. 
 Learning from departments which have well defined information and records 
management risks such as Home Office and Ministry of Justice. 
 Arranging a board briefing from The National Archives on information assurance 
and risk to help increase awareness at a senior level. 
 Increasing awareness of the Information Asset Owner (IAO) role across the 
department, among those that hold the IAO role and DCMS staff more generally 
 Ensuring that IAOs are appointed at an appropriate level and have a clear idea of 
their responsibilities. 
 Producing guidance and training to support IAOs in their role and using The 
National Archives' 'Train the Trainer' materials to help with this.  
 Developing an approach to identify and record information assets that is 
proportionate and enables DCMS to get oversight of these assets, in particular 
those that are sensitive or of high value. 
 Exploring good practice in information asset governance in other government 
departments such as the Department for Work and Pensions.  

## Recommendation 2 Dcms Should Continue Work To Promote And Maintain A Good Culture Of Information And Records Management Across The Department.

This would be supported by: 

 Using KIMIT and the Records Management, IT and Knowledge Strategies to drive 
work on improving information and records management culture. 
 Updating the records management policy and associated guidance, ensuring that it 
clearly sets out the responsibilities of staff for managing their information and records within the new IT environment.  
 Incorporating information and records management as part of the Management 
Framework to encourage managers to promote and drive good practice. 
 Working with business areas to ensure that information and records management 
is included as part of induction for new staff. The Houses of Parliament and Home Office have both produced e-learning courses to introduce staff to their information and records management responsibilities.   
 Building on the work it is already doing providing training for staff in information and 
records management. This could include e-learning. 
 Exploring and adopting cross government toolkit (available on the Knowledge Hub) 
to improve departmental culture.  
 Promoting the Knowledge and Information Management (KIM) message to mitigate 
risks that arise from machinery of government change and changes in personnel. Engaging with new teams to ensure information management requirements are identified from the outset. 
 Highlighting the importance of information from an historic and business point of 
view in order for it to resonate with staff. A good example is HM Treasury creating videos for its intranet on the history of its records. 
 Identifying a means to engage all SCS staff - not just those that are members of 
the KIMIT. 

## Recommendation 3 Dcms Needs To Ensure That Its Technology Environment Supports Legislative And Business Requirements For Managing Digital Information And Records And Mitigate Risks Where This Is Not Possible.

This would be supported by: 

 Ensuring that requirements around information and records management form a 
core part of work to review and define the service provided by Cabinet Office as IT provider. 
 Working with Cabinet Office and outside companies such as AODocs to address 
gaps in the Google environment, in particular around retention and disposal and the management of email. 
 Keeping pace with developments and sharing its own knowledge and experience of 
the tools as part of the cross-government Google working group. 
 

 Supporting staff to ensure that they are using the right systems for the right purpose 
and in the right way through policies, guidance and training. 
 Considering methods to discourage the use of hard drives such as size limits or 
auto deletion after a certain period of time. 
 Factoring in information and records management requirements as part of the IT 
procurement process as standard and ensuring that the Departmental Records Officer has a 'line in' to this. 
 Gaining an oversight of systems and applications that are in use and identifying key 
information and records management risks. 
 Developing a plan to reduce the legacy digital information from Livelink (both the 
80% inside Google and the 20% on the separate server), including establishing 
what is held, identifying information of business and historical value and considering future migration/transfer. 
 Clarifying whether information from legacy shared drives was migrated to Google. 

## Recommendation 4 Dcms Should Continue To Develop And Support Its Kim Team Governance And Team Structures And The Service That It Provides To The Business.

This would be supported by: 

 Providing senior management support to the DRO, ensuring that he and his team 
are equipped to discharge functions around information and records management and information assurance, in particular any legislative obligations (for example, Public Records Act, Data Protection). 
 Defining the level of service that will be provided from the central KIM team and 
how key aspects such as outreach, monitoring and driving improvement will be delivered. 
 Ensuring that all Knowledge Champions are clear on what their responsibilities are 
and that the importance of these duties is recognised by their line managers. 
 Considering how best to monitor compliance and raise capability with information 
and records management out in the business in a way that is proportionate for a relatively small department like DCMS. Consider the approach taken by both HM Treasury and Home Office.  

## Recommendation 5 Dcms Needs To Continue To Maintain Its Progress In Appraisal And Selecting And Transferring Paper Records In Accordance With The Public Records Act And 20 Year Rule.

This would be supported by: 

 Continuing to allocate appropriate resource for the appraisal, selection, sensitivity 
review, disposal and transfer of paper records. 
 Considering how the process of sensitivity review (including use of FOI 
exemptions, redaction and closure applications) may need to change as DCLG and DCMS move to review more recent records which are likely to contain more 
sensitive information.  

## Recommendation 6 Dcms Needs To Develop A Process For The Appraisal, Selection, Transfer And Sensitivity Review Of Its Digital Information.

This would be supported by: 

 Surveying the digital information that DCMS holds across all its systems (including 
age, format and subject matter) in order to build up a complete picture of its digital holdings. Using this to identify records that are at risk or due for digital review and transfer.   
 Exploring and trialling methods of digital appraisal and selection (including the use 
of analytical tools), drawing on advice and guidance from The National Archives and learning from the experience of other government departments in this area, in 
particular Ministry of Justice and HM Treasury.  
 Ensuring that knowledge of DCMS functions and records gathered through the 
existing paper review process are used to inform digital appraisal where possible.   
 Engaging with cross government work around the sensitivity review of digital 
information (including the use of analytical tools) and considering how these methods can be applied to digital records held at DCMS. 
 Working with Cabinet Office and The National Archives on the transfer of 
significant digital records such as those of the Olympic Delivery Authority. 

##