## 

| PART ONE: EXECUTIVE SUMMARY                                                  |   3 |
|------------------------------------------------------------------------------|-----|
|                                                                              |     |
| PART TWO: INTRODUCTION                                                       |   9 |
|                                                                              |     |
| PART THREE: ACTIVITIES CARRIED OUT BY THE ASSESSMENT TEAM                    | 14  |
| PART FOUR: HIGHLIGHTS AND AREAS FOR IMPROVEMENT                           17 |     |
| APPENDIX ONE: SUMMARY OF RECOMMENDED ACTIONS                                 |  49 |
|                                                                              |     |
| APPENDIX TWO:  GLOSSARY                                                      |  52 |
|                                                                              |     |

 April/May 2009 © Crown copyright 2009 

## Part One: Executive Summary

1. The Environment Agency is fully committed to raising awareness and 
standards to manage its information more effectively.  The Chief Executive has been credited with bringing focus and direction to the Agency at the top level. Records management is reported annually to the Chief Executive and Management Board through the Records Management Monitoring Programme. The Agency has taken steps to ensure that it is managing its information in a consistent and effective way. The focus on 
information management is now being cascaded throughout the organisation via the recent management and structural changes. 
2. The Agency"s Board approved the "Data and Information Management: IT 
Framework for Managing Data, Information and Knowledge" on 24 June 
2009, which aims to address some of the infrastructure issues that affect information management in the Agency. There is a need to ensure that there is a continued momentum, so that strategies and management structures support and embed what the Agency needs to do. The progress made to date has been an effective start in steering the organisation towards this objective.  
 
3. The Evidence Directorate, with a new Director at the helm, leads on 
records and information management. The Directorate has been 
reorganised and refocused to include all data, records and information. 
The Knowledge Management (KM) team have corporate responsibility for knowledge and records management and are perceived by Agency staff as providing sound advice and support. Despite the limited resources, the team has worked hard to have a positive impact across the organisation. This is provided through a set of policies, guidelines and protocols on the Intranet (Easinet) and Record Management forums, classroom training and an e-learning package on the intranet.  
 
4. The KM team have an established internal monitoring programme to 
assess compliance with records and information management policy across the Agency, which has raised awareness of departmental standards regarding records management. However, compliance with knowledge and information management policies and guidance is inconsistent at the local level and an increase in management support is necessary.   
 
5. The key to communicating good information management practice across 
the Agency is the support and buy-in of the middle management layer. There was evidence across the organisation that some managers are leading by example, using their resources to prioritise good knowledge and information management practice within their teams. For example, the forming of project teams tasked with managing the team"s transition onto the file plan. 6. However, there is still more to do, most notably around targeting middle 
managers. Management are key to setting the tone and direction of the 
Agency. There is a need to ensure that  middle managers act as advocates for the changes and cascade the Chief Executive"s message to their staff. There is an absence of a specific targeted communication 
programme for middle managers to ensure that they understand the value of effective knowledge and information management. 7. The Agency"s core business relies heavily on the use of specialist 
datasets that require large storage capacity, which the main IT infrastructure cannot currently support. This has resulted in widespread 
use of unregulated CDs, DVDs, external hard drives and some standalone PCs. These pose a potential risk to the Agency on a number of fronts, most notably if they are not officially recorded in the appropriate place, secured, and backed up effectively.  The Agency is aware of this and will need to take action to address this issue. 
 
8. There is a good level of records management practice in some parts of the 
Agency, with the corporate file plan assisting with this. There is an approved Retention Schedule and the Agency has also been working closely with The National Archives on an Appraisal Policy. However, the 
review, retention, and disposal of files was inconsistent, with examples of 
files being archived or destroyed without an audit trail. The potential loss of 
valuable information to the Agency is a real risk. 9. This Assessment has highlighted areas that the Agency should address to 
ensure that it continues its progress in becoming more effective and efficient in managing its records, knowledge and information to meet the Agency"s overall business objectives. 

## Risk Matrix Governance And Leadership

| Strategic management    | Satisfactory    |
|-------------------------|-----------------|
|                         |                 |
| Business objectives     | Satisfactory    |
|                         |                 |
| Management controls     | Satisfactory    |
|                         |                 |
| Resourcing              | Development     |
| Needed                  |                 |
|                         |                 |
| Risk Management         | Satisfactory    |
|                         |                 |

## Records Management

| Creation                          | Development    |
|-----------------------------------|----------------|
| Needed                            |                |
|                                   |                |
| Storage                           | Development    |
| Needed                            |                |
|                                   |                |
| Appraisal, disposal and transfer  | Development    |
| Needed                            |                |
|                                   |                |
| Sustainability of digital records | Development    |
| Needed                            |                |
|                                   |                |
| Management                        | Satisfactory   |
|                                   |                |

## Information Legality

| FOI/Data Protection     | Good    |
|-------------------------|---------|
|                         |         |
| Re-Use                  | Good    |
|                         |         |
| Security              | Good             |
|-----------------------|------------------|
|                       |                  |
| Compliance            |                  |
| Staff                 | responsibilities |
| delegations           |                  |
|                       |                  |
| Policies and guidance | Good             |
|                       |                  |
| Training              | Development      |
| Needed                |                  |
|                       |                  |
| Change management     | Satisfactory     |
|                       |                  |
| Culture               |                  |
| Commitment            | Good             |
|                       |                  |
| Staff understanding   | Development      |
| Needed                |                  |
|                       |                  |
| Knowledge Management  | Development      |
| Needed                |                  |
|                       |                  |
|                       |                  |

## Key To Colour Coding

Best Practice  
 
Good  
 
Satisfactory  
 
Development Needed 
 
Priority Attention Area  

## Part Two: Introduction Information Management Assessments

10. 
The Information Management Assessment (IMA) programme is the best 
practice model for government departments wishing to demonstrate a high level of commitment to managing their information. The assessment process ensures that government departments meet the required standards for effective collection, storage, access, use and disposal of information. The IMA programme: 
i. 
enables the Head of Profession for Knowledge and Information Management (KIM) to assess the effectiveness of the function in departments; 
ii. 
sets out the capability of departments to meet their KIM challenges and obligations; 
iii. 
assures the Accounting Officer that departments are equipped to deliver their information management responsibilities; and 
iv. 
helps 
Accounting 
Officers 
plan 
for 
future 
information 
management developments. 
11. 
The National Archives leads information management across government. 
The IMA Programme is a key element of that function. The programme"s 
goal is to deliver measurable improvements in information management across government by providing robust, independent validation of the standards and integrity of the information management processes and capability within departments. 
12. 
The IMA Programme is aimed at core government departments. To be 
admitted to the Information Management Assessment programme, an organisation will:  
i. 
make a public commitment to the IMA programme; and 
ii. 
see the commitment successfully independently verified. 
13. 
Once a Permanent Secretary or Chief Executive has declared the 
commitment, the underlying administrative and decision-making processes of the organisation are examined to verify that they support the IMA commitment.  
14. 
This report sets out the findings, conclusions and recommendations of 
The National Archives" IMA Assessment of the Agency. 

## The Business Of The Environment Agency (Environment Agency)

15. 
The Environment Agency is an Executive Non-Departmental Public Body 
(NDPB) responsible to the Secretary of State for Environment, Food and Rural Affairs and an Assembly Government Sponsored Body responsible
      to the Welsh Assembly Government.   
16. 
The Agency's remit covers the whole of England and Wales; about 
  
fifteen million hectares of land, 22,000 miles of river and 3,100 miles of 
  
coastline including two million hectares of coastal waters. 
 
17. 
The Environment Agency was created under the Environment Act 1995, 
and became fully operational in April 1996. It assumed responsibility for the functions of Her Majesty's Inspectorate of Pollution (HMIP) and the National Rivers Authority (NRA). The Agency also took on a small number of units from the Department of the Environment, Transport and the Regions dealing with aspects of waste regulation and contaminated land, as well as the waste regulatory functions of eighty-three local authorities, including the London Waste Regulatory Authority. 
18. 
In June 1997 sponsorship transferred to the new Department of the 
Environment, Transport and the Regions. In June 2001 the new Department of the Environment, Food and Rural Affairs (DEFRA) became the Agency's parent department. In Wales sponsorship lies with the Welsh
     Assembly Government. 

## Organisational Structure:

19. 
The Agency has around 12,000 members of staff and a budget of almost 
£900 million. It was set up under the Environment Act 1995 as a public body with around 60 per cent of its funding coming from Government, and other income from various charging schemes. The Agency is independent, but works closely with Government. 
20. 
The Agency works across England and Wales, with regional offices 
working closely with other, external regional bodies to develop the right solutions for local environments. In addition, the Agency also has area offices working with local authorities and others to tackle the immediate environmental issues in the areas. 
21. 
The Agency"s principal aims are to protect and improve the environment, 
and to promote sustainable development. It plays a central role in delivering the environmental priorities of Central Government and the Welsh Assembly Government through its functions and role as: 
 an environmental regulator  an environmental operator  a monitor of the state of the environment  an adviser on the development of environmental policy, and  a promoter of scientific research in support of these roles. 22. 
The main priorities of the Agency are: 
 
 Protecting people from flood  Working with industry to protect the environment and human health   Concentrating efforts on higher risk businesses, particularly those that 
run potentially hazardous operations 
 Helping business use resources more efficiently   Taking action against those who don't take their environmental 
responsibilities seriously 
 Looking after wildlife Helping the people get the most out of their environment, including 
boaters and anglers.  
 Working with farmers to build their role as guardians of the 
environment, tackling pollution as well as adding to the beauty of the countryside.  
 Helping to improve the quality of inner city areas and parks by restoring 
rivers and lakes.  
 Influencing and working with Government, industry and local authorities 
to make the environment a priority. 23. 
The Agency"s Head Office is split between Bristol and London, where 
national policy is set. The Chairman, Chief Executive and Directors are responsible for making sure policies are carried out consistently across the country, taking into account the environmental, social and economic differences in each region. 24. 
The Agency is organised in three tiers - Head Office, regions and areas. Head Office is responsible for setting policies and standards to ensure a consistent national approach and has a major role in financial control. Operational activities are carried out at regional and area level. 25. 
The Agency is divided into eight regions - Southern, Thames, South West, Midlands, Anglian, Wales, North West and Yorkshire and North East - each of which has a Regional Office, run by a Regional Director. They support the area offices and help co-ordinate their activities. 26. 
There are twenty-two area offices across England and Wales. These offices are responsible for the day-to-day management of the area and for 
making sure that the needs of the local community are met. The Agency responds to emergencies and incidents from the area offices. 
 
27. 
The Agency carries forward government legislation on the environment in 
air, land and water. This includes flooding, pollution, emissions, waste. As a regulator it issues licences and permits, as well as offering advice. 
 

## Information Management At The Environment Agency

28. 
The Agency creates, uses and stores a wealth of information that, like 
any other major organisation, is core to its operation. Examples include information on: water resources; water pollution control; flood defence and land drainage; fisheries; navigation, harbour and conservancy functions; waste regulation and disposal; integrated pollution control; radioactive substances; contaminated land; and abandoned mines. 29. 
There are also records created by Her Majesty's Inspectorate of Pollution 
(HMIP), the National Rivers Authority and waste regulation functions of local authorities, all of which transferred into the Agency when it was created in 1996. 

## Knowledge Management Strategy:

30. 
The Knowledge Management Team have been working on a high level 
Knowledge Sharing Action Plan to take them from 2009-2012 which would also incorporate a detailed work plan. 
 

## Part Three: Activities Carried Out By The Assessment Team Methodology

31. 
The underlying purpose of the assessment is to establish whether the key 
elements of the Agency"s commitment to the IMA programme and their own Information Management (IM) priorities are achieved. A range of standard processes, systems and documentation were examined to determine if this was the case. This approach was based on a matrix model, as shown below, which takes essential business outcomes, and shows how work in each of the areas of activity demonstrates compliance. 
32. 
The Agency is divided into a number of key business areas, relating to 
how the organisation is managed, governed, its vision and key business objectives, especially pertaining to information management. Key business areas across the Agency were assessed. The key business areas were considered according to a risk assessment carried out prior to the on-site visit. This was based on: 
i. 
the findings of the pre-assessment questionnaire;  
ii. 
previously identified strategic risks; and, 
iii. 
information management or skills issues raised by the Agency themselves.  
iv. 
The key business areas, and the areas of assessment focus, fall under the following headings: 

## 

| Business Area              | Assessment Focus                         |
|----------------------------|------------------------------------------|
| Governance                 | Strategic direction, business objectives |
| and performance indicators |                                          |
| Management controls        |                                          |
| Capability                 |                                          |
| Risk management            |                                          |
| Data Handling Processes    |                                          |
| Records                    | Creation, storage, appraisal, disposal,  |
| Management                              | transfer,                               | security,    | management,   |
|-----------------------------------------|-----------------------------------------|--------------|---------------|
|                                         |                                         |              |               |
| sustainability of digital records       |                                         |              |               |
| Information Legality                    | Access to and re-use of government      |              |               |
| information                             |                                         |              |               |
| Websites and equivalents                |                                         |              |               |
| Compliance                              | Staff responsibilities and delegations  |              |               |
| Policies and guidance                   |                                         |              |               |
| Intranet                                |                                         |              |               |
| Skills/Training                         |                                         |              |               |
| Effects of changes in government policy |                                         |              |               |
| or legislation                          |                                         |              |               |
| Culture                                 | The commitment to effective information |              |               |
| management                              |                                         |              |               |
| Staff                                   | understanding                           | of           | information   |
| management risks                        |                                         |              |               |
| Application of Policies and Guidance    |                                         |              |               |
| Knowledge Management                    |                                         |              |               |

## Activities Undertaken

33. 
The Assessment Team: 
i. 
examined key policy and practice documentation relating to training, skills and processes; 
ii. 
interviewed staff members from across the organisation; 
iii. 
tested the processes used; and  
iv. 
reviewed the website and intranet. 
 
34. 
These activities are described in more detail below. 

## Documentation Review

35. 
Environment Agency provided documentation in support of their 
information management objectives and the IMA commitment, which was reviewed prior to the on-site assessment. 

## People And Practices

36. 
The Assessment Team interviewed a range of staff, at all levels, who are 
involved in policymaking, interpretation and the practice of managing information. These interviews were used to determine how people in the 
organisation work and the impact of information management on them.  

## Process Testing

37. 
A sample review of the day-to-day business processes was used to 
identify possible procedural gaps. This included electronic records management systems, retention schedules and general guidance and working instructions. 

## Intranet Review

38. 
A review of Environment Agency"s Intranet was carried out to assess ease 
of use, utility of the information contained on it and to determine how up to date it was. 

## Website Review

39. 
A review of the organisation"s website was conducted to establish the transparency of information relating to Freedom of Information, Data Protection, contact details and complaints procedures.  

## Risk Assessment

40. 
The department"s risk framework and associated information statements and policies were assessed to ensure information, knowledge and records management compliance.  

## Data Handling

41. 
 The department"s data handling was reviewed in a limited context or "light 
touch" within the IMA process and only where there is an immediate effect on the process being reviewed.  

## The Assessment Team

42. 
 Each IMA is carried out by the Standards Team within The National 
Archives, with a team of external reviewers assembled to meet the requirements identified in the pre-assessment planning. The team comprised: 
 Standards and Assessment Manager, Doreen Charlton  Head of Standards, Marcia Jackson  Standards Adviser, Dan Husbands 

 Information Management Consultants, Jill Gillespie and Eunice 
Gill. 

The Environment Agency Assessment took place in April/May 2009, over 
a period of 5 days. 

## Assistance Provided By The Environment Agency

43. 
The Assessment Team are grateful for the co-operation and assistance of 
all staff interviewed, and especially the Knowledge Management Team in the Evidence Directorate. 

## Part Four: Highlights And Areas For Improvement Governance And Leadership

"I will provide effective leadership on Knowledge and Information Management capability across my Department."1 
 

## Strategic Direction

44. 
There is recognition throughout the organisation that  the Chief Executive, 
Paul Leinster, has made a real impact on the direction of the Agency and has provided a focus and promoted an awareness of what the Agency 
needs to do to meet its obligations and challenges in knowledge and information management. 45. 
The Assessment Team were repeatedly informed that the Agency was 
changing for the better. The recent impetus led by the very top of the organisation has raised the profile of knowledge and information 
considerably. 46. 
Corporately, records management performance is reported annually to the Chief 
Executive 
and 
Management 
Board 
through 
the 
Records 
Management Monitoring Programme. Monitoring results are also shared and discussed with the Records Management leads and their implementation groups. However, there is further need to increase the scope of the reporting mechanisms and to disseminate the results more widely across the organisation in order to raise levels of awareness of overall records management performance. 
 

47. 
The key to communicating good information management practice across the Agency is the support and buy-in of the middle management layer. There was evidence across the organisation that some managers are leading by example, using their resources to prioritise good knowledge and information management practice within their teams. This was 
achieved through local initiatives including, the forming of project teams tasked with managing the team"s transition onto the file plan, training of staff and ongoing management of the file plan.  

 48. 
Some teams and areas have roles that incorporate responsibility for the 
management of records and have started to review their files and strive for 
good record management practice in their areas. The visible support of the management in these areas was evident to the Assessment Team and showed a level of compliance with recognised records management practice. Also important is the role of the Records Management lead in supporting and steering this work. 49. 
Despite this, some managers perceived that simply designating an officer 
with responsibility for information management was sufficient to demonstrate effective information management within their area. 50. 
Therefore, more needs to be done to ensure the corporate message is 
communicated. Although there are examples of good practice, there was evidence that some managers devolved all responsibility for effective records and information management to the point where they believed that they did not have personal responsibility for managing their information and were simply not aware of that need. All staff have a responsibility to 
ensure that they follow the Agency"s policies and procedures. 

## Recommendation 1: The Agency Should Review The Need For A Comprehensive Communications Strategy To Ensure Data And Information Management Is Communicated Across All Parts Of The Organisation. Capability

51. 
The Agency is committed to raising the profile of information management 
and ensuring that it is on the agenda of the organisation. It has demonstrated this investment by restructuring the organisation to provide 
an effective vehicle for the Chief Executive"s key priorities as outlined in the Corporate Strategy. 

 52. 
The Evidence Directorate has been created, led by a newly appointed 
Director. Similarly, the role of Head of Data and Information has been revised, with a departmental restructure to emphasise the importance of this role to the Agency. If the Agency is to continue progressing, there is a need to ensure a continued momentum so that the management structure changes embed the Agency"s objectives. The progress made so far is 
commended by the Assessment Team. 53. 
The Knowledge Management Team (KM), led by the Knowledge 
Management Manager works within the Data and Information team. The KM team develop the Records Management policies and guidance, including 
operational 
instructions. 
Guidance 
such 
as 
"Records 
Management; Who Does What" outlines responsibilities for records management at all levels within the Agency. The KM team also provide ad hoc training, support and advice on records and information management. 54. 
Agency staff that have regular contact with the KM team, either through 
general contact or the regular RM workshops and meetings, were full of praise for the support and the guidance that they received. Some of those interviewed had also become aware of the KM team through the logistical organisation of this Information Management Assessment. 55. 
This is a crucial time in the development of the organisation and the KM team need to ensure that they continue to raise organisational awareness and understanding of good records management practice through developing the work that they have already led across the Agency. In order that there is effective records and information management within the Agency, it must be communicated effectively especially at a local level. 56. 
This communication process should include an internal awareness raising 
programme of the records and information management obligations of all 
staff. If this is not communicated effectively, there is a risk that the good work that has already begun will lose momentum. 

## Recommendation 2: The Agency Should Develop An Internal Marketing Campaign For The Data And Information Management Team. Data Handling Processes

57. 
There appears to be confusion or a lack of clarity between what the Agency defines as data and what it defines as information. The Assessment Team found evidence that data and information were treated as separate entities and given different priorities. The importance of data, 
datasets and statistics is recognised as the basis by which the Agency provides information to its key stakeholders, such as Defra and is thus 
given a higher priority over "information".   
 
58. 
The Agency needs to distinguish data, and information management so 
that all parts of the business understand how the datasets within the organisation support, contribute and feature in the overall information management agenda.  

## Recommendation 3: The Agency Should Make A Clear Distinction Between Data And Information To Provide Clarity For Staff.

59. 
The Agency needs clarity on how data and information management 
contributes and impacts on the day-to-day business of the organisation. The role of a Head of Data and Information is viewed by the Assessment Team as pivotal in providing this clarity and raising awareness levels. 
 
60. 
The Hannigan Report and the guidance on "Managing Information Risk"2 
published in 2008 has raised the corporate awareness of data handling. The Agency has assessed security risks and has a process in place for managing and mitigating these risks but must now ensure that all risks 
associated with poor information management are well understood and well managed across the organisation. An integral part of this exercise is to provide clarity on what comprises information and ensure that this is understood across the organisation. 

 

## Recommendation 4: The Agency Should Continue To Review And Define All Risks Associated With Poor Information Management To Ensure They Are Well Understood.

61. 
The Agency has invested in resources to raise awareness of information 
assurance and data security and this has resulted in the development and revision of related policies. However, concern was raised by staff that 
polices and guidance relating to physical and information security were not cohesive. 62. 
It is important that those charged with the responsibility for physical security of buildings and those with the management of the IT systems communicate effectively. The use of portable media, such as laptops and USB sticks make it important that all aspects of security are considered in a co-ordinated approach. 63. 
The Assessment Team are aware that the Agency has recently introduced 
regional security meetings that include both Facilities Managers and IT Managers to ensure that there is better integrated communication on issues that affect both disciplines.   
 

## Information Risk

64. 
The understanding of risk to physical systems in the Agency is well 
established. The risks associated with security and information assurance 
are defined and mitigated at the highest level on the Agency"s corporate 
Risk Register. However, the Agency is yet to define the risks relating to poor information management practice.  
 
65. 
The Agency has an Information Asset Register, listing the majority of the 
datasets held by the Agency, but it is not exhaustive. To have a 
comprehensive, robust risk assessment process, the Agency needs to hold an extensive Information Asset Register and have completed an analysis of the key risks associated with the information assets identified. The Agency should then take steps to ensure that senior management are made aware of these risks. It is advisable that any actions taken to mitigate the risks should be reported periodically at a senior level. 

## Recommendation 5: The Agency Should Review Its Reporting Mechanisms To Ensure Senior Management Are Fully Aware Of All Risks Relating To Information Management.

66. 
To assess the impact of the increased awareness of good records and 
information management practice, there is a need for more effective measuring and reporting processes for information management. The Agency has a Service Level for records management which requires all staff to follow procedures. This is measured and reported on through the monitoring process. However, improved controls are needed and the Agency should review its performance measures relating to records and information management. 67. 
There are key benefits in providing this information at senior management 
level as it raises visibility and supports periodic review to assess if the Agency is meeting its objectives. As a management tool it provides a formal reporting mechanism that encourages managers to understand the importance of effective information management processes and an opportunity to report back to peers and others in the organisation. 

## Recommendation 6: The Agency Should Assess The Need For Additional Management Controls And Performance Measures Relating To Information Management.

68. 
The KM team already undertake an annual programme of records 
management compliance monitoring across the organisation. The areas assessed are measured against internal metrics for compliance on records policy and their level of information management maturity. This has enabled teams to assess their own progress and identify what is required to ensure information management systems are compliant with the needs of the organisation. 69. 
The monitoring is a positive tool in ensuring that the organisation meets its 
own internal policies and raises awareness of records and information management. The resulting reports are monitored by the KM team and are used to ensure that directorates and teams keep the momentum going and improve year on year. The results of the monitoring are also reported to the Chief Executive and Management Board on an annual basis. 70. 
The use of the monitoring programme is to be commended. The impact 
could be further maximised by empowering local champions to actively participate.  
 

## Records Management "I Will Ensure That Our Information Is Appropriately Captured, Described, Managed And Preserved And That The Risks Are Controlled."

71. 
The KM team are perceived by Agency staff as providing sound advice and support. Although the team are small, they have invested heavily in ensuring that guidance, support and training are provided.  However, the 
rest of the organisation must take on their share of the responsibility to ensure that they address records management locally. 
72. 
The resources within the Data and Information team are currently not able 
to meet the individual needs of staff in such a large and diverse organisation. Their role is to provide guidance on, and raise awareness of good records management. However, currently the understanding of what 
constitutes good records management is generally low across all tiers of the Agency. 

## File Plan

73. 
The introduction of the Agency corporate file plan has done much in 
galvanising teams to think in a cohesive and methodical way as to how documents are managed and stored in the business. 74. 
The file plan was widely adopted as part of the "Big Switch" programme in 
2007, which updated the main operating systems in the Agency. The file 
plan aimed to create a corporate filing structure to ensure consistency across the organisation in its systems. The top levels of the file plan are defined and the levels below are a hybrid of functional and output based structures. 75. 
The introduction of the file plan has provided a structured approach to 
good document and records management. The Agency took the opportunity to implement the corporate file plan to support good records 
management as an adjunct to the "Big Switch," however, some of the long term goals of the plan have not been fully realised. Some staff reported that once the "Big Switch" project was completed, there was the perception in some areas that the completion of the project saw the end of the corporate drive for better records management. 

 76. 
The team encountered examples of effective work practices in some 
teams and areas with individuals taking responsibility for the team file plan. The responsibilities varied from monitoring the use of the file plan, to creating folders, assessing how often documents are filed, to periodically checking that the information held is current and archiving information that no longer had business value. Some areas had adopted the use of the Agency"s "Disk Space Analyser" software to identify duplicate, large and 
old files to facilitate the management of the file plan. The Assessment Team believes that this can be an effective tool in managing the file plan locally. 77. 
The perception that the file plan was only part of a specific project and not 
a long term ongoing requirement for managing documents and files for the organisation, has inhibited the use of the file plan in some parts of the 
Agency. 78. 
This then leads to the view amongst some staff that overall the file plan is 
not effective. Even teams and areas that fully embraced the principles of good records management encountered difficulties using it. It was described as "counter intuitive" and others suggested that the mandatory file levels were not a natural fit for how the Agency is organised at the service delivery levels. For example, the separation on the file plan between inland waterways and estuaries did not reflect how frontline operational staff manage, define and use the information.  
 

79. 
This posed problems when attempting to obtain buy-in from staff. The 
Agency needs to ensure that the corporate file plan is used to minimise the 
amount of times staff save information in their personal areas or on the hard drives of their individual PCs. 

 80. 
Problems also arose when filing data and datasets, as multiple sets of 
information are often derived from one dataset. This information needs to 
be filed in a way that is both intuitive and functional for the end user. 81. 
As the file plan has been in place for a couple of years, it would be an 
opportune time to revisit the structure and assess how effective it is in facilitating the business of the organisation. It would be good practice for the Agency to seek responses from all areas of the business, as the restructuring of both Head Office and the regions may have had an impact on some of the original planning of the corporate file plan. 

## Recommendation 7: The Agency Should Review The Application And Effectiveness Of The File Plan.

 82. 
There are a number of examples of individuals taking responsibility for 
records management in their area. Individual staff members have 
conducted audits of their teams" records, reviewed files in the corporate 
file plan and have completed general reviews of how information is stored. 
Most of these initiatives were conducted in isolation, and carried out by staff that had undertaken training via the e-learning package on records management on the intranet (Easinet). This demonstrates that for a number of individuals the e-learning package is sufficient to enable them to take on the records and information management responsibilities in their team. 83. 
Feedback from all participants is part of the regular RM forums where 
good practice or local initiatives can be shared.  However, there is an absence of a corporate repository to feed good practice examples back into Head Office so that the whole organisation can learn from their colleagues and share some of the local initiatives. The corporate KM team should formalise a process to co-ordinate how good records and 
information management practices are shared, publicised and promoted within the organisation. 

## Recommendation 8: The Km Team Should Formalise A Process To Coordinate The Formal Sharing Of Good Practice Across The Organisation.

84. 
The Assessment Team encountered a number of individuals who were 
unsure when a document became a record and should be retained. The Agency needs to communicate what is defined as a record more widely. The Agency may wish to review its e-learning package to ensure that it clearly states and highlights, with examples, when a document constitutes a record or the appropriate time to save a document/file in the corporate file plan.  

## Recommendation 9: The Agency Should Communicate The Definitions Of Records And Information Management To Ensure Consistency Across The Organisation. Retention And Review

85. 
The Agency has a current Retention schedule which was agreed and 
signed off by The National Archives in 2008.  The Assessment Team however, found evidence of an inconsistency of approach with some teams and areas being proactive in reviewing, archiving and disposing of documents and files and others retaining information beyond the needs of the business. 86. 
There was evidence of a lack of understanding on how the timely review of 
documents, 
files 
and 
datasets 
would 
support 
effective 
records 
management in the Agency. The majority of staff interviewed confirmed 
that they did not delete any files and kept everything. 
 
87. 
Nevertheless, the Agency has been actively working with The National Archives on the Appraisal Policy for some time and this is now near completion. 

## Recommendation 10: The Agency Should Review The Application Of The Retention Schedule And Seek To Complete The Appraisal Policy.

88. 
The North West regional office had recently conducted a review of all items that had been sent for archiving offsite. As a result of this exercise they were able to dispose of approximately four thousand boxes of archived material. This resulted in a reduction in the amount of storage 
space needed; lower costs for the office and most importantly ensuring that a decision was made so that only relevant information with business or historical value continued to be stored. 89. 
The local facilities teams have responsibility for managing the use and 
access of the storage facility, through their contract with the supplier. It 
may not be appropriate to adopt this review process model in all areas, but it does highlight what can be achieved with a timely review of archived material.  

## Paper Records

90. 
Creation of paper files appears to follow the protocols set out by the 
Agency within their policies and guidance. The Assessment Team are aware that the Agency has inherited a number of files during its lifetime. 

## Archiving Of Records

91. 
The Assessment Team encountered several examples of staff archiving or 
sending files and other records off to storage, but not keeping a separate note of what had been sent. Archived boxes may have an identification number but no record of its contents. Without an effective audit trail it would be difficult and time consuming for the required information to be retrieved. There is also a risk that potentially valuable information is lost. 

## Recommendation 11: The Agency Should Ensure Consistent Application Of The Records Management Policy. Storage Of Electronic Information

92. 
The Environment Agency has produced a wealth of environmental information that necessitated the creation, storage and use of large files and databases. These databases provide information on the environment to stakeholders such as Defra and the European Union. The Assessment team were advised on several occasions that the corporate IT systems and infrastructure could not support the size and complexity of some of the specialist databases. 
93. 
The Assessment Team have subsequently been advised that The Agency 
has now had formal Board approval for the "IT Framework for Managing 
Data Information and Knowledge" on 24 June 2009. This strategy will address a number of the issues highlighted in this report. 94. 
Teams in Head Office and the regions have adopted a number of 
strategies to cope with the inability of the corporate IT systems to store their specialist information. The Assessment Team discovered a rise in the numbers of external hard drives and stand alone dedicated PCs for this 
purpose in recent years. The Assessment Team were made aware of hard 
drives that not only stored the primary information, but also extra hard drives purchased and located off-site as backups to the primary source database. Where these hard drives are not registered on local asset or file lists, the external hard drives and standalone PCs pose a potential risk 
both in terms of inaccessibility and to the security of the stored information. 

## Recommendation 12: The Agency Should Assess The Risks Relating To Unregulated Storage Of Material On External Media.

 95. 
From the assessment, the Team noted that local information that is stored 
in this way may not have been recorded in the appropriate place, for example in the local file lists or the Information Asset Register. With the specialist nature of the information and datasets held, the Agency should assess where this information is held, as a priority, to ensure continued and uninterrupted access to the information in case of an incident. 

## Recommendation 13: The Agency To Reinforce Security Policy In Relation To Unregulated Storage Of Material On External Media. Electronic Document And Record Management System (Edrms)

96. 
The Agency has an electronic document and record management system (EDRM) Opentext. The EDRM is one of the corporate repositories for electronic records and is used by the National Permitting teams and Area Environment Management Teams.  The EDRM supports the structure of 
the corporate file plan approach to records and document management. 97. 
Where the EDRM is used, it is well managed. However, the use of the 
EDRM is not consistent across the Agency; some of the reasons cited for this include, the fact that staff are unable to search and retrieve information easily.  The current search facility is not effective and if used results in too many references. In addition, there is an absence of any file 
naming convention, so each team adopts their own style, which adds to the overall problem. 98. 
The EDRM is perceived to be unreliable by some interviewees, and not 
sufficiently advanced to store all their document types. As a result of the perceived short comings of the EDRM, some staff had adopted a number of behaviours to deal with the deficiencies, which included, storing information on the hard drives of PCs; storing on CDs or DVDS.  Once the information was stored on a CD or DVD, despite clear guidance on information security, staff did not take steps to ensure the security of the information as they were stored in unsecured environments. 99. 
There is a risk that information with potential business value is both 
available and unsecured. The Agency needs to ensure that staff are aware of the risks of not adhering to guidance on not having poorly stored information. 
 
100. The Assessment Team were informed that £2million has been 
dedicated to the improvement of the EDRM system and an upgrade to the system is due to be rolled out in June 2009. This aims to make the system 
more stable, more reliable and easier to use. 
 
101. It is essential that the Agency"s EDRM and any future systems are fit 
for purpose in terms of records management compliance and capabilities. If records management is not considered there is a risk that the Agency will not be able to fulfil its legislative requirements.  

## Recommendation 14: The Agency Should Complete The Project To Resolve Issues Relating To Edrm Instability And Usability And Also Review Its Records Management Capabilities And Compliance. Email

102. The Agency has an email management policy, but the majority of 
interviewees were not aware of the content of either the policy or how it affected their role. One of the critical aspects of the email policy is that emails are automatically deleted after 6 months and any emails which are business critical must be stored in the file plan on a shared drive. When a mailbox reaches a certain size, emails are automatically removed from inboxes and archived into the e-store.  Six months after creation or receipt, they are deleted regardless of whether they are still in Outlook or have been transferred to e-store. 103. There were a number of staff who were proactive in managing their 
emails and generally filed business critical information in the appropriate storage system, as well as actively trying to keep the size of their inboxes 
within a manageable limit. 104. In contrast, there were many examples of unsatisfactory practice where 
staff rely on the automatic archiving of their emails. Few understood what happens to the information once it is deleted from the e-store. The Assessment Team, whilst aware that there are staff within the Agency who 
do not produce information with business value through this medium, did find instances where the business value was not being considered and emails were not retained.  

 105. There is a potential loss of business critical decision streams as a 
result of the lack of understanding in relation to the importance of saving emails.  The publication of a policy does not necessarily mean that it will be implemented. If there is no check on the adherence, there is a potential 
for business critical information to be lost. 

## Recommendation 15: The Agency Should Reinforce Compliance With The Email Policy To Staff. Access

"I will promote access to and re-use of our information, and protect personal and other sensitive information." 

## Website Review

106. The Agency"s website is the primary mode of interaction and the main 
communication channel for business, academic and domestic users. In December 2008, the Agency redeveloped their website and redesigned access to it through the use of user profiles which demonstrated how the particular user would want to access and use the information on the 
website. The investment in the development of the eight user personas and the application of this in defining access is an example of innovation. 107. The website has clear information on its privacy policy, Freedom of 
Information procedures, Environmental Information Regulations and information on its publication scheme. 108. Within the Agency"s privacy policy there is reference to the Agency"s 
obligations under the Data Protection Act. Although there is a section entitled "Access to your personal information," the guidance informs the 
user to contact the Data Protection Manager. However, at the time of the assessment there was no additional contact information. 109. To fulfil all its obligations under the Data Protection Act, the Agency 
needs to ensure that the contact information for individuals is clearly referenced and accessible. 
 
110. The Assessment Team has subsequently been advised that there are 
now mechanisms on the website to enable e-consultation by interested parties into future Agency policy.  
 
111. Redevelopment of the Agency"s website involved the rationalisation of 
the number of pages available and the removal of obsolete information. This required the removal and storage of approximately 40,000 pages of data and information. The Assessment Team were advised that there has been no formal consideration of the best method for retaining the obsolete web pages. 112. Without a formal audit trail there is a risk that the Agency is not being 
robust in how information removed from the website is archived.  The information held is a valuable resource for the organisation and it will not be able to fully exploit its future potential if it is not stored effectively. 

## Recommendation 16: The Agency Should Conduct A Review Of How Material From The Website And Intranet Is Archived For Future Use In Coordination With The National Archives Web Continuity Project. Recommendation 17: The Agency Should Ensure That The Data Protection Contact Information And Procedures On The Website Are Clear And Accurate For Members Of The Public. Reuse Of Information

113. The Agency licenses a significant amount of its information to the 
business sector, the legal sector and the general public.  Many of these information requests involve an individual assessment against legislative exemptions/exceptions to check whether there are any confidentialities that need to be assessed in deciding whether information should be provided. 114. However, the Agency has developed an "Approved for Access" 
programme to pre-assess categories of information it holds, for example spatial flood risk maps. Categories of data and information that do not have such confidentialities can then be provided to the customer without further consideration. This is an example of innovation and good practice with regard to the licensing of the organisation"s information assets. 115. The Agency has been since November 2004, a member of the 
Information Fair Trader Scheme regulated by OPSI, part of The National Archives. 

## Public Register

116. An important channel for access for the general public is the Public 
Register. The Agency must provide access and publish its information as a 
requirement of several Acts of Parliament. For example, Section 190 of the Water Resources Act 1991 and Section 2 (2) (b) of the Control of Pollution (Amendment) Act 1989. The purpose of the registers is to allow access to information about new applications and licences that have already been granted, and whether there is potential environmental impact, such as pollution which is both airborne and water related. The registers are held in a mix of electronic and paper format. The information can be accessed via the local Environment Agency area office with limited information available on the website. 117. The local External Relations teams have responsibility for overseeing 
access to the paper registers in offices. This allows for controls to ensure that information is secure and is not removed. There appears to be no such mechanisms in place to ensure that the information held electronically at a local level is accessible. 118. Whilst the External Relations team exercise a level of control over 
access to the information they have no responsibility over the content. This obligation rests with the appropriate Process Teams who are tasked with ensuring that only information specified in the legislation is included in the public register.  

## Recommendation 18: The Agency Should Review How Overall Responsibility For Information In The Public Registers Is Managed.

The information that is held electronically is the responsibility of the local specialist originating team. Concern was also raised about what to do with information that had been superseded. As a statutory requirement the registers need to be able to stand up to external scrutiny and should be managed as such. The Assessment Team have subsequently been advised that the Data and Information team are reviewing this area of responsibility, to ensure that the issues identified are addressed. 

## Recommendation 19: The Agency Should Ensure That Information Contained Within The Public Registers Is Up To Date And Correct.

 

## Compliance "I Will Make Sure That Our Internal Processes Support Effective Information Management." Policies And Guidance

119. The Agency has a substantial number of policies and guidance relating 
to records and information management, which are readily available to all staff via the intranet "Easinet". They are helpfully designed, and separated 
into brief summaries which can be used as desk aids by users. 120. Two key documents "Managing Data and Information" policy and the 
"Data and Information Strategy" outline the Agency"s key objectives on data, records and information management. Information is highlighted as a valuable resource which should be protected, managed effectively and exploited for the benefit of the business. The "Data and Information 
Strategy" recognises that "good data is the lifeblood of the Agency"3. It 
aims to ensure that data quality is maintained, data is actively managed and that it is shared across the organisation. These two policies are instrumental in developing an effective environment for the use of data and information across the organisation. 121. The Agency is currently developing a "Knowledge Sharing Action Plan" 
which aims to build a knowledge sharing culture within the organisation. The action plan will work to improve the value of the Agency"s knowledge 
assets, to strengthen leadership and create champions and to build on staff capability. Once finalised, this action plan will begin to address the identified gaps. This is a positive step towards a knowledge sharing culture. 122. The Agency needs to ensure that any adoption of new technology and 
systems is supported by the appropriate training and guidance to continually reinforce how the Agency wants the systems to be used and ensure staff are aware of their responsibilities.  Where this does not exist, there is little buy-in to new systems, for example the delivery of Sharepoint in the CEO"s support group. 

## Recommendation 20: Where Technology Is The Solution For Managing Information, The Agency Should Review The Processes For Its Adoption To Ensure It Is Supported By The Appropriate Training And Guidance. Training

123. Training for all staff on records management is predominately delivered 
via the e-learning system. There are also other forums for disseminating good practice records management via the RM Forum and through regular meetings and updates. The e-learning package also provides an overview of good records management practice. The course is not mandatory, but has been completed by approximately 2,000 of the Agency"s staff, which is approximately a fifth of the workforce. 124. As a result of the Hannigan "Review of Data Handling Procedures in 
Government", the Agency has introduced an e-learning module on data 
handling. This module is mandatory for all new staff and must be completed by existing Agency staff by October 2009. 125. The KM team also deliver training ad hoc, classroom or location based 
training where there is a request for further advice and assistance. Within the available resources the KM team dedicate resources to enable such work. As the Agency has many offices distributed across the regions, the regional Learning and Development teams co-ordinate requests for training at a local level.  
 
126. There was limited awareness about records management training 
being conducted at any of the regional or area offices visited. Similarly, 
some staff interviewed were unaware of any such training being offered to them at any stage, although the Assessment team are aware that training is offered via the National Training Course Directory on the Intranet.  

## Recommendation 21: Information And Records Management Training Should Be Reviewed So That All Staff Are Aware That They Can Request This Training.

127. Records management is not featured on either the national or local 
induction programmes for new staff. Despite the Agency"s commitment to 
the value of data and information, no mention was made of this in either induction process. It was found that both in Head Office and in the regions it was up to the discretion of the line manager whether or not staff undertook records management training. 

## Recommendation 22: Records Management Training Should Be Included On Induction Programmes As Mandatory.

128. Similarly, with the exception of staff in the Data Protection team, 
training on data protection was limited to an e-learning package which was not mandatory. A number of staff interviewed handled personal data on a regular basis and had received no training at any stage. The staffs identified in these instances by the Assessment Team were outside the traditional areas of HR and Finance, it was not always clear in advance that they would be handling personal data regularly. 129. If personal information is to be shared within the organisation then it is 
the responsibility of the Agency to ensure that those staff in receipt of that information has the required training. It poses a considerable risk to the 
Agency if it does not ensure timely staff training in data protection. 
 
130. The FOI training and awareness programme is well established. In the 
last few months 107 staff have attended training on various aspects of FOI, such as the application of exemptions. 

## Recommendation 23: Data Protection Training Should Be Mandatory For All Staff Who Handle Personal Data On A Regular Basis. Data Protection

131. The Environment Agency holds a considerable amount of personal 
information in its datasets. The Rod licensing dataset alone includes details of approximately one million individuals. Similarly, the dataset relating to Flood Warnings contains up to 350,000 personal data entries. It is therefore extremely important that the Agency manages and protects this data efficiently and effectively. 132. The team responsible for data protection within the Agency is a small 
team located within the Corporate Security Team. Their role is limited to policy setting, advice giving and dealing with subject access requests. The 
Agency does not corporately track its major assets which contain personal data. There is therefore a significant risk that personal data distributed across the Agency, both in Head Office and in the regions, may not be subjected to the appropriate stringent protections. 133. The large number of information systems used across all Agency sites 
to store and manage information exacerbates this risk. Without a formal system to extensively track the location of specific files, containing personal data, such as HR files, there is a considerable risk that this information may be lost or destroyed incorrectly. 134. The Agency has a responsibility to ensure that staff only have access 
to personal information that is appropriate to their role. 135. To its credit, the records management team, as part of their annual 
records management monitoring programme, complete checks on 
personal data in the areas that it audits. The programme only covers a proportion of the whole Agency, and therefore there is a risk that personal data may be mismanaged elsewhere in the organisation, and may escape detection. 

## Recommendation 24: The Agency Should Continue To Review The Risk To Personal Data. Electronic Storage

136. The Agency uses a number of different formats to store and manage its 
information. Whilst most data and information is stored on corporate systems, it was evident that an increasing amount is being stored on noncorporately controlled systems because of the lack of available capacity. A considerable sample of those interviewed had archived documents and files to CDs or DVDs. This situation presents a risk because CDs and DVDs, as well as other portable media devices, are often not backed up. Similarly, there is a risk that data stored on such media can become corrupted or unreadable. 137. There was also evidence to suggest that current information was being 
stored on unencrypted laptops and USB drives. The Agency"s corporate 
security policy mandates that where laptops and portable media devices contain commercially sensitive or personal data, that data must be encrypted. However, some staff reported that they were still using devices containing unencrypted sensitive data. There is a potential security risk in these cases that if these devices are lost or stolen then the data contained on them could be accessed by an unauthorised party. 138. The Assessment Team were also made aware of capacity constraints 
on the network servers which has contributed to the practice of storing Agency files and data sets on standalone PCs, external hard drives and third party web servers. The Assessment Team were not able to verify that such datasets are identified on local file lists or as information assets. In these cases there is a considerable risk to the information"s security and 
integrity. Where data is stored on PCs and external hard drives there is a risk that the information is not supported by the corporate systems. Similarly, where data is stored on third party web servers there is a risk that this information is not securely stored, protected or backed up. 

 

## Recommendation 25: The Agency Should Review How Data Is Stored On Corporate And External Systems. Storage Of Protectively Marked Information

139. The Agency deals with a negligible amount of secret material. 
However, where it does deal with this information, it is both extremely significant and sensitive. The Agency does not currently have IT systems capable of handling data that is restricted or above. The Assessment Team were made aware that there are plans underway to install a number of GSi (Government Secure Intranet) terminals across the organisation, however these terminals will not be accredited for information above restricted. 140. Where secret information is handled, staff have developed local 
procedures for handling and destroying the information. However, the Assessment Team did not find any corporate support for the handling of this information. For example, secret documents in one team currently 
have to be handwritten and stored in locked cabinets on site. In these circumstances there are no back-ups. Although the receipt of this information is exceptional, failure to safeguard such information poses a risk to the Agency in ensuring that it meets its statutory obligations. 141. There was evidence where restricted material was sent via the email 
system which is not accredited to GSi level. It is then stored on local hard drives. There is a clear risk in these circumstances that the material is not sufficiently protected to the level required. In addition, there is no protection against the corruption of this data and no back-ups exist. 
 

## Recommendation 26: The Agency Should Review Its Arrangements For The Handling Of Protectively Marked Information. Digital Sustainability Of Information

142. The Agency has yet to consider the sustainability of its digital 
information. The Agency currently uses a number of systems to store its data and information which makes this concern more acute. It is vital that the Agency makes plans to ensure that its data and information is readable and accessible in the future. If the Agency does not give consideration to the sustainability of its digital information at an early stage then there is a risk that this information may become inaccessible and unreadable in the future as technology moves on and legacy systems are not migrated.  

## Recommendation 27: The Agency Should Undertake A Risk Assessment, Supported By The National Archives Digital Continuity Project, To Identify Organisational, Process And Operational Risk To Its Electronic Information. Recommendation 28: The Agency Should Consider The Long Term Digital Sustainability Of Its Information With Assistance From The National Archives Digital Continuity Project. Information Asset Register

143. The Agency has created an Information Asset Register. The asset 
register currently lists significant datasets across the entire organisation with their file locations. It also includes the details of who owns the intellectual property on particular datasets. We would encourage the Agency to continue adding key information to the asset register. The Agency does monitor usage via hits to the site. This is viewed as a positive step towards exploiting and sharing information across the organisation. 144. The asset register should not however be viewed as a substitute for an 
FOI disclosure log. 
 
Recommendation 29: The Agency should ensure that it captures information about all its key assets in the appropriate place. 

## Culture

"Information is recognised as the key asset for running the business of the Environment Agency and is used to support effective data and information sharing and knowledge creation." 

## 

 145. The Agency was formed in 1996 from an amalgamation of different 
government departments and agencies.  The Leadership Board have 
always made it a priority to ensure that the key objectives of the Agency 
are cascaded and disseminated to all staff. 

## Commitment

146. The Agency has recognised that it is changing for the better in opening 
greater communication channels across the organisation. The recent restructuring across the Agency has had a positive impact on Head Office 
and the regions. The Agency has demonstrated a commitment to effective information and knowledge management, through the creation of the Evidence Directorate to support the implementation of the Knowledge Action Plan. 147. It has already been identified earlier in this report that changes in the 
management structure at a senior level has started to effect a change. There are a new set of corporate priorities and organisational structures which have been better aligned to deliver these against these objectives. 148. Reforming the regions is the last stage of the organisational changes 
and is fundamental in implementing the cultural shift that is required. Now that the structure has been defined, there is a need for greater investment in ensuring that the middle management layer acts as an advocate for the changes and communicates the message to staff.  
 
149. There does not appear to have been a targeted programme of 
seminars for middle managers or an interactive programme to ensure that managers understand the value of effective knowledge and information management. 

## Recommendation 30: The Agency Should Develop A Programme To Raise Awareness Of Information Management Amongst Middle Managers.

150. Achieving the cultural shift in working styles and patterns has been 
considered. The Agency has piloted the use of collaborative working systems, such as MS SharePoint to facilitate greater information and document sharing. The Assessment Team have been advised that due to changing business priorities, the Agency is in the process of reviewing the rollout of Sharepoint to the rest of the organisation. 151. Despite the siloed infrastructure, there is a growing openness and 
sharing of information across the Agency. Information sharing, cross 
departmental working, and the sharing of best practice initiatives are not yet fully embedded. Continued work should be undertaken. 152. Throughout the assessment, the Assessment Team were made aware 
of the limitations of the IT infrastructure. These limitations have had a negative impact on the Agency"s ability to work in a collaborative and 
cross functional way. Most notably, the number of disparate servers inhibits the active sharing of information from one region to another. The Environment Agency"s IT Framework for managing data, information and 
knowledge will start to address some of the challenges identified but further actions are needed. 
 
153. There is evidence that steps are being taken at a local level to facilitate 
cross functional project team working, that do not necessitate the use of formal information sharing software. Most of the groups that are involved in cross departmental working are functionally based or are aligned to projects. 154. The Assessment team interviewed a number of both regional and Head 
Office staff. These staff have witnessed the changes implemented and felt that the organisation had worked hard to implement them. There is an acknowledgement that some parts of the organisation had embraced new ways of working completely. 155. However, there is a perception amongst some staff interviewed that 
there is a lack of mutual understanding between Head Office and the Regions. The move towards more collaborative working would have a 
positive impact on the raising the levels of understanding in the Agency. This will also help engender adherence to overall Agency polices relating to good information or records management practice. 156. There were examples of an unwillingness or reluctance to share 
information. Several professional areas within the Agency have been used to a level of independent decision making. The agency should continue to encourage a change in behaviour and attitude to sharing information. This could not be investigated fully due to constraints of the assessment process, but is worthy to note as it featured in several interviews. 157. The Assessment Team recommends that the Agency revisits its 
Communications Strategy to ensure that the corporate messages are disseminated effectively. 

## Recommendation 31: The Agency Should Assess The Effectiveness Of The Current Internal Communications Programme On Information Management.

 158. To effectively meet its business objectives and continue to be an 
effective Agency of government in the twenty-first century, the Agency must continue to push forward change and engender cohesion throughout the organisation. 

## Appendix One: Summary Of Recommended Actions

This is a summary of the recommended action to: 

 
 remedy the weakness and gaps in processes identified; and,  strengthen the commitment to the Information Management Assessment Programme. 

 
These recommendations, when implemented, will provide significant benefits to the organisation. Most notably, these will include: 

 
- 
Providing business continuity and consistency, 
- 
Protecting access and retrieval of vital information,  
- 
Providing evidence of decision making  
- 
Being accountable and transparent, 
- 
Providing an audit trail of actions 
- 
Being compliant with current  legislation  
- 
Minimising risk of loss of vital information and security breaches 
- 
Increasing effectiveness and efficiency  
- 
Reducing overall corporate costs 
 
These actions will form an Action Plan that will be monitored. 

## Business

| Ref                                                                | Recommendation                                                       |
|--------------------------------------------------------------------|----------------------------------------------------------------------|
| Area                                                               |                                                                      |
| 1                                                                  | The Agency should review the need for a comprehensive Communications |
| Strategy to ensure Data and Information Management is communicated |                                                                      |

across all parts of the organisation. 
2 
The Agency should develop an internal marketing campaign for the Data and Information Management team. 

## Governance

3 
The Agency should make a clear distinction between data and information to provide clarity for staff. 
4 
The Agency should continue to review and define all risks associated with poor information management to ensure they are well understood. 
5 
The Agency should review its reporting mechanisms to ensure senior 
management are fully aware of all risks relating to information management. 
6 
The Agency should assess the need for additional management controls and performance measures relating to information management. 
7 
The Agency should review the application and effectiveness of the file plan. 
8 
The KM team should formalise a process to co-ordinate the formal sharing of good practice across the organisation. 
9 
The Agency should communicate the definitions of records and information management to ensure consistency across the organisation. 
10 
The Agency should review the application of the Retention schedule and seek to complete the Appraisal policy. 
11 
The Agency should ensure consistent application of the Records Management policy. 
12 
The Agency should assess the risks relating to unregulated storage of material on external media. 
13 
The Agency to reinforce security policy in relation to unregulated storage of material on external media. 
14 
The Agency should complete the project to resolve issues relating to EDRM instability and usability and also review its records management capabilities and compliance. 
15 
The Agency should reinforce compliance with the email policy to staff. 
16 
The Agency should conduct a review of how material from the website and intranet is archived for future use in co-ordination with The National Archives Web Continuity Project. 
17 
The Agency should ensure that the Data Protection contact information and procedures on the website are clear and accurate for members of the public. 
18 
The Agency should review how overall responsibility for information in the Public Registers is managed. 
19 
The Agency should ensure that information contained within the Public Registers is up to date and correct. 
20 
Where technology is the solution for managing information, the Agency 
should review the processes for its adoption to ensure it is supported by the appropriate training and guidance. 
21 
Information and records management training should be reviewed so that all staff are aware that they can request this training. 
22 
Records management training should be included on induction programmes as mandatory. 
23 
Data protection training should be mandatory for all staff who handle personal data on a regular basis. 
24 
The Agency should continue to review the risk to personal data. 
25 
The Agency should review how data is stored on corporate and external systems. 

## Compliance

26 
The Agency should review its arrangements for the handling of protectively marked information. 
27 
The Agency should undertake a risk assessment, supported by The National Archives Digital Continuity Project, to identify organisational, process and operational risk to its electronic information. 
28 
The Agency should consider the long term digital sustainability of its information with assistance from The National Archives Digital Continuity Project. 
29 
The Agency should ensure that it captures information about all its key assets in the appropriate place. 
30 
The Agency should develop a programme to raise awareness of information management amongst middle managers. 
31 
The Agency should assess the effectiveness of the current internal communications programme on information management. 

## Appendix Two:  Glossary

| Data                                                            | Data are numbers, words or images that have yet to be       |
|-----------------------------------------------------------------|-------------------------------------------------------------|
| organised or analysed to answer a specific question.            |                                                             |
| 4                                                               |                                                             |
|                                                                 |                                                             |
| DEFRA                                                           | Department for Environment, Food and Rural Affairs          |
| EDRM                                                            | Electronic Document and Records Management                  |
| GSi                                                             | Government Secure Intranet                                  |
| HMIP                                                            | Her Majesty"s Inspectorate of Pollution                     |
| IM                                                              | Information Management                                      |
| IMA                                                             | Information Management Assessment                           |
| Information                                                     | Produced through processing, manipulating and organising    |
| data to answer question, adding to the knowledge of the         |                                                             |
| receiver.                                                       |                                                             |
| 5                                                               |                                                             |
|                                                                 |                                                             |
| KIM                                                             | Knowledge & Information Management                          |
| KM                                                              | Knowledge Management                                        |
| Knowledge                                                       | What is known by a person or persons. Involves interpreting |
| information received, adding relevance and context to clarify   |                                                             |
| the insights the information contains.                          |                                                             |
| 6                                                               |                                                             |
|                                                                 |                                                             |
| KPI                                                             | Key Performance Indicator                                   |
| NDPB                                                            | Non-Departmental Public Body                                |
| NRA                                                             | National Rivers Authority                                   |
| Record                                                          | A record is a specific piece of information produced or     |
| received in the initiation, conduct or completion of an         |                                                             |
| institutional or individual activity. It comprises sufficient   |                                                             |
| content, context and structure to provide evidence of that      |                                                             |
| activity. It is not ephemeral: that is to say, it contains      |                                                             |
| information that is worthy of preservation in the short, medium |                                                             |
| or long term.                                                   |                                                             |
| 7                                                               |                                                             |
|                                                                 |                                                             |

##