## Action Plan Progress Review Department For International Development (Dfid) Contents

Background  


Action plan development  
  
 
             
 
Summary of progress since the IMA  

          4 

Next steps 
           
                                                                     7 

 
© Crown copyright 2018. You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management. The Department for International Development (DFID) IMA took place in November 2016. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under 'Next Steps.' 
Action plan development DFID promptly produced a detailed action plan following the IMA. Although progress against the IMA action plan was not formally reported at board level throughout the process, it was discussed at a meeting on the IMA between The National Archives Chief Executive Officer and the DFID Permanent Secretary in November 2017. The National Archives formally assessed progress against the action plan in March 2018. We recommend that DFID reports on work achieved since the IMA and on remaining areas of risk to its audit and risk committee. The IMA report and updated action plan are both published on The National Archives' website.1 

## Summary Of Progress Since The Ima 1 The Value Of Information

Performance rating 
IMA 2016 
Review 2018 
Good practice 
Good practice 
Communicating and realising value Managing information as an asset 
Development needed 
Progressing towards satisfactory 

  The Department for International Development (DFID) has updated its 
information strategy to reflect changes in the technology landscape. The strategy has been signed off by the Chief Information Officer and it has been published internally. It is aligned with the DFID technology and digital strategies and with 
DFID's data roadmap.  **See next steps**    
 
 The Director General Finance and Corporate Performance has been assigned 
the role of senior champion for Knowledge and Information Management (KIM) and DFID is considering how it might establish a network of senior champions 
across the business. **See next steps**  DFID is working to improve its approach to managing its information assets. This 
includes factoring in disposal requirements.  It is exploring how to make the Information Asset Owner (IAO) role more effective and has incorporated policy and guidance on the IAO role in its new Corporate Control and Assurance Rules framework. DFID is also assessing how it can increase the usefulness of its Information Asset Register as a tool to manage information risks. It has engaged with work conducted by the Government KIM profession on Information Asset 
Registers and guidance for IAOs. **See next steps** 

## 2 Digital Information And Supporting Technology

Performance rating 
IMA 2016 
Review 2018 
Good practice 
Good practice 
Supporting information through technology 
Satisfactory 
Satisfactory 
Digital continuity and IT change 

  The KIM team and technology colleagues continue to work closely on the rollout 
of Office 365, ensuring that information and records management considerations are taken into account including retention and what tools can be used for. DFID has, for example, applied 1GB limits to One Drive to help discourage staff from 
saving large amounts of information there. **See next steps** 
 
 DFID is currently testing a new joined-up search tool with staff. This currently 
covers the Staff Directory, the Aid Management Platform and published documents in Vault and DFID aims to extend its scope.  Reviews are being undertaken to identify and rationalise information repositories 
outside Vault, including team sites and shared drives. **See next steps** 

## 3 Information Risk, Governance And Oversight

| Performance rating    | IMA 2016            | Review 2018         |
|-----------------------|---------------------|---------------------|
| Recognising           |                     |                     |
| information risk      |                     |                     |
| Development needed    | Progressing towards |                     |
| satisfactory          |                     |                     |
| Establishing control  | Development needed  | Progressing towards |
| satisfactory          |                     |                     |
| Satisfactory          | Satisfactory        | Providing guidance  |
|                       |                     |                     |
| Measuring impact      | Development needed  | Progressing towards |
| satisfactory          |                     |                     |

  DFID has greater understanding and oversight of the information and records 
management risks it faces. It is intended that DFID's new knowledge and information focussed Steering Group (see below) will escalate a summary risk based on the information strategy for inclusion in the Strategic Risk Register. 
 Risks have already been recorded above KIM team level on the Business 
Services Department risk log. These include risks around the disposal of records, the performance of Vault and the way staff use it, as well as DFID's ability to ensure compliance with policy. DFID has identified a range of potential legal and efficiency related effects. It now needs to build on this positive start, reviewing 
risk descriptions as the Office 365 environment is rolled out and adopted. See next steps 
 
 After considering whether to expand the remit of the Information Security 
Management Group (ISMG), DFID now plans to create a separate Steering Group focussed on the management and exploitation of knowledge and information. This body will have a wider membership including the Chair of the rescoped ISMG. **See next steps**  The KIM team continues to explore how best to support and encourage good 
information and records management out in the business. It is looking at where local Vault champions are emerging and is reviewing the methods used by the 
existing Digital Ninja network to enable digital working. **See next steps**  DFID has developed a new What to Keep Retention and Disposal Desk Guide 
and is developing specific schedules for business units based on short- mediumand long-term preservation requirements. Records management policy aspects of the Blue Book have also been updated and these are now being incorporated 
into the new DFID wide Corporate Control and Assurance Rules. However, DFID 
still needs to address the recommendation made in Sir Alex Allan's 2014 report on publication of retention schedules.2 **See next steps** 

  It is now mandatory for new starters to complete the Responsible for Information 
(RFI) training and DFID will measure this via the quality assurance regime it is developing (see below).  
 
 Although Vault training is optional, DFID is working to promote the benefits of 
using the system effectively and has developed a variety of training/support options. These include classroom based training, self service guidance material and a centralised support desk, which it reports have been well received. DFID has also worked to increase coverage of information management responsibilities 
in induction packs.  The KIM team will deliver and manage DFID's new quality assurance regime. 
The aim of this is to check performance and advise departments of their information management responsibilities, based on a review of Vault file structures and security models, RFI compliance and spot checks on sensitive information. A pilot has been carried out with a business area. DFID aims to include an element of the quality assurance process in the Annual Director's 
Assurance Statement. **See next steps**  The KIM team is currently using Vault reports and a Management Information 
dashboard to monitor usage of the EDRM system and compliance with policy. 
DFID plans to incorporate this into the quality assurance process. See next steps 

## 4 Records, Review And Transfer

Performance rating 
IMA 2015 
Review 2018 
Satisfactory 
Satisfactory 
Oversight of records and selection 
Satisfactory 
Satisfactory  
Implementing disposal decisions 

  DFID has maintained progress with paper review. It is planning ahead to ensure 
that it continues to keep pace with the transition to the 20-year rule. It is exploring macro methods of appraisal such as using the digital registry system to do an 
initial sift. **See next steps** 
 
 DFID has explored the option of using third-party contractors to ease pressure on 
staff resource, but has instead identified limited resource to continue this work inhouse for the time being. **See next steps** 
 Content migrated from DFID's old EDRM system, Quest, now has retention 
applied to it and a plan to action this for information of no continuing business use once migration is complete. DFID has also started to develop procedures using established retention criteria to review, dispose and transfer records of historical 
value to The National Archives. **See next steps**  As of yet DFID has not established a process for sensitivity review of digital 
information. See next steps 

## Next Steps

The National Archives will continue to support DFID in its work on information and records management through to the time of its next IMA. In the interim, we recommend that DFID focusses on the following points and builds them into departmental business planning: 

  Reporting on progress on implementing IMA action plan and delivery of the 
information strategy to the audit and risk committee. 
 Identify a formal end point for the current strategy and ensure the new version 
embedded as a key component of wider corporate strategy. 
 
 Working to embed the role of senior champion and to establish a network of 
senior champions that will support achievement of the information strategy goal: We manage our information in DFID. This would be a key enabler for overcoming the current behavioural, business process and skills barriers to good practice the 
strategy identifies.  Continuing to promote good practice principles for information and records 
management including the effective use of IT systems.  Continuing to move forward with work to improve approach to information asset 
management including Information Asset Registers.  Continuing to factor information and records management considerations into the 
Office 365 rollout and into IT projects etc. as business as usual.  Ensuring that any information of business or historical value held in locations 
outside Vault such as team sites or shared drives is migrated to Vault as required.  Continuing work to ensure that information and records management risks are 
recognised and managed at a corporate level. Risk descriptions should reflect 
potential behavioural and cultural barriers to compliance as well as governance related causes. Risk descriptions need to reflect the changing picture of risk that will result from the adoption of Office 365. There may be benefit in learning from good practice approaches adopted by other departments within the IMA programme including the Ministry of Justice, HM Revenue & Customs, Home Office and Cabinet Office. 

  As planned, establishing a governance group to cover information management 
and exploitation.  Continuing to explore how best to support and encourage good information and 
records management out in the business via emerging Vault champions and other roles.  Publicly publishing retention policy on GOV.UK as recommended by Sir Alex 
Allan. 
 
 Including statistics on use of Vault, One Drive etc. in the quality assurance 
process and embedding the process as business as usual, extending this across the department. 
 Continuing work to maintain progress with appraisal, selection, sensitivity review 
and transfer of paper records in order to keep place with the transition to the 20- year rule.  Continuing to explore ways of streamlining the process of appraisal and selection 
of paper records and ensuring that this also feeds into processes for future digital appraisal and selection.  Continuing work to develop a process for the appraisal, disposal and transfer of 
digital records from Vault. Including working with The National Archives on early testing of digital transfer.  Seeking to develop a process for sensitivity review of digital records, drawing on 
work carried out by The National Archives and other government departments.  Working with The National Archives on early testing of digital transfer from Vault.