## Action Plan Progress Review Hm Treasury Contents

Background 

 

02  
Executive summary  

03 
Progress to address recommendations and risk areas  
 04 
Next steps 

 

09 
 

 
© Crown copyright 2017. You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management. The HM Treasury (HMT) IMA took place in September 2015. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed under 'Next Steps.' 
Action plan development 
 
HMT produced a detailed action plan, and progress on this was reported to its Operational Risk Group. The National Archives formally assessed progress against the action plan in September 2016. The IMA report and action plan are both published on The National Archives' website.1 

## Executive Summary Value Of Information

 We are pleased to note that HM Treasury (HMT) has made significant 
progress in improving its approach to information asset management and is now working to embed its governance approach across the department. 
 HMT has maintained a good level of senior engagement with knowledge and 
information management and continues to promote the value of information across the organisation. 
 We particularly commend the work around behavioural change and improving 
information and records management culture within HMT. This work has been used as a case study as part of the cross-government Behavioural Insights Toolkit. 

## Digital Information And Supporting Technology

 HMT continues to lead the way in government in its approach to implementing 
a system for managing digital information throughout its lifecycle. 

## Information Risk, Governance And Oversight

 
 HMT has taken steps to raise awareness of information risk through regular 
briefings at a senior level and by reviewing related policies. It needs to continue to promote a better understanding of information and records management risks through policies, guidance and training and to log these risks across HMT and identify appropriate mitigations. 
 In recognition of the crucial role it plays in ensuring the successful use of Info 
Store in business areas, HMT has streamlined the Site Owner network and provides training, guidance and online forums to support it in its work. 
 
 The approach taken by HMT to monitor compliance with information and 
records management policy continues to be exemplary. The Knowledge Management Benchmarking process has been enhanced by the inclusion of management information on use of Info Store in order to ensure that staff use corporate systems to manage digital information and records appropriately. 

## Records Review And Transfer

 HMT has made significant progress in appraising and selecting digital 
information, starting with the Panagon collection (1996-2004). It has also set up processes for the review and disposal of digital information from 2005 onwards. Working in conjunction with The National Archives, HMT now needs to confirm selection, establish a process for sensitivity review and transfer its earliest digital records to The National Archives. 
 HMT is making progress with appraisal, selection and transfer of legacy paper 
records. It needs to continue to invest time and effort in this work to keep pace 
with the agreed plan to review these records and progress towards compliance with the 20 Year Rule.  

## Progress To Address Recommendations And Risk Areas 1 The Value Of Information

Performance rating 
IMA 2015 
Review 2017 
Good practice 
Good practice 
Communicating and realising value  
Development needed 
Satisfactory 
Managing information as 
an asset 
 

 Senior engagement with Knowledge and Information Management (KIM) was among the best we had seen in government. HMT had a clear strategy for improving information and records management. HMT needed to further develop its approach to information asset management in order to gain greater control of its information assets. 

 Following the arrival of a new Permanent Secretary and Second Permanent 
Secretary in 2016 and a review of senior responsibilities, the Senior KIM Champion role is now held by the Director of Corporate Services. The Director is a member of Executive Management Board.  
 The new Second Permanent Secretary presented the annual awards for 
Knowledge Management (KM) Benchmarking in spring 2017 which demonstrates continuing senior buy-in for this important work. 
 HMT has developed a Behaviour Change Strategy to encourage users to 
improve their approach to record keeping and the use of Info Store. This has included the use of videos of users talking about their record keeping experiences and articles on historical records at HMT. 
 A new role of Information Assurance Manager has been created. The 
successful candidate joined HMT in November 2016 and has taken part in The National Archives' 'train the trainer' workshop for Information Asset Owners (IAO).  
 Information policy guidance on the HMT intranet has been updated and now 
clearly sets out the role and responsibilities of the IAO and includes a definition of an information asset. 
 The Information Assurance Manager is meeting with IAOs individually and 
going through a questionnaire which covers responsibilities, the information assets held in their area and whether they have completed IAO training. The 
majority of IAOs have taken part though some are still yet to engage. See 

## Next Steps

 HMT has developed a new information asset register template. This includes 
information on retention and whether it would be required for The National 
Archives. **See next steps** 
 The KM Benchmarking has been revised to better enable business areas to 
report on the assurance of their information assets (see section 3). 

## 2 Digital Information And Supporting Technology

Performance rating 
IMA 2015 
Review 2017 
Satisfactory 
Good practice 
Supporting information 
through technology 
Satisfactory 
Satisfactory 
Digital continuity and IT change 
 

 
HMT had made good progress in putting in place a system - Info Store (based on SharePoint 2010) - to manage its digital information. Although Info Store did not have the capability for full lifecycle management of records, HMT had set up the Information Management Project to address this. 

 The Information Management project is now complete and Info Store is fully 
operational, with plug-ins (SyncPoint, Compliance Extender, Metalogix and Cardio Log) to enable full records management. HMT has enhanced the search functionality by including filter options on the left hand side - a simple and effective way of making it easier for staff to use. 
 A Records Centre service has now been implemented within Info Store to 
enable archiving and review. **See also section 4**  
 Shared drive users were identified and relevant content mapped and then 
migrated to Info Store between May and September 2016. Some staff are permitted to use shared drives for particular documents such as linked spreadsheets –this is closely monitored by the KIM team. No new shared areas are being set up. 
 HMT has established monthly reporting to track records storage and quality –
this feeds into the KM Benchmarking. **See section 3** 
 HMT produces a report on the top 100 mailboxes, which is published on the 
intranet. Members of the KIM team also sit down with staff members with large inboxes and help them to manage their emails. 
 Staff are encouraged to complete a course on smarter working with Outlook to 
help them manage their inboxes.  
 Personal drives are in use and at present are not officially monitored 
(however, it is HMT policy to delete these when staff leave the organisation). 
See next steps 

## 3 Information Risk, Governance And Oversight

Performance rating 
IMA 2015 
Review 2017 
Recognising information risk  
Development needed 
Progressing towards satisfactory 
Establishing control 
Satisfactory 
Good practice 
Providing guidance 
Good practice 
Good practice 
Measuring impact 
Good practice 
Best practice 

  
HMT had recently updated its Records Management Policy and related guidance and had developed an innovative and effective approach to monitoring KIM compliance via its annual KM Benchmarking. HMT had established an Information Management steering group to facilitate joinedup working and networks of KIM Champions and Site Owners had been established to support information and records management in business areas. HMT needed to do more to embed information risk within its risk management framework and increase awareness of information and records management risks. 

 A Board briefing took place in March 2016 on information assurance and 
cyber security and there has been continuing engagement with Executive 
Management Board and SCS communications to raise awareness of information risk. Routine reporting has been established with quarterly sessions scheduled with the SIRO and monthly reports to the Operational Risk Group. 
 Information security and risk policies have been reviewed and redrafted as 
part of the wider comprehensive policy consolidation exercise. HMT needs to continue to promote a better understanding of information and records management risks and ensure that these are logged and appropriate 
mitigations identified. **See next steps** 
 The network of Site Owners has been reviewed and reduced to a more 
focussed, manageable group; HMT has focussed on upskilling these staff. A two hour training session is provided for Site Owners and there is also a monthly forum and an online space for news, guidance and discussions. 
 Deputy Director level KIM Champions have responsibility for records 
management in their business area, for promoting good practice and tackling poor performance. 
 The HMT Retention and Deletion Policy has now been published on GOV.UK, 
in line with Sir Alex Allan's recommendation. 
 The KM Benchmarking has been further developed to use management 
information (extracted, in part, from Info Store) to measure records management practice in business areas from both a quantitative and 
qualitative perspective. Monthly dashboards are produced for KIM Champions that focus on record keeping, and quarterly reports are sent to leadership teams to ensure they are driving the right messages. Business areas are measured on what they are filing, edits, filing of emails, filing time, access management and file naming. This information is incorporated in the annual benchmarking and prizes are given for the best performing business areas. 
HMT would now like to include personal drive use in this monitoring. See next 
steps 

## 4 Records, Review And Transfer

Performance rating 
IMA 2015 
Review 2017 
Satisfactory 
Good practice 
Oversight of records and selection 
Development needed 
Satisfactory 
Implementing disposal decisions 

  
HMT needed to develop an approach to appraisal, selection, sensitivity review and transfer of its digital information as well as continuing to progress with reviewing paper records in order to transition to the 20-year rule. 

 

 Legacy digital records from 1996-2004 have now been appraised, listed on a 
digital SLAQ spreadsheet and records of historical value identified. This now 
needs to be signed off by The National Archives. **See next steps** 
 HMT is now exploring how it will sensitivity review these legacy digital 
records. The first step has been to find a software tool to enable HMT to securely share digital records with other government departments in order to consult regarding sensitivity - HMT is currently discussing the possibility of 
using Cavarta for this. **See next steps** 
 A process has been established for closing and archiving files on Info Store. 
For content created after 2015 a two step process has been established with files first closed, and then archived, into the information management area. This can be done manually or automatically after a set period of time. Once records are in the information management area the records management team will review them within ten years.  
 HMT continues to make progress in reducing its backlog of legacy paper 
records, working closely with its third party supplier (Iron Mountain) and The National Archives. An Accelerated Transfer Programme Board meets monthly to keep track of this work and discuss any issues that may arise. Iron 
Mountain track all activities such as sensitivity review and provide statistics to HMT so they can monitor progress.  

 HMT has revisited the Advisory Council to report on progress with appraisal, 
selection, sensitivity review and transfer of its legacy paper records and to refresh the Retention Instrument to ensure that legal cover is in place for 
these legacy records. **See next steps** 
 Resource has been dedicated to processing records requisitioned from The 
National Archives and developing a method of tracking these. Work is underway to confirm records that are 'misplaced in department' and for the return of non-sensitive files to The National Archives, as well as planning for 
the review of sensitive files. **See next steps** 

## Next Steps

The National Archives will continue to support HM Treasury (HMT) in its work on information and records management. Outstanding recommendations will be reviewed at the time of the department's IMA reassessment. It is recommended that HMT focusses on the following: 

 
 Embed the process for completing Information Asset Registers. 
 
 Ensure that Information Asset Owners who have not yet met with the 
Information Assurance Manager do so. 
 Build monitoring of personal drive use into monthly reporting and Knowledge 
Management benchmarking. 
 Continue to promote a better understanding of information and records 
management risks through policies, guidance and training; for example, HMT could include a definition as part of the high level information policy guidance on the intranet. 
 Recognise and log information and records management risks and identify 
appropriate mitigations. 
 Working in conjunction with The National Archives, confirm selection and 
ensure that legacy digital records from 1996-2004 are sensitivity reviewed and progressed to digital transfer.  
 
 Continue to keep pace with the agreed plan to review and transfer legacy 
paper records and progress towards compliance. 
  
 Ensure misplaced records are declared and continue the good work in 
returning non-sensitive items and to plan for review of sensitive files.