## Information Management Assessment Department For Environment, Food And Rural Affairs January 2012


About Information Management Assessments The Information Management Assessment 
(IMA) 
programme is the best practice model for government departments wishing to demonstrate a high level of achievement in managing their information. IMA reports highlight areas of best practice and make recommendations for improvements. 

These recommendations will form the basis of an action plan against which progress will be tracked. For more information about the programme and to view previous reports and action plans, see nationalarchives.gov.uk/information-management/ourservices/ima.htm Date: January 2012 © Crown copyright 2012
 

## Table Of Contents

1 RISK MATRIX 
4 
2 KEY FINDINGS OF THE ASSESSMENT 
5 
3 SUMMARY OF RECOMMENDED ACTIONS 
10 
4 SUMMARY OF GOOD PRACTICE 
16 
5 HIGHLIGHTS AND AREAS FOR IMPROVEMENT 
18 
APPENDIX ONE: GLOSSARY 
37 
APPENDIX TWO: THE ASSESSMENT TEAM 
39 
APPENDIX THREE: STATEMENT OF COMMITMENT 
40 


## 1 Risk Matrix

Indicative score drawn from the pre-assessment analysis, on-site interviews and evidence submitted:  

Governance and leadership 
Strategic management Business objectives Management controls Resourcing Risk management 
Information and records 
management 
Creation Storage Appraisal, disposal and transfer Management information Digital continuity 
Culture 
Commitment Staff understanding Knowledge management 
Access to information 
Re-use Security 
Compliance 
Staff responsibilities and delegations Policies and guidance Training Change management 
Key to colour coding 
Best practice Good Satisfactory Development needed Priority attention area 

## 2 Key Findings Of The Assessment

2.1 The Department for Environment, Food and Rural Affairs (Defra) recognises 
the need for robust, evidence-based policy and for knowledge sharing. Currently pockets of excellence, such as the information audit programme, sit side by side with inconsistent information management practices and multiple storage options for users, putting at risk Defra"s ability to evidence and account for its decisions in the future. 
2.2 Defra is the ideal department to position itself as a strategic leader on 
knowledge management. It has innovated on adopting a programme and project management (PPM) structure, but needs to ingrain good record-keeping if it is to make the most out of it. Defra has a swiftly changing policy and regulatory environment in which issues often have the potential to repeat. Defra also has some hugely significant arms-length bodies and is beginning to take the opportunity to standardise information exchange across them.  
2.3 Defra recognises the urgent need to improve its records and information 
management (IM) capability. Real efforts have been made to understand the information that Defra is creating, using and storing. Defra now needs to build on this understanding and take it forward. This report makes 12 recommendations. Action in these key areas will reduce Defra"s exposure to information risk, as well as supporting the efficient and effective functioning of the department. 

## Governance And Leadership

2.4 Defra was one of the first Whitehall departments to adopt a PPM structure. This 
approach to working can allow staff to be more efficiently deployed, moving to where their expertise is required. However, there are associated risks to information management. As staff move between business areas, the depth of knowledge within teams could be lost, increasing Defra"s reliance on its ability to find, understand and trust its records.  
2.5 As with most government departments, the movement to managing large 
quantities of digital information is a challenge. Defra urgently needs a knowledge and information management (KIM) strategy and updated, time-
bound plan to ensure it continues to manage its digital information over time and through change. The management committee should monitor compliance with the KIM strategy and goals as well as the results and actions coming out of the information audit within Defra.  

2.6 Defra has risk management processes in place. However the risks of not 
having evidence to back decisions or fulfil statutory obligations are not widely understood. As a result, necessary information is not always captured, or conversely, large quantities of ephemeral information are captured "just in case". This has a detrimental impact on the ability to manage risk. The 
management committee can play a key role supporting attempts to set and embed good practice outlined in the recommendations in this report, including championing the roles and responsibilities of the various information management roles and users. 
2.7 The information audit has started to address this, collating detailed information 
about each of the business areas. This is good practice; however more needs to be made of this. Defra needs to capitalise on this work by better exploiting the information to improve its management of information. This will better inform how Core Defra manages its information risks.  It will also inform planning for the future information needs of Core Defra and support the development of appraisal processes to deal with the legacy of electronic information.  
 

## Information And Records Management

2.8 Selection and appraisal of paper records are well managed, with robust, 
established processes. The accelerated file review process is an example of good practice. The Defra physical archive is fully supported by a complete computerised catalogue which assists FOI and other business requests.  
2.9 The volume of electronic information being stored, multiple storage locations 
and poor understanding and adherence to good practice will make future appraisal of electronic information problematic. Defra needs to ensure that clear principles for the management of all corporate repositories is set out, monitored and enforced. 
2.10 The email archive system Vault has a three-year auto deletion. Although there 
are policies in place to manage the issue, staff awareness and compliance is 
low, leaving Defra exposed to risk. Defra needs to evaluate whether using a separate email archive system is within its information risk appetite. 

2.11 If Defra is to function successfully using a PPM structure, it needs a clear 
approach and consistent application of policy in local areas to allow others within the organisation to find what information they need and understand it. This will support Defra to access accurate and reliable records of decisions, as well as supporting compliance with legislative requirements. 

## Management Of Digital Information

2.12 Defra needs a comprehensive plan to ensure it is able to use its digital 
information as it needs to, when it needs to. Defra has been slow to introduce a credible and reliable electronic records system, which would help staff work consistently and manage the lifecycle of electronic information. The Clean 
Sweep project and the e Review project, incorporating work on DROID,1 has 
been discussed with The National Archives. Defra should continue to develop processes for the ongoing management of digital information over time or through change. Failure to do so will leave Defra exposed to the significant risk that it will lose the ability to find, open, use, understand or trust information that it requires for business purposes. 
2.13 A specific digital continuity plan should be produced and owned by an 
appointed senior responsible owner (SRO). This should ensure that all digital information is recorded as (part of) an information asset, is managed over time, 
and scheduled for disposal.  

## Access To Information

2.14 There is inconsistent and often poor understanding of staff responsibilities for 
managing corporate information, including how to use the Government Protective Marking Scheme (GPMS) and control access permissions. Policies are available but staff awareness is low. This leaves Defra exposed to risks that 
                                            
information will be inappropriately disclosed or shared, or that it is given too high a protective marking which restricts the ability to share information legitimately. 

2.15 Defra needs to improve significantly its management of information in order to 
ensure it is meeting its statutory responsibilities, such as the ability to find information under Freedom of Information Act (FOI). This will be supported by a reduction in the number of corporate repositories available, guidance and training and monitoring of compliance.  
 

## Compliance

2.16 There are a number of good policies and pieces of guidance available, however 
staff awareness and use of internal policies and guidance is low. The knowledge, information and records management (KIRM) team are attempting to identify and address the most significant issues within teams identified through the information audit programme. This is good practice; however, the resource required to provide such a service limits the breadth of the scope.  
2.17 Defra therefore needs a strategy for publicising guidance and good practice 
examples, increasing staff awareness of their IM responsibilities and measuring broad compliance with internal policy and external mandatory measures, starting with key policies. This must be backed up at a minimum by the inclusion of information management principles in a mandatory corporate induction programme. It should be coupled with the recommendation to 
improve the capability of local information managers (LIMs), to ensure they offer support and monitor compliance. 
 

## Culture

2.18 For Defra to be confident that it is capturing the record of its activity, 
inadequacies in staff awareness about their IM roles and responsibilities must be addressed and IM supported from the management committee to raise its profile and importance within the department. Unclear governance, and inconsistent enforcement of policy and guidance have created a range of issues and these will not be resolved solely by the introduction of a unified 
technology solution. While Defra needs to mandate a corporate repository, any such solution needs a simultaneous drive to increase staff understanding of their roles and responsibilities, and monitoring of actions to ensure compliance.   

## 3  Summary Of Recommended Actions

These recommendations will form the basis of an action plan that will be monitored. 

| Ref                                                                                                | Summary Recommendation                                                                                             |
|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------|
| 1                                                                                                  |                                                                                                                    |
| The management committee needs to monitor and champion knowledge and information management within |                                                                                                                    |
| Defra.                                                                                             |                                                                                                                    |
|                                                                                                    |                                                                                                                    |
| The management committee needs to:                                                                 |                                                                                                                    |
|                                                                                                    | Oversee the development of a KIM strategy and monitor compliance with the goals                                    |
|                                                                                                    | Oversee and monitor the improvement in capability as a result of the Information Audit                             |
|                                                                                                    | Support actions to set and embed good practice outlined in these recommendations                                   |
|                                                                                                    | Drive cultural change through the department from top of the office, recognising the value of information as a key |
| asset                                                                                              |                                                                                                                    |
|                                                                                                    | Ensure adequate resources are made available to support KIM in achieving its goals and in training of staff        |
| 2                                                                                                  |                                                                                                                    |
| Develop a knowledge and information management strategy and revised plan for Core Defra            |                                                                                                                    |
|                                                                                                    | These must be developed in consultation with information technology and information assurance                      |
|                                                                                                    | The KIM plan needs to be time-bound include milestones and measures of success                                     |
|                                                                                                    |                                                                                                                    |
5.13, 5.30 5.5, 
5.46, 
5.55 

## 3 Kirm Need To Continue To Develop A Process To Appraise The Legacy Of Electronic Information Held On The Shared Drives.

 
Defra need to continue to ensure that they are thoroughly sampling key records, deleting against agreed retention schedules and keeping adequate records of this. 
 
The information audit programme data should be utilised to help to identify the business users and key information 
assets.  

## 4 Expand The Scope Of The Information Asset Register (Iar) For Core Defra To Create A Management Tool Which Captures The Business Requirements Of The Organisation.

As a minimum action, Defra should include at least the following fields in its IAR: 
 
The value of information to the organisation (business criticality and risks associated with not being able to use the information) 

 
Where and how it is stored 
 
Who uses the information (including sharing) 

## For Digital Information, Defra Should Also Include Technical Dependencies And Requirements To Be Able To Find, **Access**,

5.28 
5.10, 5.17, 5.34, 5.35, 5.37, 5.39, 5.41, 5.46 

## Work With, **Understand** And **Trust** Information.

 
These requirements should be used to evaluate all proposed information and records management systems 
(technical and non-technical) in Core Defra. 
 
The requirements should be owned by KIRM with support from the Core+ Intelligent Customer Function. The results of this requirement gathering exercise should be analysed by the SharePoint programme board, and used to inform business and technical change decisions through visibility at change boards. 

## Information To Support This Should Be Compiled, As Far As Possible, From Work Already Undertaken. The Expanded Iar Should Be Owned Jointly By Information Assurance And Kirm, And Cross-Referenced With Disaster Recovery Plans. 5 Put In Place A Plan To Ensure That Defra Maintains Its Ability To Use Its Digital Information Over Time And Through Change:

 
Ensure that all digital information is recorded as (part of) an information asset, or scheduled for disposal. Information with ongoing business value should be recorded on the IAR and assigned ownership. 
 
Ensure that there is corporate oversight and monitoring of the continuity of Defra's digital business 
information. This should include regular testing. 
 
Ensure that technical and business change does not adversely impact on Defra's ability to find, open, use, 

5.32 
understand or trust information that it requires for business purposes. 

 
Digital continuity risk2 must be regularly reported to the board. 

## 6 Defra Needs To Ensure That Individual Elements Of The Information Services (Is) Strategy Are Developed Collaboratively And Embed Knowledge Management:

 
All IS policy leads need to have input into the development of all sections of the IS strategy. 

 
A timescale for development and publication of the IS strategy should be produced by Q1 2012. 

## 7 Ensure That Every Technical Change Project Includes Formal Representation From A Skilled Knowledge And Information Management Representative From Kirm And An Information Assurance Professional. The Data Protection Team Must Also Be Formally Consulted About Requirements.

 
Defra need to ensure that information and records management requirements and concerns are fully represented on the SharePoint2010 programme board, ideally through inclusion of a representative from KIRM. Information 
management and assurance requirements must be fed in as part of this. 
 
Defra"s requirements for SharePoint 2010 need to include essential modifications to ensure the capture of all evidential information including emails as well as the ability to export information while preserving content and context in the event of machinery of government changes. This needs to be scoped and signed off by the EDRM 
2 The National Archives will support Defra to develop a supporting digital continuity plan.  The plan needs to be owned by an appointed digital continuity SRO, reporting to the senior information risk owner (SIRO). Guidance, support, commercial tools and services and a self-assessment tool are available from nationalarchives.gov.uk/digitalcontinuity. 

5.7 
5.34, 5.42 
capability lead, SIRO and chief information officer (CIO).  
8 
Raise capability by retraining staff with information management responsibility, including information asset 
owners (IAOs), local information managers (LIMs) and information management representatives (IMRs).  
 
IAOs must be aware of their obligation to fill in quarterly return on IAR. 
 
Deputies should be appointed for each IAO. 
 
An IAO network should be considered to offer support and champion issues. 
 
Evaluate the potential for specific training for LIMS and IMRs with the aim of increasing local compliance with policies and guidance. 
 
Assess the possibility of monitoring performance against IM targets. 
9 
Using its understanding about its information requirements, Defra needs to introduce and enforce policies about 
the structure and use of corporate digital repositories, including accredited shared drives, shared drives and 
SharePoint 2007. KIRM, with input and support from the CIO and SIRO, must: 
 
Review and tighten its mandatory principles for the management of corporate repositories. These should 
allow for local flexibility, but require naming to be "SLIM" (Specific, Logical, Informative and Meaningful) 

In conjunction, to support this, LIMS should: 

 
Cascade and publicise guidance and good practice examples on an ongoing basis (and get feedback to 
improve usability) 
5.19, 5.40, 5.41, 5.46, 
5.48, 5.49, 5.51 5.13, 5.23, 5.30, 5.41, 5.46, 5.51  
 
Monitor and report on local progress and compliance 
10 
KIRM, with support from senior management, needs to maintain the information audit programme and develop a 
plan to increase the use of what to keep within business areas: 
 
Usage should be monitored and reported in to the board by the Defra board-level KIM champion.  
 
This recommendation should be part of a programme of work to raise awareness of KIM responsibilities among 
staff, particularly Vault and email user policies (**see recommendation 11**). 
11 
Provide adequate induction training, educational work and refresher courses for staff: 
 
Ensure all new starters have a corporate induction to Defra, and that this covers the risks and benefits associated 
with information and records management, information management roles within Defra and what to keep. 
 
Information management refresher courses and information should be made available to staff. This should be informed by an analysis of the issues identified through the information audit programme. 
12 
Evaluate the appropriateness of the use of a separate email archive system: 
 
This should evaluate whether the use of an automatic delete function falls within Defra"s risk appetite. 
5.13, 5.25, 
5.30 5.30, 5.41, 5.48, 5.49, 5.52 5.30 

## 4 Summary Of Good Practice

The following have been specifically identified as good practice in the report.  

1 
Information audit programme has collated useful data across all areas of Core Defra. A report has been supplied to 
each business area which documents the technology in use and types of information being used, created and stored. The programme made over 800 recommendations in total, identifying important risks and working with staff to resolve them. 
Bespoke what to keep guidance has also been created for each business area. 
2 
Evidence investment strategy, which is a separate budget area and is championed at board level ensures that Defra is collecting the information that it requires for evidential purposes. 
3 
Evidence board interrogates the scientific evidence of policy decisions. This ensures that the evidence that Defra is 
relying on to formulate policy positions is robust and can stand up to challenge and scrutiny. 
4 
The **SIRO has a high profile**, and in championing information assurance has raised the profile of the discipline 
throughout Defra. This was recognised by interviewees as good practice and Defra should consider ways to embed this 
as a core part of the SIRO role. 
5 
An **accelerated single file review process** has been embedded to expedite the review process to meet the challenges 
of 20-year rule change. The associated risks appear to have been considered and understood. Defra should continue to share information about their process and lessons learned to support other government departments who may benefit from a similar exercise. 

## 6 Defra'S Innovative Work In Using Droid Has Identified Legacy Electronic Information Assets Which Have Been Unmanaged Since Desktop It Was Introduced In 1994. This Has Enabled Low Value Ephemeral Information To Be Deleted Information Of Value To Be Maintained And Is A Stepping Stone To Harmonising Physical And Electronic Appraisal. Defra Should Make The Lessons Learned Available To Other Government Departments. 5 Highlights And Areas For Improvement Governance And Leadership Strategic Management

5.1 Core Defra does not currently have a clear strategy or time-bound plan for 
knowledge and information management. Defra is currently developing a Defra network information services (IS) strategy, which covers Core Defra and the wider network, including executive agencies (EA) and non-departmental public bodies (NDPBs). The four elements forming the core of the strategy (information and communications technology strategy; commercial/sourcing strategy; knowledge, information and data strategy; and people, capability and governance strategy) will provide an over-arching strategy to guide strategy and policy across the Defra Network, although it will not replace strategies and plans within departments. 
5.2 When developed, any Core Defra strategy will need to align with the 
knowledge, information and data strategy component of this. In the meantime, Core Defra needs to develop a strategy and implement a plan to raise its knowledge and information management (KIM) capability. 
 
5.3 The knowledge, information and records management (KIRM) function is 
undergoing a review by the CIO; however the continued lack of strategic 
approach is putting Defra"s ability to use its information and account for its 
actions at risk. The CIO role needs to be engaged, as far as possible, with all elements of knowledge, information and records management in order to derive maximum value from, and provide assurance for, Defra"s information. 
 
5.4 The KIRM team have assessed the findings of the information audit programme 
and identified priority recommendation areas for future work in the information audit evaluation report. Core Defra needs to ensure that these actions are considered and included as part of a time-bound implementation plan. 
5.5 The current Core Defra KIM plan is not tied to an overall strategy and does not 
identify remedial actions or a timetable for resolution of the issues and risks identified. Defra needs to define the timescale for developing a KIM strategy and for the revision and publication of its KIM plan. This needs to specify milestones, measurements for success and timescales. See recommendation 2. 

## Defra Network Information Services (Is)

5.6 The CIO is leading the drive to promote collaboration and joint use of ICT 
across the wider Defra Network, as part of the joined-up IS strategy. This is in line with the aims of the Government ICT strategy. Collaboration between Core Defra and its agencies and NDPBs in the Defra Network is promoted through 
the CIO board, which has developed the ICT strategy document. This is a good start as it demonstrates collaboration and compromise in order to 
provide shared and cost-effective ICT solutions. 
5.7 The ICT strategy has been developed first due to external pressures to reduce 
IT spend. There had been little involvement from KIM specialists or business users before it was presented for sign-off. This presents the significant risk that strategies are developed that do not reflect the information needs of the 
organisation. Defra must ensure that the IS strategy is developed and 
reviewed in conjunction with lead representatives from other IS policy leads. The ICT strategy must be regularly reviewed in conjunction with 
key business areas, including KIRM. See recommendation 6. 

## The Information Landscape

5.8 Whilst Core Defra does not have a strategy in place for the management of its 
information, the KIRM team have attempted to understand Core Defra"s information landscape and drive IM improvements through the use of DROID 
file profiler tool and information audit programme. This is an example of good 
practice, and the head of information management and practice at The National Archives has sent a letter of commendation to Defra in 
recognition of the information audit programme. 
 
5.9 The information audit programme initially ran for 18 months (it is now in tranche 
2), collating information about what and how information was being created and managed across Core Defra. Each business area has been supplied with a comprehensive report of the technologies used, the types of information being created and stored. The programme made over 800 recommendations in total, identifying important risks and providing action plans to resolve these. 

5.10 The data gathered by the information audit programme could be more widely 
used to help Defra to manage its risk and maintain central oversight of its information and support risk management. The information should also be used to inform Defra"s information requirements, evidence investment strategy (EIS), 
and to plan the strategic development of the technical infrastructure. The 
information should be actively fed in to an expanded information asset 
register. See recommendation 4. 

## Business Objectives

5.11 "Evidence" is championed by the board and the associated risk is well 
understood. However, the ability to trust and use the evidence Defra uses relies on good information management (IM). The importance of IM to underpin evidence is not generally understood, with one interviewee commenting that 
Defra "does not value information in its own right". 
 
5.12 The strong culture of valuing "evidence" is backed up by the EIS, which is a 
separate budget area and is championed at board level. This is good 
practice. Similarly, the introduction of an evidence board, to interrogate policy decisions drawn from scientific evidence also represents **good practice**. This 
ensures that the evidence that Defra is relying on to formulate policy positions is robust and can stand up to challenge and scrutiny. 
 
5.13 Information assurance (IA) similarly has board-level representation. However, 
there is no equivalent representation of Knowledge and information management. Board-level ownership of evidence and IA has been central to 
driving improvements in awareness and compliance among staff. KIM needs 
to have visibility at board level through monitoring and regular reporting of information risk and progress against the IMA action plan. See 
recommendation 1. The priorities identified, which should include What to 
Keep, then need to be cascaded, embedded and progress against them 

## Monitored. **See Recommendations 9 And 10.** Risk Management

5.14 Defra"s governance structures and the level of strategic oversight they provide 
are not sufficiently robust and comprehensive to manage the full spectrum of information risk. Information risk is only monitored on the corporate risk register as an exception. So, whilst Defra understands the need for collecting the right "evidence", the risks of failure to demonstrate the basis of past decisions and 
failure to fulfil statutory obligations is not widely understood. 
5.15 The SIRO has maintained a high profile, and in championing information 
assurance has raised the profile of the discipline throughout Defra. This was recognised by interviewees as good practice and Defra should consider 
ways to embed this as a core part of the SIRO role. The information audit programme has also identified key risks and issues within individual business areas. 
5.16 The information asset register (IAR) is a key tool to manage risk to both 
personal and sensitive business information; however this is currently underused and incomplete. As a consequence, risks to the departments" assets may not be captured or understood. 
5.17 To enable oversight of wider information risk, Defra should seek to expand its 
IAR to serve as a central point of reference when recording usability requirements for key information assets, managing technical dependencies over change, determining ownership of information and monitoring risk and retention. It may also support Defra to plan the development of its technical infrastructure, such as adopting greener and more cost-effective storage, for 
instance keeping only frequently accessed information on live servers. Defra 
needs to expand the scope of the IAR for Core Defra to create a management tool which captures the business requirements of the 
organisation. See recommendation 4. 
 
5.18 The assessment team found that the IAR is not updated consistently and does 
not represent a complete list of assets. A review of a selection of the 
information audit programme reports found examples of information assets that had been highlighted but not subsequently listed on the Core Defra IAR (one defined as containing personal information with constraints on sharing, and another created for statutory evidence gathering and hosted externally). 

5.19 The IAR is an important management tool for risk and information. It is the 
responsibility of the Information Asset Owners (IAOs) to ensure this information is recorded on the IAR with the relevant risk information. However it is notable that less than 15% of the Core Defra entries had completed risk fields. Whilst 
having a risk field **represents a good start,** the lack of completion is 
representative of a lack of awareness among many IAOs about their responsibilities. It is vital to the ability of Core Defra to monitor, track and manage information risk that they are given the right training and support in 
order to do their job. Defra needs to re-train its IAOs to ensure they are 
aware of their responsibilities. Defra also needs to implement a clear governance structure to ensure monitoring and compliance, include an 
obligation to fill in the quarterly return on the IAR. **See recommendation 8.**  

## Information And Records Management Management Of Information

5.20 Defra needs consistently structured repositories if the programme management 
structure in Defra is to work effectively. This will allow others within the organisation to find and understand information, as well as supporting corporate memory and compliance with accessibility legislation and transparency.  
 
5.21 The current information and technology environment is confused. There are 
multiple repositories and formats in use and inconsistent enforcement of corporate ways of working by senior managers. Staff using shared drives and team sites described problems finding information that they knew existed and uncertainty about the version status of records that they required. Staff were using shared drives as corporate repositories, rather than filing hard copies of records as policy dictates, and using more than one storage area contrary to published guidance. A lack of active management and moderation of the drives has also led to a proliferation of information, as information is kept unnecessarily and retention is not applied. One interviewee described information going back to the 1990s in shared drives and file plans containing multiple levels, making finding and retrieval very difficult. Another stated that "it can take a long time to find something that you know is there - from a few minutes to hours". A lack of oversight of its information also means that Defra 
"has paid for the same research twice". 
5.22 It is particularly important that Defra can be confident that it is capturing the 
record as it uses Private Office Model 2, which relies on policy areas to retain a full and accurate record. However, whilst Defra is aware of the issues highlighted above, there is no effective strategy or plan in place to tackle them. Defra needs to decide on a corporate policy and mandate it. Guidance exists on the use of shared drives, explaining that these are not a corporate repository and as such any records saved in them must be printed and kept in a registered paper file. However, the same guidance also tells users that they are "strongly encouraged" not to use non-accredited shared drives if there are other 
options in place. Defra needs to mandate that in such situations, shared 
drives should be used to store new information. This needs to be accompanied with clear policy and mechanisms to enforce compliance. 

5.23 Due to the delayed roll out of SharePoint 2010 the KIRM team have reestablished the accredited shared drive (ASD) Project, which had been stopped due to a lack of resource. KIRM have also produced corporate information workspace (CIW) guidance to advise business areas how to structure local workspaces. This guidance is not sufficiently prescriptive and does not set out good practice. The KIRM team should revisit the guidance and set out prescriptive, good practice principles for the structuring and maintenance of 
shared areas. This should make use of good practice already in use, such as the finance team"s "4-Click" principle (that any information should be findable 
within four clicks) and the CIW guidance that naming should be SLIM3. This 
allows autonomy for local areas within an intelligible framework. This will support access and re-use, enabling a smoother transition to any technical 
EDRMS solution that is implemented. Defra needs to introduce and enforce 
clear policies about the structure and use of corporate digital 
repositories. See recommendation 9. 

## What To Keep (Wtk)

5.24 Staff had a poor understanding of what information they needed to retain, how 
long for and what to dispose of. This presents the risk that necessary records and information may not be captured, and has also contributed to a proliferation 
of digital information in business areas and a risk of over-retention. 
5.25 The KIRM team has produced corporate what to keep guidelines and tailored 
what to keep schedules for each programme as part of the information audit 
programme. **This is good practice.** However, awareness of these was poor 
and not all SROs were cascading fully to their teams. Only a small number of managers and IAOs interviewed had embedded the WTK schedules in their areas. As recognised by the KIRM team, the proliferation of information will make future appraisal more difficult. It is also likely to increase the cost as 
appraisal will be more time-consuming and resource-intensive. KIRM, with 
                                            
support from senior management, should develop a plan to increase and monitor the use of what to keep within business areas. See recommendation 10. 

## Appraisal, Disposal And Transfer

5.26 Paper appraisal is well-managed and the processes in place are sufficiently 
robust. The team is currently working at capacity; the recent reduction of their annual appraisal target from 80,000 to 50,000 reflecting a recent reduction in 
staff numbers. The records review team have also embedded an accelerated single file review process, in an attempt to expedite the review process to meet the challenges of 20-year rule change. Staff members interviewed were confident that the associated increased risks had been considered and 
understood. This represents **good practice** and Defra should share information 
about their process and lessons learned to support other government departments who may benefit from a similar exercise. 
5.27 There has been a pilot study to analyse the electronic information on the 
shared drives within Defra. The DROID file characterisation tool is being used to analyse the contents of the shared drives. This project has been running for one year and having analysed information created between 1994 and 2001 has identified with business areas assets which still have ongoing or potentially historical value and other information that can be safely deleted. The findings of this study concluded that digital information created prior to 2001 is duplicated 
in hard copy or ephemeral, as until that point the department had a print to paper policy. 
5.28 Defra has considered the risks that this poses and acknowledge that they are 
taking a risk-based approach; specifically the failure to keep and maintain a complete public record under the requirements of the Public Records Act (PRA) 
and section 46.4 Defra has discussed this approach with The National Archives 
and are doing some assessment to ensure that files to be deleted are held in hard copy and can be transferred under the Public Records Act if selected. This 
is an interesting and pioneering piece of work. Defra should make their lessons learned from the exercise available to other government departments who may want to investigate the feasibility of macro-appraisal of digital information using the DROID tool. **See recommendation 3.** 

## Email

5.29 Email presents a significant challenge in terms of capturing context and a 
record of decisions, due to inconsistent filing of evidential emails to corporate 
systems. Despite clear email guidance that key evidential emails must be stored in corporate systems, some areas of the business were using Outlook folders as a collaborative and record keeping area, rather than saving these emails to corporate systems. There is a significant risk to business efficiency if emails cannot be shared when needed, and to Defra"s reputation if, for example, records required for an inquiry cannot be found as they have been stored in Outlook, and are not returned in search results. 
5.30 The use of the email storage solution Vault is of particular concern; the 
introduction of Vault was initiated by IBM without prior consultation with KIM. Vault is an IT capacity solution that presents significant KIM risks. Vault acts as a personal storage area, accessible only to the user, and has an in-built threeyear automatic delete function. The information audit report estimated that over 50% of Defra"s business areas are using Vault to store evidential emails. Anecdotally, the assessment team heard stories of important evidential emails 
that were almost lost to Vault"s automatic delete function. Guidance on the use of Vault is available, which specifies its use as a personal repository only. However the assessment team found poor understanding about these issues, 
and the potential risks and issues for Defra. Defra should evaluate whether 
using a separate email archive system is within its information risk 
appetite. See recommendation 12. KIRM, with support from senior 
management (see recommendation 1), need to develop a plan to increase the use of 'what to keep' guidance within business areas, at the same 
time as ensuring compliance with information management policies in particular educate staff to promote the Vault and email user policies. See recommendations 9, 10 and 11.  

## Management Of Digital Information Digital Continuity Risk

5.31 Defra is not currently managing its digital continuity.5 There is no strategy or 
plan to ensure that Defra remains able to find, access, **work with**, understand and **trust** its digital information over time and through change. The 
assessment team found ongoing management of digital information to be the exception rather than the norm. If Defra cannot open or prove the provenance 
of a record when it is required for an inquiry, it places itself at risk of contravening its statutory obligations. This could be a source of embarrassment or financial loss to the department. 
5.32 Defra needs a comprehensive digital continuity plan, in order to ensure it 
is managing its digital information and retaining its usability. This will 
support the realisation of other benefits of improved management of information, and The National Archives will provide advice and guidance to 
deliver a robust plan. A senior responsible owner6 (SRO) for digital 
continuity should be appointed to implement this and monitor progress. 
See recommendation 5. 

## Information Requirements

5.33 The assessment team found differing expectations throughout Defra about the 
capability that will be delivered in the SharePoint 2010 roll-out. This is due in part to delays in the deployment of the system that were beyond Defra"s control. SharePoint will incorporate EDRMS capability if it is considered "costeffective". If this is the case, Defra plans to save duplication of effort by using Home Office SharePoint 2010 requirements, which Defra considers to meet 
minimum section 46 requirements. 
 

5.34 This raises two important issues; firstly Defra needs to update its requirements 
to find, access, work with, understand and trust its information it is not possible to make an objective decision about the most appropriate solution. Secondly, 
Defra cannot effectively analyse the risks to their ability to use information presented by re-using Home Office requirements. Defra needs to understand 
and document its own information requirements for records management (see recommendation 4) and include a skilled information and records manager on the SP2010 programme board **(see recommendation 7).** Once these 
requirements have been scoped, Defra should test these by doing a 
comprehensive gap analysis against the SharePoint paper produced by The 
National Archives.7 
 
5.35 Defra needs to develop and document a "Plan B" for electronic records 
management if SP2010 does not provide EDRM capability. Core Defra needs 
to define and document its corporate requirements for records management, independent of any proposed technical solution, and use these as the basis for the selection of any solution. See recommendation 4. 

## Technology And Information

5.36 Defra does not have a central record of how its technological environment 
supports its information. There is little understanding about the impact that 
technology change may have on the ability of Defra to use its information, with the resultant risk that digital information may become unusable if it is not managed appropriately over change. 
5.37 There was no evidence within teams or programmes that key information 
assets are tested to ensure they can be used. In one example, there were no plans to test the usability of files which were due to be kept for 25 years. In a PPM environment, when teams disband and it is harder to enforce active management of legacy information, it increases the importance of corporate 
                                            
oversight of the key assets and that these are being managed through change that might impact on them. This will be mitigated through the introduction of an expanded IAR and documented understanding about Defra's information requirements (see recommendation 4). 

## Access To Information Information Assurance

5.38 Information risk was articulated by most interviewees in terms of protecting 
personal data. Despite this, there remain significant issues with the way that the department manages its personal information, with Defra not currently meeting Information Assurance Maturity Model (IAMM) level 1. 
5.39 Defra is working with Cabinet Office to raise its capability. Areas of concern are 
disaster recovery, data leak prevention, unsupported legacy information technology and the lack of an up-to-date comprehensive IAR. Improved information 
management 
processes 
and 
procedures, 
including 
the 
recommendations in this report, will support improved information assurance in Defra. An expanded IAR will improve oversight of and ability to manage 
information, and can be cross-referenced with disaster recovery plans. See recommendation 4. 
 
5.40 The management of shared drives for access control is particularly important to 
protect legacy information given Defra"s programme management structure. Ownership of older information is not always clear, and if there is no business owner, all orphaned material falls to KIM. Access may be granted to legacy information on a short-term basis before being revoked. There is a structured process for monitoring access in team sites, and some examples of good 
practice monitoring of shared drives, such as an individual who recorded and regularly reviewed access permissions on an Excel spreadsheet. However this was the exception rather than the norm, and almost always the initiative of the individual rather than being initiated by the IAO. IAOs need to ensure that they 
are taking adequate steps to protect their information. The responsibilities of 
the IAO role needs to be clarified and made explicit, including the 
obligation to fill in quarterly risk return on IAR. See recommendation 8. 

## Data Protection Act (Dpa)

5.41 Defra perceives itself to be a low-risk department in terms of personal data. 
However it should not be complacent because of the lack of incident. There is currently little active management of DPA risk, and the lack of a comprehensive IAR means it doesn"t have oversight of **information** that it holds. Staff use multiple repositories to store information, including Vault, and the assessment team heard an example of personal information about staff being kept on a personal drive because it was considered "secure". This personal information is invisible to the business and increases the risk that Defra contravenes DPA Principles 3 (if too much personal information kept), and 5 (it is being kept for longer than required). Defra needs to assure itself that it is managing risk effectively, through its information asset register, governance structures, and staff capability. See recommendations 4, 8, 9 and 11. 

 
5.42 There is currently a requirement for consulting with the data protection officer 
when setting up policy projects. This is **reassuring**; however the same does 
not formally happen for IT change projects and programmes, such as the 
SharePoint programme. Defra needs to ensure that data protection issues are formally considered as a part of new IT projects. See recommendation 7. 

## Re-Use

5.43 Defra ranks highly in terms of the number of datasets that it publishes on 
Data.gov. Currently they have 416 datasets, making them the 4th largest UK 
government publisher.8 Defra also makes a large amount of statistical 
information available, mostly in .pdf format, through Science, Economics, Statistics and Research section of the website. The assessment team welcomed this. 
5.44 Defra states in its business plan for 2011-2015 that it has "always taken a "right 
to data" approach in our dealings with the public and are taking steps to 
formalise this approach for both existing and new data holdings." The assessment team heard of a number of other historical datasets held by Defra in different formats and of differing levels of quality. Defra should ensure that its historical datasets are recorded appropriately, the risks reviewed and, where 
                                            
possible, that they are published. 

 

## Freedom Of Information (Foi)

5.45 Defra received 150 requests under the FOI act for April-June 2011. 83% of 
these were answered within the 20-day deadline, rising to 92% with permitted extension. This is above the average across central government departments for the period. 
5.46 The cumulative effect of multiple storage locations, a lack of consistent IM 
policy and little management of legacy information means that Defra cannot be confident that it is able to locate all of the information related to a request made under the FOI act. Inconsistent management also increases the risk that this information will not be able to be opened or trusted as required. The recommendations in this report will help to manage this risk, through a strategic 
approach (**recommendation 2**), an expanded information asset register (**recommendation 4**), clear policy that meets Defra"s needs (recommendation 9) 
and 
increasing 
the 
efficacy 
of 
information 
management 
roles 
(**recommendation 8**). 
 
5.47 There are significant issues with the availability of information on the Defra 
website, although this is currently undergoing improvement works. The Access to Information pages, including instructions, publication schemes and FOI performance details, are historical and accessed through an archived site. The 
publication scheme is not up to date, with links to many reports dating from 2007. Many of the links (for example, to impact assessments and capability review) are also broken. The external information asset register page has a 
"last updated" date of 5th October 2009.9 The assessment team recognises that 
improvement work is in progress, which is positive. If Defra were to expedite the process, this would support openness and transparency. 
                                            

## Compliance Staff Responsibilities And Delegations

5.48 Defra has networks of power users for SharePoint 2007, local information 
managers (LIMs) and information management representatives (IMRs). Very few of the interviewees reported that they had been offered advice or good practice guidance to support information management. Many were aware that there was some form of support available within the team, however this was 
often assumed to be IT support, reflecting the low awareness of information management roles within Defra. These roles are important in promoting KIRM guidance and best practice, and monitoring local compliance. Defra needs to consider how well it is utilising its current network, and ensure that staff have the right training and resources available to help drive good information 
management in Defra. **See recommendations 8 and 11.** 

## Government Protective Marking Scheme (Gpms)

5.49 Interviewees demonstrated inconsistent application and understanding of the 
GPMS. For example, two interviewees used the blanket term "confidential" 
when describing information that should be "protect" or "restrict". Another 
interviewee had received "commercial in confidence" information, but could not specify the GPMS equivalent. The information had subsequently been 
transferred to a shared drive without any protective marking applied. This leaves Defra exposed to risks that information will be inappropriately disclosed or shared, or that it is given too high a protective marking which restricts the ability to legitimately share information. Defra needs to improve staff 
understanding of information risk and monitor compliance locally. See recommendations 8 and 11. 

## Policies And Guidance

5.50 Interviewees were often unaware of the availability of guidance, or did not know 
where to access it from. Some good quality guidance documents are easily 
accessible from the intranet. However, a lack of awareness is reflected in the fact that compliance with them is low. This is, for example, notable through the continued use of Vault for evidential emails, despite KIRM policy. Generally, only a very small proportion of the interviewees had proactively sought advice and guidance from the KIRM team. 
5.51 After understanding and defining its information requirements, Defra should 
ensure that its policies and guidance meet the needs of the organisation - and mandate and monitor compliance throughout the organisation. This needs to be 
supported and championed by senior management. See recommendations 8 and 9. 
 

## Training

5.52 The corporate induction to Defra is the online e-learning package. Completion 
of this is not enforced, with a number of interviewees unclear as to whether Defra has any corporate induction. Many interviewees did not feel that they had been given an adequate introduction to their information management roles and responsibilities, but where training has been offered, this has been well received. For example, the email ways of working course was reportedly 
attended by approximately 300 people. This is understood to have contained practical information management advice and was considered beneficial by a 
number of interviewees. Defra should seek to identify further cross 
departmental training needs using the results of the information audit programme. All staff should receive a corporate induction and access to refresher courses. See recommendation 11. 

## Culture Commitment

5.53 Defra"s requirements for using its information need to inform the way business 
areas work. A unified technological solution will not in itself resolve these issues; there needs to be a simultaneous drive to increase staff understanding of their roles and responsibilities. Managers have an important role here to drive change and monitor progress. 
 
5.54 The assessment team found different ways of working and different 
approaches to information management throughout Defra. The naming of files and folders varies considerably according to the business area, as does the structure of the corporate repository. This inconsistency affects the ability of information to be shared and managed. 
5.55 Defra needs to re-affirm its commitment to developing its technical 
infrastructure to meet its requirements for its information and records, starting by developing and embedding a KIM strategy for Core Defra and putting a plan 
in place to raise capability. This should be outlined in the KIM strategy specified in recommendation 2. 

## Knowledge Management/Transfer

5.56 The structure of the organisation makes it difficult to locate individuals (such as 
owners of information or those who have previously worked in programmes or on projects). A lack of effective information management capability across Defra is also putting the capture and maintenance of records at risk, impacting on corporate memory and the ability to share knowledge and information. 
5.57 The ability of staff to share information is inhibited by the use of different 
systems, with one interviewee describing as "bothersome" the process of sharing information stored in SharePoint with those using other systems. Interviewees frequently described finding workarounds, such as sending documents rather than links (creating issues around version control, 
proliferation of storage). Another interviewee felt that the PPM structure had affected the ability for knowledge to be disseminated, as previously "we used to find out [what we needed to know] by osmosis". If Defra is to function effectively and be able to share its knowledge, it first needs to ensure it is managing and safeguarding its information. 

## Appendix One: Glossary

| ASD                                                    | Accredited Shared Drive                             |
|--------------------------------------------------------|-----------------------------------------------------|
| CIW                                                    | Corporate Information Workspace                     |
| DPA                                                    | Data Protection Act                                 |
| DROID (tool)                                           | Digital Record Object IDentification                |
| EDRMS                                                  | Electronic Document Records Management System       |
| EIS                                                    | Evidence Investment Strategy                        |
| FOI                                                    | Freedom of Information                              |
| GPMS                                                   | Government Protective Marking Scheme                |
| IA                                                     | Information Assurance                               |
| IAO                                                    | Information Asset Owner                             |
| IM                                                     | Information Management                              |
| IMA                                                    | Information Management Assessment                   |
| IMR                                                    | Information Management Representative               |
| IT                                                     | Information Technology                              |
| KIM                                                    | Knowledge and Information Management                |
| KIRM                                                   | Knowledge Information and Records Management (Team) |
| LIM                                                    | Local Information Manager                           |
| Section 46                                             |                                                     |
| L                                                      |                                                     |
| ord Chancellor"s Code of Practice on the management of |                                                     |
| records issued under section 46 of the Freedom of      |                                                     |
| Information Act 2000                                   |                                                     |
| SIRO    | Senior Information Risk Owner                 |
|---------|-----------------------------------------------|
| SLIM    | Specific, Logical, Informative and Meaningful |
| SRO     | Senior Responsible Owner                      |
| WTK     | What to Keep                                  |

## Appendix Two: The Assessment Team

 
The assessment was conducted by members of the Standards Department and specialist colleagues from The National Archives between 4th and 12th July 2011. The assessment team comprised: 

 
 
Standards and Information Policy Manager 
 
Standards and Assessment Manager 
 
Head of Standards 
 
Standards Adviser 
 
Lead Information Management Consultant 
 
Digital Preservation Advice Service Manager 
 
IT Service Delivery Manager 
 
CEO (observer) 
 
Director of Information Policy and Services (observer) 
 
Information Management Consultant (observer) 

## Assistance Provided By Defra:

The Assessment team are grateful for the cooperation and assistance of all staff at Defra who were interviewed, provided additional information or facilitated the assessment process. Our particular thanks are extended to Mike Kaye, Kate Pritchard and the KIRM team for their organisation and hospitality. 


## Appendix Three: Statement Of Commitment