# Information Management Assessment November 2008

| PART ONE: EXECUTIVE SUMMARY                               |   2 |
|-----------------------------------------------------------|-----|
|                                                           |     |
| PART TWO: INTRODUCTION                                    |   7 |
|                                                           |     |
| PART THREE: ACTIVITIES CARRIED OUT BY THE ASSESSMENT TEAM |  11 |
|                                                           |     |
| PART FOUR: HIGHLIGHTS AND AREAS FOR IMPROVEMENT           |  15 |
|                                                           |     |
| APPENDIX ONE: SUMMARY OF RECOMMENDED ACTIONS              |  35 |
|                                                           |     |
| APPENDIX TWO:  IMA COMMITMENT                             |  38 |
|                                                           |     |
| APPENDIX THREE:  GLOSSARY                                 |  39 |
|                                                           |     |

 November 2008 © Crown copyright 2008 

## Part One: Executive Summary

1. The Department for International Development (DFID) is managing its 
knowledge and information well. It has clear leadership from the top, and has put considerable effort into embedding knowledge and information management into the culture of the department. Indeed, DFID has the potential to be an exemplar across government in the field of knowledge and information management.   
 
2. DFID has embraced the challenges of information management and 
has taken real strides to ensure that its information is well managed. In recent years, the department has driven forward significant changes across the organisation to make staff aware of their information management responsibilities and has put in place processes to help embed the cultural shift.  These changes have been viewed positively by staff and have enabled DFID to move towards the electronic working environment.  
 
3. DFID has published an Information Charter1. This is one example that 
highlights the Permanent Secretary"s commitment to the principles of 
good information management. Information management, risk and 
assurance has also been recognised at senior level2, and DFID is one 
of the few government departments to have fully implemented an electronic document and record management (EDRM) system.  
 
4. DFID has invested in specialists within the Knowledge and Information 
Management Team to support and manage information, most notably within the Information Management Unit (IMU). This team provides excellent support for staff across DFID, with the support of Information Managers across the department. DFID is also making use of IT systems to communicate, collaborate and share information effectively.  
5. As with other departments, there is still room for improvement in DFID. 
Information 
management 
at 
the 
middle 
management 
tier 
is 
inconsistent, with some managers choosing to delegate responsibility for some information management tasks. To ensure organisational success, middle managers need to be fully informed and engaged with information management on a daily basis. Management of information risk needs to be at a level in the organisation where there is day-to-day accountability and it is considered "business as usual." Although the 
initial training programmes for information management systems are well implemented, DFID needs to address ongoing training to maximise use and reinforce the required behaviours.  
6. DFID"s commitment to the IMA process is recognition that it places real 
value on its information. This assessment represents a risk-based approach to information assurance. There are only a small number of areas that DFID needs to address to improve all round performance in order to be recognised as a good performer across the board. The issues highlighted in this report and the recommendations made would 
take current performance from "good" to "great". We would encourage 
DFID to implement these recommendations, with the support of The National Archives, in order to build on the strong capability already 
demonstrated.  
 

## Risk Matrix

Governance and Leadership 
Strategic management  
Best Practice 
 
Business objectives  
Good 
 
Management controls  
Best Practice 
 
Resourcing   
Satisfactory 
 
Risk management  
Good 
 
Records Management 
Creation   
Best Practice 
 
Storage   
Good 
 
Appraisal, disposal and transfer  
Development needed 
 
Sustainability of digital records  
Satisfactory 
 
Management   
Good 
 
Access 
FOI/Data Protection  
Best Practice 
 
Re-Use   
Best Practice 
 
Security   
Best Practice 
 
Compliance 
Staff responsibilities and delegations  
Good 
 
Policies and guidance  
Best Practice 
 
| Training             | Satisfactory    |
|----------------------|-----------------|
|                      |                 |
| Change management    | Good            |
|                      |                 |
| Culture              |                 |
| Commitment           | Best Practice   |
|                      |                 |
| Staff understanding  | Best Practice   |
|                      |                 |
| Knowledge Management | Satisfactory    |
|                      |                 |
|                      |                 |

## Key To Colour Coding

Conclusion: DFID has made substantial progress in managing its information. The department has the potential to be an exemplar in the field of knowledge and information management.  The recommendations made in this report will help DFID reach its potential. The National Archives will continue to provide support in meeting these recommendations. DFID, as a high achieving organisation, will be reassessed in four years.

## Part Two: Introduction Information Management Assessments

7. The Information Management Assessment (IMA) programme is the 
best practice model for government departments wishing to demonstrate a high level of commitment to managing their information. The assessment process ensures that government departments meet the required standards for effective collection, storage, access, use and disposal of information. The IMA programme: 
 enables the Head of Profession for Knowledge and Information 
Management (KIM) to assess the effectiveness of the function in departments; 
 sets out the capability of departments to meet their KIM 
challenges and obligations; 
 assures the accounting officer that departments are equipped to 
deliver their information management responsibilities; and 
 helps 
Accounting 
Officers 
plan 
for 
future 
information 
management developments. 
8. The National Archives leads information management across 
government. The IMA Programme is a key element of that function. 
The programme"s goal is to deliver measurable improvements in 
information management across government by providing robust, independent validation of the standards and integrity of the information management processes and capability within departments. 
9. The IMA Programme is aimed at core government departments. To be 
admitted to the Information Management Assessment programme, an organisation will:  
 make a public commitment to the IMA programme; and  see the commitment successfully independently verified. 
10. 
Once a Permanent Secretary or Chief Executive has declared the commitment, the underlying administrative and decision-making processes of the organisation are examined to verify that they support the IMA commitment.  
11. 
This report sets out the findings, conclusions and recommendations of 
The National Archives" IMA Assessment of the Department for 
International Development (DFID). 

## The Business Of The Department For International Development (Dfid)

12. 
The Department for International Development (DFID) is the part of the UK Government that manages Britain's aid to developing countries and works to get rid of extreme poverty. It was created in 1997 to replace the Overseas Development Administration (ODA). 
 
13. 
DFID has two headquarters, one in London and one in East Kilbride, near Glasgow. There are currently sixty-four offices located overseas and DFID employs over 2500 staff, almost half of whom work abroad. There are four main areas each reporting to a Director-General: 
 Corporate Performance  Country Programmes  Policy and Research  International The Business Solutions Directorate is part of the Corporate Performance area and includes the central Knowledge and Information Management Team. 
14. 
DFID works in over 150 countries worldwide, with a budget assessed at 
£4.6 billion in 2006. Such a large programme requires DFID to be structured in a manner to ensure delivery of a complex and comprehensive programme budget. 
 
15. 
More recently the organisation has been subject to a refocus of its main priorities and has, in line with many other government departments, undergone some restructuring. Coupled with restrictions on the general adminstration budget, this has resulted in an emphasis on increasing the budget availability for international development.   
 
16. 
It seems natural, therefore, that a substantial amount of the service delivery is external to DFID through partnership with international organisations, charities and governments. The DFID organisational structure reflects the project and programme style required to manage 
and monitor the activities delivering aid and supporting nations overseas. 

17. 
At the time of the assessment, DFID is in major transition under its "Making it Happen" Programme to make it fit for the future.  The transformation will ensure that the organisation is ready to meet its objectives in helping poorer nations to be supported with the expertise, knowledge and systems they require. 
 
18. 
The Department for International Development business objectives  
 
DFID"s work forms part of a global promise to: 

 halve the number of people living in extreme poverty and 
hunger;  
 ensure that all children receive primary education;  promote sexual equality and give women a stronger 
voice;  
 reduce child death rates;  improve the health of mothers;  combat HIV & AIDS, malaria and other diseases;  make sure the environment is protected;  build a global partnership for those working in 
development.  
Together, these form the United Nations" 
eight 
"Millennium Development Goals", with a 2015 deadline. Each of these Goals has its own, measurable, targets. 

## Information Management At The Department For International Development (Dfid)

19. 
DFID creates, uses and stores a wealth of information that, like any other major organisation, is core to its operation. This includes information such as personnel records, financial records, estate management and performance information. 
 
20. 
DFID is different  to most other government departments, in that half its staff are based in overseas offices and many are recruited locally. This, 
in itself, puts pressure on the organisation to manage its knowledge and information systems effectively, encompassing local ways of working, but preserving the DFID corporate identity. It naturally follows that, as DFID has a substantial budget for the development of poor nations, its systems and processes to manage and monitor this activity are crucial to the organisation.  

 
21. 
The Knowledge and Information Management (KIM) Team, led by the Head of Knowledge and Information Management, are situated within the Business Solutions Division and work across DFID to address 
business information needs, develop knowledge and information systems and processes, and provide advice and support. 
 
22. 
The team is divided into three branches: 
 
 Openness Unit - responsible for handling Freedom of 
Information requests, Data Protection compliance and providing the central "Public Enquiry Point"; 
 Web Team - responsible for maintaining and developing the 
DFID public website and the staff intranet (Insight) working with Communications Division; 
 Information Management Unit (IMU) - responsible for records 
management and document management. 
 
23. 
The KIM team are also currently responsible for two projects: 
 
 Web 
Transformation 
Project 
Team 
- 
responsible 
for 
redevelopment of the DFID public website. Project completion date due March 2009; 
 Knowledge and Information Management Programme - a £4.5m 
Programme over the period to 2010 aimed at increasing DFID"s efficiency and effectiveness through better Knowledge and Information Management. 
 
24. 
DFID are in the process of developing a Knowledge and Information Strategy. This strategy will underpin corporate activities to ensure that knowledge, information and expertise within the organisation are preserved, developed and utilised for the future. 

## Part Three: Activities Carried Out By The Assessment Team Methodology

25. 
The underlying purpose of the assessment is to establish whether the 
key elements of DFID"s commitment to the IMA programme and their 
own Information Management (IM) priorities are achieved. A range of standard processes, systems and documentation were examined to determine if this was the case. This approach was based on a matrix 
model, as shown below, which takes essential business outcomes, and shows how work in each of the areas of activity demonstrates compliance. 
26. 
DFID is divided into a number of key business areas, relating to how the organisation is managed, governed, its vision and key business objectives, especially pertaining to information management. Key services across the range of DFID business groups were assessed into areas of assessment focus. The key business areas were considered according to a risk assessment carried out prior to the onsite visit. This was based on: 
 the findings of the pre-assessment questionnaire;  previously identified strategic risks; and,  information management or skills issues raised by DFID 
themselves.  
The key business areas, and the areas of assessment focus, fall under the following headings: 

| Business Area                     | Assessment Focus                             |
|-----------------------------------|----------------------------------------------|
| Governance                        | Strategic direction, business objectives and |
| performance indicators            |                                              |
| Management controls               |                                              |
| Capability                        |                                              |
| Risk management                   |                                              |
| Data Handling Processes           |                                              |
| Records Management                | Creation,                                    |
| transfer,                         | security,                                    |
|                                   |                                              |
| sustainability of digital records |                                              |
| Access                            | Access to and re-use of government           |
information Websites and equivalents 
Compliance 
Staff responsibilities and delegations Policies and guidance Intranet 
Skills/Training Effects of changes in government policy or legislation 
Culture 
The commitment to effective information management Staff 
understanding 
of 
information 
management risks 
Application of Policies and Guidance Knowledge Management 

## Activities Undertaken

The Assessment Team: 

 examined key policy and practice documentation relating to 
training, skills and processes; 
 interviewed staff members from across the organisation;  tested the processes used; and  reviewed the website and intranet. 
 
These activities are described in more detail below. 

 

## Documentation Review

27. 
DFID provided documentation in support of their information 
management objectives and the IMA commitment, which was reviewed prior to the on-site assessment. 

## People And Practices

28. 
The Assessment Team interviewed a range of staff, in the UK and overseas, at all levels, who are involved in policymaking, interpretation and the practice of managing information. These interviews were used to determine how people in the organisation work and the impact of information management on them.  

## Process Testing

29. 
A sample review of the day-to-day business processes was used to identify possible procedural gaps. This included electronic records 
management systems, retention schedules and general guidance and working instructions. 

## Intranet Review

30. 
A review of DFID"s Intranet was carried out to assess ease of use, 
utility of the information contained on it and to determine how up to date it was. 

## Website Review

31. 
A review of the organisation"s website was conducted to establish the 
transparency of information relating to Freedom of Information, Data Protection, contact details and complaints procedures.  

## Risk Assessment

32. 
The 
department"s 
risk 
framework 
and 
associated 
information 
statements and policies were assessed to ensure information, knowledge and records management compliance.  

## Data Handling

33. 
 The department"s data handling was reviewed in a limited context or 
"light touch" within the IMA process and only where there is an 
immediate effect on the process being reviewed.  

## The Assessment Team

34. 
 Each IMA is carried out by the Standards Team within The National Archives, with a team of external reviewers assembled to meet the requirements identified in the pre-assessment planning. The team comprised: 
 Standards and Assessment Manager  Head of Standards  Information Management Consultant  Standards Adviser 
 

## Assistance Provided By The Department For International Development

 35. 
The Assessment Team are grateful for the co-operation and assistance 
of all staff within the Department for International Development, and especially the Knowledge and Information Team in the Business Solutions Division for helping to facilitate the visit. 

## Part Four: Highlights And Areas For Improvement Governance And Leadership "I Will Provide Effective Leadership On Knowledge And Information Management Capability Across My Department."

36. 
The Assessment Team recognise that DFID is in transition towards, aligning its structure to deliver more efficiently and effectively the 
department"s priorities. 
 
37. 
There was recognition from interviewees that information was seen as an important asset within DFID. Recent changes in structure, with information management being given a higher profile, supported this view. 
 
38. 
DFID are in the process of developing a Knowledge and Information Strategy and have already delivered an IT Strategy. These initiatives are important to ensure that information is managed effectively.  DFID"s KIM Team have completed the early stages of researching what information management means to the department and are at the 
"visioning" stage of the Knowledge and Information (KIM) Strategy. In 
addition, DFID has a comprehensive Information Technology Strategy for the whole organisation. This includes the introduction of IT based 
information and financial management systems, such as Aries, to facilitate more efficient and coordinated financial working practices across the organisation.   
 
39. 
Information assurance and data security are widely understood within DFID and are supported by senior management. For instance, the Director of Business Solutions, in his role as the Senior Information Risk Owner (SIRO), is responsible for developing and implementing policy for managing information risk. The Assessment Team noted that DFID has obtained external accreditation under BS ISO27001 in April 2008 for their information assurance and data security protocols. 
 
40. 
DFID has a high-level risk management structure in place, with clear senior management responsibility for business areas at risk in DFID.  
However, most interviewees saw information risk and the ownership of the risks as the preserve of the senior management team.  Information risk, outside data handling, does currently feature on DFID"s corporate risk register and was among the top tier risks monitored by the management board when it was judged higher than at present. DFID should continue to monitor information risk and if necessary raise it to the top tier of risks if circumstances require this.  

41. 
Although senior management support for information management is to be commended, there was little evidence to suggest that good 
information management practice, as a business objective, was embraced below the senior management level.  Business areas, which have a direct responsibility for information management, do have a departmental information management objective, but other business areas do not.  This may act as an inhibitor to achieving the aims of 
DFID"s Knowledge and Information Strategy through embedding 
information management into the business. For DFID to be successful and achieve its information management objectives it will need to ensure that all members of staff have an understanding of information management and what it means to DFID.  

## Recommendation 1: Dfid To Review How Knowledge And Information Management Principles Are Disseminated To All Staff Across The Organisation.

42. 
DFID should also recognise that the lack of middle management  "buyin" may also adversely affect other areas of the organisation where 
management has to lead by example.  The lack of accountability or the distance between corporate objectives and management accountability is a risk for DFID, especially when placed in context of the capital investment in new information systems such as Aries, and previously, Quest. The Assessment Team understands that the information management was part of the core competency framework. However, it was removed following a review. Although an information management competency may not suit all areas of the business, the potential risk to DFID is that without the wider coverage of a competency based on information management; the required changes in management behaviour may not develop in line with business needs.  

## Recommendation 2: Dfid To Assess The Need For An Information Management Based Competency For Managers. Records Management

"I will ensure that our information is appropriately captured, described, managed and preserved and that the risks are controlled."   

 
43. 
DFID creates information and records across a variety of systems, from EDRM to web based services.  The Assessment Team believe that DFID is working hard to consolidate its approach to information and records management across the organisation. One of the greatest challenges DFID faces is to successfully achieve the integration of the separate business processes and systems, encourage collaborative working, and the sharing and preservation of key information and records without loss or risk to essential information. 

## Paper Records

44. 
DFID holds paper records in offsite repositories with TNT, owns one offsite storage facility in East Kilbride and an area in the basement of Abercrombie House for the storage of semi-current records. Paper records in the overseas offices are returned to the UK when an office closes.  

## Electronic Records Management

45. 
The Quest EDRMS is the official system for storing core documents and records with a corporate value. Where appropriate, all other operational systems which use information and records should be linked to the EDRMS.  The Assessment Team notes that the EDRMS is as yet not compatible with other formats, for instance spreadsheets containing links and databases. DFID is aware of these limitations. 
46. 
Although there has been an EDRM system in DFID since 2005, there is evidence that some staff still continue to use their personal areas on the hard-drive of their laptops or PCs to store not only personal correspondence but also some   information with a business critical value. This is contrary to current DFID information and records 
guidance, which states that corporate information should be stored on Quest. There is a potential risk that business critical information may be lost. 

 
47. 
The Assessment Team also found that some staff interviewed were 
unaware that they had a private "home" area on the EDRM system 
specifically for holding the personal and draft documents. 

## Recommendation 3: Dfid To Re-Emphasise To Staff That They Should Not Use C: Drives For Storage Of Documents That Have Business Value. Recommendation 4: Ensure That Staff Are Aware Of The "Home" Area On Quest And The Policies Relating To Its Use.

48. 
The Quest corporate file plan was initially a functional structure, based on traditional filing conventions as opposed to an organisational structure. However, this deterred staff from using the system as they were unsure where to save or retrieve documents.  To its credit, DFID has reviewed the file plan, which is now re-structured to retain the functional structure across the top three layers, and has then been developed along organisational lines in the sub levels. However, user problems 
are 
still 
continuing 
and 
DFID 
is 
taking 
forward 
recommendations from an external consultant"s report to improve the file plan in 2009. 
 

## Annual Review Programme

49. 
DFID has for some years carried out an Annual Review Programme for non-digital records under the supervision of The National Archives, and this is currently on target to maintain DFID"s compliance under current legislation. The implementation of digital working and the Freedom of Information Act (FOIA) has led to a reallocation of resources due to priority changes within the IMU. DFID are still managing to meet their annual review and transfer responsibilities.   
 
50. 
Following this reallocation, there could be future implications relating to the essential sensitivity checks on documents and records when establishing access requirements for selected records. Additionally, if there was any reduction in the point of transfer under the 30 Year 
Review, DFID may struggle to respond to any legislative changes. DFID has current Retention Schedules for existing and semi-current paper records. 

51. 
Consideration should be given to the potential impact and associated risks of only having one Reviewer in the organisation. The Assessment Team could find no evidence of succession planning if the current post holder is unable to carry out their duties for whatever reason.  

## Recommendation 5: Dfid Should Ensure That They Have Sufficient Capability And Capacity To Maintain Their Reviewing Function, Both Now And In The Future. Retention Schedules

52. 
Although there are retention schedules for paper records, there are no such schedules in place for DFID"s digital information and records. As DFID is moving towards a fully electronic environment, this needs to be addressed as a priority. The Assessment Team were informed that there are currently approximately two million documents on Quest, and this figure will continue to grow. Implementing a retrospective retention schedule will become more problematic as the numbers of documents on the system increases. 53. 
The National Archives is currently developing clear guidance and toolkits such as, the "What to Keep" project. This project aims to 
support Departments in the creation of a framework for what to create and capture, to ensure that information of corporate value is systematically captured. Retention periods will then be set against each category of information. If DFID adopt this approach, it could offer some potential ways of approaching the issue of which electronic information to keep, and for how long. 

## Recommendation 6: Dfid To Review The Retention Policy To Incorporate Digital Records. Transfer

54. 
There have been delays in transferring selected records to The National Archives owing to DFID staff resourcing issues. However, 
DFID has employed a temporary member of staff to carry out the preparation work prior to transfer and this should temporarily resolve the current problem. If the 30 Year Rule is reduced, DFID will obviously need to consider its capability. 

## Recommendation 7: Dfid To Review Its Capability In Meeting Transfer Targets With The Aim Of Being Able To Consistently Meet The 30 Year Transfer Requirement Of The Public Records Act.

55. 
The Department has an established and robust information security 
protocol. The Information Management Security Group meets every six 
weeks and is chaired by the SIRO. DFID"s Internal Audit Department 
were involved in assessing DFID"s systems for data handling after the HMRC incident. The Information Systems Department (ISD) and Security Department have an on-going responsibility for ensuring appropriate standards are met, under the oversight of the Information Management Security Group, chaired by the SIRO. In addition, DFID has received accreditation under ISO27001 on Information Security Management. 

## Security

56. 
Whilst many security issues have been addressed, there is still need for reconciliation between working practices and data security with regard to management of Restricted and personal information held on QUEST. There is a degree of delegation to Information Managers 
within business areas on the management of information and records across the various systems. Although some quality assurance checks have been completed, more checks are needed to ensure best practice across the whole organisation. 

## Recommendation 8: Dfid To Establish And Maintain A Programme Of Quality Assurance Checks For Data Security.

57. 
It was felt by some Senior Managers that not all staff are sufficiently 
aware of what documents should be categorised as "Restricted" under 
the security classification system.  There is a concern that this could lead to sensitive documents lacking the necessary security protection when held on Quest.  There was also anecdotal evidence that staff had 
found restricted material in the general file plan outwith restricted folders, and that they had taken steps to ensure that the relevant managers were made aware and that the files were moved immediately. 

## Recommendation 9: Dfid To Re-Emphasise Its Policy Regarding The Classification Scheme To All Staff, And Back Up With Appropriate Checks And Audit.

58. 
The general understanding was that in the overseas offices there would 
be at least one member of staff with sufficient security clearance to be 
able to view "restricted" files. The Assessment Team were advised that 
on several occasions in smaller offices there has been no staff member with suitable clearance to give access to "restricted" files when needed. 
It is the Assessment Team"s understanding that locally recruited staff 
are not security cleared to this level.  DFID does provide UK based IT staff with sufficient security clearance but this is not a 24-hour service. 
59. 
In line with the DFID Security protocols, all laptops have been encrypted, but this is not the case for USB drives.  Despite the availability of encrypted USB drives, some staff still choose to use unencrypted USB drives. The Assessment Team understand that with the constant global movement of staff between DFID"s offices, there is a potential risk to loss of data. 

## Recommendation 10: Dfid To Consider Making The Use Of Encrypted Usb Drives Mandatory For All Staff.

60. 
The Assessment Team has subsequently been informed that DFID are in the process of making the use of encrypted USB drives mandatory. 

## Email

61. 
DFID has an established email policy applicable to all staff.  It includes the restriction that all emails older that 90 days are automatically deleted from inboxes. This acts as an incentive for staff to review the content of their messages and store those with business value in a timely manner. For the majority of staff, this is effective in ensuring that mailboxes are kept to a manageable limit and that required business 
information is stored on Quest. 

62. 
However, there were instances when interviewees acknowledged that 
they have emailed themselves the information from their inbox again to circumvent the automatic deletion deadline. This poses a risk to DFID that business relevant emails are not being highlighted and filed correctly. 

## Recommendation 11: Dfid To Re-Emphasise The Email Policy And Guidance. Msn Instant Messenger

63. 
DFID has the facility to use instant messaging. By its very nature it is used in an ad hoc and informal way to communicate.  DFID has recognised that there was a potential risk that a business decision may be made in the course of the conversation and not be recorded or followed up. 
64. 
The Assessment Team was made aware that guidance has recently been issued on not using the Messenger for important decisionmaking. The Assessment Team was not able to test the effectiveness 
of the guidance due to time constraints. The "what to keep" programme 
referred to in paragraph 50 should, if DFID decide to work on this approach, support staff in identifying where information needs to be retained, regardless of format. 

## Access

"I will promote access to and re-use of our information, and protect personal and other sensitive information." 

65. 
DFID has a good understanding of copyright issues and has developed a process to ensure that there is awareness of copyright throughout the Department. For example, there are clear statements of ownership of copyrighted material saved to Quest via the use of prompts and a drop 
down menu.  In cases where copyright is not known, the system flags up that the issue is outstanding and that within 90 days the Business Information Specialist, who sits within the KIM team, ensures that outstanding issues are followed up and resolved.   
 
66. 
The options available on the EDRM system are "DFID copyright owned", "Other Government Department owned" (both Crown 
copyright), "Third Party copyright (permission granted)" and "Third Party copyright (seeking permission)." There was evidence to suggest 
that rather than identify material as third party, which would signal that some clearance was required, that some DFID staff categorised the 
information as "DFID copyright owned" in order to avoid the process of 
seeking third party clearance.  This could result in necessary clearance being bypassed or overlooked. This could potentially lead to a risk that DFID may inadvertently re-use third party material without permission 
and could be in breach of copyright laws.  
 
Recommendation 12: DFID should assess the risk resulting from 

## Copyright Ownership Being Incorrectly Identified.

67. 
Freedom of Information (FOI) and Data Protection (DP) processes are 
demonstrated in DFID to be both robust and effective, with a dedicated 
and resourced team of officers who are the "expert" hub for the 
organisation. A recent development for DFID is the separation of FOI and Data Protection responsibilities in recognition that DFID faces specific and heightened risks in relation to personal information.  
 
68. 
The level of accountability for FOI and DP within the department is clear. The Assessment Team were pleased to note that all FOI and 
Data Protection responses are signed off at senior management level. This is invaluable in ensuring that DFID meets the statutory response times and assures the quality and the consistency of the responses.  

 
69. 
The quantity of FOI requests received by DFID is steadily increasing. The latest statistics available are April to June 2008 when DFID handled 101 FOI requests. In comparison, during July to Sept 2007 DFID processed a total of 47. For the whole year (July 2007 to July 2008) DFID had a total of 268 FOI requests.  We would suggest that DFID review its current arrangements to ensure that they can cope with 
these additional requests. At present the Business Solutions Division"s 
management structure is such that there is only one senior manager able to give final approval to FOI responses. This may pose a potential risk to the organisation if, due to unforeseen events, there is no one available to sanction FOI requests which would mean that FOI statutory response times are not met. 
 
70. 
Recognising that it needs to review the current arrangements, DFID are to instigate a pilot within Human Resources to delegate responsibility for responding to HR related FOI requests to the HR Director or Deputy Director. The Assessment Team views this as a positive step. 
 
71. 
As an international organisation, the ease of which external users or potential partners have access to information on DFID was assessed in a website review. 72. 
The review found the DFID website is, on the whole, quite easy to use. There is an up to date news section on the home page as well as a brief description of what DFID does and how and why it does it. The search engine is good at finding information and is based on Google
 
technologies. A help section, FAQs and contact us are all easily available and not difficult to access. 
73. 
As a Crown body, the Office of Public Sector Information (part of The National Archives) handles any requests for re-use of DFID information. 
 

## Compliance

"I will make sure that our internal processes support effective information management." 

74. 
In General, DFID has good information management processes and controls in place, but the application of these controls is not always consistent or comprehensive. DFID has demonstrated that there is good awareness of Knowledge and Information Management within the 
organisation. 
 
75. 
All staff receive information and records management training, which includes the principles of best practice on how to create, save, manage and protect the information and records they produce. The Assessment Team commend the work of the KIM Team in their approach to the rollout of new systems and in the introduction of a user group run by Information Systems Department. All those interviewed agreed that the profile of information management and the sharing of information had improved across the organisation in recent years. 
 
76. 
There is a considerable amount of guidance available on the intranet on how staff should create, capture and manage their information.  
Some staff felt that there was too much, or that it should be "honed" to 
key points. Others considered that it lacked strong messages about the 
disciplines and personal responsibilities attached to working in an electronic environment. 

## Insight

77. 
The majority of DFID"s corporate news, guidance, policy and procedures are placed on their intranet site, Insight. The organisation is heavily reliant on the use of Insight to ensure that all staff are made aware of the issues affecting the department. Within Insight there is the Spotlight feature on the front page which is updated daily and directs staff to news, major changes in guidance and project updates. 
 
78. 
Insight also contains the Connect Directory, holding the details of all staff in DFID. The Connect directory system plays a key role in keeping DFID in touch with staff movements and the extensive restructuring 
programme that has been ongoing for much of 2008.  HR is responsible for updating and putting initial staff details on the system. Permanent staff are subsequently able to update their own contact details for a limited number of fields to include interests and biographies.  Agency and contract staff are unable to update their details on Connect, and in these cases it is imperative that the HR systems are able to keep the directory updated regularly. 

 
79. 
It was reported that outdated information on teams and staff changes had impacted on front line service delivery. For example, one new 
DFID team waited four months before either the team structure or contact details were updated and available on Insight, despite requests to update the information.   

## Recommendation 13: Dfid To Set Mandatory Time Limits For The Updating Of Information On The Connect Directory.

80. 
Insight also contains DFID"s comprehensive set of guidance, policy and 
procedures held within their "Blue Book". This guidance is available to 
all DFID staff via their Intranet site, wherever they are in the world. The Blue Book was referenced by all interviewees as where they would look for guidance. 81. 
The Assessment Team were able to view new information and guidance on using Aries, as it is currently in the middle of the roll out 
phase to the business. However, it was noted that other essential guidance elsewhere was out of date, for example the Records Management Policy.  The Records Management policy has not been updated since 2005 and it does not take account of retention needs for electronic documents. It is necessary that this is reviewed periodically to ensure that it remains fit for purpose and encompasses any recent changes in government information management policy. It should also be used to map changes in work processes, especially with regard to using electronic document and financial management systems. 

## Recommendation 14: Dfid To Update The Record Management Policy And Guidance To Take Account Of The Management Of Electronic Documents.

82. 
The Blue Book guidance, although considered essential and useful, was viewed in some instances as multi-layered and over complex.  The 
volume of information that it contains makes it difficult for some staff to find information easily and inhibits the use of the guidance.  There was some evidence that if staff could not find information quickly they would either give up or ask a colleague for assistance.   
83. 
There were positive examples of business areas, offices and teams translating some of the Blue Book guidance into more localised 
procedures that better reflected the needs of their offices. Although there is a risk that such local guidance could lead to inconsistency of practice, there were examples that it made it easier for staff to understand and use in practice.  DFID Uganda is a positive example of what can be done to ensure that the corporate DFID message is translated into working local procedures. It would be a positive step for DFID to try and capture ideas and good practice.  

## Recommendation 15: Dfid To Establish A Good Practice Forum To Share Examples Within The Organisation.

84. 
The Freedom of Information and Data Protection information held on Insight is a duplicate of the material received from the Ministry of Justice. With the numbers of countries that DFID works in, and procedures unique to DFID, it may be useful to translate the guidance 
into "what FOI means to DFID". This would ensure that all staff are clear what their responsibilities are. 

## Recommendation 16: Dfid To Draw Up Foi And Dp Guidance Setting Out How The Legislation Is Handled Within Dfid. Information Managers

85. 
There is currently an Information Manager (IM) and Department Information Support Officer (DISO) in most business areas. The importance of these staff to the management of information throughout DFID was frequently stressed to the Assessment Team. DFID currently has a total of 77 in place across the organisation.  It is recognised by the Assessment Team that not all areas of DFID have an Information 
Manager; there is a real risk of Quest not being used effectively. 

## Recommendation 17: Dfid Should Take Steps To Ensure That Wherever Possible Information Managers Are In Place To Oversee The Effective Use Of Quest.

86. 
However, the roles of Information Managers (IMs) and Departmental Information Support Officers (DISOs) are not dedicated roles and the percentage of time allocated to information and records management varies between business areas, with the IM and DISO reporting to a 
business area line manager.  
 
87. 
The introduction of the IM role is a real success story for DFID. They are the front line of the information management agenda and have proved that once in place they are a valuable resource.  The Assessment Team found some IMs relished the role and made a valuable contribution to the organisation wherever they were located.   
 
88. 
The IMs have an annual IM forum where they meet to discuss issues. This is working well and was cited as best practice example within DFID. The IM is seen as the local Quest expert and in some cases they were seen as pivotal to how an office operates.   
 
89. 
The biggest concern voiced by IMs and others is that because only a percentage of an individual"s role is dedicated to information 
management it was sometimes considered a low priority.   The majority of the IMs are on administrative grades, so when they identified issues regarding the use of Quest they felt that they were not equipped or able to advise senior officers if they were using the system inappropriately.  
 
90. 
In some cases all the administration and personal filing into Quest was left to the IM, when clearly with the exception of a minority of cases, personal filing is the responsibility of the individual. This over reliance on one individual may have a negative effect in the long-term in an organisation that is restructuring and where staff are being relocated. 

## Recommendation 18: Dfid To Review The Role Of Information Manager To Ensure Consistency In Responsibility Across The Organisation. Edrms

91. 
DFID should be commended on its rollout of Quest. Only a limited 
number of government departments have a fully established and implemented comprehensive EDRM system. DFID monitors how the system is used through a series of information audits. This quarterly task is the responsibility of the local IM who reviews the number of documents saved to Quest, their sizes, types of documents and naming conventions applied. 
 
92. 
DFID has a comprehensive training programme as part of the project planning and roll out of information management systems.  The successful Quest EDRMS roll out in 2005 included a comprehensive training programme that involved a mix of direct training and cascade training to ensure that all offices had officers competent in the use of Quest.  The Information Management Unit (IMU) based in East Kilbride provides ongoing support to staff. 
 
93. 
All respondents praised the level of training that they received as part of the Quest implementation programme. Conversely however, there is no established programme of continuous and ongoing training for users to ensure that effective use is maintained.  New entrants to DFID do receive training on Quest, but there is a particular gap in the available training for staff who received initial training, but whose roles in the use of Quest had subsequently changed. In addition, respondents were 
concerned that as Quest is due for an upgrade in 2009 they might not be fully aware of changes that have been made to the system since initial training. 
 
94. 
As the EDRMS has now been in use for a number of years, there is potential for poor behaviours to have developed. Additionally, there is a risk that a lack of ongoing training may impact on the effectiveness of Quest. The Assessment Team found evidence of inconsistent titling of documents across business areas, which makes it difficult to search. It should be noted that DFID are currently developing a Google search facility, which should improve search capability. There is a risk that the issues highlighted may lead to staff using C: drives on local PCs and laptops. 

## Recommendation 19: Dfid To Review The Need For Ongoing Training For Quest And Other Related Systems. Edrms Implementation Overseas

95. 
Despite a successful Quest roll out in the UK, the roll out overseas has been problematic in some cases. Staff have experienced delays in the time taken to retrieve, save and download documents. The practical impact of this is that staff have devised alternative ways of working to compensate, such as saving to local shared drives.  The risk to DFID is 
that staff become reluctant to use Quest and documents do not get transferred over. DFID have recognised the limitations in the technology and are making efforts to resolve these issues with research into fibre optics and satellite use 

## Aries

96. 
Although a significant amount of investment has been made in the initial cascade training for the Aries financial system, no long-term resources have been allocated to ongoing training, once roll out is completed in 2009.  There were also concerns raised that the training 
received was designed around the "one size fits all" paradigm and was 
not tailored to the responsibilities of the individual user in relation to ARIES, for instance those inputting and authorising information.   
97. 
DFID has clear procedures in place for saving core programme and 
project documents in Quest. However, it was evident that some project and programme officers do not always follow the guidance and save the appropriate documents into QUEST. This is important to ensure that there is read across to the Aries system and to enable financial accountability and monitoring of the extensive programme and project budgets in place. 

## Recommendation 20: Dfid To Re-Emphasise The Importance Of Following Guidance And Of Saving Core Programme And Project Documents To Quest.

98. 
There are examples that staff, in order to expedite matters, agree to accept payment requests/progress reports in formats other than the 
 
DFID template. Reasons for the difference in documentation varied from local objectives to local pressures, for example a lack of staffing or time constraints.  These local agreements are clear breaches of DFID 
rules and basic accounting protocols. Where these are in place it will make it difficult to follow a clear audit trail, leaving the organisation open to challenge on application of its management controls. In addition, there is a range of non-standard documentation in Quest as a result of local agreements.  

## Recommendation 21: Dfid To Re-Emphasise The Use Of Correct Documentation And Guidance Notes In Order To Support Dfid'S Accountability Infrastructure. Recommendation 22: Dfid To Ensure That All The Key Programme Documents Are Stored In The Correct Location. Teamsite

99. 
Amongst the range of systems that are in use in DFID there are a number that support collaborative working. The main system is Teamsite, which allows all teams, or working groups, to have their own space on the Intranet to share team news, consult on documents and provide project updates. This is achieved by either uploading documents on to Teamsite or providing links to the documents held on Quest.  
 
100. 
Teamsite is a valuable resource for DFID, but the use of 
Teamsite is varied. In the areas where it was fully utilised, such as the Teamsite set up for the Information Managers, it was updated regularly and was a useful forum for keeping Information Managers aware of developments. 
 
101. 
The Assessment Team also found that some Teamsites were 
not updated and were not removed once they had past their usefulness, such as at the end of a project or after a reorganisation. There were also cases where documents were held indefinitely on Teamsite, and were neither deleted nor saved into Quest. 
 

## Recommendation 23: Dfid To Ensure Teamsite Is Reviewed Periodically And Obsolete Information Removed. Recommendation 24: Dfid To Review How They Ensure That Corporate Documents Are Systematically Migrated To Quest From Teamsite, Either Through An Automated System Or By Users. Foi Training

102. 
Although there is a dedicated resource for FOI and Data 
Protection queries, there can be a significant time lag of several 
months between staff starting their job and formal in-depth training on FOI legislation. A well-trained FOI/DP team is an imperative to ensure that FOI and DP requests are handled appropriately.  

## Recommendation 25: Dfid To Ensure That Foi/Dp Staff Receive In-Depth Foi/Dp Training Within 4 Weeks. Culture

"Information is recognised as the key asset for running the business of [organisation] and is used to support effective data and information sharing and knowledge creation." 

 
103. 
The culture of the management structure in an organisation 
dictates how an organisation values and uses its information. It was made clear to the Assessment Team that the profile of information management has been raised throughout the organisation in recent years. The Permanent Secretary Nemat (Minouche) Shafik and her predecessor Suma Chakrabarti have been closely associated with ensuring that DFID manage their knowledge and information effectively.   
 
104. 
The Assessment Team found examples of the strides DFID is 
taking in moving the information management agenda forward. For instance, the ISD user group allows users to voice concerns and raise issues of the systems that they use.   
105. 
DFID staff change roles on average every 2-3 years and this can 
lead to not only a loss of knowledge, but a disruption in working practices as staff move from one job to another.   
106. 
DFID is perhaps not making the best use of the intellectual 
knowledge and wealth of information that its staff have gained through either working overseas or within the United Kingdom. For instance, personal knowledge from staff leaving the organisation or have transferred 
from 
overseas 
offices 
is 
not 
routinely 
captured.  
Additionally, some staff felt that they were not re-inducted into DFID"s 
corporate processes, procedures and guidelines after returning from an overseas posting.  

## Recommendation 26: Hr To Establish Formal Handover Procedures To Capture Knowledge And Information For Internal Staff On Transfer Within Dfid.

107. 
The policy and guidance that is available to all staff via Insight is 
comprehensive. However, the proliferation of information may prove overwhelming to new users or those without a detailed knowledge of the subject.  Department reorganisations and staff transfers require the guidance to be updated regularly and reflect the corporate identity of DFID.  It is important that such changes are brought to the attention of relevant staff.  

## Recommendation 27: Dfid Should Ensure That Changes To Guidance Are Brought To The Attention Of Relevant Staff.

108. 
How middle managers perceive and act on their role in relation 
to information management is crucial in ensuring that information is well managed. DFID needs to ensure that middle managers understand the importance of knowledge and information management to the organisation. The Assessment Team found examples of processes and procedures that were inhibited at middle management level. For example, a few managers did not use Quest, but relied instead on departmental Information Managers to do their filing for them.    
109. 
Information management is the responsibility of all staff and it is 
vital that everyone within the organisation values the information.    
 
110. 
Management of Information risk needs to be set at a level where 
there is day to day accountability so that it becomes incorporated into 
"business as usual" and not seen as additional work.  Not identifying 
risks below senior management level may make it harder to enshrine good information management principles in DFID and will impact on the good work done so far in raising information management understanding and practice. 
 

## Appendix One: Summary Of Recommended Actions

This is a summary of the recommended action to: 

 remedy the weakness identified; and,  strengthen the commitment to the Information Management 
Assessment Programme. 
 
These recommendations, when agreed, will form an Action Plan that will be monitored. 

Business 
Ref 
Recommendation 
Area 
1 
DFID to review how Knowledge and Information Management principles are disseminated to all staff across the organisation. 
2 
DFID to assess the need for an information management based competency for managers. 
 
3 
DFID to re-emphasise to staff that they should not use C: drives for storage of documents that have business value. 
4 
Ensure that staff are aware of the "Home" area on Quest and the policies 
relating to its use. 
5 
DFID should ensure that they have sufficient capability and capacity to maintain their reviewing function, both now and in the future. 
6 
DFID to review the retention policy to incorporate digital records.   
7 
DFID to review its capability in meeting transfer targets with the aim of 
Records Management 
being able to consistently meet the 30 year transfer requirement of the Public Records Act. 
8 
DFID to establish and maintain a programme of Quality Assurance checks for data security. 
9 
DFID to re-emphasise its policy regarding the classification scheme to all staff, and back up with appropriate checks and audit. 

10 
DFID to consider making the use of encrypted USB drives mandatory for all staff. 
11 
DFID to re-emphasise the email policy and guidance. 
12 
DFID should assess the risk resulting from copyright ownership being incorrectly identified. 

## Access

13 
DFID to set mandatory time limits for the updating of information on the Connect directory. 
14 
DFID to update the Record Management Policy and guidance to take account of the management of electronic documents. 
15 
DFID to establish a good practice forum to share examples within the organisation. 
16 
DFID to draw up FOI and DP guidance setting out how the legislation is handled within DFID. 
17 
DFID should take steps to ensure that wherever possible Information Managers are in place to oversee the effective use of Quest. 
18 
DFID to review the role of Information Manager to ensure consistency in responsibility across the organisation. 
19 
DFID to review the need for ongoing training for Quest and other related 

Compliance 

systems. 
20 
DFID to list core programme and project documents and reissue guidance. 
21 
DFID to re-emphasise the use of correct documentation and guidance notes in order to support DFID"s accountability infrastructure. 
22 
DFID to ensure that all the key programme documents are stored in the correct location. 
23 
DFID to ensure Teamsite is reviewed periodically and obsolete information removed. 
24 
DFID to review how they ensure that corporate documents are systematically migrated to Quest from Teamsite, either through an automated system or by users. 
25 
DFID to ensure that FOI/DP staff receive in-depth FOI/DP training within 4 weeks. 
26 
HR to establish formal handover procedures to capture knowledge and information for internal staff on transfer within DFID. 
27 
DFID should ensure that changes to guidance are brought to the attention of relevant staff. 

## Appendix Two:  Ima Commitment

I am personally committed to making sure that we create and manage the information we need to fulfil our corporate obligations. To show the strength of my commitment, both in DFID and to our partners, I have asked The National Archives to begin the process of assessment. The National Archives final report will be published. I will provide effective leadership on Knowledge and Information Management capability across my Department. I will make sure that our internal processes and training support effective information management. Information is recognised as a key asset in DFID and is used to support effective data and information sharing and knowledge creation. I will ensure that our information is appropriately captured, described, managed and preserved and that the risks are controlled. I will promote access to and re-use of our information, and protect personal and other sensitive information. Permanent Secretary 

## Appendix Three:  Glossary

| DFID    | Department for International Development    |
|---------|---------------------------------------------|
| DISO    | Departmental Information Support Officer    |
| DPA     | Data Protection Act                         |
| EDRM    | Electronic Documents Records Management     |
| FOIA    | Freedom of Information Act                  |
| IM      | Information Manager                         |
| IMA     | Information Management Assessment           |
| IMU     | Information Management Unit                 |
| ISD     | Information Services Directorate            |
| KIM     | Knowledge and Information Management        |
| ODA     | Overseas Development Agency                 |
| SIRO    | Senior Information Risk Owner               |
| TNT     | External document storage contractor        |