## Information Management Assessment Department Of Energy And Climate Change October 2011

| 1 PART ONE: KEY FINDINGS OF THE ASSESSMENT         |     |     |     |    2     |
|----------------------------------------------------|-----|-----|-----|----------|
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |
| 2 PART TWO: INTRODUCTION                           |     |     |     |          |
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |
| 3  PART THREE: THE ASSESSMENT TEAM                 |     |     |     |          |
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |
| 4  PART FOUR: HIGHLIGHTS AND AREAS FOR IMPROVEMENT |     | 11  |     |          |
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |
| 5  APPENDIX ONE: SUMMARY OF RECOMMENDED ACTIONS    |     | 31  |     |          |
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |
| 6 APPENDIX TWO: GLOSSARY                           |     |     |     |          |
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |
|                                                    |     |     |     |          |

 Date: October 2011 © Crown copyright 2011 
 

## Key Findings Of The Assessment

1.1 The Department for Energy and Climate Change (DECC) is a relatively new 
department that has the opportunity to embed and develop its knowledge and 
information management practices to support key objectives.1 Tackling energy 
and climate change challenges requires quality information that supports collaboration across many stakeholders. By embedding sound governance structures, policies and guidance, DECC will have the confidence that the context and record for present and future decisions is available. DECC is making steady progress against its information management goals. Already, many of the 
recommendations made in this report have been actioned. The Information Management Assessment (IMA) process is supporting DECC in the realisation of its Knowledge and Information Management (KIM) ambitions. 

## Governance And Leadership

 
1.2 DECC"s corporate governance structure is changing. These changes are 
intended to strengthen senior level accountability, visibility and the clarity of overall decision making, including that of performance and information management. 
1.3 The overarching risk governance structure is not fully embedded. There is 
evidence of limited reporting on risk, but a more mature risk governance process for DECC will provide a fuller picture of information assurance, information technology and information management.  
 
1.4 The roles and responsibilities of the Senior Information Risk Owner (SIRO) and 
the Chief Information Officer (CIO) require greater visibility, authority and influence within the department. 
1.5 The core KIM team provides support for forty-two departmental Information 
Managers (IMs). DECC must foster recognition of the IM role so that its benefit to DECC"s KIM objectives is maximised. 
                                            

1.6 In 2010, DECC completed an audit of all internal datasets not included on its 
Information Asset Register (IAR). This is good practice. 
1.7 Understanding of the IAR and of the roles and responsibilities of Information 
Asset Owners (IAOs) was limited at all levels within DECC. If IAOs do not fully understand their roles they cannot provide assurance to the SIRO. 

## Information And Records Management

 
1.8 DECC must develop its own "What to Keep" (WTK) schedules. This will provide 
the department with assurance that it understands how, what and where records of key policy decisions must be retained. Currently, the department relies on individual staff to make decisions on what they define as important business information, without KIM team involvement. This will affect the cohesion, clarity and consistency of DECC"s information legacy. 
1.9 DECC"s records management policy and other related guidance states that 
information of corporate value must be stored in the Electronic Document Records Management System (EDRMS), Matrix. However, use of Matrix is not consistent in practice. 
1.10 Staff use alternative document storage facilities such as personal drives, 
shared folders and email inboxes. Best practice supports restricting the ability to store information in such alternative systems, in favour of the corporate EDRMS, Matrix. 
 
1.11 It is essential that private offices demonstrate good information management 
practice. The potential impact of missing, incomplete or unavailable information within a private office constitutes a serious risk to the reputation and effective operation of DECC. To mitigate this risk, Private Office must audit its processes annually, in order to provide assurance that its procedures are effective.  

## Access To Information

 
1.12 Within DECC, knowledge of how to safeguard personal information was low. 
DECC is at risk of failing to meet its obligations under the Data Protection Act if it does not address issues such as personal information being held by managers 
in Matrix without appropriate restrictions, and therefore potentially visible to all. 

1.13 Although all systems used in DECC have appropriate access controls and 
permissions in place, these are not routinely monitored or audited at a local level. DECC faces a risk to its reputation if potentially sensitive information is not adequately safeguarded.  
 

## Compliance

1.14 The "DECC School" training format provides a high standard in training across 
DECC. The inclusion of a series of lunchtime seminars for all DECC staff via "DECC School Light" is seen as a way to bring the department together and share knowledge. 
 

## Culture

1.15 DECC"s biggest challenge is to develop a culture that values knowledge and 
information management and to embed knowledge sharing behaviours. 
1.16 The KIM team has piloted use of SharePoint technology across some policy 
teams. DECC should extend this further to tackle the information retrieval and sharing issues that exist, and also to build ownership and wider participation.  

## Risk Matrix

1.17 The Risk Matrix result is a culmination of the pre-assessment analysis, on-site 
interviews and evidence submitted.  

## Governance And Leadership

 
Strategic management 
Satisfactory 
 
Business objectives 
Good 
 
Management controls 
Satisfactory 
 
Resourcing   
Satisfactory 
 
Risk management 
 Satisfactory 

## Information And Records Management

 
Creation   
Satisfactory 
 
Storage   
Satisfactory 
 
Appraisal, disposal and transfer 
 Satisfactory 
 
Sustainability of digital records 
Development Needed 
 
Management   
Development Needed 

## Access To Information

 
FOI/Data Protection 
Development Needed 
 
Re-use   
Satisfactory 
 
Security   
Good 
 
 
Compliance 
 
Staff responsibilities and delegations 
Satisfactory 
 
Policies and guidance 
Good 
 
Training 
 Satisfactory 
 
Change management 
Satisfactory 
 
 
Culture 
 
Commitment 
Satisfactory 
 
Staff understanding 
Development Needed 
 
Knowledge management 
Development Needed 
 

## Key To Colour Coding

Best Practice  
Good  
Satisfactory  
Development Needed Priority Attention Area  

## Part Two: Introduction Information Management Assessments

2.1 The Information Management Assessment (IMA) programme is the best practice 
model for government departments wishing to demonstrate a high level of achievement in managing their information.2 

## Background

2.2 The Department of Energy and Climate Change (DECC) was formed on 3 
October 2008. Prior to this, climate change mitigation policy was the responsibility of the Department for Environment, Food and Rural Affairs (Defra) and energy policy was the responsibility of the Department for Business, 
Enterprise and Regulatory Reform (BERR).3  
 
2.3 The 2010 Comprehensive Spending Review commits DECC to an 18 per cent 
real-term reduction in resource spending by 2014/15. The department"s administrative budget will be reduced by 33 per cent. This will be achieved through increased use of shared services across Government, a refocusing on critical work streams and further reductions to travel, accommodation and IT expenditure. 
2.4 DECC has four structural reform priorities, as outlined in its current Departmental 
Business Plan: 
 
 
Save energy with the "Green Deal" and support vulnerable consumers; 
 
Deliver secure energy on the way to a low carbon energy future; 
 
Drive ambitious action on climate change at home and abroad; 
 
Manage our energy legacy responsibly and cost-effectively. 
                                            

## Knowledge And Information Management (Kim) In The Department Of Energy And Climate Change (Decc)

2.5 The KIM team is situated within the Finance Directorate. The Head of KIM 
reports to the CIO. At the time of the assessment the team consisted of three permanent members of staff and one project-manager post. 

## Part Three: The Assessment Team

3.1 The assessment was conducted by The National Archives between 9 and 13 
May 2011. The assessment team comprised: 
 
Standards and Assessment Manager 
 
Head of Standards 
 
Standards Adviser 
 
Information Management Consultant 
 
Members of the Digital Continuity Project 
 
Information Management Consultant, Archive Sector Development 

## Assistance Provided By The Department Environment Climate And Change (Decc)

3.2 The Assessment Team are grateful for the co-operation and assistance of all 
staff of DECC who were interviewed, provided additional information or facilitated the assessment process. 

## Part Four: Highlights And Areas For Improvement Governance And Leadership

4.1 To become an information led department, the Department of Energy and 
Climate Change (DECC) must have a clear understanding of how the information it collects and uses can support it in reaching its goals. To do this it must know what information it holds and where, and must be confident that the information that it is creating and collating supports and provides the context for 
key decisions now and in the future.  
 

## Strategic Management

 
4.2 The department"s corporate governance structure is being remodelled. Changes 
to the process by which issues such as risk and performance are reported to the Board were being implemented at the time of the assessment. Once embedded, these should strengthen senior accountability and the visibility and clarity of decision making within DECC. 
4.3 An Information Management Programme Board was created in 2009 to oversee 
the implementation of Matrix across the Department and to explore knowledge sharing across the department. In January 2011 it adopted new terms of reference to become the KIM Steering Group and took on responsibility for developing and delivering the new KIM strategy. DECC"s Head of Strategy 
chaired the KIM Steering Group at the time of this report. 
4.4 DECC has adopted a number of shared service solutions relating to records 
management and technology. This arrangement has helped the department to maintain a level of business as usual since its creation. However, several managers interviewed expressed concern that the existing Service Level Agreements (SLAs) are not meeting the department"s needs as it evolves and that these decisions can affect information management. 4.5 Following the 2011 Comprehensive Spending Review, the use of shared 
services will assume a greater prominence across government. Business needs should be clarified and regular monitoring of contracts, updates and identification 
of associated risks need to be presented at a senior level in DECC. The Shared Services Integration Project Board, chaired by the director of finance, regularly reviews an issues log which captures areas of concern relating to the various shared services used by DECC. This will enable senior management to have a clear oversight and control of the SLAs to guarantee that DECC gets maximum benefit from the arrangements. 

## Recommendation 1: Decc Must Ensure That Where Key Services Are Procured Under Slas That Knowledge And Information Continuity Risks Are Monitored And Reported Periodically To The Decc Shared Services Integration Project Board. Business Objectives

4.6 DECC"s Information Management Strategy was published in 2009 with a 
roadmap to the end of 2010. The draft Knowledge-Sharing Strategy aims to build on this by further embedding good information management alongside the introduction of "knowledge sharing enablers" and the development of a knowledge sharing culture. It contains an action plan and a knowledge sharing maturity model, an approach that has been successfully used by other government departments in the IMA programme. The new strategy has the potential to both measure and support real information management change. However, there are no clear timelines within the strategy. Once the strategy is agreed, a detailed implementation plan, including timeline, must be added to map DECC"s progress. 
 

## Recommendation 2: Decc To Develop An Implementation Plan, Including Timeline And Benefits Realisation, For The Knowledge-Sharing Strategy.

4.7 DECC has successfully implemented a metric to monitor and increase use of the 
departmental EDRMS, Matrix, using a RAG rating system. Each month, staff are allocated a green rating if at least one document has been created within Matrix, an orange rating if at least one document has been accessed and a red rating if there has been no Matrix-related activity. The resulting statistics are reported to the SIRO and CIO and circulated monthly to Managers and IMs. The metric has given visibility to the issue of Matrix use, introduced an element of competition and correlates with an increase in the volume of information created within the 
EDRMS. This is a good start for DECC. However, the metric is not qualitative. DECC needs to ensure staff are not only engaging with Matrix to avoid a "red" rating, but also seeking to preserve a full and accurate record of departmental activity. DECC needs to get to a stage where metrics have ongoing validity, challenge, and credibility and can support long-term KIM ambitions. 

## Recommendation 3: The Kim Team Should Modify And Review The Edrms Metrics So That They Continue To Challenge And Raise Edrms Use. Resourcing

4.8 The core DECC KIM team is led by the Head of KIM, with two full-time staff.  A 
number of key services are also provided via a shared service provided by BIS which is managed by the head of KIM team To support the work of the KIM team there is a network of 42  Information Managers (IMs) who each support between 30 and 160 staff.  IMs are expected to undertake a wide range of activities including controlling and providing access to folders in Matrix, through to raising awareness among staff of their responsibilities with regard to information management and encouraging best practice. However, there was a perception among most staff that IMs were simply Matrix administrators or "gurus" rather than a general KIM resource. DECC needs to ensure that the profile and the contribution of these roles in terms of wider KIM and records management is recognised. 

## Recommendation 4: Kim Team To Review How The Profile Of The Im Role Can Be Raised. 4.9 Awareness Of The Im Role And The Kim Team Itself Was Generally Low. The Core

KIM team needs to make effective use of the IM network to support and spread the message about good information management practice. To do this, the KIM team needs to be confident that all IMs attend network meetings and are supported in doing so. 

## Recommendation 5: Kim Team To Assess How The Expertise Of The Ims Can Be Raised To Meet The Department'S Information Needs.

 

## Risk Management

4.10 DECC has a mature risk management process, with a published risk process 
that includes risk management meetings and audit committee. However, whilst information risk has been raised at Operations Committee, it is not yet widely understood within the business areas. Additionally, there is a lack of coordination between different roles to address the risk. A corporate risk manager responsible for the combined risks associated with information assurance, information technology, and information management would bring cohesion and aid understanding.  
 

## Recommendation 6: Decc To Identify And Nominate A Corporate Risk Manager. 4.11 An Improved Understanding The Roles And Responsibilities Of The Senior

Information Risk Owner (SIRO) and the Chief Information Officer (CIO) should go in tandem with the wider work on governance within DECC. The Senior Information Risk Owner (SIRO) and the Chief Information Officer (CIO) are committed to KIM. However, the visibility, authority and influence of these roles was questioned by some managers. A number of interviewees were not sure of their responsibilities on how, why and to whom they should report an information assurance or information security matter if it arose. 
4.12 DECC faces a reputational risk if it does not fully understand and manage the 
risks arising from the information it holds. This is particularly true for a department that handles information on sensitive and potentially emotive topics 
such as climate change and the nuclear programme. It is vital that the SIRO and CIO roles achieve greater visibility and authority. 

## Recommendation 7: Executive Board To Communicate The Importance Of The Siro And Cio Roles In Supporting And Reporting On The Department'S Compliance On Information Security And Assurance.

4.13 The emphasis of the DECC Information Asset Register is on assets that 
contain personal information. DECC has the opportunity to expand this to create a management tool to support them to manage their information. DECC has recently conducted an audit that identified a total of 120 datasets with business value to the department, nearly double the number of information assets 
currently identified on the IAR. The IAR makes provision for recording ownership and business purpose of information assets, but does not record information relating to risk, sensitivity (beyond specifying personal protect) or technical dependencies. The work done to develop the IAR should now be built upon to include all information assets of value to the department, and to capture data required to manage those assets effectively. Without these details DECC will not be in a position to identify and fully mitigate information risk, including the ability to manage its digital continuity.4   
 

## Recommendation 8: Decc Should Use The National Archives' Digital Continuity Guidance To Expand Its Information Asset Register To Create A Management Tool To Support The Management Of Information Over Time And Through Change.

4.14 The Information Asset Owner (IAO) role was found to have a low profile within 
the department. At the time of assessment many IAOs had not been made aware of their full responsibilities. A programme of training is needed to ensure all IAOs understand the value of their assets together with associated risks. Without this they will be unable to report effectively to the SIRO. 

## Recommendation 9: Decc Should Put In Place A Programme To Train The Iaos And Raise Awareness Of The Role And Its Responsibilities.

4.15 DECC needs assurance that information assets which should be represented 
in business continuity planning are identified and that ownership is assigned and managed. In a department that is at a mature stage of risk management with 
respect to its information, IAR entries are used to support business continuity planning processes and procedures. This is particularly relevant for DECC, which has several shared-services and contracts in place from IT through to facilities and services management. 

## Recommendation 10: Information Related To Business Critical Assets Within The Iar Must Be Tied Into Departmental Business Continuity Planning. Information And Records Management 'What To Keep'/Creation

5.1 DECC, as yet, has not defined its own "What to Keep" (WTK) schedules. 
Although there is central guidance available on the intranet, members of staff interviewed were found to be making local decisions on what they judged to be important business information.  DECC needs to maintain a full record of key policy decisions, as at present DECC lacks assurance that this is being 
captured. Corporate ownership of a WTK schedule tailored to the department"s own needs and objectives would provide clarity on what information needs to be kept. This would help to ensure that DECC"s legacy remains available and that obsolete information is disposed of in a structured manner. 

## Recommendation 11: Decc Should Use The National Archives Guidance To Develop A 'What To Keep' Schedule For The Department. Storage

5.2 Following the merger, BIS staff continued to work on existing system, which was 
rolled out to ex-Defra staff. Some of this came across as read-only shared drives.  At the time DECC was created, a review was carried out of information on the shared drives. Significant records were migrated onto Matrix. However, much information remains in personal drives. One interviewee stated that they 
had emails and other information going back ten years, which they kept "just in case." The use of the DROID tool, which has been implemented by a number of government departments, would allow DECC to identify duplicate files and the 
date of last revision.5 
 

## Recommendation 12: Decc To Conduct A Review Of Information Held On Personal Drives And Consider Introducing A Size Limit.

5.3 DECC"s record management policy states that information of corporate value 
must be saved into Matrix. However, use of the EDRMS was not consistent across the department. Staff were generally confident in its use and understood 
its purpose as a corporate repository. This was despite complaints about occasional technical problems such as documents corrupting and comments that it was "clunky" and that information was difficult to find once filed. Others were reluctant to use Matrix, only used it for key final documents or barely accessed it except to comply with the monthly monitoring. If staff does not understand what should be saved to Matrix and do not use the EDRMS consistently there is a risk that context, such as key facts on which advice is based, will be lost. 
 
5.4 Staff also file information in Outlook folders and personal or shared drives.   The 
multiple choices available to staff lead to duplication, difficulty in locating documents and inconsistencies in what is saved and how it is saved. Best practice dictates a clear mandate to use an existing system, whether it is an EDRMS, SharePoint or approved shared drives. At the same time the ability to save information elsewhere should be restricted, and a solid record and information management culture awareness programme put in place to ensure that corporate or key business information is stored appropriately. 
5.5 The assessment team found little evidence that DECC"s guidance on naming 
documents and folders is enforced. Poor naming of documents impacts on the ability of staff to receive good results from searches carried out in their own areas and across the file plan. Good naming practice should be encouraged at a local level to ensure that important information can be discovered and 
understood outside of the immediate business area. 

## Recommendation 13: Decc Should Ensure That Ims Are Empowered To Challenge Staff Over Poor Naming Of Documents And Encourage Colleagues To Follow Departmental Guidance. Recommendation 14: Decc Should Mandate Usage Of The Edrms And Impose Limits On Exceptions To The Policy And Communicate To All.

 
5.6 Matrix will be unsupported from 2014, DECC has a project due to start in autumn 
2011 to assess future options for records and information management. Relevant Digital Continuity guidance available from The National Archives may 
be of help to DECC when planning future technology.6 However, until a solution has been decided DECC must minimise the risk that business information cannot be found or accessed.  
 

5.7 A pilot was being run to establish how well SharePoint 2007 can be used as a 
knowledge sharing enabler, an interface with Matrix, and to host the Intranet. It is hoped that this will provide a viable search capability for both. This may be good for the department if this creates an environment for structured record and information management control. 

## File Plan

 

5.8 The Matrix file plan is limited to four levels. New folders need approval from IMs 
who can also rename and hide, rather than delete, folders. Whilst the flat structure of the file plan might cause some inconvenience for a minority of DECC staff, it provides structure, discipline and consistency. 
5.9 Technical infrastructure is provided by Fujitsu but the EDRMS service is 
contracted through BIS. DECC uses a section of the BIS record plan in Matrix. This was designed by DECC, but as the shared service is provided "as is", DECC is constrained to record plan rules applied by BIS. Discussions are ongoing with BIS to ensure that the current SLA fully reflects the changing needs of DECC. BIS oversee management and development of Matrix, including any requests to amend or add to the file plan. This arrangement has placed limits on what DECC can do to change the record plan.   
 

## Paper Files

 
5.10 BIS is contracted under the records management SLA to register and manage 
DECC"s paper files, and DECC state that this is working satisfactorily. Plans are underway to move paper files from the current repository in Earlsfield, London, to Cardiff by 2012, which will require large volumes of paper files to be rapidly 
                                            
reviewed. These paper records will be appraised in accordance with the BIS criteria. 

## Recommendation 15: The Kim Team To Develop Appraisal Criteria For Legacy Records.

5.11 BIS and DECC"s paper legacy files are stored together but no audit has been 
carried out to establish the relative volumes that are held. Work is being undertaken to define DECC and BIS responsibilities over the registered paper records.  
 
5.12 There is an assumption within DECC that the department is a digitally based 
department. While the creation of paper records is very limited, staff do, in some cases, have an ongoing duty to collate, register and store specific important information that may be in paper form; for example, nuclear plant planning decisions. In addition, the IMA team found evidence that staff were keeping paper copies of potentially sensitive information so that it would be "close at hand." This puts the department at risk of failing to meet its obligations under the Data Protection Act. 

## Recommendation 16: The Kim Team Needs To Ensure That Kim Guidance References All Record Types, Including Legacy Paper Records. Private Office

5.13 DECC private offices follow Model 2 of The National Archives" guidance in the 
management of its records.7 This places the onus on policy areas to ensure that 
records are captured within the departmental records system. Private Office will only accept submissions that are emailed in the form of Matrix links, which 
ensures these key documents, are captured within the EDRMS. This is good 
practice. 
 

## 

5.14 However, the assessment team found some confusion over the procedures 
and responsibilities for recording Private Office generated information. The team also found evidence that duplicate copies and information available in alternative 
formats was being retained without a clearly defined purpose. The Private Office is a key information hub and the potential impact of missing, incomplete or unavailable information poses a serious reputational risk to DECC. The private offices need to lead by example, with the assurance that key information is available, that Private Office staff are adhering to procedures and that their offices are managing their decisions and information efficiently. 

## Recommendation 17: The Kim Team To Liaise With The Private Offices In The Implementation Of An Annual Audit As Referenced Within The National Archives' Guidance To Ensure That They Are Operating Effectively. Emails

5.15 Emails within DECC are automatically deleted from Outlook after a year.  
DECC guidance advises staff what type of email should be saved to Matrix and when. A minority followed this guidance. There was little other evidence of proactive email management. One interviewee admitted to having "seven thousand" emails archived and others admitted that important information had been lost through automatic deletion. Poor management of emails contributes to the risk that important legacy information will to be lost or become inaccessible. 

## Recommendation 18: The Kim Team And Ict Should Audit Email Inboxes To Provide The Base To Identify And Mitigate The Risk Of Poor Email Management. Appraisal And Disposal

5.16 Digital Information is held in several locations, from personal drives to the 
EDRMS and shared drives. This makes understanding what is available, its age, and choices regarding timely review and disposal problematic. The monthly 
Matrix RAG ratings and Private Office"s insistence on the use of links instead of 
attachments both help underline the importance of the EDRMS. Using WTK schedules and a clear retention policy will underpin this. 
 

## Digital Continuity

5.17 The findability of DECC"s information is poor, largely because it is held in a 
number of different systems and locations. Matrix is regarded as a repository for filing away final documents, not as a tool for managing, finding or sharing them. Staff do not consider future findability when naming files or creating metadata - although there was agreement that finding information in Matrix is much easier if it has been named in a meaningful way.  
 
5.18 DECC does not yet have a strategy for management of digital continuity and 
there is a lack of clarity on how key internal roles, business units and external service providers should work together to ensure that DECC"s digital information remains usable over time. The KIM, IT and IA need to work closely to support management of digital continuity and enable relevant risks to be raised and managed. A Senior Responsible Owner should be appointed to lead in this area. 
 

## Recommendation 19: Decc To Develop A Strategy For Managing Digital Information Drawing On Expertise From All Relevant Teams Within The Department. 5.19 Decc"S Sensitive Information Assets Are Captured On The Departmental Iar, In

line with the recommendations of the DHR. However, the department does not yet have a comprehensive understanding of the range of information it holds, its value or the associated risks. Populating and maintaining the IAR will rely on 
DECC appointing IAOs at the right level, with a clear understanding of the business value of their information assets, and with adequate support from IT. This work will deliver the additional benefit of supporting the identification and managed disposal of information that has no clear business purpose, delivering efficiencies and reducing risk. 
 
5.20 DECC needs to improve the management of its information assets and to 
continue to work on their identification, to include all information of value to the department. DECC should use its Information Asset Register to record the value, business use, location(s), format and risk of each individual information asset, in addition to ownership, content and sensitivity. DECC should also review information that is not managed as an asset and dispose of it where appropriate. 
 

5.21 DECC holds information in both legacy and proprietary systems, which are 
particularly vulnerable to loss of continuity. DECC should apply its understanding 
of the technical dependencies of its information assets, as documented in the IAR, to maintain the usability of its information assets over time and through technical change. This will support DECC in improving the alignment between 
the department"s requirements for using its information, and the technology that 
supports it. 

## Recommendation 20: Decc To Embed Digital Continuity Into The It Change Management Process, With A Digital Continuity Impact Assessment As A Core Component.

5.22 DECC"s IT and records management services are supplied by BIS. This is a 
streamlined approach to procurement, which has delivered good continuity of service for staff transferred from BIS. However, the technology roadmap for Matrix is driven by BIS requirements. DECC needs to ensure that its needs are fully met and that it has influence over the technical environment.  

## Recommendation 21: Decc To Develop A Technology Roadmap For Matrix Continuing To Engage Suppliers And Pilot New Approaches To Identify Options. Recommendation 22:  Decc To Include Digital Continuity Requirements In The Specification And Procurement Of New Systems To Cover Interoperability, Data Exchange And Extraction And Standardised Technology. Access To Information Data Protection Act

6.1 Knowledge of the means by which sensitive personal information can be 
safeguarded, and the controls available, was found to be low. Staff in HR understood this need, but noted that the move to a shared service for HR had increased certain challenges as personal information was held on at least three systems with the physical HR files elsewhere.  
 
6.2 In other areas, it was less clear that the principles of the Data Protection Act 
were understood or being followed. Examples were cited of applicant"s CV"s, contracts and other personal information being held by managers in Matrix without appropriate restrictions which meant they were potentially visible to all users. This situation should be rectified, as DECC is at risk of failing to meet its obligations under the Data Protection Act. 

## Recommendation 23: Decc To Review How Data Protection Training Is Cascaded And Implemented To Ensure Personal Information Is Held And Managed Effectively. Freedom Of Information Act (Foia)

6.3 Freedom of Information queries are managed under the BIS SLA. Most recently 
published figures at the time of the IMA show DECC answered 89 per cent of 
request within time (Jan-Mar 2011).8  Queries are pursued by action officers in 
DECC and overseen by an appointed BIS case officer. Action officers are also responsible for carrying out redaction in line with BIS guidance. No monitoring has been carried out to see how effectively this is being done. 
6.4 The decision to release or withhold material lies with DECC. The department 

## 

needs to assume ownership of the process as handling FOI queries and understanding of the importance of FOIA were found to vary. To do this DECC must support a general information awareness and training programme for key internal staff. To obtain buy-in from staff clear responsibilities should be defined and communicated. DECC must assure itself that guidance is understood and that proper procedures are being followed. Until such time as the SLA is up for review, working with BIS for improved training of DECC staff on FoI could provide consistency and raise standards and awareness. 

## Recommendation 24: Decc Should Work Within The Bis Sla To Refresh The Foi Training And Communication Programme For Staff. Re-Use

6.5 At the time of assessment DECC had published a total of 37 datasets on 
data.gov.uk. DECC offers data via its website with statistics and analysis available to download under key headings including energy, fuel poverty and climate change. The oldest of these, a graph of average annual surface temperatures, dates back to the eighteenth century. The DECC Business Plan recognises that improving transparency can play an important part in helping the department to achieve its objectives. It states that the department is complying with the Prime Minister"s commitments on transparency, and seeks to go further in its commitments where possible. The recent audit of databases conducted within DECC has enabled the department to assess what is currently published and assess what further material could be made available including in redacted 
form. 

## Security

 
Most staff understood information assurance and information security in relation to the move to flexible working arrangements, being responsible for safeguarding their laptops and being careful about sharing information outside the department. Access to laptops is strictly controlled, with each one reflecting the working requirements of the individual. All information written to removable media is encrypted. 

6.6 There was a misconception among some staff that access to information in 
Matrix did not need to be controlled as it was an internal system accessible only to colleagues. Audits of access permissions to DECC systems, such as Matrix were not in evidence, although a minority of IMs proactively reviewed local access permissions. A failure to consistently review and control access permissions increases the risk that sensitive information will not be adequately protected, a risk that is increased when placed in context with out-of-date staff directories, ad-hoc use of corporate systems and use of removable media. 

## Recommendation 25: Kim Team To Develop Access Control Auditing Processes Compliance Staff Responsibilities And Delegations

6.7 The IM network has a key role to play in enabling DECC"s goal of transforming 
into an effective organisation that shares its knowledge. The KIM team has worked hard to update guidance and identify IMs and some IMs are now proactively working to raise the standard of information management. Raising the standard of KIM across DECC will require the ongoing, visible commitment of 
senior management. The KIM team should take the lead by communicating with and managing the IM network to ensure the provision of local information and record management support. 

## Policies And Guidance

6.8 KIM guidance is accessible via a prominent link on the front page of the 
department"s Intranet. The KIM team are in the process of updating the records and information management guidance to support the draft Knowledge Sharing Strategy. However, although much existing guidance was found to be clear, compliance to KIM guidance was found to be variable. Examples were cited of staff unsure of the minimum financial and project records that needed to be kept. Other interviewees requested clarity on what constitutes a record. All the above should figure prominently in the refreshed guidance and WTK schedules to enable DECC to be effective in how it uses its information. 
 

## Recommendation 26: The Kim Team To Mandate The Minimum Record Standards To Be Kept And Incorporate Them Into Wtk And Kim Guidance.

6.9 Across DECC there was evidence that teams had their own ways of working, 
among which were some examples of good record and IM practice. One IM in Finance produced comprehensive local Matrix user notes; these were well received and also correlated with high levels of EDRMS use.   

## Government Protective Marking Scheme

6.10 Use of protective marking was found to be inconsistent. Staff responses to the 
 
question of if, how and when they used protective marking ranged from the conscientious user, to no understanding of protective marking, or only using marking on external communications.  The proper application of protective marking ensures that sensitive information can be protected and non-sensitive information can be shared with confidence.  
 

## Recommendation 27: Decc Should Explore What Initiatives Are Available Or In Use By Government Departments To Raise Awareness And Use Of Protective Marking. The Intranet

6.11 The intranet contains some direct links to BIS or Defra content, rather than 
DECC-specific guidance. The department has now been in existence for over two years; information on the departmental intranet should be branded as a DECC resource where it does not relate to shared services.  
 

## Recommendation 28: Decc Should Review, Delete And Rebrand Bis Or Defra'S Intranet Content.

6.12 Policy references were also not linked to teams nor located in one area.  An 
online policy library would make finding information easier for users. Staff reported the regular use of external search engines to find DECC policies. 
6.13 Contact information on teams and the staff directory were found to be 
outdated, making finding the right information problematic. This was a problem for those staff who relied on informal networks or contacts to find information.  
 

## Training

6.14 The creation of DECC School and DECC School Lite, the comprehensive 
training programme for all DECC staff, has the potential to set high standards for training within DECC. Positive reactions were received from staff who say the seminars are a means to get to know each other and an opportunity for the 
department to integrate. This is to be commended. 
 
6.15 Induction training covers knowledge and information management practice 
including information assurance. Online training is pushed to all staff on data protection. Staff have limited, read–only access to Matrix until they have attended Matrix training, which is conducted off site by BIS under the SLA. It is primarily about use of the EDRMS, or "buttonology", without reference to DECC IM procedures. A quality assessment of the training, which would ensure the training is fit for purpose, has not been carried out. The training should be reviewed as part of the SLA review. 

6.16 Occasionally, there is a time lag between staff joining DECC, receiving 
training on Matrix and obtaining access to the live system. In the meantime, staff 
are able to store information in personal and shared drives, repositories that remain available when full Matrix access is given. DECC should ensure that managers understand the importance of requesting prompt training so that staff do not get the chance to develop bad records and information management habits. 

## Recommendation 29: Decc Should Assess How Induction Training Can Be Improved Within Available Resources To Meet Departmental Needs. Recommendation 30: The Kim Team To Input Into The Bis Matrix Training As Part Of The Sla Review. Culture

7.1 Good information management practices were not consistently applied across 
DECC. DECC is a new department with an emerging culture. Embedding sound information management practice will be crucial in helping DECC achieve business objectives. Flexible working and "hot desking" are the norm, which add an additional challenge to ensuring consistency and embedding good information management practice. Embedding changes to the governance structure and setting common standards for managing information will enhance 
good information management. DECC should also aim to make the best use of both the expertise and the information available. 

## Commitment

7.2 Commitment to knowledge and information management within DECC is 
developing, with evidence of mature information management structures within some individual teams, such as Nuclear Planning and consents. DECC needs to ensure staff are clear how both the department and the individual will benefit from good information management practice. Developing a DECC centric "What to Keep" policy and defining its core business information will give the department a good base on which to build. 

## Information Sharing

 
7.3 The historic differences between the climate change and energy parts of the 
business are recognised by senior management. These differences have created a barrier to information sharing that is being overcome. Individuals within DECC had made efforts to establish their own networks; these were often based on a need to work on a common policy or project task. 
7.4 The concept of "newness" also had an impact on how staff searched, reviewed or 
referenced previous information. Several interviewees stated that they would not look for information in DECC systems that was over two years old as they would not be able to find it or trust its integrity, and would instead either commission new research, produce their own or find the person associated with that policy and seek information that way. DECC aims to become a knowledge sharing 
department. In a time of efficiency savings any potential to duplicate work and tie up limited resources should be avoided. 

## Knowledge Management/Transfer

7.5 Staff at all levels perceived that DECC operates in functional silos, in part 
because of the mergers that formed the department. The existence of specialist teams, and teams with clear local objectives that need to be delivered irrespective of departmental priorities, may also play a part. The existence of these silos has created a working environment where knowledge is overly 
invested in its people rather than formal structures and processes. When knowledge sharing takes place, informal channels dominate. The risk that key knowledge will not be shared or be lost will be magnified if the majority of the department operates in this way. 
7.6 The role guidance for IMs contains a requirement to ensure that the records of 
temporary staff, and staff leaving teams, are captured. This is an important safeguard to have in place until DECC reaches a point where records and information guidance is universally adhered to and key information is saved to Matrix as a matter of course. The Assessment Team are aware of plans to pilot a knowledge capture process for departmental fast streamers, but no formal knowledge capture process has been developed for staff who move and change roles. 

## Recommendation 31: Decc Should Develop And Implement A Formal Knowledge Capture Process To Include Access To That Information Once Recorded. Appendix One: Summary Of Recommended Actions

8.1 This is a summary of the recommended actions to remedy the weaknesses 
identified and strengthen the commitment to the Information Management Assessment Programme. These recommendations, when agreed, will form an action plan that will be monitored by The National Archives. 

## 

Business 
 
Recommendation 
Area 
1 DECC must ensure that where key services are procured under 
SLAs that knowledge and information continuity risks are monitored and reported periodically to the DECC Shared Services 
Integration Project Board. This may be achieved by: 
 
Defining a set of metrics for contract monitoring. 

 
Agreeing a timetable for reporting. 

2 DECC to develop an implementation plan, including timeline and 
benefits realisation, for the Knowledge-Sharing Strategy. This may 
be achieved by: 
 
A detailed project plan with agreed milestones. 

 
Regular updates to a relevant change programme or project 

board. 
3 The KIM team should modify and review the EDRMS metrics so 
that they continue to challenge and raise EDRMS use. This may be 
achieved by: 
 
Including the number of documents into the EDRMS, when updated, number of emails filed, etc. 
4 **KIM team to review how the profile of the IM role can be raised.** 
This may be achieved by: 
 
Reviewing training requirements for the role. 
 
A community of practice section on the Intranet. 

 
Restating the importance of the role to managers. 

5 KIM team to assess how the expertise of the IMs can be raised to 

## Governance And Leadership

meet the department's information needs.  
 
See recommendation 4 above. 

## 

6 **DECC to identify and nominate a corporate risk manager.** This may 
be achieved by: 
 
Referring to Managing Information Risk: A guide for Accounting 
Officers, Board Members and Senior Information Risk Owners.9 
 
Referring to the Digital Continuity guidance on the management 
of digital continuity risk.10 
7 Executive Board to communicate the importance of the SIRO and 
CIO roles in supporting and reporting on the department's 
compliance on information security and assurance. This may be 
achieved by: 
 
Reviewing and strengthening the reporting structures to the SIRO and CIO. 
 
Communicating the responsibilities to all managers for information security and assurance. 
 
Accessing support available from the Cabinet Office for the SIRO and CIO guidance. 
8 DECC should use The National Archives' digital continuity 
guidance to expand its Information Asset Register to create a management tool to support the management of information over 
time and through change. This may be achieved by: 
 
Referring to the digital continuity guidance to support on The National Archives" website. 
9 DECC should put in place a programme to train the IAOs and raise 
awareness of the role and its responsibilities. This may be achieved 
by: 
 
Using the digital continuity guidance as a basis for the training. 
 
Reviewing how the IAO role has been assigned within DECC. 
                                            

10 
Information related to business critical assets within the IAR must 
be tied into departmental business continuity planning. This may 
be achieved by: 
 
Referring to the digital continuity guidance. 
11 
DECC should use The National Archives guidance to develop a 
'What to Keep' schedule for the department. This may be achieved by: 
 
Utilising the available professional support and guidance to assess best practice and use examples from other government departments. 
12 
DECC to conduct a review of information held on personal drives 
and consider introducing a size limit. This may be achieved by: 
 
Linking the information from the IAR, information on ICT systems. 
 
Using the knowledge of the in house IT staff, contractors, IMs, IARs and managers to collate this information. 
13 
DECC should ensure that IMs are empowered to challenge staff over poor naming of documents and encourage colleagues to 
follow departmental guidance. This may be achieved by: 
 
See recommendation 4 above. 
14 
DECC should mandate usage of the EDRMS and impose limits on 
exceptions to the policy and communicate to all. This would be 
supported by: 

## Records And Information Management

 
Limiting personal drive sizes. 
 
Reviewing the provision of shared drives to business units. 
 
Using IMs and middle managers to drive compliance. 
15 
The KIM team to develop appraisal criteria for legacy records. This 
may be achieved by: 
 
See recommendation 11 above. 
16 
The KIM team needs to ensure that KIM guidance references all 
record types, including legacy paper records. This may be achieved 
by: 
 
Updating current records and information guidance. 
17 
The KIM Team to liaise with the private offices in the implementation of an annual audit as referenced within The 
National Archives' guidance to ensure that they are operating 
effectively. This may be achieved by: 
 
Referring to Guidance on the Management of Private Office 
Papers.11 
18 
The KIM Team and ICT should audit email inboxes to provide the base to identify and mitigate the risk of poor email management. 
This may be achieved by: 
 
Use of available metrics available on use of the EDRMS and 
that provided by IT. 
19 
DECC to develop a strategy for managing digital information drawing on expertise from all relevant teams within the 
department. This may be achieved by: 
 
See recommendation 8 above. 
20 
DECC to embed digital continuity into the IT change management process, with a digital continuity impact assessment as a core 
component. This may be achieved by: 
 
See recommendation 8 above. 
21 
DECC to develop a technology roadmap for Matrix continuing to engage suppliers and pilot new approaches to identify options. 
This may be achieved by: 
 
See recommendation 8 above. 
22 
DECC 
to 
include 
digital 
continuity 
requirements 
in 
the 
specification and procurement of new systems to cover interoperability, data exchange and extraction and standardised 
technology. This may be achieved by: 
 
See Recommendation 8 above. 
                                            

23 
DECC to review how data protection training is cascaded and implemented to ensure personal information is held and managed 
effectively. This may be achieved by: 
 
Reviewing the attendance of courses 
24 
DECC should work within the BIS SLA to refresh the FOI training 
and communication programme for staff. 
25 
KIM team to develop access control auditing processes. 

## Access

26 
The KIM team to mandate the minimum record standards to be 
kept and incorporate them into WTK and KIM guidance. This may 
be achieved by: 
 
See recommendation 11 above. 
27 
DECC should explore what initiatives are available or in use by government departments to raise awareness and use of protective 
marking.  
28 
DECC should review, delete and rebrand BIS or Defra's intranet 
content. This may be achieved by: 
 
incorporation into the ongoing refresh of record and information management guidance, and the review of ongoing review of EDRMS training. 
29 
DECC should assess how induction training can be improved within available resources to meet departmental needs. 
 
30 
The KIM team to input into the BIS Matrix training as part of the 
 
SLA review. This may be achieved by: 
 
Agreeing content to cover DECC"s WTK guidance and records 

## Compliance

and information management. 

31 
DECC should develop and implement a formal knowledge capture 
process to include access to that information once recorded. This 
may be achieved by: 
 
Creating a template that includes set questions. 
 
Ensuring that staff and managers know when and who must complete it. 

## Culture Appendix Three: Glossary

 BIS 
Department for Business, Innovation and Skills 
CIO 
Chief Information Officer 
DECC 
Department of Energy and Climate Change 
Defra 
Department for Farming and Rural Affairs 
DHR 
Data Handling Review 
EDRMS 
Electronic Records Management System 
FOI 
Freedom of Information 
FOIA 
Freedom of Information Act 
IA 
Information Assurance 
IAO 
Information Asset Register 
IAR 
Information Asset Owner 
IM 
Information Manager 
IMA 
Information Management Assessment 
KIM 
Knowledge and Information Management 
SIRO 
Senior Information Risk Owner 
SLA 
Service Level Agreement 
WTK 
What to Keep