## Information Management Assessment Action Plan Review Her Majesty'S Revenue And Customs May 2012

                                                                                                                                                              

## Background

Between March and April 2010 The National Archives carried out an Information Management Assessment (IMA) of Her Majesty's Revenue and Customs (HMRC). In March 2011 a report of the findings was published containing 38 recommendations. These formed the basis of the departmental action plan. 

On 1 May 2012, The National Archives formally reviewed HMRC's progress against the action plan. This report is an assessment of our main findings. 

## Summary

HMRC is committed to using information management to support and complement its business. HMRC has established governance structures in place, such as the board level Information Strategy Group (ISG), that provide oversight of knowledge and information management (KIM). The Permanent Secretary (PS) for Tax is the KIM champion on ISG and recently agreed HMRC's records retention policy. The integration of Knowledge Analysis and Intelligence (KAI) into Information and Security Directorate (ISD) has raised the profile and given validity to KIM.  

Other areas of progress since the IMA are the combined information security (IS) and information management (IM) road shows that have proved successful for HMRC. Refreshed guidance and policies reinforce the message of the importance of KIM. Also the KIM Golden Rules now sit alongside the Data Security Golden Rules, providing consistency and reinforcement. 

Organisational changes have had an impact on the pace at which HMRC has implemented its action plan.  Currently only six of the original recommendations have been closed. HMRC has put the foundations of a solid IM structure in place and must now focus on the implementation of its plans. 

## Ima Review 2009

The original assessment highlighted areas of good practice within the department. HMRC has high-level support, visibility and direction for data handling at Executive Committee. There are robust information security and assurance processes, with exceptional staff awareness of the need to safeguard personal information. Information risk was identified on KAI's risk register. Controlled Access Folders (CAFS) were being rolled out across the department and had the potential to better manage the risks associated with HMRC's shared folder structure. 

The IMA highlighted the following areas that the department should focus on to meet its core KIM objectives. These recommendations were made to ensure HMRC has the capacity to handle, store and process its information consistently and efficiently. 

 
 The appreciation of the benefits of good KIM was less visible than the one-off 
IMA. HMRC needs to raise profile of KIM and engage middle managers in supporting the KIM agenda. 
 Risk management of IM was not as visible as that of information assurance (IA) 
risks. Managers tended to focus on meeting business objectives without strategic consideration of how good KIM practices would help them. 
 HMRC does not have a full Information Asset Register (IAR) or a corporate data 
model. An information inventory, to identify information assets and its owners was being compiled. The extent of HMRC's data holdings made this a challenging task. HMRC must continue its work to improve understanding of its information assets and define its key work processes.  
 HMRC's management of paper files differed across the organisation.  Published 
retention schemes were inconsistently implemented; therefore, HMRC required a more systematic approach to disposal of records. 
 HMRC needed to define and implement appropriate retention schedules for 
heads of duty systems.  
 There was confusion around the various KIM roles, which required clear 
definition and consistent application. KAI was best placed to support and communicate the purpose of these roles to all staff. 

## Progress Against Recommendations

The Permanent Secretary for Tax, as KIM champion at board level, has been instrumental in maintaining the quality of KIM practice within HMRC. This is demonstrated by changes to KIM governance structures, programmes and communications: 

 Records and information management is included in the regular information 
management road shows aimed at managers within HMRC. 
 KIM is championed at Board level and there is a governance structure for KIM 
issues, via IMG and the KIM Delivery Forum. Terms of reference for the groups 
are being developed. 
 The programme of migration to Controlled Access Folders (CAFs) has been 
completed for all business units. 
 A departmental wide Information Asset Register went "live" in April 2012.   The development of a collaboration strategy to define how and when information 
and best practice should be shared is complete. Networks for Information Security Managers, Data Guardians and Information Partners are established. 
 Collaborative workspaces are being used but are also being trialled further using 
different software, with the view to extending them across HMRC to share information and best practice. 
 To underpin the KIM strategy, KIM guidance has been updated and extended, 
including the addition of KIM seven wastes as part of the Pacesetter change programme. 
 Similar to other government departments, HMRC has to contend with the loss of 
staff and the ongoing challenge of resource limitations. This has slowed progress but KIM was never off the departmental agenda.  
 The original recommendations have been grouped into six high priority 
categories. The KIM team are working with the lines of business to ensure those 
recommendations are reflected and prioritised accordingly. 

## Next Steps:

HMRC still has some key activities outstanding to ensure that it consolidates work undertaken and progresses its KIM ambitions. These are: HMRC to continue with the development, support and training of the specialist KIM related roles, so that they can be an effective resource for the department. 

 HMRC to continue to ensure that CAFs are managed and used consistently.  Working with the LOBs to make sure that the right people are allocated KIM roles 
to manage the CAFs and ensuring that there is local managerial support for staff. 
 HMRC to work alongside with The National Archives to develop an appropriate 
what to keep approach that meets HMRC's business needs.  
 The continued population of HMRC's Information Asset Register, including 
defining its information assets, so that eventually all key information assets are recorded and managed.  

## Ongoing Ima Programme Support

The National Archives recognises that HMRC has been constrained in implementing its action plan.  HMRC will need a period of implementation, monitoring and review of progress. To enable this HMRC will be subject to two  six monthly review meetings. After the second meeting the action plan will be subject to formal closure. Outstanding recommendations will be reviewed at the time of the next formal IMA review for HMRC in 2015 

The National Archives will continue to working closely with HMRC so that the department is supported as it continues its work on records and information management throughout the department.  

## Performance Management Framework Risk Matrix

                                                                  

Governance and Leadership 
Strategic management Business objectives Management controls Resourcing Risk management  

## Records Management

Creation Storage   
Appraisal, disposal and transfer Sustainability of digital records  
Management   

## Access To Information

FOI/Data Protection Re-Use Security   
Compliance  
Staff responsibilities and delegations  
Policies and guidance Training Change management  
Culture 
Commitment Staff Understanding 
 

## Key To Colour Coding

Best Practice Good  
Satisfactory Development Needed 
Priority Attention Area