| Assessment Category                                              | Rating        |
|------------------------------------------------------------------|---------------|
| Appraisal, selection and                                         | Priority risk |
| sensitivity review                                               | area          |
| process                                                          |               |
| Recommendation accepted.                                         |               |
| Action plan will be monitored                                    |               |
| for progress                                                     |               |
|                                                                  |               |
| Develop and                                                      |               |
| publish a                                                        |               |
| methodology for                                                  |               |
| appraising and                                                   |               |
| selecting public                                                 |               |
| records in                                                       |               |
| consultation with                                                |               |
| TNA (R1)                                                         |               |
| Recommendation accepted.                                         |               |
| Action plan will be monitored                                    |               |
| for progress                                                     |               |
|                                                                  | Establish a   |
| process for                                                      |               |
| sensitivity                                                      |               |
| reviewing paper                                                  |               |
| and digital                                                      |               |
| records prior to                                                 |               |
| transfer to TNA                                                  |               |
| (R2)                                                             |               |
| Transfer to TNA                                                  | Priority risk |
| area                                                             |               |
| Recommendation accepted.                                         |               |
| Action plan will be monitored                                    |               |
| for progress                                                     |               |
| Put in place                                                     |               |
| resource to                                                      |               |
| enable the DKIM                                                  |               |
| team to take over                                                |               |
| the management                                                   |               |
| of the paper                                                     |               |
| storage contract                                                 |               |
| and begin                                                        |               |
| transferring                                                     |               |
| records (R3)                                                     |               |
|                                                                  |               |
| Controlling and                                                  | Development   |
| exploiting legacy                                                | Area          |
| information                                                      |               |
| Recommendation accepted.                                         |               |
| Action plan will be monitored                                    |               |
| for progress                                                     |               |
|                                                                  |               |
| 1. Put in formal application to Advisory Council to over-retain. |               |
| 2. Gather Stakeholder feedback on appraisal policy               |               |
| 3. Consult with TNA on appraisal policy                          |               |
| 4. Set up SharePoint to enable electronic records to be          |               |
| selected                                                         |               |
| 5. Move appraisal and selection to become BAU                    |               |
| 6. Publish appraisal policy on MHRA site                         |               |
| 7. Update IAR and RRS to reflect appraisal decisions             |               |
| 1. Conduct pilot project                                         |               |
| 2. Assess resources needed and whether methodology works         |               |
| 3. Finalise approach for paper records                           |               |
| 4. Assess potential methodologies for digital records            |               |
| 5. Test preferred methodology                                    |               |
| 6. Dependent on test outcome put steps in place to enable        |               |
| review                                                           |               |
| 1. KIM to discuss budget and resourcing requirements with        |               |
| Policy.                                                          |               |
| 2. KIM recruit resource                                          |               |
| 3. KIM get training from Policy on IM connect, archiving         |               |
| procedure                                                        |               |
| 4. Budget transferred; contractual responsibility transferred    |               |
|                                                                  |               |
|                                                                 |             |
|-----------------------------------------------------------------|-------------|
| are resourced to                                                |             |
| play an active                                                  |             |
| role in                                                         |             |
| procurement of                                                  |             |
| new systems (R8)                                                |             |
| Procurement:                                                    | A piece of  |
| work planned for 2020/21                                        |             |
| will look at supplier                                           |             |
| assurance as part of                                            |             |
| information security and data                                   |             |
| protection improvements.                                        |             |
| We will expand this activity                                    |             |
| to ensure that information                                      |             |
| and records management                                          |             |
| requirements are included in                                    |             |
| this activity.                                                  |             |
| System Design:                                                  | DKIM team   |
| are already involved in the                                     |             |
| design and development of                                       |             |
| new systems, however, the                                       |             |
| IMA recognised that the pace                                    |             |
| of change, and complexity of                                    |             |
| systems makes is challenging                                    |             |
| for the team to ensure that                                     |             |
| they are able to spend                                          |             |
| sufficient time working with                                    |             |
| colleagues                                                      |             |
| IT systems and tools                                            | Development |
| Area                                                            |             |
| Recommendation accepted.                                        |             |
| Action plan will be monitored                                   |             |
| for progress                                                    |             |
| Make                                                            |             |
| improvements to                                                 |             |
| SharePoint                                                      |             |
| online, ensuring                                                |             |
| information                                                     |             |
| management                                                      |             |
| functionality is                                                |             |
| rolled out across                                               |             |
| SharePoint online                                               |             |
| and users are                                                   |             |
| aware of any                                                    |             |
| actions they need                                               |             |
| to take (R7)                                                    |             |
| Procurement                                                     |             |
| 1. Develop due diligence checklist with SCM and Finance as      |             |
| part of a review of supplier assurance in the agency.           |             |
| 2. Put in process for risk assessing and reviewing procurement  |             |
| System design                                                   |             |
| 1. Put in place time to allow DKIM team to fully review project |             |
| briefs, business cases, and designs to ensure that retention    |             |
| and information architecture is considered from earliest point. |             |
| 2. Develop information standards that project design must       |             |
| adhere to.                                                      |             |
| 3. Ensure that projects relating to systems migration cannot    |             |
| be signed off without the migration and retention having been   |             |
| considered.                                                     |             |
| 1.                                                              |             |
|                                                                 |             |
| Develop a programme of work (Digital Workplace 3)               |             |

to ensure maximum benefits is made of Office365 platform including SharePoint Online. 2. Complete roll-out of records management functionality. 3.  Investigate whether new functionality within O365 could provide cheaper and easier long-term solution for records management. 4. Ensure that users understand information management functionality in SharePoint, through development of content owner role. 5. Carry out user research to identify barriers to using SharePoint Online for information management and what functionality they would like to use                                                     
6. Review the way access and permissions are managed in SharePoint Online. 

 Control and Oversight 
of Current Practice 
Recommendation accepted. Action plan will be monitored for progress 
  
Improve training offer by making specific IM 
training available to staff at induction and providing additional training for those in IAO/Information Custodian and Site Content 
Owner roles (R9) 
Monitoring Performance Development 
Area 
Recommendation accepted. Action plan will be monitored for progress 
Further develop the yearly Information Assurance reporting process and consider expanding the role of the Information Custodians to aid monitoring of compliance with information management best practice (R5) 
Control and Oversight of 
Current Practice  
Recommendation accepted. Action plan will be monitored for progress 
  
Improve communications and distribution of resources 
between the central DKIM 
7. Review how content types are used and look at alternatives 
 
1. Information governance and Digital Workplace training to be rolled out to new starters. 2.  Promote Knowledge Hub and existing training resources.  
Develop videos and online training. 3. Refresh role-specific training and advertise more widely, including specific training for Information Asset Owners, Information Custodians and Content Owners. 4. Consider re-running DWP training for new starters 
1. KIM team will develop baselines each division and make recommendations for improvements, as part of the annual assurance process in 2019/20. Once baseline is established, a mini-IMA for each division will be development, to provide individual actions plans and this will feed into the yearly reporting process 2. Review of Information Custodians will be carried out, the role will be strengthened and a recruitment drive for Information Custodians will take place.  The role of Content Owner will be strengthened to support Information Custodians specifically on SharePoint Online. 1. DKIM team to work with NIBSC and CPRD IAOs to look at specific requirements and how these can be addressed  
team and information 
governance roles in NIBSC and CPRD (R4) 
Policy and guidance 
Approaching 
satisfactory 
1. Put together a strategy and roadmap for developing IM within the Agency linking in with OT 
Finalise and sign off IM strategy (R6) 
 Recommendation accepted. Action plan will be monitored for progress