## Information Management Assessment Department For Communities And Local Government Assessed March 2012

About Information Management Assessments The Information Management Assessment (IMA) programme is the best-practice model for government departments wishing to demonstrate a high level of achievement in managing their information. 

 
IMA reports highlight areas of best practice and make recommendations for improvements. These recommendations will form the basis of an action plan against which progress will be tracked. For more information about the programme and to view previous reports and action plans, see: nationalarchives.gov.uk/information-management/our-services/ima.htm About Department for Communities and Local Government DCLG 
sets policy on supporting local government; 
communities and neighbourhoods; regeneration; housing; planning, building and the environment; and fire. For more information about DCLG, please visit: http://www.communities.gov.uk/corporate/about/ 
Date: **October 2012** 
© Crown copyright 2012 
 

## Table Of Contents

| 1 RISK MATRIX                          | 3                                 |
|----------------------------------------|-----------------------------------|
| 2 EXECUTIVE SUMMARY                    | 4                                 |
| 3 SUMMARY OF RECOMMENDED ACTIONS       | 8                                 |
| 4 SUMMARY OF GOOD PRACTICE             | 14                                |
| 5 HIGHLIGHTS AND AREAS FOR IMPROVEMENT | 15                                |
|                                        | APPENDIX ONE: GLOSSARY            |
|                                        | APPENDIX TWO: THE ASSESSMENT TEAM |
|                                        |                                   |

## Risk Matrix

1.1 Indicative score drawn from the pre-assessment analysis, on-site interviews 
and evidence submitted:  

Governance and leadership 
Business objectives Strategic management Management controls Resourcing Risk management 
Information and records 
Creation Storage Appraisal, disposal and transfer Management of information Security 
Compliance 
Staff responsibilities and delegations Policies and guidance Change management Commitment Staff understanding Knowledge management Development needed Priority attention area 

## Executive Summary

2.1 The Department for Communities and Local Government (DCLG) has gone 
through a period of significant restructuring, including changes in the way the department delivers key policy outcomes. At the time of assessment, DCLG was mid way through a staged  37% reduction in staffing levels, with remaining staff exits due to be completed by October 2012. The Knowledge and Information Management function has seen a 67% reduction in staffing levels since the previous Information Management Assessment (IMA) of the 
department, which was conducted in 2007. 
2.2 Moving forward, current governance and oversight of information risk needs to 
be improved if DCLG is to ensure that it is meeting minimum statutory compliance. The reduction in staffing levels and available resources will impact on DCLG's ability to assure this. This report therefore recommends that DCLG begins by defining its requirements for information and its management in alignment with business objectives and develops a plan to ensure it is meeting minimum compliance and achieves key goals. This work must be supported corporately and prioritised in accordance with the resources available. 

## Governance And Leadership

2.3 DCLG manages some high-profile projects well. However the department lacks 
an overall strategic approach to information management that is supported by 
the Senior Information Risk Owner (SIRO) and Chief Information Officer (CIO). Oversight and monitoring of information and records management is currently limited and the assessment team found evidence of divisions working without reference to policy. Without effective oversight and monitoring, DCLG cannot provide assurance that key records are being captured and that information is being managed as required, or routinely identify areas of concern. 
2.4 As a priority DCLG must now move to agree its overall information 
management outcomes and must not wait until the outcome of the forthcoming IT re-fresh before taking action. DCLG needs to review, revise and clearly define the priorities of the Corporate Records Management Service (CRMS) in light of this. The department must ensure this is accompanied by a commitment to ensure adequate support for CRMS to meet these objectives. 
2.5 Some elements of information risk are well managed, particularly, where a risk 
specific to a project or set of records is identified. For example, the potential financial penalties that can result if records relating to the European Regional 
Development Fund do not meet the auditable standards of the European Commission. This has meant that DCLG had to put in place robust structures and teams to manage the associated risks.  This made the files easily identifiable and retrievable following the closure of the Government Offices resulting in the transfer of over 500,000 paper files to DCLG. DCLG also defined its information management requirements to mitigate the risks to 
statutory compliance that was posed by the departmental reorganisation.1  
 

## Information And Records Management

2.6 CRMS has transferred the majority of electronic information over three years 
old from the preferred corporate repository Approved File Plan (AFP) on to Nearline storage for selection, review or deletion at a later date. The National Archives needs further assurance that DCLG has the resources to effectively review this for selection, and avoid placing the department at risk of breaching the Public Records Act. 
2.7 DCLG needs to build up and document its understanding about the information 
that it is creating, storing and using. Without this understanding, DCLG cannot be assured that it is taking effective and proportionate action to safeguard and 
utilise its information. This is impeded by the lack of a department-wide 
corporate filing system. Multiple repositories (including personal drives and Outlook, as well as shared drives and AFPs) are currently used by staff to store corporate information. DCLG needs to take stock of its information immediately. DCLG should start by defining its key information assets, building on its work in creating an Information Asset Register to ensure coverage of structured and unstructured information. 
                                            

## Access To Information

2.8 DCLG meets 92% of FOI requests on time, with extensions.  In addition DCLG 
fully responded to FOI requests in 70% of cases against a Whitehall average of 
56%. The department also exceeds minimum compliance levels with the Transparency Agenda, making more information available about expenditure within the department. However, having multiple repositories and large volumes of information held in personal drives and email accounts, will make future reviews for selection problematic. 

## Compliance

2.9 DCLG plans during restructuring to ensure the loss of staff did not impact on its 
ability to use its records and information could have been stronger. Although there were systems in place to capture the knowledge of experienced staff who were leaving, this was not always done systematically.  Furthermore not all key information may have been captured in corporate systems. 
2.10 The IT re-let has been led by Information Technology (IT). Whilst there has 
been some collaboration with CRMS, DCLG needs to ensure that information requirements are effectively factored in as part of the process. This will ensure that technology change does not adversely impact on the ability of the department to use, protect and trust its information. 

## Culture

2.11 The assessment team found that staff understanding about their information 
management responsibilities appeared inconsistent. Some interviewees failed to understand that the information they create is a corporate resource. 
2.12 The focus of DCLG for the year prior to the assessment has been the 
departmental restructuring, the ingest of over 0.5 million records following the closure of the Government Office Network and the transfer of over 2.5 million records from one offsite file storage provider to another.  The assessment team found some evidence of corporate commitment to good information management within this. However this needs to be embedded as a component 
of the change programme and as business as usual within the department if DCLG is to effectively assure minimum statutory compliance. 

2.13 The recommendations made in the IMA report in 2007 have largely been left in 
abeyance, awaiting the introduction of a corporate Electronic Document Records Management system (of which full funding was cancelled following a Comprehensive Spending Review) and because of other tight budgetary conditions. If DCLG does not take immediate action, the complexity and cost of resolving these issues will continue to increase. 

## Summary Of Recommended Actions

3.1 These recommendations will form the basis of an action plan that will be 
monitored. 

| Ref                                                                      | Summary Recommendation                                           |
|--------------------------------------------------------------------------|------------------------------------------------------------------|
| 1                                                                        |                                                                  |
| DCLG must further define the corporate aims and outcomes for             |                                                                  |
| information management in the department, ensuring minimum               |                                                                  |
| compliance with statutory requirements.                                  |                                                                  |
| These aims need to continue                                              |                                                                  |
| to explicitly support corporate outcomes set out in the new departmental |                                                                  |
| business plan.                                                          |                                                                  |
|                                                                          | This must be a corporate priority now that the new business plan |
| has been published and should not wait for the outcome of the IT         |                                                                  |
| procurement exercise.                                                   |                                                                  |
|                                                                          | Prioritisation of outcomes must take in to account what can be   |
| realistically achieved by the organisation with the resources            |                                                                  |
| allocated to it.                                                        |                                                                  |
|                                                                          | The CIO and SIRO need to assume responsibility for ensuring      |
| minimum statutory compliance and support for the implementation          |                                                                  |
| of these objectives.                                                    |                                                                  |
|                                                                          |                                                                  |
| DCLG needs to review and reissue its statement concerning                |                                                                  |
| its appetite for risk in regard to information assurance as a            |                                                                  |
| key underpin to its knowledge and information                            |                                                                  |
|                                                                          |                                                                  |
| 2                                                                        |                                                                  |
| DCLG needs to define the remit and priorities of Corporate Records       |                                                                  |
| Management Services (CRMS).                                              |                                                                  |
| Following recommendation 1, CRMS                                         |                                                                  |
| needs to define a plan, including time-bound milestones to ensure        |                                                                  |
| corporate goals for information management are reached. Actions must be  |                                                                  |
| clearly defined and the benefit to the business articulated.            |                                                                  |
|                                                                          | The plan must clearly define and prioritise actions according to |
| business need.                                                          |                                                                  |
|                                                                          | The plans must identify actions to raise the information         |
| 5.5,        | 5.11,    |
|-------------|----------|
| 5.13, 5.21, |          |
| 5.82        |          |
| 5.6,        | 5.11,    |
| 5.13, 5.21, |          |
| 5.22, 5.23, |          |
| 5.48        |          |

management understanding and capability of staff. 

|                                                                          | The plan must be accompanied by an implementation plan.           |
|--------------------------------------------------------------------------|--------------------------------------------------------------------|
|                                                                          | DCLG and CRMS should consider setting up an internal service       |
| standard.                                                               |                                                                    |
|                                                                          | CRMS and IT must ensure that the CRMS plan is integrated with      |
| the IT strategy.                                                        |                                                                    |
|                                                                          | Monitoring of compliance and progress needs to be established      |
| and owned at a suitable level within DCLG.                               |                                                                    |
| 2                                                                        |                                                                    |
|                                                                          |                                                                    |
| 3                                                                        |                                                                    |
| DCLG needs to define appropriate metrics and monitor progress            |                                                                    |
| against information management outcomes                                  |                                                                    |
| (according to corporate                                                  |                                                                    |
| priorities in recommendations 1 and 2) if it is to drive positive change |                                                                    |
| throughout DCLG.                                                        |                                                                    |
|                                                                          | This should include performance against mailbox and personal       |
| drive reduction targets, AFP usage and the application of retention      |                                                                    |
| in corporate repositories.                                              |                                                                    |
|                                                                          | Monitoring of performance should be the responsibility of the DRO, |
| escalated to the CIO and SIRO when necessary.                            |                                                                    |
| 4                                                                        |                                                                    |
| DCLG needs to ensure that management promotes and monitors               |                                                                    |
| compliance with corporate policy for information management.             |                                                                    |
|                                                                         |                                                                    |
|                                                                          | DCLG needs to monitor non-compliance with policy and define        |
| appropriate sanctions.                                                  |                                                                    |
|                                                                          | Where technically possible, CRMS must be given appropriate         |
| permissions to access divisional drives to allow oversight of            |                                                                    |
| compliance with policy.                                                 |                                                                    |
|                                                                          | The SIRO and CIO need to establish formal lines of communication   |

                                            

| 5.7,        | 5.17,    |
|-------------|----------|
| 5.22, 5.30, |          |
| 5.31, 5.35  |          |
| 5.7,        | 5.15,    |
| 5.17, 5.22, |          |
| 5.25, 5.27, |          |
| 5.30, 5.31, |          |
| 5.35,       |          |

to ensure that information management risks are visible and easily escalated. 

5 
CRMS must ensure that policies and guidance are aligned with the 
corporate priorities for information management (as defined by DCLG 
in recommendation 1). 

 
Policies need to be accompanied by an implementation plan based 
on DCLG prioritisation. 
 
As a matter of urgency, DCLG should create and distribute easy to use guidance based on the fundamental information management 
priorities.  
 
The head of Knowledge and information Access needs to continue 
to provide specific policy and guidance on: 

o FOIA and the application of exemptions as these develop 
6 
DCLG needs to understand the information that it holds, where it is 

## Stored And How It Needs To Be Used. This Will Support The Department In Identifying How Information Needs To Be Managed In Order To Ensure

statutory compliance.  

 
DCLG needs to agree ownership and responsibility for maintaining the departmental and Divisional Information Asset Registers (IARs) and how they will be used to inform risk and management decisions. 
 
CRMS, with the support of the CIO and SIRO, needs to ensure that Divisions are actively engaging in the process of recording the information that it creates and holds. DCLG also needs to continue to define what its key information assets are, where they are stored and how they need to be managed. 
 
DCLG should work with The National Archives to ensure that maximum benefit can be gained from its IAR ahead of the forthcoming ICT re-let. This includes increasing understanding of technological dependencies and usability requirements.  
 
DCLG needs to develop a clear strategy for aligning its current 

5.15, 5.68 
 
5.19, 5.35, 5.50 
Information Asset Register into wider Government data and 

information reviews, such as the forthcoming Data Inventory, ensuring all information assets are accounted for. 

7 
CRMS must implement its action plan to ensure compliance with the 20 year rule change. 
 
DCLG needs to ensure it has comprehensively planned its 

resource allocation to cope with the increased volume of review required for both DCLG and Department for Transport (DfT). 

8 
CRMS needs to ensure compliance with What To Keep and retention 
schedules in conjunction with Divisions to ensure that DCLG is 

capturing the records that it requires and that these are retained and destroyed in line with statutory obligations.  

|            |
|------------|
| defined.  |

 
DCLG must evaluate the full range of its legislative obligations and define minimum measures for compliance with these. 
 
DCLG needs to ensure that staff are aware of available guidance. 

Managers need to be aware of their responsibilities to promote and 

ensure compliance with policy and legislation 

|                                                                                | DCLG would benefit from using a reinvigorated Business Records       |
|--------------------------------------------------------------------------------|----------------------------------------------------------------------|
| Officer (BRO) network to champion and encourage good practice in               |                                                                      |
| this regard.                                                                   |                                                                      |
| 9                                                                              |                                                                      |
| DCLG must reduce the personal size limit for email to levels                   |                                                                      |
| congruent with other government departments. Use of personal                   |                                                                      |
| drives must also be addressed.                                                |                                                                      |
|                                                                                | A phased reduction is required with individual targets linked to the |
| migration to the new IT re-let schedule.                                      |                                                                      |
|                                                                                | Corporate targets must be decided and monitored by CIO, SIRO         |
| and DRO.                                                                       |                                                                      |
| 10                                                                             |                                                                      |
| DCLG needs to ensure that the action taken to review and dispose of 5.37, 5.47 |                                                                      |

5.44 5.25, 5.29 
5.41  

## Digital Information Is Fully Risk-Assessed Against Compliance With Legislative And Business Requirements. This Is Because Retrospective Application Of Retention Raises The Risk That Of Deleting Records And Information That Retain Value To The Organisation Or As A Public Record.

11 
DCLG must ensure that all technology change projects meet its information requirements.  
 
DCLG needs to develop a strategy for managing Digital Continuity. 
 
DCLG needs to ensure that information requirements are central to all technology change planning and projects, through the adoption 
of formal structures such as a technology change board. The National Archives Digital continuity guidance will support the department as it embeds good practice in to policies and processes. 
 
CRMS and IT must continue to run the digital continuity self assessment tool based on future electronic records held in Nearline Network Attached Storage and those held by TNT storage, and take appropriate mitigating action where risk is identified. 
12 
DCLG should take the opportunity to consider information security requirements ahead of the IT re-let with particular regard to striking the right balance between protecting and sharing information. 
13 
DCLG should re-invigorate the network of effective Business 
Records Officers (BROs) with sufficient coverage, appropriate delegation 
of authority, training and monitoring. This will enable DCLG to disseminate best practice and drive compliance, to ensure a minimum standard of consistent good practice in order to meet minimum statutory requirements, including compliance with the Public Record Act, Freedom of Information Act and the Data Protection Act.  
 
CRMS need to engage with BROs to create local What to Keep schedules for Divisions. These must be reviewed regularly. 
 
DCLG must ensure that the BRO network is maintained. CRMS needs to provide leadership and direction and coordinate 
5.48, 5.49, 5.74 5.60 5.60, 5.61, 5.62, 5.63, 5.64, 5.71 
 
CRMS must provide updated guidance and training for the role. 
CRMS should also take a lead in sharing and disseminating good 
practice. 
5.75 
14 
In order to ensure the success of any technology change, DCLG 

needs to define ownership for the management of the cultural change 
and establish how the department will achieve buy-in to corporate records management principles in the future technology environment. 

 
DCLG needs to ensure that any new ways of working are 

mandated and compliance monitored, including the use of corporate repositories. 

5.82 
15 
As DCLG's restructuring process is completed, the department 

should build on the knowledge management pilot and investigate ways of embedding knowledge management into team and project working.  
                                            

## Summary Of Good Practice

4.1 The following areas have been specifically identified as good practice in the 
report. 
1 **The review team undertake selection review at 25 years**, 
communicating review decisions with the Information Management Consultant from The National Archives. This helps to absorb some of 
the capacity pressures of meeting the targets for the 20 year rule change. 
2 The draft IT strategy is flexible. It will allow DCLG to adopt shared / 
cloud services when these become available, considering 
opportunities for standardising and simplifying the infrastructure. 
The department is also talking to suppliers about their requirements as part of the IT re-let process. This is good practice as it allows a discussion about the ways in which different parties would approach finding a solution to issues. It also helps to clarify any differences of interpretation at an early stage. 
3 DCLG is going beyond the minimum requirements of the 
Transparency 
Agenda, 
publishing 
financial 
information 
about 
expenditure on staff at a wider range of grades than other Whitehall 
departments.  
4 The Library team developed its own knowledge capture process 
and the planning team run a programme of 'apprenticeships'. This is good practice as it encourages staff to deepen their knowledge of the Division and the records and information being created. This is also done all year round, not just when individuals are leaving. 

## Highlights And Areas For Improvement Governance And Leadership Business Objectives

5.1 DCLG has gone through a period of significant restructuring. Current 
governance and oversight of information risk is not sufficient to ensure the department is protecting and utilising its key records and information assets effectively. 
 
5.2 DCLG has developed an overall corporate understanding of what information is 
valuable or important to the department, for business or legislative purposes, as demonstrated by the What to Keep guidance. This represents a good start. However, with regard to digital information there is limited oversight of what is being created and stored. The department needs to be assured that it is managing its records and information in line with minimum statutory requirements.  
 
5.3 Information is currently not understood as an enabler for the business and is 
not recognised as a corporate priority. The assessment team found limited corporate understanding about why information might be important to support DCLG in meeting its business aims or how it might pose a risk to the organisation. The exceptions are those areas with external scrutiny or where there is a clear risk of financial penalties. In the case of the European Regional 
Development Fund (ERDF), the risk is of an interruption to funding if records cannot be provided to the standards required by the EC. To mitigate this, DCLG has set up a programme to coordinate the closure and capture of records. In general terms however, senior oversight, understanding and monitoring to ensure that records and information are captured and managed effectively was not evident either from the documentation supplied or the interviews conducted. 
 
5.4 In the majority of cases there is no mechanism for ensuring that information 
management practice is in accordance with policy and supports business need. This means that DCLG cannot assure itself that information and vital records are being captured and secured effectively by individual teams. This puts DCLG at risk of not being able to account for its actions. 

5.5 DCLG defined general principles for records management ahead of ALB 
closure. DCLG has also documented corporate aims for information management in the department for the period 2012–13. However, DCLG must 
review and build on these in light of the risks highlighted in this report to ensure minimum compliance. The department must define the way in which information management supports the achievement of departmental aims and the role of the information management function within the department. This will help DCLG in achieving minimum legislative compliance over the restructuring exercise 
and 
forthcoming 
Information 
Technology 
(IT) 
re-let. 
See 
recommendation 1.  
 
5.6 These aims need to be prioritised as actions for Corporate Records 
Management Service (CRMS) and Knowledge and Information Access in order to raise capability and ensure that information management practice support DCLG business objectives. This needs to be based on a realistic assessment 
of what can be achieved with the resources available. **See recommendation 2**. 
 
5.7 This prioritisation needs to be backed up with a commitment to ensure 
adequate support for information management. This needs to include making sure that managers understand and report on their responsibilities and that monitoring is taking place. The organisation also needs to set out good practice 
in information management. **See recommendations 3 and 4**. 

## Strategic Management

5.8 The DCLG IT strategy includes the aspiration to become a top performing 
department. This means that the department 'consistently get the basics right'. 
The department understands and recognises this in terms of IT. If DCLG is to ensure compliance and drive significant improvements in its performance, information management must also be prioritised as one of these basics. 
5.9 Strategic clarity is a current priority for the DCLG board. This includes 
monitoring and advising on how business functions contribute to the achievement of the departmental vision. However the department lacks an up to date strategic plan for information management. The assessment team viewed requirements for a DCLG Knowledge Management Strategy that 
focuses on the synergy between information management, Information Technology (IT) and culture. It establishes core principles such as the need to effectively coordinate these three elements, and proposes the use of a maturity model. This is a good start, but the assessment team was unable to confirm how this has been taken forward.  

 
5.10 Long-established processes for the management of paper records mean that 
the paper lifecycle is managed with a good level of assurance. However, the lack of a strategic and prioritised approach to the management of digital information impedes the ability of DCLG to ensure that it is taking effective and 
proportionate action to manage its information risk. 5.11 The absence of strategic direction and planning has contributed to the 
accumulation of large amounts of digital information in multiple repositories. CRMS has struggled to manage the impact of this. DCLG needs to prioritise actions to resolve the causal problems associated with storage and creation of 
digital information. **See recommendations 1 and 2.** 
 
5.12 The assessment team understands that CRMS members are prioritising 
statutory functions, such as FOI performance.  However the prevailing circumstances within the department mean that the focus is on the day-to-day, not strategic. CRMS has limited resources and has focused its attention on dealing with specific priorities. This includes managing the influx of ERDF records and others from closure of the Government Office Network and other 
Arm's Length Bodies (ALB) coupled with the transfer of over 2.5 million files 
from one offsite file storage supplier to another. 
 
5.13 The SIRO, appointed in Q3 2011, is the champion for information management 
at board level and has only just started to actively engage with this role. The CIO has responsibility for both technology and records management and is the only formal representation for information management on any board. The CIO and SIRO need to assume responsibility for driving change with regard to information management, ensuring clearly defined information management 
goals and clear ownership of actions as established above.  See recommendations 1 and 2. 
 
5.14 The 2007 IMA, carried out by The National Archives, identified issues that have 
not yet been completed. Since then, DCLG information holdings and 
subsequent risks and effort required to mitigate the risks have increased. DCLG cannot wait until a technology solution is in place before taking action. The Comprehensive Spending Review cost savings in October 2010 halted the implementation of LiveLink EDRMS throughout the department. This has left DCLG continuing with an interim Approved Fileplan (AFP) of MS Office folders and shared drives. However, AFPs were not rolled out to the whole of DCLG and are not used by all business areas. This creates problems applying and managing security, access and disposal.  

 
5.15 DCLG needs to make appropriate corporate systems available to users with 
clear policy, guidance and monitoring to enforce their use. However, ahead of the IT re-let, the department needs to ensure that *good enough* policies, procedures and governance are in place to identify and assure the capture of 
valuable information from staff. **See recommendations 4 and 5**. 
 
5.16 Organisationally, attempts are being made to document the technical 
architecture and information flow, ultimately developing an enterprise architecture with plans to incorporate information requirements at a later stage. This is a good start and should be developed to reflect the corporate priorities for knowledge and information management within DCLG. 
 

## Management Controls

5.17 Current management controls cannot address and do not adequately mitigate 
the risks of heterogeneous or poor records and information practice. The 
assessment team found that business areas exercise almost complete autonomy in the way in which they manage records and information. The majority of managers have never been encouraged to monitor or report on the management of information and there is no central mechanism to ensure that business areas are following central policy and guidance. In order to drive improvements in information management, DCLG must define appropriate 
metrics to monitor compliance and progress. **See recommendations 3 and 4**. 
 
5.18 There is no central oversight of the information held by DCLG. The DCLG 
Information Asset Register (IAR) is potentially an important tool for capturing key departmental information assets and its use should be expanded as a tool to ensure ownership and monitor risk. The assessment team is not assured 
that the IAR captures all of the key information assets within DCLG. It is not clear how the information on the IAR snapshot seen by the assessment team is derived from the quarterly returns completed by IAOs or their deputies. 

 

5.19 It is imperative that DCLG understands its key information assets ahead of the 
restructuring. Information Asset Registers are key tools that can enable organisations to map information and technology lifecycles as well as informing decisions about the management and assurance of information. This will be a significant task. DCLG should start by ensuring that the key assets are identified and recorded prior to the IT re-let, with a plan to incrementally build 
up this understanding to cover all information assets. **See recommendation 6**. 
 
5.20 The assessment team is not clear what benefit DCLG is currently gaining from 
use of the IAR, or how it is used to inform decisions about the management of information risk. The assessment team found IAOs to be aware of their responsibilities, but uncertain about why or how information submitted would be used. Ownership of the IAR at a divisional level was also unclear, except where business areas had recognised the associated risk and implemented their own structures, such as finance and planning. Within the planning division the initiative had been taken to expand the divisional IAR to 'look beyond personal data'. This is a good start and CRMS should take a lead in sharing similar good practice initiatives. 

## Resourcing

5.21 The reduction in staff numbers in 2011/12 will result in a significant loss of 
knowledge and expertise. This will have an impact on the ability of the organisation to understand and manage its legacy information. The changes that DCLG is facing require an immediate focus on digital information management. The department needs to ensure that it is capturing and protecting key records and information through the effective application of corporate policy. DCLG also needs to manage records and information already held in various repositories throughout the organisation if the department is to maintain minimum statutory compliance. This is not something that CRMS can achieve on its own. Once it has defined its corporate priorities for information management, DCLG needs to ensure that adequate support is provided to 
CRMS and the business. **See recommendations 1 and 2**. 
5.22 CRMS has decreased in size over the previous five years, although the total 
volume of records managed has increased by 25%.  CRMS is currently not 
providing sufficient outreach, education or audit of current practice. The assessment team was not able to ascertain if this was the result of a planned change in service provision, or a reflection of limited resources. At present, CRMS staff are predominantly engaged in 'fire fighting' and are not engaged in proactive activities such as ensuring the use of AFPs and routine establishment 
of file plans or promoting good practice. **See recommendations 2, 3 and 4**. 

## 5.23 The Crms Records Review Team In Hastings Also Provides A Review Function For

the Department for Transport. This contract is well managed and the service provided includes review and support to BROs within DfT.  The advent of the 20-year rule change will increase the quantity of review required which will impact on the service provided. CRMS, supported by senior management, needs to prioritise the implementation of an action plan to ensure compliance with the 20 year rule change, ensuring it has comprehensively planned to cope with the increased volume of review required for both DCLG and DfT with the 
resources at its disposal. **See recommendation 2 and 7**. 
 

## Risk Management

5.24 Information management risks are reported to the board quarterly via an 
information pack which predominantly focuses on FOI statistics.  The 
assessment team found some understanding of compliance risk. For example, the measures taken to secure the information assets of the Government Office Network and several DCLG ALBs that were closed over the last two years. However, the assessment team was not sufficiently assured that DCLG has an 
understanding of the distinction between IT and information risks.4 In addition, 
although senior managers were found to be aware of financial and resource risks, wider information risk relating to storage of information and record 
 
creation, were not widely understood or documented.5 
 

5.25 The lack of a strategic approach to information management means that there 
is no means of ensuring that risk is being effectively managed. The draft Records Management policy explicitly states information management responsibilities according to role. This includes the responsibility of the DRO to ensure compliance with the Public Records Act (PRA). This is a good start. In order to ensure that the department is effectively managing the full spectrum of information risk, DCLG must ensure that responsibility and accountability for 
information management is enforced through management structures. See 
recommendations 4 and 8. 
 

5.26 The assessment team were unable to view the departmental risk register on 
site or the CRMS divisional risk register. Therefore the team was unable to assess the oversight and capture of information risk. The Planning Division has previously monitored some information risk on their divisional risk register. However, this is an exception. Information risk is not generally monitored on divisional risk registers (such as risks relating to the loss of ability to find, access, work with, understand or trust information). 
 

5.27 Interviewees were not able to confirm what level of Information Assurance 
Maturity Model (IAMM) DCLG currently operates at. The SIRO, as departmental risk owner, must ensure that this distinction is understood and that information risk is monitored and mitigated. The SIRO and CIO need to establish formal lines of communication to ensure that information management 
risks are visible and can be escalated through a managed process. See recommendation 4. 

## Information And Records Management Creation

5.28 Records management guidance available on the intranet defines at a high level 
what constitutes a record and sets out responsibilities for records creation and storage. The vast majority of staff were not aware of this guidance or had never accessed it. The assessment team found that there is no DCLG-wide understanding of records created that are of value and need to be retained. DCLG's corporate Retention and Deletion policy has been signed off by the 
management board. This policy states that disposal agreements should be created by the Division in conjunction with CRMS. However the assessment team were told that these only partially exist for AFPs (not for other repositories such as shared drives) and that compliance is not enforced or monitored. 
5.29 The assessment team found that interviewees did not have a clear 
understanding of what records need to be retained within their business areas. They could not identify having referred to a retention or disposition schedule to inform their decision-making. DCLG needs to revisit and ensure that What to Keep requirements are comprehensively documented for each Division, including what categories of information needs to be retained and for how long. Building this into the process for establishing new projects or policy areas as a matter of course would be beneficial in establishing good practice principles from the outset. DCLG may benefit from using a reinvigorated Business 
Records Officer (BRO) network in this regard. **See recommendation 8**. 
 
5.30 DCLG guidance states that 'all records should be held within an approved 
environment, 
by 
the 
Departmental 
Records 
Officer'. 
The 
approved 
environments include registered paper files, and AFPs, pending the introduction of an Electronic Document Records Management System (EDRMS). The AFP is the corporate repository of choice in the absence of an EDRMS. However the department-wide roll-out of this interim solution was not completed and many of the business areas do not have access to the AFP. Use of shared drives as a temporary corporate repository has therefore been sanctioned in this RM guidance. However, where AFPs or shared drives are used there is no central oversight or control over structure or content. This means there is no assurance that key records are being captured and stored 

## Correctly In Corporate Repositories. **See Recommendations 3 And 4**.

5.31 The Records Management Policy (in draft stage at the time of the assessment) 
includes the responsibility of managers and the responsibility of each member 
of staff to keep accurate records under the Civil Service Code. DCLG needs to ensure that all staff are aware of their responsibilities. Once signed off, DCLG needs to define who is responsible for ensuring that these responsibilities are 
being met and define ways to monitor compliance. See recommendations 3 and 4. 
 
5.32 Generally, DCLG has well established tracking and review processes in place 
for paper records. This is encouraging. However, the assessment team also heard some examples of unregistered files being created. In each case this was due to a lack of understanding of the proper processes and the interviewee not knowing where to find advice and guidance about how to set up files, what information needed to be kept and how this should be done.  
 

## Storage

5.33 The lack of a single corporate repository for digital information means that 
information is stored in a combination of AFPs, Shared Drives, Outlook, LiveLink, SharePoint, personal drives and other systems. With little active monitoring of retention and deletion of digital information, staff are storing information of value to the department alongside ephemeral information in these systems. CRMS were trialling a new process to combat this at the time of 
the onsite assessment, introducing two separate areas in to the fileplan. One will be for *work in progress* (and have automatic destruction applied to information stored within it) and the other for *records*. The aim of this is to encourage staff to identify and select records as they go, with ephemeral information being deleted after a defined period of time. This is an encouraging initiative. CRMS need to ensure that compliance with this is monitored in order 
to ensure that key records and information are not destroyed.6 
                                            
 

5.34 AFPs have been operating for several years but their efficiency over time is 
dependent upon staff understanding their responsibilities and following 
corporate guidance, as well as the appointment of Business Records Officers (BROs) to regulate and maintain them and the development and application of divisional disposition schedules. AFP file plans were originally agreed with CRMS with restrictions on the number of levels that can be created. Any changes to the file plan or permissions should be made through IT supplier Steria. If followed, this process would allow DCLG much greater ability to control and manage the information stored in this system. However, AFPs have 
not been made universally available. 
 

5.35 At the time of assessment, CRMS had received fewer than 5 requests to set up 
AFPs in the previous 12 months. Interviewees suggested that business areas are not following corporate policy on the development and maintenance of file plans. Instead they are adding low level additions to the existing structure or shared drives, because it is less bureaucratic or more familiar to staff than setting up an AFP. This combination of systems does not support good information management practice. It is difficult to effectively implement version control and regulate access; either restricting or making information available. Shared drives allow little corporate oversight of the information stored within them and the file plan is not managed. One interviewee described the file plan for their high profile business function as being an 'organic monster'. There is no automatic CRMS contact or involvement in new areas or teams; here the expectation on the part of CRMS is that the BRO toolkit will be used at a local 
level to set up the file plan. The lack of oversight and ownership is such that the contents of shared drives cannot be mapped to business areas, impacting on 
the ability to store, use and protect information. See recommendations 3, 4 and 6. 
 
5.36 Figures from December 2011 show a total of 4 terabytes (TB) stored in both 
personal drives and Outlook mailboxes. Information and records stored in these is essentially invisible to DCLG centrally. Interviewees described using email as a repository for storing the information that they required to do their job and some did not use corporate solutions such as AFPs or shared drives, despite their availability, because they found it easier to retrieve information from Outlook.  
5.37 DCLG needs to define and prioritise its requirements for information 
management to inform the storage options available within the department. The transfer of all electronic information stored on the AFP that is over three years 
old to Nearline Network Attached Storage (NAS) in October 2010 was a decision based on capacity and driven by the technology needs of the department. This is a temporary archiving solution and not a decision based on the requirements of the department for the information contained within the system. DCLG needs to assure itself that its proposed destruction does not put 
its compliance with legislation at risk. **See recommendation 10**. 
 

## Management Of Information

5.38 Current inconsistent or poor practice has an impact on the efficiency and ability 
of DCLG to make evidence-based decisions. One interviewee reported difficulties accessing historical information and synthesising it to inform policy decisions. Another senior interviewee remarked that the 'department is not in a position to look back and test how good past assumptions were'. This has an impact on the ability of DCLG to deliver robust, evidence-based policy and learn from previous actions. Interviewees also expressed concern that the context of policy decisions may not be intelligible to those trying to understand it in five years time. This is due to the inconsistent capture of records and information in corporate systems. This is a particular risk at present because of the loss of knowledgeable staff and the inconsistent use of corporate systems to capture records and information.  
 
5.39 The proliferation of digital information, particularly the size of Outlook 
mailboxes, is a key priority for the CIO. However this is predominantly articulated as a capacity issue. The assessment team found little recognition that the information contained within the emails may be public records or require managing to ensure legislative compliance. 
5.40 The risks relating to the proliferation of email were highlighted in The National 
Archives 2007 IMA report. Since then the maximum mailbox size has been reduced from 1.5 gigabyte (GB) to 1.0 GB per individual mailbox. Outlook and personal drives are used as a repository by staff, with departmental statistics showing the number of users with mailboxes over the 1.5 GB limit rising from 
134 in May 2011 to 141 by the end of the year. This is against an overall drop in total Outlook storage from 2.31 TB to 2.09 TB in the same period. The number of staff with personal drives in excess of 5GB rose from 67 to 80 in the same period. 

5.41 The 1GB mailbox user limit is up to ten times that of business users in 
comparable government departments. It does not encourage staff to use appropriate corporate repositories to store their digital information or to delete unnecessary or ephemeral information according to policy. As such it impedes the ability of DCLG to find, access, protect and exploit information. There is a 
significant risk that DCLG will lose information and records during the restructure, as there is no compulsion for staff to move all of the business information to an appropriate corporate repository. DCLG must reduce the size limit for email in combination with a drive to enforce retention guidance and 
good practice in using corporate repositories. **See recommendation 9**. 5.42 DCLG has begun to extend LiveLink EDRMS to staff with mailboxes over 2GB 
in order to encourage good filing practice. The assessment team was told that some staff transfer the contents of large mailboxes in bulk to an area in the EDRMS. An automatic destruction marker of 10 years (AD 10) will be applied to senior employees' mailbox content with business areas aware that they will be responsible for keeping the records of any decisions made. DCLG needs to ensure that mechanisms are in place to ensure the capture of records and information of business value, otherwise records of historical value may be deleted, stored inappropriately or be missing vital context.  
 

## Appraisal, Disposal And Transfer

5.43 CRMS is divided between London and Hastings. London mainly provides a 
paper file creation and offsite storage, archiving and retrieval service. Hastings deals with paper file creation, electronic file plan creation, and maintaining the records catalogue. DCLG has a long-standing shared service in place for DfT and its agencies. 
5.44 DCLG has a long-established system of macro review of paper records, 
conducted by staff with expertise and a comprehensive set of documentation to guide and record selection decisions. The review team have for a number of 
years undertaken selection review at 25 years and there is good communication of review decisions with the Information Management Consultant from The National Archives. **This is good practice**. It will help to absorb some of the capacity pressures of meeting the targets for the 20 year rule change. However, DCLG should also prioritise implementation of its action plan to ensure compliance. **See Recommendation 7.** 
 

5.45 DCLG holds some files over 30 years old for which the Lord Chancellor's 
Instrument has lapsed. The department needs to retain these in perpetuity. The DRO needs to clarify the status of these and seek advice from The National 
Archives 
in 
order 
to 
ensure 
that 
legal 
requirements 
are 
met.  
 
5.46 The records review team in Hastings has begun to undertake a review of the 
records currently stored on Nearline that were created by, or relate to, the Information Management function. The team notionally has responsibility for reviewing the remainder of the electronic information on the drive that is between 3 and 8 years old. However, there is no clear plan about how this will be approached and CRMS does not have the capacity to review effectively the quantity of information for selection. The assessment team was informed that the majority of information will have AD10 applied and sent to TNT with no plans to review this material again. At present DCLG cannot provide assurance that records and information of value will not be deleted. 
5.47 The National Archives has previously expressed concern that this course of 
action will leave DCLG in breach of the Public Records Act. DCLG need to 
undertake a risk assessment to ensure that this does not impact on their 
responsibilities under the PRA, DPA and FOI. **See recommendation 10**.   
 

## Digital Continuity

5.48 DCLG does not have a digital continuity strategy. The assessment team found 
evidence that the department understands the need to ensure that technology supports business need. This is a good start; however there are no formal mechanisms to ensure that information requirements are considered during technology change. Whilst it is reassuring that informal regular communication does take place between CRMS and IT, the introduction of formal processes will ensure that DCLG information management requirements are embedded 
within IT change management and planning. **See recommendations 2 and 11**. 

 

5.49 The department needs to ensure that technology change will not impact on 
(and in the case of Nearline has not impacted on) its ability to use and protect its information. In order to ensure it can manage its information effectively, DCLG needs to make initial efforts to understand what information it holds, what it needs to keep and its requirements to find, access, work with, 
understand and trust7 its key digital information assets. DCLG also needs to 
ensure that technology change has not impacted on its ability to use and 
protect its information by conducting a digital continuity risk assessment.8 
DCLG needs to ensure that digital continuity requirements are built in to its IT 
strategy. **See recommendation 11**. 
 

5.50 The department is at a critical juncture and needs to develop a plan to utilise its 
IAR as a comprehensive management tool. DCLG should start by defining key assets to ensure these are managed appropriately and build up its understanding incrementally over a defined period of time. The IAR should also be used to ensure that the IT re-let meets the information requirements and 
business needs of the organisation.9 **See recommendation 6**.  
 5.51 The draft IT strategy begins to map information requirements to business 

functions. The new contract will allow flexibility to adopt shared / cloud services when these become available. The DCLG IT strategy begins to consider the technical architecture and look at opportunities for standardising and simplifying the infrastructure. The department is also talking to suppliers about their 
requirements as part of the IT re-let process. **This is good practice**. It allows a 
discussion about the ways in which different parties would approach finding a solution to issues. It also helps to clarify any differences of interpretation at an early stage. The department needs to ensure that where multiple systems are merged and any information that is migrated retains its necessary functionality and metadata and that digital continuity best practice is built in to the 
procurement.10 DCLG needs to ensure that migration strategies, interoperability and impact assessments on the usability and availability of information are part of the process. 

                                            

## Access To Information Freedom Of Information (Foi) / Data Protection Act (Dpa)

5.52 The latest FOI statistics for DCLG (Q3 2011) demonstrates that 92 per cent of 
responses were within time, including extensions. Encouragingly, departmental policy makes it clear that all staff have responsibility for FOI. 
5.53 DCLG is confident that the restructure has not yet affected the departments' 
FOI capability. However, the loss of staff, use of multiple repositories and an 
absence of knowledge capture processes will make retrieval of information for FOI more difficult or time consuming. The recommendations in this report will support DCLG to preserve its high response rate through the ability to find, access and trust the information that it holds.  
 
5.54  Clear policy and guidance relating to the appropriate use of exemptions needs 
to be defined by the head of the Knowledge and Information Access unit.  
 
5.55 A number of projects were unclear about the assignment arrangements for 
crown copyright material transferring to non-crown bodies.  
 

## Re-Use

5.56 DCLG has recognised the potential to remove technical barriers and improve 
collaboration through the IT re-let. Currently, staff encounter difficulties sharing 
information between different areas of shared drives, or between shared drives and AFPs. The inability to search or access information stored in other divisions or business areas is such that interviewees reported that the sharing and re-use of information is rare. This results in the duplication of effort and siloed working practices. One interviewee stated 'there's a wealth of knowledge 
and experience in DCLG but it's inaccessible. Someone must have done things 
before.' Collaboration requirements will be built in to the IT re-let. To support this, sharing requirements should be recorded against information assets on the IAR to ensure that these are considered through the requirements development process. 

## Transparency

5.57 Increasing transparency is a strategic priority for the department. DCLG 
publishes 789 datasets on data.gov.uk and publish more information about pay 
than the minimum requirements. **This is good practice**. Action taken to 
address the recommendations in this report will also further support the department's compliance with the reuse of public sector information, through supporting DCLG to identify the information that it holds and mapping this to an IAR. 
 

## Security

5.58 DCLG is not managing information security risks effectively. Access 
permissions are not controlled effectively on AFPs or shared drives. DCLG has no formal capability to apply access permissions on shared drives.  Processes are in place to remove permissions from AFP but are not always applied leaving staff with the capability to continue to access, modify and delete information inappropriately. This poses a risk to the integrity of the departments' digital information. Human resources inform IT when staff change jobs or leave the department. However the vast majority of interviewees had never had permissions reviewed or revoked when they had changed role. This is the responsibility of the line manager to action but there is no imperative to ensure that this is done. 
5.59 Staff are able to use unencrypted removable media, with the risk that files or 
information could be inappropriately downloaded from or uploaded to corporate systems. AFPs and shared drives do not have an audit trail so it is not possible to tell who has accessed or modified information, or whether information has been downloaded. This presents a security risk. Personal and sensitive information could be downloaded without the ability of the organisation to trace this. 5.60 The assessment team understands that DCLG has carried out a risk 
assessment that concluded current arrangements fall within the department's risk appetite. However, this report recommends that security requirements must be addressed in the IT re-let exercise, with careful consideration given to ability to monitor, apply and revoke access permissions. BROs could perform this task 
however there must be a policy and process that is followed to ensure that this is done. **See recommendations 4, 12 and 13**.  

## Compliance Staff Responsibilities And Delegations

5.61 DCLG lacks a coherent mechanism to promote, monitor and support 
information management. At the time of assessment, the majority of business areas had IT Focal Points. These act as a conduit to liaise with Steria regarding changes to the file plan or permissions. IT Focal Points have assumed more prominence in the department than BROs. The BRO role was originally intended as the vehicle for oversight and management of information within 
divisions. The role remains referenced as such in policy documentation. Key expectations on BROs include the requirement to administer and control divisional file plans and encourage compliance with records management policy. However, at present, an effective network does not exist in practice. Alternative solutions have not been put in place and guidance has not been updated. 
5.62 Divisions currently exert almost complete autonomy over information 
management practice. The assessment team understand that there are plans to re-launch the BRO role with an email from the SIRO in August 2012. This is an excellent opportunity for DCLG to embed clearly articulated priorities for information management throughout the department. To be most effective, the re-launch requires a structured roll-out with BRO responsibilities clearly defined and supporting corporate information management priorities. CRMS need to ensure new BROs are trained and are equipped to develop What to Keep 
schedules within their division in conjunction with CRMS. They should monitor retention and destruction, as well as compliance with corporate information 
management policy. **See recommendation 13**. 5.63 DCLG needs to review and revise the responsibilities for the BRO role 
according to the corporate requirements for information management in the department. As a minimum, the BRO must be fully equipped with the time to carry out their responsibilities and with the access permissions necessary to perform the role. Training, access to guidance and a consistent understanding about what DCLG needs to keep, how and why is also required. BROs need to have responsibility for monitoring compliance with policy. They should also continue the responsibility to maintain a Contents Page for each first level 
folder, including a description of the information and retention period. This knowledge should be utilised by liaising with the Divisional IAO when completing returns for the IAR. In order to ensure the longevity and success of the role, DCLG should establish an active network with regular meetings to discuss and share ideas and initiatives. A space on the intranet (or another suitable location) to make standard resources available would also be of benefit.11 **See recommendation 13**. 

5.64 DCLG needs to ensure that non compliance with corporate policy is monitored 
and issues escalated where appropriate. DCLG also needs to delegate 
responsibility for this at an appropriate level. After defining its corporate priorities, DCLG should assess whether this responsibility is most appropriate for the IAO or BRO. DCLG must ensure that this is monitored by senior management. Department for Transport has a network of BROs in place throughout the organisation and other departments such as Ministry of Justice are working to re-establish their own networks. These may be able to provide 
advice and lessons learned to support the set up of an effective network. See recommendations 4 and 13. 
 

## Policies And Guidance

5.65 At the time of assessment, the Records management policy, Appraisal policy, 
Electronic filing policy and Paper filing policy were in a draft form. The Retention and Deletion policy has Board approval. The policies reviewed by the team are comprehensive and recognise the importance of their application and 
obligations of the department. However, the assessment team were not able to confirm that these policies or their antecedents are used. The interviews were unable to verify how they inform priorities and guidance. None had corresponding implementation plans. For example, while the assessment team understands that retention schedules have been developed with Divisions, there was little evidence that they were being actively used to inform retention and deletion. 
                                            

5.66 The draft Records management policy (referred to above) needs to ensure that 
DCLG is meeting minimum statutory requirements and is accompanied by an implementation plan to define the key activities. This must be developed once 
DCLG has defined its information management priorities within the business and defined what the priority attention areas are for the CRMS function. The policy does not currently mention the BRO role or other support structures. In order to increase buy-in and support from DCLG senior management, CRMS should ensure that this policy details the ways in which information management supports the aims and priorities of the organisation, and document how it will achieve these aims and with what resource. 5.67 Information management guidance is available on the intranet. However, the 
majority of interviewees were unaware of, or had never used, this resource. Of those who were aware of the guidance, the majority felt that the guidance was not as useful as they required, and 'not easy to search' because of poor intranet search functionality. 5.68 The information management guidance seen by the assessment team covers 
the fundamental principles of information management. The IT re-fresh makes the production of a whole suite of guidance untenable, as much of it will change with the introduction of a new technology system. However, the CRMS could begin to embed good practice and drive key changes through the production of a clear set of short pieces of guidance promoting basic responsibilities to be applied in the interim. This should reflect the corporate priorities set out for 
information management. **See recommendation 5**. 5.69 To reduce the burden on CRMS, the department should promote the sharing of 
good practice and lessons learned. In an example of good practice a BRO reported that they have re-written guidance for their division, making it simple and easy to follow. CRMS should consider ways to facilitate the sharing of this guidance amongst BROs and other staff. 
 

## Training

5.70 The lack of formal training in DCLG constrains the ability of the department to 
make improvements in its information management capability. Other than completing the mandatory Cabinet Office Data Handling e-learning package, 
the overwhelming majority of interviewees reported having not had any formal training in the previous 3 years. The assessment team was told that 'it is not obvious what training or support is available'. One interviewee described having to 'fight' to get training for their team to help them to understand their basic information management responsibilities. Induction and refresher training will help to raise the capability of staff and the profile and benefits good information management. 

5.71 Pockets of good practice exist with some BROs taking the initiative to provide 
training in their Division, including one BRO who had created a presentation for 
about how information should be stored and managed on the AFP. CRMS can utilise this to support their own role by ensuring that mechanisms are in place 
to share good quality resources and good practice. **See recommendation 13**. 
 

## Change Management

5.72 The assessment team is not confident that DCLG has fully considered the 
impact of staff loss and restructuring on the ability of the department to manage its records and information through the current period of significant change. Adequate mitigating actions are not in place. 
5.73 Because of the large volumes of information stored outside corporate oversight 
and control, there is a significant risk that re-structuring and reductions in 
staffing numbers will result in contextual information being lost. This will impair 
the ability of the department to account for its actions or understand information or records that it has created. There is no assurance that individuals who leave will store information that has corporate value in corporate systems. No processes or monitoring are in place to mitigate this risk. The corporate repositories themselves are not controlled so key information may subsequently be lost. This places DCLG at serious risk of not being able to manage, protect and retrieve information that it has a duty to manage under the Public Records Act, FOI and DPA legislation. 5.74 The IT re-let is managed by IT. The development of a map of the enterprise 
architecture is part of the draft IT strategy. It is tied in to the IT re-let and maps business areas to technology. It is yet to define the information flow and information requirements, although these are planned to form part of this at a 
later stage. This is a good start but it will come too late to mitigate the risks associated with the restructuring. At present, IT have not mapped the information and owners to drives, making it very hard to assess the impact of any changes. There has been informal collaboration with the CRMS. DCLG needs to ensure that information management requirements are recorded and used to test the suitability of any technology solution. CRMS and IT must develop formal structures of communication to ensure that DCLG is effectively assuring its ability to use its key information assets over technology change. 

See recommendation 11. 

 
5.75 The department needs to ensure that the behavioural elements of the 
technology change are managed in order to ensure its success. A significant number of interviewees reported that they did not feel engaged or suitably informed about the changes taking place within the department. Technology change necessitates a change in working practices and DCLG need to ensure that staff feel engaged and informed about the impact and benefits of technology change. The perception that the department is committed and prioritising records and information from the top will also be vital to drive good practice and compliance, but needs to go hand-in-hand with monitoring of compliance and adherence to new working practices. Clearly defined ownership for the behavioural change needs to accompany the technology 
change. **See recommendation 14**. 
 
5.76 DCLG is managing some changes well where threats are recognised, such as 
the proactive approach taken to ingest of ALB and Government Office Network 
(GON) paper files. Large projects have been set up to take in and quality assure an estimated 750 paper files relating to ERDF from each of the five remaining GON. There are currently plans to register all ex-GON files once the ERDF files have been completed as these have taken priority.  In addition DCLG has managed the migration of 2.5 million files from one off site storage contractor to another, without impacting on its service to users. 
 

## Culture Commitment

5.77 The focus of the last year for DCLG was the departmental restructuring. The 
assessment team found little evidence of corporate commitment to good information management within this, either as a component of the change programme 
or 
as 
business 
as 
usual within 
the 
department. 
The 
recommendations made in the IMA report in 2007 have largely been left in abeyance, awaiting the introduction of a system for managing its electronic 
records. If DCLG does not take immediate action, the complexity and cost of resolving these issues will continue to increase.  
 
5.78 DCLG must assess the impact of this and communicate the benefits of good 
information management to all staff, including their responsibilities under the Civil Service Code and the benefits to the individual and the department of 
following section 46 good practice.12  
 

## Staff Understanding

5.79 Staff understanding about their information management responsibilities is 
inconsistent. The assessment team is not assured that the majority of interviewees understand that the information they create is a corporate resource. Information that is created by individuals tends to be kept interminably 'just in case' the creator requires it at a later stage. The 
assessment team found no evidence that understanding and application of retention at a local level is pervasive and little recognition that information should be retained for a pre-determined period of time. 
5.80 Pockets of good practice do exist. However, the majority of interviewees did not 
have regular contact with the corporate records management function. They were uncertain about where they could find guidance, support and advice about how to manage records and information in their business area. This gives 
                                            
effective autonomy to Divisions. The information assurance and risk management strategy recognises that 'there is much guidance available on the intranet to describe CLGs policies and process for handling information; 
however, some staff are unaware of the content, or complacent to the seriousness of the risk.' Staff understanding about their responsibilities must be reiterated as part of DCLGs desire to 'consistently get the basics right'. See recommendations 2 and 4. 

 

## Knowledge Management/Transfer

5.81 DCLG has not defined what it means by knowledge. As highlighted above, 
DCLG's requirements for a knowledge strategy establishes cogent sensible principles and recognises that culture and IT impact on the ability of the organisation to manage knowledge. However the specific objectives, milestones and timescales of the strategy need to be updated. 
5.82 The loss of staff and subsequent loss of knowledge and understanding about 
records will impact on the ability of DCLG to manage, protect and use its information. The Change Management section details the assessment team's findings about knowledge capture. Business areas throughout DCLG operate as silos, with interviewees rarely reporting the need to collaborate, share ideas or refer to information created before the current administration. Available technology isn't conducive to collaboration, which DCLG recognises. However, 
there has been little attempt made to break down cultural barriers between 
business areas or divisions or promote a corporate identity. The CIO and SIRO need to assume responsibility for promoting records and information as a vital corporate resource, driving this change and leading from the top. DCLG may also benefit from considering approaches being developed by other 
departments such as the Ministry of Justice. **See recommendations 1 and 15**. 5.83 The Library team has developed its own knowledge capture process and the 
planning team run a programme of 'apprenticeships'. **This is good practice.** It 
encourages staff to shadow other people in order to deepen their knowledge. This is done all year round, not just when individuals are leaving. 

## Appendix One: Glossary

| AFP                                                 | Approved FilePlan                               |
|-----------------------------------------------------|-------------------------------------------------|
| ALB                                                 | Arm's Length Bodies                             |
| BRO                                                 |                                                 |
| Business Records Officer                            |                                                 |
|                                                     |                                                 |
| CIO                                                 | Chief Information Officer                       |
| CRMS                                                | Corporate Records Management Service            |
| DfT                                                 |                                                 |
| Department for Transport                            |                                                 |
|                                                     |                                                 |
| DCLG                                                | Department for Communities and Local Government |
| DPA                                                 | Data Protection Act                             |
| EDRMS Electronic Document Records Management System |                                                 |
| ERDF                                                | European Regional Development Fund              |
| FOI                                                 | Freedom of Information                          |
| GB                                                  | Gigabyte                                        |
| GON                                                 | Government Office Network                       |
| GPMS                                                | Government Protective Marking Scheme            |
| IA                                                  | Information Assurance                           |
| IAMM                                                | Information Assurance Maturity Model            |
| IAO                                                 | Information Asset Owner                         |
| IAR                                                 | Information Asset Register                      |
 
IMA 
Information Management Assessment 
 
IT 
Information Technology 
 
KIM 
Knowledge and Information Management 
 
 
LCI 
Lord Chancellor's Instrument 
NAS 
Network Attached Storage 
 
PRA 
Public Records Act 
 
Section 
 
Lord Chancellor's Code of Practice on the management of records 
issued under section 46 of the Freedom of Information Act 2000  
46 
 
SIRO 
Senior Information Risk Owner 
TB 
Terabyte 

## Appendix Two: The Assessment Team

 
The assessment was conducted by members of the Standards Department and specialist colleagues from The National Archives, 12–19 March 2012. The assessment team comprised: 

 Head of Standards  Standards and Information Policy Manager 
 Standards and Assessment Manager  Standards Adviser  Head of Information Management and Practice  Information Management Consultants  Digital Preservation Advice Service Manager   The National Archives CEO (Observer)  Director of Information Policy and Services (Observer) 

## Assistance Provided By Dclg:

The Assessment team are grateful for the cooperation and assistance of all staff at DCLG who were interviewed, provided additional information or facilitated the assessment process. Our particular thanks are extended to David Smith, Jason King and David Double for their organisation and hospitality.