## Action Plan Progress Review Northern Ireland Office Contents

 
Background and action plan development  
  
 
 00  
Executive summary  

00 
Progress to address recommendations and risk areas  
 00 
Next steps 

 

00 
 

 You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management. The Northern Ireland Office (NIO) IMA took place in February 2016. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under 'Next Steps.' 
Action plan development 
 
NIO produced a detailed action plan in summer 2016 and reported on delivery of this to the departmental Audit and Risk Committee. This is a good practice approach to ensuring senior scrutiny of progress to address recommendations and improve capability in information and records management. NIO's IMA and action plan were covered in the department's annual report and accounts for 2016/17 under the heading of risk management and control, reflecting the importance attached to participation in our programme. The National Archives formally assessed progress against the action plan in September 2017. The IMA report and action plan are both published on The National Archives' website.1 

## Executive Summary Value Of Information

- The Northern Ireland Office (NIO) continues to promote the importance of 
records management to its staff through briefings, workshops and guidance and has reviewed and updated its Knowledge and Information Management Strategy. 
- NIO's approach to information asset management has continued to improve 
with the formalisation of the Information Assurance Coordinator role, updated and improved guidance and training for Information Asset Owners and the 
beginning of work to review the Information and Data Asset Registers.  

## Digital Information And Supporting Technology

- As predicted at the time of the IMA, the upgrade of NIO's system for electronic 
management from TRIM to Content Manager 9 (CM9) and move to a Google 
platform and the incompatibility between these two tools has had a negative impact on work practices and records capture within NIO. NIO is working hard to mitigate this through technical solutions, training, guidance and support and 
should continue to monitor the situation carefully. 
- NIO has recognised the need for greater skills and support to ensure that 
digital information is managed effectively throughout its lifecycle and are restructuring the Records and Information Management team to meet this need.  

## Information Risk, Governance And Oversight

- NIO has made progress in raising the profile of information risk but needs to 
recognise that this is an ongoing task. 
- The Records and Information Management team have worked extremely hard 
to support staff in records and information management through guidance and 
training. Policy and guidance relating to information and records management 
has been updated to reflect the move to Google and CM9. 
- NIO is yet to develop a formal approach to monitoring compliance with the 
information management policy. 

## Records Review And Transfer

- NIO has streamlined its approach to appraisal and selection of paper records 
which is enabling it to better keep pace with the transition to the 20 Year rule 
and move towards compliance with the Public Records Act. By documenting 
its approach and capturing the knowledge of reviewers it is ensuring that it 
has the capability to carry out this work in the long term. 
- NIO has made good progress in laying the foundations for disposal of its 
digital information, both in terms of starting to think about skilling the team to carry out the appraisal, selection and transfer of digital information and in preparing to apply disposal instructions to information on CM9 

## Progress To Address Recommendations And Risk Areas 1 The Value Of Information

Performance rating 
IMA 2016 
Review 2017 
Good practice 
Good practice 
Communicating and realising value Managing information as an asset 
Satisfactory 
Progressing towards good practice 
 

- The Northern Ireland Office (NIO) had a strong culture of information 
and records management and information security but needed to ensure that this was maintained as the department moved to more open and flexible working. 
- A Knowledge and Information Management (KIM) strategy for 2015-20 
had been drafted and was awaiting sign off.  
- NIO had made a good start on building a process for the management of 
its information assets but needed to embed this across the organisation including training and guidance for Information Asset Owners (IAO). 
- The Knowledge and Information Strategy was signed off in June 2016. It was 
reviewed and updated in June 2017 and no substantial changes were made. 
See next steps 
- Work to promote good records management practice includes briefings for 
staff at induction, reminders at Deputy Directors' meetings and at business area/team briefings and fun approaches such as the board game on records transfers and the six simple rules for information management.  
- The Information Assurance Coordinator (IAC) role has been formalised and 
NIO is now adopting a more active approach to information asset governance. The IAC delivers one-to-one briefings to Information Asset Owners, explains 
the responsibilities of an IAO and makes available the links to NIO guidance. 
The IAC also checks that all IAOs have undertaken mandatory Civil Service 
learning on information handling.  
- IAO guidance has been reviewed and an IAO questionnaire has been 
developed along with a one page overview of IAO responsibilities. The role is held at deputy director level and is now recognised in performance 
management objectives. **See next steps** 
- NIO is currently reviewing the Information and Data Asset Registers (IDARs) 
and gathering feedback from IAOs, in particular on how adequately the registers document information risk.  

## 2 Digital Information And Supporting Technology

Performance rating 
IMA 2016 
Review 2017 
Development area 
Development area 
Supporting information through technology Digital continuity and IT change 
Development area 
Progressing towards satisfactory 
 

- NIO was about to undergo a major change in its technology environment 
as it moved to a new IT platform including Google and mobile technology. There were concerns about the impact of this on the use of NIO's established system for digital records management, TRIM, and on the management and handling of digital information more generally. 
- NIO needed to start developing a strategy/plan for dealing with older 
digital information in TRIM and on shared drives including an approach for appraisal, selection and transfer of records of historical value to The National Archives. 
- As anticipated at the time of the IMA the upgrade from TRIM to CM9 and 
move to a Google platform and the lack of integration between these two tools has had an impact on work practices and records capture within NIO. There is 
no simple way to move emails/documents between Google Drive/Gmail and CM9 and NIO has had to devise workarounds. Statistics show growing use of 
Google Drive. NIO needs to monitor the situation carefully and continue to 
mitigate risks around record capture through strategy, policy, training, 
guidance and support whilst exploring a more long term solution. See next steps 
- The 90 day deletion of emails has not been activated since the move to Gmail 
to minimise any loss of important emails as the department adjusts to this new 
system. 
- NIO has tested DROID (The National Archives file profiling tool) and found it a 
useful tool for finding out about the digital information that is held including 
age, format, dates etc. However, due to the manual work needed to use the information created by DROID, NIO is also starting consider testing other ediscovery tools. Further work on this has been deferred until 2018. See next 
steps 
- NIO has taken steps to resource the KIM team to focus efforts on managing 
digital continuity and grow skills in this area (See section 5). This is good 
practice 

## 3 Information Risk, Governance And Oversight

Performance rating 
IMA 2016 
Review 2017 
Recognising information risk  
Development area 
Progressing towards satisfactory 
Establishing control 
Satisfactory 
Satisfactory 
Providing guidance 
Satisfactory 
Good practice 
Measuring impact 
Development area 
Development area 
 

- NIO's approach to information risk, particularly risks relating to 
information management was fragmented. Information risk in its wider sense was not necessarily understood across the organisation or recognised at Board level.  
- The Records and Information Management (R&IM) team provided a good 
service to the business and there was a clear plan in place for KIM work. 
- NIO had good policies and guidance in place for information 
management but needed to ensure that these were updated in line with the move to a new IT environment and mobile working.  
- NIO was yet to develop an approach to monitoring compliance with 
information and records management policy.  
 
- Information risk is now a permanent agenda item for the Departmental 
Security Committee, which meets every six weeks. In addition a report on information assurance goes to the Audit and Risk Committee twice a year and Directors are expected to report any information risks in monthly dashboards which are submitted to the Executive Management Committee. Also positive 
to see that a risk around management of digital information was included in 
the top prioritised NIO risks for June 2017. 
- The IAC is developing a process for IAOs to report on information risk and 
mitigation via the quarterly IDAR updates. See next steps 
- The complicated nature of the workarounds required to make record keeping 
work within Google and CM9 has meant extra pressure on information management staff to prepare guidance, deliver training and provide ongoing support. This has impacted on their ability to deliver other work in particular 
measuring compliance with records management policy. **See next steps** 
- The Information Management Policy has been updated to reflect the move to 
Google and CM9 and now includes a section on social media. This is good 
practice 
- In addition to comprehensive guidance on how to use CM9, NIO has 
produced succinct and easy to read guidance on social media and safe handling of information, managing email ('Get it Filed'), and on naming 
conventions. NIO also plans to review its guide to remote working later in 
2017/18. This is good practice 
- Record Retention/Disposal Schedules have been completed for all business 
areas and most are now published on the NIO intranet. NIO should now 
publish these on GOV.UK as recommended by Sir Alex Allan in his Report on 
Records Review. See next steps 
- The situation around facilities for training remains difficult though new kit has 
helped and there is now a dedicated room in Belfast that can be used for 
training. 
- Statistics gathered on systems use give an indication of records management 
practice but NIO has yet to progress work on monitoring compliance with 
information and records management policy.  See next steps 

## 4 Records, Review And Transfer

Performance rating 
IMA 2016 
Review 2017 
Satisfactory 
Good practice 
Oversight of records and selection 
Development area 
Satisfactory 
Implementing disposal decisions 
 

- NIO had a team of knowledgeable and experienced part-time file 
reviewers who carry out appraisal and selection and sensitivity review of paper files to be transferred to The National Archives.  
- However, there was no overall departmental guidance for appraisal and 
selection or sensitivity review and NIO needed to capture and document the knowledge of its reviewers.  
- NIO was slightly behind in its transition to the 20-year rule, was starting 
to plan to address this as well as an increase in the volume of paper 
files. 
- NIO was not yet able to apply auto disposal to TRIM and needed to 
develop an approach for the appraisal and selection and sensitivity review of digital information and ensure that it acquired new skills within the team to be able to carry out this work.  
 
- Steps are being taken to capture the knowledge of reviewers, for example, the 
review team have produced 'A Guide to Sensitivity Review' and a summary of 
key events in Northern Ireland from the early 1970s to the early 2000s. This 
is good practice 
- The transfer team trialled and then adopted a new macro method of records 
appraisal. NIO reported that this has resulted in a 30% reduction in time spent 
on close scrutiny review. As a result the team is about to finish reviewing the 
1991 records. **This is good practice.** NIO needs to ensure this progress 
continues in order to move towards compliance with the 20 Year Rule and 
Public Records Act. **See next steps** 
- Approval was given in August 2017 to expand KIM team resource to create 
two new Digital Continuity Officer posts to enable the team to increase focus on the continuity of digital records and to ensure readiness for digital transfers 
to The National Archives by 2024. The post of System Administrator has also been upgraded to recognise greater responsibility for digital continuity issues. Five NIO staff have also attended the digital transfer training at The National Archives. **This is good practice** 

- NIO is in the process of transitioning to a new paper storage contract which 
will also include preparation of files for transfer. Moving this work to a 
contractor should ease pressure on the Records and Information Management team. NIO should ensure that it has a process in place for 
quality assuring this work. **See next steps** 
- NIO needs to develop an approach to appraisal, selection, sensitivity review 
and transfer of digital information across all systems. The collection of confidential records that have recently been identified may be prove to be a 
good set of records to develop and test the process of digital transfer and NIO 
should work with The National Archives on this. **See next steps** 
- The project to reduce the file plan within CM9 to a single level has been 
completed but there is a further work that needs to be done before retention periods can be applied to this. NIO have identified a business area to test this 
out with in the coming months. **See next steps** 

## Next Steps

The National Archives will continue to support the Northern Ireland Office (NIO) in its work on information and records management. Outstanding recommendations will be reviewed at the time of the department's IMA reassessment. It is recommended that NIO focusses on the following: 

## 

- Review the IMA strategy to ensure appropriate direction is set to tackle key 
cultural and IT related challenges. 
- Update Information Asset Owner (IAO) guidance as NIO's approach to 
information security develops. NIO should tailor the IAO handbook to reflect its own requirements, following the example of other IMA programme 
members such as the Ministry of Justice and Home Office. 
- Continue to develop and improve the Information and Data Asset Register. - Continue to raise the profile of information risk and increase understanding of 
this. 
- Monitor the situation around incompatibility with CM9 and Google carefully 
and continue to mitigate risks around record capture through training, guidance and support whilst exploring a more long term solution to the problem. 
- Update guidance on remote working and ensure that this covers information 
and records management. 
- Develop a proportionate approach to monitoring compliance with information 
and records management policy. Good practice approaches within the IMA programme include HM Treasury 
- Ensure that it has a process in place to quality assure file preparation work 
carried out by the outside contractor. 
- Keep pace with the transition to the 20 Year Rule by continuing its more 
streamlined approach to appraisal and selection. 
- Put in place a plan to apply disposal instructions to the file plan in CM9. 
NIO needs to develop an approach to appraisal, selection, sensitivity review 
and transfer of digital information across all systems perhaps starting with confidential records.