Use of Social Media
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

Where information resulting from investigation and/or audit work is made public or is provided to a 
third party by the client or by Veritau then this must be done on the understanding that any third party 
will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any 
responsibility towards anyone other than the client in relation to the information supplied. Equally, no 
third party may assert any rights or bring any claims against Veritau in connection with the 
information. Where information is provided to a named third party, the third party will keep the 
information confidential. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Use of Social Media 
City of York Council 
Memorandum  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
For: Assistant Director – Customer Services & Digital; Head of Communications 
Status: Final 
Date Issued: 15/06/2017 
 
 
 

1 
INTRODUCTION & SCOPE 
 
1.1 
Social media can be a key form of communication; offering free, instant, two – 
way communication. This can be a powerful tool for an organisation, 
particularly when integrated into a wider communications strategy. 
  
However, as it is a pervasive medium that is constantly evolving, it can be 
difficult to control and can present some significant risks to an organisation. It 
can negatively affect the council’s reputation, staff relations, productivity and 
integrity of data. As a changing medium, there are also potential risks that are 
currently unknown.  
 
There are two distinct facets to the usage of social media at the council: 
internal and external usage, each with their own risks. External usage can be 
described as how City of York Council, as an organisation, uses social media 
to engage with the local community.  
 
Internal, or personal, usage can be described as how people within the 
council use social media. The risks here are varied and depend on individual 
circumstances, but the key risks could be considered as the amount of use 
and inappropriate use, as well as how the council manages these issues.  
 
1.2 
The initial aim of this audit was to establish the degree to which there are 
adequate controls relating to the overall use of social media, in both business 
and personal capacities. Specifically, there was an aim to provide assurance 
over the extent to which the management of social media usage is consistent 
and appropriate, and that the monitoring arrangements are balanced, 
proportionate and appropriate.  
 
However, due to developing circumstances, this was not a viable approach. 
The area is currently undergoing a significant overhaul, with the aim of 
developing a social media strategy that is coherent with a wider 
communications strategy.  
 
 
 
Therefore, the aim of this exercise was to provide feedback on the proposed 
social media policy, and assess to what extent it addresses the risks 
presented by the use of social media.  
 
1.3 
The current status of this development is that a draft social media policy has 
been drawn up by the Communications team. This is in the process of being 
approved by the Council Management Team. This policy builds and improves 
upon the existing social media policy in a number of ways.   
 
1.4  
There is a further allocation of time for this area in the 2017/18 audit plan and 
this could be used to review the objectives detailed at 1.2 in relation to 
management of social media usage and monitoring arrangements.  
 

2 
FINDINGS 
Social Media Policy 
 
2.1  
The social media policy is not currently available to staff (due to being in a 
draft stage), there is a plan for the Chief Executive to circulate it to all staff to 
raise awareness. It should also be made available on the intranet for all 
employees. There are currently two policy documents that are being 
superseded by this current draft document. This new version brings together 
these two separate documents into one unified policy document, and goes 
into further detail on the topic. For example, it provides an introduction that 
gives context for the use of social media, it also goes into more detail on the 
risks of using social media, and it is also clearer about breaches of conduct.  
 
2.2 
The policy is up to date, as it is still in draft stage. It is also quite robust in 
terms of remaining applicable, due to the identification of underlying principles 
of social media rather than specific instances. It is also clear to whom the 
policy applies to, and these appear to be appropriate.  
 
2.3 
The policy effectively outlines social media, and the role it plays in the wider 
strategic aims of communication in general. Whilst there is no explicit 
definition of social media, an attempt has been made to identify the principles 
that underpin social media, and this should be sufficient. It also serves the 
purpose of helping to prevent the policy from becoming outdated, as the 
changes in this field can be rapid.   The policy also highlights the major 
advantages of the use of social media, as well as the some of the significant 
risks.  
 
2.4 
The policy gives a good degree of guidance on social media. It is important to 
understand the policy as secondary to other more fundamental policy 
documents. It mediates the use of social media, but also refers to underlying 
policy, for example employee code of conduct and electronic communications 
policy. The social media policy essentially applies relevant policy to use of 
social media.  
 
2.5 
Data protection concerns have been addressed in the policy, and explicitly 
prohibits the publication or distribution of data about individuals or 
organisations.  
 
2.6 
The policy adequately covers the issue of monitoring of the use social media. 
The policy highlights the underlying policies that mediate the monitoring of 
social media usage, such as the employee code of conduct and the electronic 
communications policy. The policy makes it clear that the council reserves the 
right to monitor and maintain audit trails of electronic communications, and 
that this includes the content on social media sites. The policy also makes the 
important distinction that content regarding the council, created by private 
accounts, could also be monitored and actions raised if deemed necessary.  
 

2.7 
The policy makes a distinction between official use of social media for 
business purposes, and the use of social media for personal reasons. For the 
former, authority to make official press releases has been identified and 
stated, there is an attempt to co-ordinate the release of information, and 
adequate consideration has been given to the release of inappropriate 
information.  
 
2.8 
The personal use of social media has been sufficiently addressed in the policy 
document. Provisions have been made to ensure that no inappropriate 
content is produced by council employees, and there is recourse possible if 
necessary. There is also thought given to the overuse of social media during 
work time, and this would bring it in line with any other non-productive work 
activity.  
 

3 
CONCLUSIONS 
3.1  
The policy that has been drawn up is good. It adequately mitigates the risks 
presented by the use of social media, and finds a good balance between 
robustness and applicability – it goes into the right level of detail to be useful 
but not easily outdated.  
 
3.2 
It makes the important distinction between personal use and business use of 
social media, and there are adequate guidelines for both.  
 
3.3 
At the time of writing, the latest policy document was not available to staff. 
There is a plan to update the intranet with this new policy, and this should be 
done when it is finalised. It is important that the principles of the policy are 
embedded in the culture of the organisation, and consideration should be 
given to this aim. It is important that the new policy is publicised to employees, 
and it may be beneficial to test how engaged employees are through an 
iComply follow-up once the policy has been in place for a few months.  
 
3.4 
Once there has been an opportunity for the new policy to be embedded, 
Veritau will carry out further work to assess the effectiveness of the new policy 
on day-to-day operations.