Public Records Act Audit Findings Report.pdf

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
General Business Activities - Summary
Planning
Stage
Description
Achievement
Initiation
Policy and planning initiated.
Coordinated planning, documentation and review of the
management of records is evident.
Establishment
Policy and plans are being implemented.
Coordinated planning, documentation and review of the
management of records is evident.
Capability
Policy and plans are regularly reviewed and updated.
Coordinated planning, documentation and review of the
management of records is evident.
Resourcing
Stage
Description
Achievement
Initiation
Resourcing requirements for recordkeeping identified.
Effective management of resourcing requirements is fully integrated
with strategic and operational activities.
Establishment
Resourcing for recordkeeping established.
Effective management of resourcing requirements is fully integrated
with strategic and operational activities.
Capability
Succession planning and resourcing is part of business Effective management of resourcing requirements is fully integrated
plans.
with strategic and operational activities.
1/06/2011 2:56 PM
Page
1 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Training
Stage
Description
Achievement
Initiation
Training needs analysis undertaken.
Effective management of training programme is fully integrated with
strategic and operational activities.
Establishment
Training programme established.
Coordinated planning, documentation and review of training
requirements for the management of records is evident.
Capability
Training programme actively monitored, reviewed and
Coordinated planning, documentation and review of training
updated.
requirements for the management of records is evident.
Reporting
Stage
Description
Achievement
Initiation
Reporting requirements identified.
Effective management of reporting programme is fully integrated
with strategic and operational activities.
Establishment
Basic operational reporting established.
Coordinated planning, documentation and review of reporting
requirements for the management of records is evident.
Capability
Recordkeeping is part of organisational risk and
Effective management of reporting programme is fully integrated
reporting framework.
with strategic and operational activities.
Legend
absent
aware
actioned
embedded
1/06/2011 2:56 PM
Page
2 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Specific Recordkeeping Practice - Summary
Creation & Capture
Stage
Description
Achievement
Initiation
Recordkeeping requirements have been identified.
The existence of coordinated systems and/or controls for the
creation and capture of records is evident.
Establishment
Systems and controls are implemented.
The existence of coordinated systems and/or controls for the
creation and capture of records is evident.
Capability
Systems and controls are actively monitored and
The existence of coordinated systems and/or controls for the
reviewed.
creation and capture of records is evident.
Retrievability & Security
Stage
Description
Achievement
Initiation
Recordkeeping requirements have been identified.
Effective systems and/or controls for the retrievability and security
of records is fully integrated within operational activities.
Establishment
Systems and controls are implemented.
The existence of coordinated systems and/or controls for the
retrievability and security of records is evident.
Capability
Systems and controls are actively monitored and
The existence of coordinated systems and/or controls for the
reviewed.
retrievability and security of records is evident.
1/06/2011 2:56 PM
Page
3 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Maintenance & Storage
Stage
Description
Achievement
Initiation
Recordkeeping requirements have been identified.
The existence of coordinated systems and/or controls for the
maintenance and storage of records is evident.
Establishment
Systems and controls are implemented.
The existence of coordinated systems and/or controls for the
maintenance and storage of records is evident.
Capability
Systems and controls are actively monitored and
Effective systems and/or controls for the maintenance and storage
reviewed.
of records is fully integrated within operational activities.
Disposal & Transfer
Stage
Description
Achievement
Initiation
Development of disposal authorities and
Effective systems and/or controls for the disposal of records is fully
implementation plans initiated.
integrated within operational activities.
Establishment
Authorised disposal authorities and implementation
The existence of coordinated systems and/or controls for the
plans established.
disposal of records is evident.
Capability
Disposal of records actively managed.
The existence of coordinated systems and/or controls for the
disposal of records is evident.
Legend
absent
aware
actioned
embedded
1/06/2011 2:56 PM
Page
4 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
General Business Activities
Planning
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
A governance framework has been
Operational
Victoria University's recordkeeping
Completed and up All
Completed
established in which the recordkeeping
governance structure is based on a
to date
function will operate from Chief Executive
delegation and escalation model. The
to Executive Management to recordkeeping
Vice Chancellor has final
and other staff.
responsibility for all policy and
compliance including recordkeeping.
The VC delegates operational
recordkeeping responsibilities to the
records manager, who escalates
matters as necessary, through his
manager and the Recordkeeping
Steering Committee.
Victoria University is a large and
complex information environment
characterised by multiple
recordkeeping systems in both
physical and electronic form.
Metadata is managed using a
devolved model. The Records
1/06/2011 2:56 PM
Page
5 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
Manager's role is to provide tools,
policies and education to business
units, and to be a source of good
practice. The Records Manager is
taking a central role in the
development of Victoria's EDRMS
project.
2
A profile of systems within the
Operational
A profile of all electronic systems
Completed - some All
Plans in place
recordkeeping framework exists (i.e.
exists. A profile of all paper systems
out of date
systems which create and maintain
has been created as part of Victoria
records).
University's Records Survey Project -
this is almost complete.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Records Management policies are
Operational
Recordkeeping policy is current and
Completed and up All
Completed
documented and implemented.
all actions in current policy are
to date
implemented.
RATING CHANGE:
Progress changed to 'completed and
1/06/2011 2:56 PM
Page
6 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
up to date'.
Intentions to Progress changed to
'completed'.
2
Recordkeeping procedures have been
Operational
Recordkeeping procedures have been  Completed - some  All
Plans in place
documented and implemented, including
documented based on recordkeeping  out of date
procedures for verifying metadata.
policy. Whole-of-lifecycle procedures
are available on Victoria University
Intranet. Guidance on classification
schema is currently in development.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
3
Business-critical records are identified and
Operational
The identification and management of  Under way
All
Plans in place
managed.
vital records at Victoria University is
currently in progress as part of a
broader Records Survey Project. This
project is a one year long major
project that involves a detailed
analysis of each business unit's
records and recordkeeping
environment. Each survey results in a
Finding Aid. A list of each unit's vital
records is one of the outputs of the
consultation process. This list
includes details of where copies are
held and their format. Once all units
have completed the Records Survey,
1/06/2011 2:56 PM
Page
7 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
and all vital records have been
identified, a Vital Records Programme
will be implemented.
RATING CHANGE:
Coverage changed to 'all'.
4
A disaster recovery plan for records is
Operational
Disaster Recovery planning for
Under way
All
Plans in place
implemented.
electronic records is managed by ITS.
Disaster Recovery for physical
records is in progress and is part of
the current recordkeeping operational
plan. Offsite storage has recently
been consolidated to one provider to
allow better management of offsite
records. Victoria University's third
party offsite storage provider has a
comprehensive disaster recovery plan
in place.
RATING CHANGE:
Coverage changed to 'all'.
5
New, redeveloped or replaced business
Operational
Records Manager works closely with
Completed - some All
Plans in place
specific systems are designed to deliver the
BAs and Enterprise Architect to
out of date
capability to meet recordkeeping principles.
ensure systems are designed to
deliver the capability to meet
recordkeeping principles.
RATING CHANGE:
Progress changed to 'completed -
1/06/2011 2:56 PM
Page
8 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
some out of date'.
Coverage changed to 'all'.
6
An approved recordkeeping plan is
Operational
Findings support ratings.
Completed and up  All
Completed
regularly reviewed by senior management.
to date
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Regular reviews of recordkeeping policy
Operational
Findings support ratings.
Completed and up  All
Completed
and updates are evident.
to date
2
Regular reviews of recordkeeping
Operational
Recordkeeping practices and
Completed - some  All
Plans in place
procedures and updates are evident.
procedures are reviewed and updates  out of date
to procedures, where appropriate, are
evident. A current major Records
Survey Project is in progress.
Guidance on Classification Scheme
application is planned.
RATING CHANGE:
Coverage changed to 'all'.
3
Risk management planning considers
Compliance
As part of the Victoria University
Under way
All
Plans in place
recordkeeping risks and mitigation
business planning project, every
strategies including legislation and
manager will have the requirement to
standards requirements.
reference recordkeeping in their
operational plan.
1/06/2011 2:56 PM
Page
9 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
RATING CHANGE:
Coverage changed to 'all'.
4
The business/strategic plan references
Strategic
The Victoria University recordkeeping Completed - some Most
Plans in place
recordkeeping outputs and outcomes.
strategy is linked to the wider
out of date
business strategy and goes through
an approval process with senior
management. The ITS Strategy also
includes reference to recordkeeping.
Plans are in place to develop an
Information Management Strategy
and integrate recordkeeping into the
business planning life cycle.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
5
The disaster recovery plan is regularly
Operational
A Disaster Recovery planning
Under way
All
Plans in place
tested and reviewed.
programme is underway and will be
applied organisation wide.
RATING CHANGE:
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
10 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Resourcing
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Recordkeeping roles and related support
Strategic
Recordkeeping roles at Victoria are
Completed and up All
Completed
resources are defined in order to meet core
defined in order to meet core
to date
information management requirements.
information management
requirements.
RATING CHANGE:
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
Responsibility for creating and managing
Compliance
Responsibility for creating and
Completed and up All
Completed
records is assigned and communicated to
managing records is assigned and
to date
individual staff.
communicated to individual staff
through the recordkeeping policy,
intranet guidance, induction process
and the current major Records Survey
Project which covers all business
units.
RATING CHANGE:
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
1/06/2011 2:56 PM
Page
11 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Qualified and/or experienced or skilled
Operational
Qualified and/or experienced or
Completed and up All
Completed
recordkeeping practitioners have been
skilled recordkeeping practitioners
to date
appointed for all defined roles.
have been appointed for all defined
roles. Victoria University has
instituted an informal training role that
is filled by a student of the Records
Management degree programme.
These informal staff members, who
are being trained on the job, also
attend professional development
events.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
A proactive human resource management
Operational
The Records Manager meets with the Completed and up All
Completed
programme is in place to maintain and
Performance Manager on a two-
to date
develop recordkeeping personnel capacity.
weekly basis. The RM's Performance
1/06/2011 2:56 PM
Page
12 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
Development Career Plan includes all
areas of recordkeeping and includes
courses as appropriate. Progress
against the plan is monitored every
two weeks.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
Future budget and personnel requirements Operational
Victoria University's planning and
Completed and up All
Completed
to sustain improvements in the
budget cycle involves allocating
to date
recordkeeping programme is considered.
budgets for new projects, including
recordkeeping projects.
Recordkeeping operational plans
provide details of budget allocated to
projects.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
1/06/2011 2:56 PM
Page
13 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Training
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
An analysis of management needs and
Operational
An analysis of management needs
Completed and up All
Completed
skills of recordkeeping staff consistent with
and skills of recordkeeping staff,
to date
their respective roles and responsibilities
consistent with their respective roles
has been conducted.
and responsibilities, is built into the
performance planning process. All
training needs are aligned with the
recordkeeping strategic plan and
monitored on a two-weekly basis.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
The responsibility for defining the
Operational
The responsibility for defining the
Completed and up All
Completed
recordkeeping requirements is assigned to
recordkeeping requirements is
to date
the records manager or equivalent position.
assigned to the Records Manager.
1/06/2011 2:56 PM
Page
14 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
RATING CHANGE:
Intentions to Progress changed to
'completed'.
2
Staff training is assigned to the appropriate  Operational
Staff training is assigned by the
Completed and up  All
Completed
trainer by the Records Manager (or
Records Manager to the appropriate
to date
equivalent).
trainer: inductions devolved to
Business Unit Managers include
recordkeeping responsibilities,
specialist training conducted by
Records Manager and other training
outsourced by the Records Manager
to specialist providers where
appropriate (Disaster Recovery
Training).
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
3
A recordkeeping training plan is
Operational
Training is embedded into all
Completed - some  All
Plans in place
implemented and maintained.
recordkeeping projects, and a training  out of date
plan is included in the recordkeeping
operational plan, with workstream
initiatives over a three year period.
Staff inductions that include
recordkeeping responsibilities are in
1/06/2011 2:56 PM
Page
15 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
place for every contractor and
permanent staff member and are the
responsibility of the Business Unit
Manager. Inductions are monitored
through a completion checklist. Plans
are in place to develop a Strategic
Capability Plan.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
4
Staff receive recordkeeping training in:
Operational
Training is embedded into all
Completed - some All
Plans in place
• policies, procedures and practices
recordkeeping projects, and a training out of date
• organisation specific tools and systems
plan is included in the recordkeeping
• relevant legislation and standards.
operational plan, with workstream
initiatives over a three year period.
Staff inductions that include
recordkeeping responsibilities are in
place for every contractor and
permanent staff member and are the
responsibility of the Business Unit
Manager. Inductions are monitored
through a completion checklist. Plans
are in place to develop a Strategic
Capability Plan.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
1/06/2011 2:56 PM
Page
16 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Recordkeeping training and skills are
Operational
Review of recordkeeping training is an Approved - but
All
Plans in place
regularly reviewed.
area for future focus - plans are in
not yet started
place to implement a Strategic
Capability Plan that will encompass
the monitoring and review of training.
RATING CHANGE:
Coverage changed to 'all'.
2
Assigned staff are trained in emergency
Operational
The Records Manager and Special
Completed - some All
Plans in place
procedures to protect and salvage records.
Collections Librarian have both
out of date
attended specialist disaster recovery
training. Plans are in place to train
one staff member for each key
physical storage area.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
17 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Reporting
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Monitoring and reporting of recordkeeping
Reporting
Detailed reporting against the
Completed and up  All
Completed
requirements are defined and documented.
recordkeeping operational plan occurs  to date
at Recordkeeping Steering Group
meetings on a quarterly basis. The
operational plan identifies and
documents recordkeeping monitoring
requirements. Physical records are
monitored through control sheets on
the door of every storage room. A self
assessment against the PRA occurs
every six months.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
Monitoring and reporting of recordkeeping
Reporting
Findings support ratings.
Completed and up  All
Completed
practices is assigned to the records
to date
manager (or equivalent).
1/06/2011 2:56 PM
Page
18 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Reviews of recordkeeping practices are
Reporting
Reviews of recordkeeping practices
Completed and up  All
Completed
undertaken and reported to senior
are undertaken and reported to senior  to date
management.
management on a quarterly basis.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
Recordkeeping monitoring reports are
Reporting
Recordkeeping at Victoria University
Completed - some  Most
Plans in place
distributed to line managers and actioned.
takes place within a devolved
out of date
structure. Business Unit Managers
take responsibility for the day to day
management of their records. The
Records Manager's role is policy
development, awareness raising and
education. Currently Business Unit
Managers do not report on
recordkeeping practices on a regular
basis, however a major
Recordkeeping Survey Project is
currently underway. This survey
allows the Records Manager to
understand the level of maturity and
characteristics of each business unit.
Actions resulting from the survey are
1/06/2011 2:56 PM
Page
19 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
developed and agreed with line
managers. Plans are in place for an
EDRMS - this will allow a more
granular level of reporting.
RATING CHANGE:
Coverage changed to 'most'.
3
Managers are accountable for
Reporting
The recordkeeping policy includes a
Under way
All
Plans in place
recordkeeping objectives being met and
delegation model that holds managers
ensuring performance levels are reported.
accountable for recordkeeping
objectives being met and reporting
performance levels. Plans are in place
to build these requirements into the
recordkeeping life cycle. Plans are in
place to develop a Training and
Capability Plan that will also address
this. These plans are university wide.
RATING CHANGE:
Progress changed to 'under way'.
Coverage changed to 'all'.
4
Creation and capture of records (including
Compliance
Plans are in place to institute an
Under way
All
Plans in place
associated metadata assigned manually) is
EDRMS that will allow the monitoring
routinely monitored and corrective action
of the creation and capture of records.
taken.
RATING CHANGE:
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
20 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
The public office undertakes a systematic
Operational
Findings support ratings.
Completed and up All
Completed
assessment of their recordkeeping
to date
capability.
1/06/2011 2:56 PM
Page
21 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Specific Recordkeeping Practice
Creation and capture
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Business processes and functions are
Compliance
The Records Manager is training
Completed - some  All
Plans in place
reviewed and analysed to map
Business Analysts to ensure business  out of date
recordkeeping requirements.
processes and functions include
recordkeeping requirements. Critical
systems have been mapped to
recordkeeping requirements.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
2
Records of all business activities are
Compliance
Records of all business activities are
Completed and up  All
Plans in place
systematically and consistently created in a
systematically and consistently
to date
records management system.
created in a wide range of records
management systems that include
structured and unstructured electronic
systems and hard copy systems. An
organisation wide records survey has
identified all systems.
1/06/2011 2:56 PM
Page
22 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Physical and electronic records are
Compliance
Plans are in place to institute an
Completed - some All
Plans in place
captured routinely in a way which meets the
EDRMS that will capture records
out of date
public office's business requirements.
consistently and create greater
consistency around version control
and naming conventions for
documents.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
2
Decisions around the application of
Operational
All critical business systems have
Completed - some All
Plans in place
minimum point of capture and process
been mapped to the metadata
out of date
metadata have been documented.
standard. Plans are in place to ensure
all new systems are designed with
recordkeeping requirements taken
into account.
RATING CHANGE:
1/06/2011 2:56 PM
Page
23 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
3
Recordkeeping metadata schema and
Operational
An organisation wide classification
Under way
All
Plans in place
schemes are documented, communicated,
scheme has been developed. The
maintained and reviewed to reflect
schema has been verified as part of
business activities and structure.
the Records Survey Project.
Organisation wide consultation will be
undertaken.
RATING CHANGE:
Coverage changed to 'all'.
4
All records are documented and organised  Operational
All records are organised according to  Completed - some  All
Plans in place
according to a classification scheme.
classification schemes in various
out of date
recordkeeping systems. Plans are in
place to consolidate these into an
EDRMS system where appropriate.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Critical business systems/applications have  Strategic
Critical business systems/applications  Completed and up  All
Completed
1/06/2011 2:56 PM
Page
24 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
been identified and mapped to the
have been identified and mapped to
to date
recordkeeping metadata schema.
the recordkeeping metadata schema
in a recent "Metadata Standard
Mapping" exercise.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
The business classification scheme is
Strategic
An organisation wide classification
Completed - some All
Plans in place
routinely reviewed for relevance.
scheme has been developed. The
out of date
schema has been verified as part of
the Records Survey Project.
Organisation wide consultation will be
undertaken.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
3
Disposal authorities linked to the business
Strategic
All disposal authorities have been
Completed and up All
Completed
classification scheme to enable record
linked to the business classification
to date
sentencing at time of creation.
scheme.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
1/06/2011 2:56 PM
Page
25 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Retrievability and security
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Accessibility, usability, retrievability and
Operational
Accessibility, usability, retrievability
Completed and up  All
Completed
retention of records is managed within the
and retention of records is managed
to date
recordkeeping system.
within the recordkeeping systems
used by Victoria University. Physical
systems include finding aids, indices
and clear labelling. Electronic systems
have agreed structures and defined
metadata to manage and locate
records.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Recordkeeping systems and storage
Strategic
Plans to complete protection of
Completed - some  All
Plans in place
facilities for physical records are protected
physical records and storage facilities  out of date
1/06/2011 2:56 PM
Page
27 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
from unauthorised access, destruction,
are almost completed. The
theft, fire, flood, earthquake, volcanic
development of a Disaster Recovery
eruption and vermin.
Programme and the removal of some
records from inappropriate storage
areas will complete these plans.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
2
Sensitive and restricted records are
Compliance
All sensitive and restricted records are Completed and up Most
Completed
identified, documented and controlled.
identified and documented. The
to date
implementation of an EDRMS will
ensure all sensitive records are also
controlled in all cases.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'most'.
Intentions to Progress changed to
'completed'.
3
Access to sensitive and restricted records
Compliance
Plans are in place to build sensitive
Completed - some All
Plans in place
is provided in accordance with the:
and restricted records into the
out of date
- Official Information Act
recordkeeping policy.
- Privacy Act
- Security in Government Sector (SIGS)
RATING CHANGE:
Manual
Coverage changed to 'all'.
- Technical Specifications for the Electronic
1/06/2011 2:56 PM
Page
28 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
Recordkeeping Metadata Standard
4
The access status of public records over 25  Strategic
Records over 25 years old are
Completed - some  All
Plans in place
years of age is determined according to
identified as part of the Records
out of date
Archives New Zealand's Access Standard
Survey Project in a "Legacy Records
and registered with Archives New Zealand.
Register". Plans are in place to
register these with Archives.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
The ability to locate records is monitored
Operational
Plans are in place to develop internal  Under way
All
Plans in place
and routinely audited.
Quality Assurance processes around
the ability to locate records.
RATING CHANGE:
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
29 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Maintenance and storage
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
All records (regardless of format or media
Operational
Electronic backups effectively ensure Completed - some All
Plans in place
and including recordkeeping metadata) are
that electronic records cannot be
out of date
managed so they cannot be altered or
altered or deleted. The Shared Drive
deleted without permission.
Security Policy informs staff of their
responsibilities. Plans are in place for
an EDRMS which will manage this
more consistently. Physical storage
rooms are managed through an
Access Standard.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
2
Records contain both content and
Strategic
Business systems, shared drives and Completed - some All
Plans in place
contextual information to ensure that a link
physical systems all contain
out of date
to the applicable business activity is
contextual information to ensure a link
maintained.
to business activity is maintained.
Plans are in place for an EDRMS
which will manage this more
consistently.
RATING CHANGE:
Progress changed to 'completed -
1/06/2011 2:56 PM
Page
30 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
some out of date'.
Coverage changed to 'all'.
3
A risk-based assessment of records
Strategic
A risk-based assessment of the nine
Completed and up Most
Completed
storage has been undertaken to ensure
major records storage areas at
to date
records are stored appropriately.
Victoria University has been
undertaken to ensure records are
stored appropriately. This assessment
identified several areas for
improvement. The Records Manager
has developed a plan to address
these areas and the plan is now in
progress.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Intentions to progress changed to
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Records are reviewed/appraised and
Strategic
Project to ensure all records storage
Completed - some All
Plans in place
stored in accordance with their value and
areas comply with Storage Standard
out of date
security needs.
is almost complete, needing only the
completion of Disaster Recovery
Plans and the removal of some final
1/06/2011 2:56 PM
Page
31 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
records from areas already identified
as inappropriate to long term storage.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
A storage plan must be in place if physical
Strategic
A Storage Plan is in place.
Completed and up All
Completed
records of archival value over 25 years of
to date
age are retained.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
Storage plan must meet the requirements
Strategic
The Storage Plan meets the
Completed and up All
Completed
of the Storage Standard applicable to
requirements of the storage standard. to date
archival records and inactive records of
archival value.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
1/06/2011 2:56 PM
Page
32 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
'completed'.
1/06/2011 2:56 PM
Page
33 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Disposal and transfer
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Core functional records and associated
Compliance
Core functional records and
Completed and up  All
Completed
metadata are appraised and disposal
associated metadata are appraised
to date
authorities agreed.
and disposal authorities are agreed.
Processes cover disposal of records.
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
Disposal authorities are applied to classes
Compliance
Disposal authorities are mapped to
Completed and up  All
Completed
or groups of records within the
the classification scheme and applied  to date
recordkeeping framework.
to physical and electronic records.
Currently disposal authorities are
applied to electronic records on a
manual basis. Reporting on disposal
occurs on a quarterly basis.
1/06/2011 2:56 PM
Page
34 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
RATING CHANGE:
Progress changed to 'completed and
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to
'completed'.
2
Procedures are in place to manage
Compliance
Procedures to manage records
Completed and up  All
Completed
disposal of records when no longer needed
disposal are in place and available on  to date
for business use as per the authorised
the intranet.
retention and disposal schedule.
RATING CHANGE:
Intentions to Progress changed to
'completed'.
3
Deferral agreements are in place for
Compliance
Findings support ratings.
Completed and up  All
Completed
records over 25 years of age which are still
to date
required by the public office.
4
Minimum recordkeeping metadata as
Compliance
'Records Destruction Authority' forms  Completed - some  All
Plans in place
defined in the Electronic Recordkeeping
retain minimum recordkeeping
out of date
Metadata Standard is retained after
metadata. Plans are in place for an
disposal action for as long as required.
EDRMS which will manage the
retention of minimum recordkeeping
metadata automatically.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
35 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to
Progress
1
The public office's disposal programme is
Compliance
Monitoring and review occurs on a
Completed and up All
Completed
monitored and reviewed.
quarterly basis.
to date
RATING CHANGE:
Intentions to Progress changed to
'completed'.
2
Regular and efficient records disposal
Operational
Disposal procedures are in place for
Completed - some All
Plans in place
occurs as part of the public office's
physical and electronic records.
out of date
recordkeeping framework.
Disposal of electronic records
happens manually. This process will
be automated - plans are in place to
develop an EDRMS system.
RATING CHANGE:
Progress changed to 'completed -
some out of date'.
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
36 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
RISKS
Compliance
Operational
•
Failure to meet legislative and regulatory requirements
•
Inability to transfer data across organisational systems
•
Unlawful disposal of records
•
Inability to deliver services due to the loss of information
•
Inability to provide assurance of legislative compliance
•
Inability to retrieve and interpret records in obsolete formats or systems
•
Inability to provide records or provide evidence
•
Information is inaccessible or unsuitable for the conduct of business
•
Inability to provide a record of specific transactions
Reporting
•
Inconsistent, ineffective and inefficient conduct of business
•
Inability to provide reliable evidence summarising activities or undertakings
Reputation
•
Reduced capability to demonstrate good performance
•
Misleading the minister or other key stakeholders
•
Embarrassment to the chief executive, minister, the government and individuals
•
Damage to reputation, loss of credibility, lowered public confidence
Strategic
•
Loss of records which support New Zealand’s cultural and national identity
•
Poor strategic planning and poor decisions made on inaccurate information
•
Inability to use organisational information and knowledge to full potential
•
Constrained business and information management strategies
•
Inability to automate processes and to secure efficiency benefits
1/06/2011 2:56 PM
Page
37 of 37