Audit of public office recordkeeping

The audit programme is part of our monitoring of and reporting on the state of public sector IM.

It is one of the key components of our Monitoring Framework , which also includes an annual survey of public sector IM and the Information Management Maturity Assessment (IM Maturity Assessment).

The Monitoring Framework helps us to focus our work as the regulator of public sector IM by forming a picture of the state of IM across the public sector. This allows us to track improvement over time, and to identify and respond to risks, challenges and opportunities.

The IM Maturity Assessment provides a consistent structure for the audit and is issued to public offices in advance of their audit. The IM Maturity Assessment consists of eight categories with a varying number of topics within each:

• Governance

• Self-monitoring

• Capability

• Creation

• Management

• Storage

• Access

These are based on the requirements of the PRA and the Information and records management standard . The IM Maturity Assessment is also available to organisations to do their own self-assessment of IM practices at any time.

Measuring performance is an important step for organisations to improve their IM maturity and to work more efficiently and effectively.

Audits will support public offices by:

• identifying areas of strength and weakness in IM within the organisation;

• prioritising areas that need attention and what needs to be done to strengthen them.

Additionally, the audit findings will help us build a picture of the strengths and weaknesses of public sector IM. This will allow us to issue advice and guidance to help organisations meet their PRA requirements and implement the mandatory Information and records management standard

The Chief Archivist has a primary statutory role through the PRA to lead public sector information and records management. Section 33 of the PRA gives the Chief Archivist a statutory audit function. Requirements for independent audits of public offices are:

• The Chief Archivist must commission and meet the costs of each audit.

• The Chief Archivist develops criteria for the aspects of recordkeeping practices to be audited.

• Audits must be conducted at intervals of not less than 5 years and not more than 10 years from the previous audit.

The audit programme covers over 200 public offices . We are not mandated by the PRA to audit local authorities. Some public offices are not included in the current scope of the audit programme, notably schools and Ministers of the Crown.

To find out if your organisation will be audited you can view the 5-year schedule

We will notify Executive Sponsors and Chief Executives if the organisation is going to be audited in the next financial year.

We’ve developed a proposed schedule for audits in years 2021/22 to 2024/25

Most public offices have been scheduled for the year in which they must be audited for compliance with section 33 of the PRA i.e. 10 years since their last PRA audit. There may be an opportunity to schedule some audits earlier than that if there is room in the schedule.

For further information on scheduling for your public office please contact us at PRAAudit@dia.govt.nz

We meet the costs of the independent auditors delivering the audit programme. Public offices meet the costs they incur in completing the requirements of the audit process.

Audits are based on the mandatory Information and records management standard and the PRA, as represented through the IM Maturity Assessment . Organsiations due for audit are asked to complete the IM Maturity Assessment. By doing this assessment you will gain an understanding of the kinds of areas and questions that will be covered.

Further guidance for implementing the requirements of the PRA and the mandatory standard is available in our resources and guides

Following initial notification to a public office’s Chief Executive, our primary contact point will be the Executive Sponsor. They will receive formal correspondence relating to the audit. Parts of the audit process will also involve IM staff in both pre-audit activities and during the onsite audit.

The onsite audit activities will include interviews and focus groups. These will involve the Executive Sponsor, IM specialist staff , ICT staff, other staff members and contractors.

You can find out more about Executive Sponsors here

A diagram showing the PRA audit process

• Detailed description of image

  Pre-audit:

  • Notification of the start of your audit process

  • Engagement meeting between Archives and your organisation

  • A letter of engagement that includes the scope and dates for your organisation's audit

  • Evidence gathering and completion of Information Management Maturity Assessment by your organisation

  • Identifying onsite contacts and interviewees

  In-audit:

  • Interviews

  • Focus groups

  • Inspections

  • Draft audit report

  Post-audit:

  • Right of reply/review of the draft audit report

  • Final audit report

  • Chief Archivist letter

  • Publication of final audit report and Chief Archivist letter

  Follow up:

  Creation of an action plan with Archives for your organisation based on recommendations from audit

The audit process is illustrated at a high level in the diagram above and will be discussed with Executive Sponsors before their organisations onsite audit.

Our follow-up approach will track improvement actions undertaken by public offices as a result of audit findings. After each audit, there is an expectation that the public office uses the identified recommendations from the audit report and the Chief Archivist audit letter to create an action plan for their organisation. We will work with the public office and monitor progress through the activities identified within their action plan.

This also will assist us to target advice, guidance, and other activity to support public offices based on insights gained from the audits.

The audit report and Chief Archivist audit letter will be published on our website after these have been sent to the public office (subject to any justified withholding). This provides public visibility of the audit outcomes and will support sector learning as well as our Open Government Partnership (OGP) commitments

Additionally, the Chief Archivist is required, under section 35 of the PRA, to submit an annual report to the Minister on the financial year’s audits. The Minister presents the report to the House of Representatives.

As a regulator of public sector IM, our leadership role includes developing understanding within public sector organisations about how IM practice should be responsive to Māori. This is consistent with the purpose of the PRA “to encourage the spirit of partnership and goodwill envisaged by the Treaty of Waitangi (Te Tiriti o Waitangi)” (Section 3(g)).

The IM Maturity Assessment requires an organisation to consider whether it has identified information it holds that is of importance to Māori, and whether it understands the IM implications of settlements or other agreements with Māori. It also asks how well this information is managed to ensure that it is identifiable, accessible and usable by and for Māori.