Audit of public office recordkeeping
We are refreshing our audit programme for public offices in late 2020. Monitoring government organisations’ information management (IM) practices helps assure the New Zealand public that:
government is open, transparent and accountable by making public sector IM practices known to the public;
full and accurate records are created and maintained, improving business efficiency, accountability and government decision-making, and in turn, enhancing public trust and confidence in government.
Audits help ensure that public offices are:
delivering high-quality information to decision-makers, other government organisations, customers and stakeholders;
enabling continuous improvement within a rapidly changing environment;
taking proper care of information by creating and managing it well so that they can trust it, understand it, find it and protect it; and
facilitating safe and lawful sharing across government.
An audit is a point-in-time view of core IM practices that recognises an organisation’s operating environment and IM challenges. It is also an opportunity to show an organisation’s IM strengths and where there might be opportunities for improvement.
Section 33 of the Public Records Act (PRA) confers the audit function on the Chief Archivist. The audit programme is part of our leadership role in regulating IM across the government sector under the PRA.
What is the audit programme?
The audit programme is part of our monitoring of and reporting on the state of public sector IM. The programme consists of audits of eight key areas of IM practice, including:
The audit programme is part of the Monitoring Framework , which also includes an annual survey of public sector IM and the Information Management Maturity Assessment (IM Maturity Assessment).
The framework helps us to focus our work as the regulator of public sector IM by forming a picture of the state of IM across the public sector. This allows us to track improvement over time, and to identify and respond to risks, challenges and opportunities.
The IM Maturity Assessment underpins the audit and will be issued to public offices in advance of their audit taking place. The IM Maturity Assessment provides a framework to assess IM practice against a set of core principles and standards. These are based on the requirements outlined in the PRA and the Information and records management standard . The IM Maturity Assessment will be provided to public offices being audited and will be publicly released later this year.
What's the purpose of audit?
We require New Zealand public sector organisations to monitor and review their IM practice. Measuring performance is an important step for organisations wishing to improve their IM maturity and to work more efficiently and effectively.
Audits enable public offices to:
better identify areas of strength and weakness in IM within the organisation;
prioritise areas that need attention and work towards strengthening them;
set goals for building or improving IM capability and skills development; and
use the findings to support proposals for funding, resources or initiatives to improve IM.
The findings from the audits will help us build a picture of the strengths and weaknesses of public sector IM. This will allow us to issue advice and guidance that will help organisations meet their PRA requirements and implement the mandatory Information and records management standard with a wider view to improving the maturity of IM across the whole public sector.
What are the legislative requirements to audit?
The Chief Archivist has a primary statutory role through the PRA to lead public sector information and records management. This legislative responsibility is met in part by the provision of an integrated regulatory framework for the systematic creation, management, disposal and preservation of public sector information (including data) and records.
Section 33 of the PRA gives the Chief Archivist a statutory audit function. Requirements for independent audits of public offices are:
The Chief Archivist must commission and meet the costs of each audit
The Chief Archivist develops criteria for the aspects of recordkeeping practices to be audited
Audits must be conducted at intervals of not less than 5 years and not more than 10 years from the previous audit.
When will the audit programme start?
Onsite audits will start in February 2021 with pre-audit activities leading up to this. Organisations included for audit in the 2020/21 financial year will be notified in September 2020.
Who are we auditing?
The audit programme covers over 200 public offices. We are not mandated by the PRA to audit local authorities. Some public offices are not included in the current scope of the audit programme, notably schools and Ministers of the Crown.
To find out if your organisation will be audited you can view the 5-year schedule .
How do I know when my organisation will be audited?
We will notify Executive Sponsors and Chief Executives of the financial year that their public office’s audit is scheduled.
The list of public offices scheduled for audit in 2020/21 has been confirmed and we’ve developed schedules for audits in years 2021/22 to 2024/25.
Most public offices have been scheduled for the year in which they must be audited for compliance with section 33 of the PRA; meaning 10 years since their last PRA audit. Some are scheduled earlier.
You can view the 5-year audit schedule here .
For further information on scheduling for your public office please contact us at PRAAudit@dia.govt.nz
Who pays for the audit?
We meet the costs of engaging independent auditors and its own staff and systems for delivering the audit programme. Public offices meet the costs they incur in completing the requirements of the audit process.
What will the audits cover?
Audits are based on the mandatory Information and records management standard and the PRA, as represented through the IM Maturity Assessment. The IM Maturity Assessment will be supplied for use by public offices being audited. It will also be published later this year to help the general understanding of the audit focus areas and so that organisations not currently being audited can also use it for self-monitoring.
Further guidance for implementing the requirements of the standard is available in our resources and guides .
Who will be involved in an audit?
Following initial notification to a public office’s Chief Executive, our primary contact point will be the Executive Sponsor. They will receive formal correspondence relating to the audit. Parts of the audit process will also involve IM staff in both pre-audit activities and during the onsite audit.
The onsite audit activities will include interviews and focus groups. These may be made up of Executive Sponsors, IM staff and managers, ICT staff and managers, other staff members and contractors.
What is the process?
The audit process is illustrated at a high level in the diagram above and will be discussed with Executive Sponsors before their organisations onsite audit.
How will we support public offices to improve their IM after audit?
Our follow-up approach will track remedial and improvement actions undertaken by public offices as a result of audit findings. After each audit, there is an expectation that the public office uses the identified recommendations from the audit report and the Chief Archivist letter to create an action plan for their organisation. We will work with the public office and monitor their progress through the activities identified within their action plan.
This also will assist us to target advice, guidance, and other activity to support public offices and local authorities based on insights gained from the surveys and audits.
How will the audit results be publicised and released?
As explained above, we will work with public offices where potential improvements to their IM maturity have been identified by their audit. The audit report and Chief Archivist letter will be published on our website after these have been sent to the public office (subject to any justified withholding). This will provide transparency and further enable government organisations to be held accountable. It will also support our Open Government Partnership (OGP) commitments .
The Chief Archivist will submit the annual report to the Minister on the financial year’s audits required by section 35 of the PRA. The Minister presents the report to the House of Representatives.
How does audit support Te Tiriti o Waitangi?
As a regulator for public sector IM, we have a leadership role to play in developing understanding within public sector organisations about why and how IM practice should be responsive to Māori. This is consistent with the purpose of the PRA “to encourage the spirit of partnership and goodwill envisaged by the Treaty of Waitangi (Te Tiriti o Waitangi)” (Section 3(g)).
The IM Maturity Assessment therefore requires an organisation to consider whether it has identified information it holds that is of importance to Māori, and whether it understands the IM implications of settlements or other agreements with Māori. It also asks how well this information is managed to ensure that it is identifiable, accessible and usable by and for Māori.
Last modified on 14 September 2020