TOOLKIT IDENTIFYING RECORDKEEPING REQUIREMENTS
GUIDELINE 2:
Identifying Recordkeeping Requirements
WHO IS THIS GUIDELINE FOR?
This guideline can be used by anyone who wants to find out what records a government department needs to create and keep to carry out its business well.
Some of the people who may be well suited to carrying out this work might be:
• staff from the government archives or national library
• records management staff from within the organisation
• long-serving staff who have a good understanding of how the whole organisation works
• staff from the government audit office or who have other audit experience.
The work of identifying recordkeeping requirements will usually need to be done by someone who works inside the government, although it may be possible to hire an expert consultant to carry out the work or to hire a temporary staff member who can concentrate on the project.
WHAT ARE RECORDKEEPING REQUIREMENTS?
Government departments and organisations need records to do their work efficiently and to make sure that they can be accountable for their actions. Being accountable means being able to prove what actions we have taken and explain why we acted the way that we did.
To make sure that they can work efficiently and be accountable, organisations need to identify their recordkeeping requirements. That means understanding:
• what files or other records they should be making
• how long they should keep the records that they need
• who should and should not have access to the records
• what format the records need to be in.
A recordkeeping requirement is a need to keep evidence of the organisation’s actions and decisions. Recordkeeping requirements are usually documented in rules, procedures or other guidelines that show that an organisation might need to create, keep, provide access to or deal in some special way with a file or other type of record.
For example, a law that the agency is responsible for overseeing might say:
There shall be a register of licensees.
This suggests that the department responsible for making sure that this law is abided by must keep a register of the people to whom it gives licences. This is an example of a legal requirement that requires the department to create a particular record.
As another example, a government department’s procedures for processing a licence application might say:
Step 1: Desk officer stamps date of receipt on application and forwards to Licensing Officer
Step 2: Licensing officer checks applications for completeness
Step 3: Approving officer checks that all requirements are met and marks the application as ‘Approved’ or ‘Not Approved’.
The desk officer cannot stamp the date of receipt unless there is a record in the form of an application. The licensing officer cannot complete their job unless they receive a record containing the application from the desk officer. The approving officer cannot do their job unless they also have access to a record of the application. In this example, there is a business requirement to have a record of the application—the required process cannot be completed unless the organisation creates a record of each step in the process.
Sometimes recordkeeping requirements can come from the community. Members of the public might expect the government to keep some types of records. For example, imagine reading a story like this in the newspaper:
PUBLIC ANGRY OVER PASSPORT RED TAPE
A local man has complained to the Ombudsman about his treatment by the Passports Office after he was refused a replacement for his lost identity document.
Mr Albert Christian lost his passport when his house burned down last month. When he went to the Passport Office to apply for a new one, he was told that he could not have a new passport until he provided the office with the number of his old passport. ‘This is ridiculous,’ Mr Christian told the Times. ‘They gave me the number of the passport in the first place. Surely it is their job to keep a record of what passport number they gave me. Why should I have to remember these things for them? Now I don’t see how I will ever get another passport, as my old one is lost and I can’t remember the number.’
In this case, the public expects that the organisation will keep records about its activities so that it can serve its clients better in the future.
WHY IDENTIFY RECORDKEEPING REQUIREMENTS?
By identifying their recordkeeping requirements, government organisations can make sure that they:
• comply with the law, by having and giving access to records that the law says they must have
• operate efficiently, by making sure that records that are needed to complete all the steps in a process are created and passed on to those staff who need them
• account for their actions, by keeping records for long enough to allow ministers, auditors, the parliament and sometimes the public, to review and understand their work.
There are many things that can tell us what an organisation’s recordkeeping requirements are. These are explained in the next section.
HOW TO IDENTIFY RECORDKEEPING REQUIREMENTS
There are three main steps in identifying an organisation’s recordkeeping requirements. These are:
• identifying and collecting sources
• recognising recordkeeping requirements
• documenting recordkeeping requirements.
Identifying and collecting sources
There are many sources that can tell us what an organisation’s recordkeeping requirements are. They can include:
• laws and regulations
• strategic plans
• policies
• procedures
• reports by parliamentary committees, the auditor-general, the ombudsman or other review bodies
• reviews and reports by bodies outside government, such as the World Bank or Asian Development Bank
• surveys of the department’s records or other reviews by the national archives
• media reports
• the organisation’s staff.
Anything that tells the organisation how it should carry out its work can be a source of recordkeeping requirements.
How many sources you need to identify and what information you need to collect will depend on how thorough you need to be and how much time you have to do the work. If there is not much time available, you could concentrate on only finding the most important sources. These are likely to be laws and regulations. This is because the requirements in these kinds of sources are usually compulsory. If the organisation does not meet these requirements, it will probably be breaking the law.
Other very important sources include reviews by other government organisations such as:
• the parliament or congress
• a parliamentary or congressional committee
• a minister, member of cabinet or other elected representative
• a government auditor
• the ombudsman
• the Public Service Commission.
Recordkeeping requirements in reviews and reports about the organisation from these types of bodies can be very important because they indicate what important parts of the government expect the organisation to do. If the organisation does not meet these requirements, the government may take action against it—the organisation could be split up or closed down, or senior staff could be dismissed for not doing their jobs properly.
This does not mean that other sources of recordkeeping requirements are not also important. Internal sources like policies, procedures and information from staff can tell you about recordkeeping requirements that are vital for the organisation to be able to do its job. This means that it is important to try to find all of the sources that you can.
Another option for making the job quicker would be to look at only one section of the organisation at a time. For example, if the Department of Foreign Affairs deals with immigration matters, as well as diplomatic relations and international trade, you might choose to look only for sources that relate to immigration at this time, and look at the work of other areas of the organisation at another time.
Laws
Start by finding all of the laws that relate to your organisation. The laws of many Pacific countries are available on the internet through the Pacific Islands Legal Information Institute (PacLII). Its website is at <http://www.paclii.org>. Your country may also have its own website where you can find copies of laws.
There may be three types of laws that you need to look for:
• Enabling legislation. This is a law that legally creates your organisation. Major departments do not always have enabling legislation, but smaller organisations such as commissions, authorities and boards are often set up when the parliament or congress passes a law saying they should be created. The senior staff in the organisation or in the attorney-general’s office should be able to tell you what the enabling legislation is.
• Administered legislation. These are laws that the organisation is responsible for overseeing. Small organisations may not have any administered legislation—often their job is to carry out the functions described in their enabling legislation. Large departments may administer many different laws. For example, the Department of Foreign Affairs might oversee an Immigration Act, a Citizenship Act, a Passports Act, and Acts relating to diplomatic relations with other countries. If the organisation provides an annual report to a minister, cabinet, parliament or congress, this may list all of the laws the organisation administers. Sometimes, when the government decides which departments it will establish, it will produce Administrative Arrangements Orders that list the laws each department administers. Other places to learn about the organisation’s administered legislation might include government gazettes or interviews with staff who oversee the laws for the department.
• Administrative legislation. These are laws that often apply to all government organisations and tell them how to carry out some parts of their business. Examples might include freedom of information or archives laws, Evidence Acts, Financial Management Acts and Crimes Acts that apply to everyone—including public servants. The Public Service Commission or legal advisers, such as in the attorney-general’s office, may be able to tell you about what administrative laws there are.
Write down the name of each law that you identify, and make a note of where you can find a copy. You will need to be able to read copies of all of these laws when you begin the work of recognising your recordkeeping requirements.
Regulations
Regulations are sometimes known as ‘subordinate legislation’. Regulations are rules that can be made by departments that relate to a particular law. The Regulations of many Pacific countries are often included on the internet with the laws under which they are made. You may be able to find these laws through the Pacific Islands Legal Information Institute (PacLII). Its website is at <http://www.paclii.org>.
Departments can only make regulations about things that a law says they can control. If it is possible for a department to make Regulations under a particular law, this will usually be stated in one of the last sections of the Act. For law you have found you should:
• first check to see if the law says your department has the power to make Regulations
• then, if the department has that power, find out what Regulations have been made. Regulations often have to be formally ‘registered’ or ‘gazetted’ by the government, and legal advisers such as in the attorney-general’s office may be able to tell you about what Regulations there are under each Act.
Write down the name of each Regulation that you identify, and make a note of where you can find a copy. Regulations often have the same name as the Act under which they are made. You will need to be able to read copies of all of these regulations when you begin the work of recognising your recordkeeping requirements.
Plans, policies, procedures, reports and other internal sources
Internal documents such as plans, policies, procedures, instructions, reports, websites and publications can provide important information about what records the organisation needs to do its job efficiently.
• Plans and policies usually explain the types of activities that the organisation carries out, and may help you to see those parts of the organisation about which you need to find more information.
• Procedures and instructions can be very important sources—they can give you specific information about the records and other types of information staff need to do their jobs.
• Reports, websites and publications can give you ideas about what information public and other stakeholders expect your organisation to keep.
Write down the name of each of the sources that you identify, and make a note of where you can find a copy. You will need to be able to read copies of these sources when you begin the work of recognising your recordkeeping requirements.
External reviews and reports
Reviews and reports by other organisations of how your organisation does its work can tell you about what other people expect your organisation to do with its records, even if the organisation has not thought of doing these things itself. They can be very important in helping the organisation to meet the expectations of the community, and can even help it to improve the way it does its work.
If there has been a major review of your organisation’s work, it is likely that staff in the organisation will know about it, and they may be able to provide you with copies of the report.
Some of the key places you should check for external review and reports are:
• parliament or congress—talk to the staff at the parliamentary or congressional offices and ask them to give you any reports about your organisation
• government auditors—talk to the staff at the government auditor’s office and ask them to give you any reports about your organisation
• the ombudsman—talk to the staff at the ombudsman’s office and ask them to give you any reports about your organisation
• donors—talk to people who work for donor organisations such as the World Bank, if they have representatives in your country, and ask them to give you any reports about your organisation
• the media—talk to staff in your organisation to see if there have been any stories in the news that criticise your department’s work; if there has been an issue in the media, see if there is a file of media clippings in your organisation’s records management unit or in the library
• the public—talk to staff in your organisation to see if there have been lots of complaints from the public; s ee if there is a file in your records management unit about public complaints.
Write down the name or a description of each external source that you identify, and make a note of where you can find a copy. You will need to be able to read copies of all of these sources when you begin the work of recognising your recordkeeping requirements.
Interviews with staff
Talking to the staff in your organisation can tell you a lot about the information they need to do their work, and the problems that they may be having in finding it. This can be very important if your department does not have many policies and procedures written down. Try to interview staff from every section of your organisation. This will help to make sure that you have not missed any important recordkeeping requirements.
The purpose of these interviews is to find out what kinds of records the organisation should be creating to meet its recordkeeping requirements. Staff may be able to tell you about:
• which laws and regulations they administer, so that you can find copies of these and look at them more closely
• what procedures they follow in their jobs, especially if these are not written down
• what information they are asked for by other sections of the organisation, members of the public or other stakeholders.
Questions you might be able ask at the interviews include:
• Do you administer any laws or regulations?
• Do you have written procedures that tell you how to do your work?
• What steps do you take to carry out your work?
• Do you need information from other areas of the organisation to carry out your work?
• Do you give information to other areas of the organisation as part of your work?
• Do you give information to, or receive it from, external organisations as part of your work?
• Do you give information to, or receive it from, members of the public as part of your work?
• Have there been any audits or other external inquiries in your part of the organisation?
• Do you get lots of complaints or questions from the public?
Make sure that you take good notes of the interviews that you do, and write down the name, position and section of each person to whom you talk. You will need to read these notes again when you begin the work of recognising your recordkeeping requirements.
Recognising recordkeeping requirements
Government officers often do not think specifically about recordkeeping issues when they are writing laws, policies and procedures. This means that to find recordkeeping requirements in these documents you might need to use a bit of detective work.
Check for records keywords
First, look through each of your sources and find words in them that could relate to records. Some of the terms used in laws, procedures and other documents that might indicate there is a recordkeeping requirement are:
Agenda Application Bill Books
Copy Document Endorsed Evidence
Files Form Information Instructions
Log Minutes Note Notice
License Papers Permit Receipt
Record Register Report Return
Signature Ticket Writing
If you are using an electronic source, such as PacLII, you might be able to use the ‘Find’ function in your word processing software or internet browser to find these words.
Wherever you find a word that suggests there may be a reference to records, read the rest of the section where you found the word, until you understand what the section is saying. Sometimes you will find false alarms—for example, the word ‘books’ could refer to the accounting records of a company, or it could just refer to library books.
Types of recordkeeping requirements
If the word you have found does appear to refer to records, think about what the statement is saying. There are several types of recordkeeping requirements that you might come across. They can be requirements to:
• create a record—for example, ‘There shall be a register of licenses’
• include certain information in a record—for example, ‘The form must include the applicant’s name and date of birth’
• create a record in a certain form—for example, ‘Applications must be lodged using an official form’
• keep a record for a certain amount of time—for example, ‘The Registrar must keep all approved applications for a period of seven years from the date of their lodgement’
• destroy a record after a certain amount of time—for example, ‘The Registrar must destroy all unsuccessful applications one year after the date of their lodgement’
• provide access to a record—for example, ‘The Register must be open for inspection by the public’
• prevent access to a record—for example, ‘Applications must be stored in such a way as to keep their contents private’.
For each recordkeeping requirement you have found, make a note of where you found it. Include references like page or section numbers so that you do not have to read the whole document again next time you need to find the reference. Also, write a note about the type of requirement you think this is, such as a creation requirement, a destruction requirement, or an access requirement.
Check for ‘hidden’ requirements
If you have more time, and you want to make sure that you have identified all of your organisation’s recordkeeping requirements, you may choose to look at all of your sources again, this time checking for ‘hidden’ recordkeeping requirements. ‘Hidden’ or ‘implicit’ recordkeeping requirements are requirements that do not mention a need for records themselves, but describe a situation where a record really would be needed.
Laws are often a good source of ‘hidden’ recordkeeping requirements. Many laws say what the role or functions of a particular government organisation are. For example, a law setting up a new national library might have a section called ‘functions’, which could list these functions of the national library:
• to collect publications relating to the nation
• to make its collections available to the public
• to provide advice and assistance to other libraries throughout the country.
Even though there is no mention of records here, the government and the community would expect that a national library would keep records about the functions that it is required by law to carry out. This means that even if there are no specific recordkeeping requirements in this Act, there may be a ‘hidden’ requirement for the library to keep records about collecting publications, making collections available and assisting other libraries.
Policies and procedures may also include ‘hidden’ recordkeeping requirements. For example, a procedure for investigating complaints about an employee might require the investigating authority to check if there have been any other complaints about that person. Even though there is no mention of any type of record here, there would need to be a record kept of complaints about staff, or the undersecretary would have no way of checking if there have been complaints in the past. Hence, there is a ‘hidden’ requirement to create records that document complaints made about staff.
Each time you find a ‘hidden’ recordkeeping requirement, make a note of it in the same way as you would for other recordkeeping requirements. Make a note of where you found it, and include references like page or section numbers so that you do not have to read the whole document again next time you need to find the reference. Also, write a note about the type of requirement you think this is, such as a creation requirement, a destruction requirement, or an access requirement.
Documenting recordkeeping requirements
Once you have identified all of your organisation’s recordkeeping requirements, you will need to write them down in a way that other people will be able to understand and use them in the future. You need to document your organisation’s recordkeeping requirements so that:
• you can prove that you have done your job properly and checked the sources you have identified
• others in the organisation can see what the requirements are and make sure that they are meeting them
• you do not have to search all of the sources all over again if you want to update your requirements
• you can use the information for other things.
To document your recordkeeping requirements, you will need to organise them into logical groups. There are a number of types of groups you could use to organise your recordkeeping requirements. They include arranging them by:
• the business activity to which they relate
• the section of the organisation that carries them out
• their level of importance.
There is a Recordkeeping Requirements Form at the end of this guideline (Appendix 1) that you can use to document your recordkeeping requirements. You should fill out a copy of the form for each group of recordkeeping requirements that you discover. An example of how information you might include on a Recordkeeping Requirements Form is provided as Appendix 2.
Grouping by business activity
Grouping the requirements according to the business activity they relate to is usually the best option, but can also be the most difficult to do. If your organisation already has something called a business classification scheme (BCS), your business activities will already be written out in that document, and you can use the same headings to group your recordkeeping requirements. Fill in one copy of the Recordkeeping Requirements Form in this guideline for each function in your BCS.
Grouping by section
Most organisations do not have a BCS. If this is the case for your organisation, the best option is probably to group your requirements according to the section that is responsible for meeting them. For example, if you have found a recordkeeping requirement that says the organisation must keep a record of all the passport numbers it has issued, find out which section is responsible for issuing passports. This section is responsible for making sure that it meets the requirement to keep records of passport numbers. Start a new Recordkeeping Requirements Form with the name of the section at the top of the form, and use it to list all of the recordkeeping requirements you find that relate to that section of the organisation. For each section you find that is responsible for a recordkeeping requirement, start a new form with the section’s name at the top.
Grouping by importance
Another option is to group your recordkeeping requirements by their level of importance. This can be a useful system if you do not have much time and you only plan to look how you will meet some of the organisation’s recordkeeping requirements. This problem with this system is that can make it difficult to keep track of who is responsible for meeting each requirement.
If you choose to use this option, think about how you will decide which are your most important recordkeeping requirements. Your most important requirements might be the ones that:
• are in laws and regulations, because the organisation will break the law if they are not met
• come from members of the public, because the organisation could be embarrassed if they are not met
• involve a lot of money, because this could be managed badly or even stolen if they are not met
• relate to staff and customers of the organisation, because people could be disadvantaged or even hurt if they are not met.
Once you have decided which are your most important categories, look for recordkeeping requirements you have identified that fit into each category, and fill in a copy of the Recordkeeping Requirements Form for each group.
It is important that you put your documentation about recordkeeping requirements on file. After all, your organisation has a requirement to be able to find information about its recordkeeping requirements!
USING RECORDKEEPING REQUIREMENTS
Documenting your recordkeeping requirements will be a waste of time if you do not make sure that the organisation is meeting all of them. For each requirement you have identified, you will need to see if the organisation is doing what the requirement says it needs to do.
For example, if you have found a requirement that says there must be a record kept of each passport number that has been issued, you will be able to talk to the section of the organisation responsible for issuing passports to see if they are meeting this requirement. If you have found a requirement that says that members of the public must be able to see a register of liquor licences, talk to the staff responsible for issuing liquor licences to see if they know about the requirement and are providing access when it is needed. If members of the public are only allowed to see some of the information about liquor licences, is the section responsible keeping the information in way that allows them to show some information to the public but not all of it?
There is room on the Recordkeeping Requirements Form for you to note if you think each requirement is being met. There is also space for you to make notes of suggestions for how the organisation can make changes to make sure it meets the requirements in the future.
Information about recordkeeping requirements that are not being met may be helpful in talking to senior managers about getting more resources to manage the organisation’s records. If managers can see that they are breaking the law or making the public very unhappy by not meeting their requirements, they may be willing to pay more attention to the importance of good recordkeeping and to provide enough staff and other resources to do the job better in the future.
Later guidelines in this Toolkit series will give you more detailed information on how to make sure your organisation is meeting its recordkeeping requirements.
REVIEWING RECORDKEEPING REQUIREMENTS
Recordkeeping requirements can change over time. The parliament may pass new laws or change existing laws for which the organisation is responsible. The public’s needs may change, and they may be expecting the organisation to keep information that it did not keep in the past. A new review by the auditor-general might find ways of improving the work of the organisation and suggest new recordkeeping requirements.
Organisations should review their recordkeeping requirements regularly to try to keep them up to date. It is best to update the requirements each time you know about a change—for example, when a new law is passed or a new review of the organisation is released.
Otherwise, try to do a review of the requirements each year. A review does not need to take as long as the original process. To review recordkeeping requirements, you can go back to the sources you have already documented and see if anything has changed since last time you looked at them. Possible changes might be amendments to laws, or changes to internal procedures. Then, talk to staff within the organisation to see if there have been any new reviews, laws, policies or procedures, and check these for new recordkeeping requirements. You could also check the complaints files and media clippings files (if your organisation has them) to see what has been added since last time you looked at your recordkeeping requirements.
If you find any changes, make sure you document them on your Recordkeeping Requirements Form, and make sure that the people who are responsible for meeting the new requirements know what they need to do.