Audit of public office recordkeeping
Monitoring government organisations’ information management (IM) practices helps assure the New Zealand public that:
full and accurate records are created and maintained, improving business efficiency, accountability and government decision-making, and in turn, enhancing public trust and confidence in government;
government is open, transparent and accountable by making public sector IM practices known to the public.
Audits help ensure that public offices are:
delivering high-quality information to decision-makers, other government organisations, customers and stakeholders;
taking proper care of information by creating and managing it well so that they can trust it, understand it, find it and protect it;
facilitating safe and lawful sharing across government.
An audit is a point-in-time view of core IM practices that recognises an organisation’s operating environment and IM challenges. It is an opportunity to show an organisation’s IM strengths and where there might be opportunities for improvement.
Section 33 of the Public Records Act (PRA) confers the audit function on the Chief Archivist. The audit programme is part of our leadership role in regulating IM across the government sector under the PRA.
Please get in touch with PRAAudit@dia.govt.nz if you have any questions.
What is the audit programme?
The audit programme is part of our monitoring of and reporting on the state of public sector IM.
The Monitoring Framework helps us to focus our work as the regulator of public sector IM by forming a picture of the state of IM across the public sector. This allows us to track improvement over time, and to identify and respond to risks, challenges and opportunities.
The IM Maturity Assessment provides a consistent structure for the audit and is issued to public offices in advance of their audit. The IM Maturity Assessment consists of eight categories with a varying number of topics within each:
These are based on the requirements of the PRA and the Information and records management standard. The IM Maturity Assessment is also available to organisations to do their own self-assessment of IM practices at any time.
What's the purpose of audit?
Measuring performance is an important step for organisations to improve their IM maturity and to work more efficiently and effectively.
Audits will support public offices by:
identifying areas of strength and weakness in IM within the organisation;
prioritising areas that need attention and what needs to be done to strengthen them.
Additionally, the audit findings will help us build a picture of the strengths and weaknesses of public sector IM. This will allow us to issue advice and guidance to help organisations meet their PRA requirements and implement the mandatory Information and records management standard
What are the legislative requirements to audit?
The Chief Archivist has a primary statutory role through the PRA to lead public sector information and records management. Section 33 of the PRA gives the Chief Archivist a statutory audit function. Requirements for independent audits of public offices are:
The Chief Archivist must commission and meet the costs of each audit.
The Chief Archivist develops criteria for the aspects of recordkeeping practices to be audited.
Audits must be conducted at intervals of not less than 5 years and not more than 10 years from the previous audit.
Who are we auditing?
The audit programme covers over 200 public offices. We are not mandated by the PRA to audit local authorities. Some public offices are not included in the current scope of the audit programme, notably schools and Ministers of the Crown.
To find out if your organisation will be audited you can view the audit schedule.
What notification will my organisation receive?
We will notify Executive Sponsors and Chief Executives if the organisation is going to be audited in the next financial year.
We’ve developed a schedule for audits in years 2021/22 to 2024/25.
Most public offices have been scheduled for the year in which they must be audited for compliance with section 33 of the PRA i.e. 10 years since their last PRA audit. There may be an opportunity to schedule some audits earlier than that if there is room in the schedule.
For further information on scheduling for your public office please contact us at PRAAudit@dia.govt.nz.
Who pays for the audit?
We meet the costs of the independent auditors delivering the audit programme. Public offices meet the costs they incur in completing the requirements of the audit process.
What questions are asked during the audit?
Audits are based on the mandatory Information and records management standard and the PRA, as represented through the IM Maturity Assessment. Organisations due for audit are asked to complete the IM Maturity Assessment. By doing this assessment you will gain an understanding of the kinds of areas and questions that will be covered.
Further guidance for implementing the requirements of the PRA and the mandatory standard is available in our resources and guides.
Who will be involved in an audit?
Following initial notification to a public office’s Chief Executive, our primary contact point will be the Executive Sponsor. They will receive formal correspondence relating to the audit. Parts of the audit process will also involve IM staff in both pre-audit activities and during the onsite audit.
The onsite audit activities will include interviews and focus groups. These will involve the Executive Sponsor, IM specialist staff , ICT staff, other staff members and contractors.
What is the process?
The audit process is illustrated at a high level in the diagram above and will be discussed with Executive Sponsors before their organisations onsite audit.
How will we support public offices to improve their IM after audit?
Our follow-up approach will track improvement actions undertaken by public offices as a result of audit findings. After each audit, there is an expectation that the public office uses the identified recommendations from the audit report and the Chief Archivist audit letter to create an action plan for their organisation. We will work with the public office and monitor progress through the activities identified within their action plan.
This also will assist us to target advice, guidance, and other activity to support public offices based on insights gained from the audits.
How will the audit results be publicised and released?
The audit report and Chief Archivist audit letter will be published on our website after these have been sent to the public office (subject to any justified withholding). This provides public visibility of the audit outcomes and will support sector learning as well as our Open Government Partnership (OGP) commitments
Additionally, the Chief Archivist is required, under section 35 of the PRA, to submit an annual report to the Minister on the financial year’s audits. The Minister presents the report to the House of Representatives.
How does audit support Te Tiriti o Waitangi?
As a regulator of public sector IM, our leadership role includes developing understanding within public sector organisations about how IM practice should be responsive to Māori. This is consistent with the purpose of the PRA “to encourage the spirit of partnership and goodwill envisaged by the Treaty of Waitangi (Te Tiriti o Waitangi)” (Section 3(g)).
The IM Maturity Assessment requires an organisation to consider whether it has identified information it holds that is of importance to Māori, and whether it understands the IM implications of settlements or other agreements with Māori. It also asks how well this information is managed to ensure that it is identifiable, accessible and usable by and for Māori.
Last updated on 23 July 2021