Policy for Information and Records Management	(template for organisational use) Version Date File: Fileref (enter name of organisation) (enter name of business unit – if relevant) )

Instructions

This template supports the Information and Records Management Standard.

To use, delete this page and use in the existing Tasmanian government template or apply your own organisational template.

This template is written as one long policy document for medium to large organisations. You may choose to split it into shorter documents (policy, guidelines, procedures) to suit your organisation. Smaller organisations may choose to simplify it to meet their needs.

ACKNOWLEDGEMENTS

This template is based on the following, now withdrawn Tasmanian Archive and Heritage Office publication:

Advice 50: Developing a Records Management Policy: Template.

CONTACT US

Office of the State Archivist | www.informationstrategy.tas.gov.au | osa@education.tas.gov.au | 03 6165 5581 This template is part of the Tasmanian Government Information Management Framework. It supports the Information and Records Management Standard. This is a living document and we will make minor changes as needed. If you notice anything that needs updating, please let us know.
License URL: www.creativecommons.org/licenses/by/4.0/legalcode Please give attribution to: © State of Tasmania, 2021

Document Development History

Version	Date	Comments
1	10/05/2021	Initial release

Purpose

The purpose of this policy is to provide guidance and direction on creating and managing information and records and to clarify staff responsibilities. <Name of organisation> commits to creating and maintaining information and records management practices that meet our business needs, accountability requirements and stakeholder expectations.

Complying with this policy will result in trusted, well described information and records stored in known locations that are accessible to staff and clients when needed.

This policy is part of our information and records management framework, located at <XXX>. Other policies and procedures, found at <XXX>, support this policy.

POLICY STATEMENT

Our organisational information and records are a business asset. They are vital for our operations and provide valuable evidence of business decisions, activities and transactions.

We ensure that organisational recordkeeping policies are developed, implemented and maintained. We assign, document and communicate recordkeeping responsibilities.

We manage and maintain all organisational records, irrespective of format, in an authorised system/s. We ensure that records remain accessible over time to support business operations.

We keep records only as required by the organisation and to comply with relevant legislation.

We preserve permanent records. When they are no longer actively used and/or are 25 years or older, we transfer them to the Tasmanian Archives, in line with the Archives Act 1983 (Tas).

All staff are required to create and maintain authentic, reliable and useable information, documents and records, and protect their integrity for as long as they are required by:

ensuring that full and accurate records are created and maintained for each business process

ensuring that records are saved and stored in the organisational recordkeeping system, or other approved system, with appropriate metadata, and naming conventions that enable their efficient retrieval and use.

Read this Policy with the <name of any relevant organisational information and records management guidance>. All our information and records management practices and procedures comply with this Policy.

SCOPE

This policy applies to managing and maintaining records through their life cycle from creation, receipt or capture, to preservation and disposal. It includes records in any format held in our information systems. This policy covers the work practices of all staff, board members, elected representatives, volunteers and contractors (whether directly employed, or via third party arrangements) <delete or add as required> who:

create information

access information

have responsibility for information including storage, retrieval, distribution and disposal

have management responsibilities for officers engaged in any of these activities

manage or have design input into information technology infrastructure.

The key distinction between organisational records and other types of information is that records provide evidence of business activities (refer to ‘Definitions’ section in this document for definition of a record).

Records exist in various formats including, but not limited to digital records in email systems, websites, social media, cloud-based applications, mobile technologies and business systems, and paper records.

We ensure the creation, capture, maintenance, security and disposal of records complies with requirements of this Policy (refer to ‘Requirements’ section in this document) and the Archives Act 1983 (Tas).

GOALS

The goals of this Policy are to:

ensure effective information and records management, covering the creation and maintenance of authentic, reliable and useable records

ensure records support the accountability and transparency of our business functions and activities for as long as those records are required

provide evidence of our commitment to best practice information and records management

set out the responsibilities of staff, clarifying their accountability for information and records management (refer to ‘Responsibilities’ section in this document)

ensure that information and records management is in line with our business and legislative requirements (refer to ‘Rationale’ section in this document).

RATIONALE

Our records are our corporate memory, providing evidence of actions and decisions. They are a vital asset and support our daily functions and operations. Records support policy formulation, decision-making and protect the interests of <name of organisation>.

Records also help us to make good use of precedents and organisational experience. They support consistency, continuity, efficiency and productivity in program delivery, management and administration. Good records support government accountability and transparency, and protect the rights and entitlements of individuals.

We ensure best practice management of our information and records by complying with legislation and adopting International Standards.

The following provides an overview of key legislation and standards applicable to our organisation <add or delete from this list to suit your organisation, only include as many as necessary for staff to understand their business requirements>:

Archives Act 1983 (Tas) establishes the requirement for Tasmanian government organisations to create and keep State records.

AS:ISO-15489-1:2017 – Information and Documentation – Records Management – Part 1: Concepts and Principles provides clear guidelines for the establishment and application of records management practices, procedures and systems that have been incorporated into our information management program.

Corporations Act 2001 (Cwlth) defines our organisational responsibilities for keeping financial records which correctly record and explain transactions, financial position and performance; and that enable true and fair financial statements to be prepared and audited.

Criminal Code Act 1924 (Tas) covers criminal activity including fraud.

Electronic Transactions Act 2000 (Tas) facilitates and promotes business and community confidence in the use of electronic transactions. It recognises the legal validity of transactions carried out electronically, and so allows the “recording and retention of information and documents in electronic form”.

Evidence Act 2001 (Tas) describes the ways documents may be admitted as evidence into court.

Financial Management Act 2016 (Tas) and Audit Act 2008 (Tas) cover accounting and auditing requirements. <these Acts are not relevant for Councils>

Financial Transaction Reports Act 1988 (Cwlth) provides for the reporting of certain transactions and monetary transfers to the Australian Transaction Reports and Analysis Centre (AUSTRAC) and specifies minimum retention periods for account and signatory information.

Income Tax Assessment Act 1997 (Cwlth) requires organisations to keep records of income tax returns and assessments, and any related accounting documentation such as calculations, income and expenditure records.

Limitation Act 1974 (Tas) sets out time periods in which legal action can be taken in various instances.

Local Government Act 1993 (Tas) requires Councils to create a wide variety of records. <relevant only to Councils>

Personal Information Protection Act 2004 (Tas) sets out handling of personal information, including collection, use, storage and disclosure.

Police Offences Act 1935 (Tas) includes various offences relating to computer data including fraud, damage, unauthorised access and insertion of false information.

Privacy Act 1988 (Cwlth) is the principal piece of Australian legislation protecting handling of personal information about individuals. This includes collection, use, storage and disclosure of personal information in the Australian public sector and in the private sector. Some Tasmanian government organisations may have requirements under the Notifiable Data Breaches scheme, part of the Act.

Right to Information Act 2009 (Tas) provides for greater access to information held by Tasmanian government bodies and encourages proactive disclosure of information, and giving the public access to information on request.

State Service Act 2000 (Tas) provides a legislative framework designed to support a contemporary workforce and provide the best possible services to the Government, the Parliament and the community. <not relevant to Councils>

Tasmanian Government Information Management Framework identifies and defines the various components which contribute to effective information management.

DEFINITIONS

< Definitions are from the Office of the State Archivist’s Glossary of Recordkeeping terms. Add to as appropriate. >

Business Classification Scheme

A conceptual model of what an organisation does and how it does it. It involves the identification and documentation of each business function, activity and transaction and the documentation of the flow of business processes, and the transactions which comprise them.

Destruction Authority

A once-off authorisation from the State Archivist for the disposal of non-scheduled records.

Disposal

A range of processes associated with implementing appraisal decisions. These include records retention, destruction of records, and transfer of custody or ownership.

Disposal Schedule

Documents authorised by the State Archivist that set out retention periods for classes of records. There are two main types: Common Disposal Schedules, which apply to more than one organisation, and Functional Disposal Schedules, which are specific to the unique records of one organisation.

Information asset

An information asset is a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited effectively. Information assets have recognisable and manageable value, risk, content and lifecycles.

Information Asset Register (IAR)

An information asset register is a structured list that helps identify, control and monitor information assets within your organisation.

Metadata

Recordkeeping metadata is data that describes the context, content and structure of records and their management through time.

Record

Information created, received, and maintained as evidence and as an asset by an organization or person, in pursuit of legal obligations or in the transaction of business.

Records are both evidence of business activity and information assets. Any set of information, regardless of its structure or form, can be managed as a record. This includes information in the form of a document, a collection of data or other types of digital or analogue information which are created, captured and managed in the course of business.

Short-term value records

Records of such short-term value that they do not support or contribute to the business functions of the organisation. These include:

records of a trivial nature

records which duplicate (or extract) information which is already held elsewhere

records with little or no administrative, fiscal, evidential, cultural, or no known historical, value.

State archive

State archive means any State record or any other record which is deposited and preserved in the Archives Office. Source: Archives Act 1983 (Tas).

State records

Records of State government agencies/departments, State authorities, or local authorities. These public bodies are defined in Section 3 of the Archives Act 1983 (Tas).

State record means –

(a) a Crown record; or

(b) a record of a State authority; or

(c) a record of a local authority; or

(d) any other record that was at any time a record mentioned in paragraph (a), (b) or (c) – but does not include a record of the Parliament of Tasmania. Source: Archives Act 1983 (Tas).

REQUIREMENTS

Creation and maintenance of records

Everyone subject to this policy is required to create and capture business records. Good business records provide a reliable and accurate account of business decisions and actions. Including names, dates and times, and other key information that captures the business context helps create good business records.

Records can be folders, documents or data created, received or maintained as evidence and information of work done for or on behalf of the organisation. Records can be in any format. Temporary records range from short term records (for example, those that can be destroyed when reference ceases) to long term (for example, 75 years). Permanent records are eventually transferred to the Tasmanian Archives.

Examples of our organisational records include (but are not limited to):

<Note: edit this list of records according to your organisational needs and keep it up-to-date.>

agendas, minutes and papers

audio or video recordings of public meetings

case files

complaint correspondence

contracts and agreements

correspondence received from members of the public, private and public sector organisations that require action

documents related to events organised with or for external organisations, students etc.

facilities hire forms and documentation

maps

media releases and articles

personnel recruitment and appointment documentation

photographs of events, people, places

policies and guidelines

reports and submissions

risk management registers and documentation

social media posts

surveillance footage including body camera video images

training program documentation

websites

workplace safety files.

Records need to be kept for the time specified in an authorised Disposal Schedule.

Where no authorised Disposal Schedule exists, keep records until they can be destroyed according to a Disposal Authority authorised by the State Archivist, or until they are transferred to either another agency or to the Tasmanian Archives.

Short-term value records that do not have to be kept

Some records can be destroyed in the normal course of business and do not belong in our recordkeeping system. These are short-term, facilitative or of transitory value, and do not support or contribute to the business functions of the organisation. They include:

external advertising material

externally published newsletters that do not contain material created by or referencing our organisation

junk email

personal files including email

rough notes, working papers and calculations used solely to assist in the preparation of other records such as correspondence, non-auditable reports and statistical tabulations

copies of any documents, preserved solely for reference

published material preserved solely for reference

electronic revisions of documents in our recordkeeping system which can be purged/deleted when finalising documents

Documents of this nature may be destroyed in accordance with the Disposal Schedule for Short Term Value Records (DA2158).

Systems used to maintain records

We register and capture records created within our normal business practice, and those received from an external source in our recordkeeping or other approved business system.

We endorse the following business and administrative databases and software applications for the capture and storage of specific information and records. These include:

Recordkeeping system <name>

Business system <name>

Finance system <name>

A full register of endorsed systems used to create or manage information and records is in our Information Asset Register. We endorse these systems because they support information and records management processes (for example, creation and capture, storage, protection of integrity and authenticity, security, access and retention, destruction and transfer).

Email systems, shared folders, personal drives or external storage media lack the functionality to protect business information and records over time. Business should be saved and stored in endorsed systems. Social media records or those on mobile devices may also need to be captured into an endorsed system.

Access to records: sharing business information within <name of organisation>

Information is a resource to be used by all staff, except where the nature of the information requires restriction. Access restrictions should not be imposed unnecessarily but should protect:

individual staff, or client privacy

highly classified material (for example Protected or Highly Protected).

When handling information, staff are reminded of their obligations outlined in their statements of duties <link to your Statement of Duties database> and under the State Service Act 2000 Code of Conduct. <State Service Act not relevant to Councils.>

Release of publicly available information

In accordance with our obligations under the Right to Information Act 2009 (Tas), access to publicly available information is provided on our website. This is the responsibility of <position or area responsible>.

The public have the right to apply for access to information held by our organisation under this Act, excluding “information contained in back-up systems, or information that has been disposed of in compliance with an approved disposal schedule issued under the Archives Act 1983.” s10(2). Other exclusions, reasons for refusals, and exempt information are outlined in the Act.

Responding to Right to Information applications is the responsibility of <responsible position in organisation>.

Retention or destruction of records

Organisational records are destroyed when they reach the end of their required retention period. Authorised Disposal Schedules set out retention periods, having taken into account all business, legal and government requirements for the records. We use several general and organisation-specific schedules to decide retention, transfer and destruction actions.

<list here those Schedules relevant to your organisation - contact the Office of the State Archivist for assistance>

Disposal Schedule for Common Administrative Functions (DA2157)

Disposal Schedule for Functional Records of Local Government (DA2200)

Disposal Schedule for Short Term Value Records (DA2158)

Disposal Schedule for Statutory Governing Bodies (DA2508)

Disposal Schedule for Source Records (DA2159)

<list other schedules here>

<list other schedules here>

Only dispose of records in line with authorised policy instruments issued by the State Archivist. These include Disposal Schedules, Destruction Authorities, Retention notices (“disposal freezes”), Transfers of Ownership, and Transfers of Custody. The approval of <insert title of relevant officer> and the Manager of the business unit responsible for the records is also needed before disposal.

Central to our organisational accountability process is the requirement we maintain a Register of Records Destroyed. This is our formal evidential record of destruction. The Register is retained permanently and clearly identified as the Register of Records Destroyed under Section 20(2)(b) of the Archives Act 1983 (Tas).

Transfer of records

Records may be transferred out of our custody. When permanent records are no longer actively used and/or are 25 years or older we transfer them to the Tasmanian Archives. We are still able to consult records that have been transferred to the Archives.

Records may also be transferred due to government administrative change, either to another government organisation or to a private body. We seek permission from the State Archivist (Transfer of Ownership or Transfer of Custody) before the records are transferred.

Contact our organisational Senior Advisor, Information and Records Management <or relevant title> to discuss the procedures for transferring records.

Monitoring the Records Management program

The <position title of head of organisation> monitors our records management for breaches of this Policy.

The <position title of head of organisation> will facilitate training as required.

The <position title of relevant delegated authority> coordinates day-to-day records management audit activities.

RESPONSIBILITIES

All staff, board members, elected representatives, volunteers and contractors (whether directly employed, or via third party arrangements) <delete or add as required> employed or engaged by our organisation are responsible for managing records created during their work. This includes complying with this Policy.

Staff are reminded that all records created during their employment are the property of the organisation.

Contractors generally handover their records at the end of their contract. <delete or add as required>

Specific responsibilities and accountabilities for information and records management include:

<Match the responsibilities below to the relevant positions. Update the responsibilities to reflect your organisation.>

The Director, Office of the Secretary <or relevant title> is responsible for:

Department and Heads of Agency Responsibilities <or relevant titles> are responsible for:

The Information Technology Unit <or relevant title> staff are responsible for:

setting the organisational risk profile for information and records management

taking organisational responsibility for information and records management, ensuring the program meets operational and legislative requirements

implementing and continually improving our information management program

defining our information and records management requirements

ensuring that staff are aware of their roles and responsibilities relating to the management of information

maintaining and reviewing this Policy and relevant documentation as required

including information and records management training in induction programs

arranging for refresher training sessions as required

ensuring new users are given access to the organisational recordkeeping system as part of the new user induction program

providing technical support for the ongoing operation and maintenance of organisational systems

providing technical support to all staff on the use of organisational systems/applications

publishing and updating information on the intranet and internet in consultation with the content owners

undertaking system backups

developing, maintaining and testing the organisational disaster recovery plan.

The Senior Advisor, Information and Records Management <or relevant title> is responsible for the efficient management of the organisational recordkeeping system, ensuring that sound information and recordkeeping principles, management and best practice guidelines are followed.

This involves introducing and maintaining control over daily information and records management activities and services in line with our procedures, including providing support to staff in the use of our recordkeeping system.

The Senior Advisor, Information and Records Management <or relevant title> is also responsible for:

arranging training sessions for staff in the use of our recordkeeping system

ensuring records are captured uniformly across the organisation and stored in approved business systems

maintaining the integrity and authenticity of records

managing the storage of records located onsite and offsite

managing the disposal of records under authorised Disposal Schedules and Authorisations, and maintaining the Register of Records Destroyed

making and documenting configuration changes to the recordkeeping system as deemed necessary and via change control processes

maintaining and extending procedures for metadata and classification schemes for records control

ongoing review and amendment of Disposal Schedules

ensuring the system is accessible and performing appropriately on a day to day basis

responding to user requests for assistance with the recordkeeping system or other information and records management issues.

Human Resources <or relevant title> staff are responsible for:

administration and management of employee records

administration and management of records within <name of HR system/s>

requesting the creation of personnel records

Finance <or relevant title> staff are responsible for:

administration and management of financial records

administration and management of records within <name of Finance system/s>

Managers are responsible for:

managing risk in business units in line with the organisational risk profile for information and records management

ensuring their staff have an appropriate awareness of recordkeeping systems and requirements

ensuring that staff attend training in recordkeeping systems or procedures relevant to their work area where necessary.

Staff members are responsible for using, maintaining and managing records in accordance with this Policy and records management procedures. Staff must not damage, alter or destroy information and records of the organisation, without authorisation.

Staff are responsible for:

creating records that document their activities and decisions and saving them into the organisational recordkeeping system or other approved systems

undertaking electronic document management activities within the recordkeeping system to ensure revision and version controls are captured

ensuring records in email, social media, cloud and collaborative workspaces are saved in the recordkeeping system

ensuring paper records are scanned to electronic format and saved in the recordkeeping system <if relevant>

recording folder movement for paper records in the recordkeeping system and storing them securely <if relevant>

learning how and where records are kept within the organisation

adhering to organisational disposal requirements

being aware of and following records management procedures.