Orkney Islands Council

Guide to Records Management

Version 2.0

IMAGE: The Orkney Islands Council crest appears above the large title “Orkney Islands Council” and “Guide to Records Management”. The document is marked “Version 2.0”.

Contents

• Introduction
• Overview
• Useful Definitions
• Why are these definitions important?
• Characteristics of authoritative records
• Benefits of Good Records Management
• Consequences of Poor Records Management
• Records Management Process
• ‘Non-current’ Records Definition
• Naming conventions
• Version Control
• Guidance on file sizes
• Documents/Files intended for long term preservation
• Brief Introduction to the EDRMS (Electronic Document and Records Management System) Project
• Project scope and exclusions
• Listing the Records that the Council Needs
• The Retention and Disposal Schedule
  • Definition
  • Why do we need a Retention and Disposal Schedule?
• ‘Non- current’ Paper Records
• Destruction of Records
• Business Classification Scheme
  • Definition
  • Why do we need a Business Classification Scheme and how does it work?
• Vital Records
  • How do we identify Vital Records?
• Screenshot of the Retention Schedule on the Portal
• Data Protection and Information Security
• Key Documents
• Links to Policies, Procedures and iLearn:
• Key Responsibilities:
• Further Queries
• Control Sheet

Introduction

Records and information are a vital asset. They support the daily functions of the Council and protect the interests and rights of staff, and members of the public who have dealings with the Council.

Overview

Some information that individuals and teams in our organisation holds should not be widely available across the whole organisation- for example, information relating to personal data. However, too often information which should be shared and available across the whole organisation is instead held in isolation by individuals and teams: in information silos. Holding information in this way slows down the working of organisations, and it has been estimated that in the UK, employees spend an average of an hour a day looking for information.

Additionally, without a consistent process to share information, issues can arise where it is lost or manipulated in such a way that renders it unusable for the purposes for which it is needed. An example includes if someone leaves the organisation without a good handover; information needed by the organisation or members of the public may be lost if a consistent procedure is not in place and properly implemented.

Thus, the Records Management Policy is about ensuring the efficient and systematic management of our records and information for the effective delivery of our services, to support accountability of our actions, and to foster the collective memory of the Council.

Useful Definitions

Record(s): According to the OIC’s Records Management Policy, along with BS ISO 15489-1:2016, records are ‘Recorded information, in any form, including data systems, created, received and maintained by the Council and kept as evidence of an activity and as an asset by the Council, in pursuance of our legal obligations or in the transaction of business.’ Examples of records could include completed application forms, letters and invoices.

Document: Any account or collection of data and/or information in any form. Documents are discrete and identifiable from other documents and there are logical relationships between each of the textual (and sometimes visual) elements of which it is composed. Examples of documents could include drafts and some emails.

It is important to realise that all records start off as documents, but not all documents will ultimately become records, as will be explained in more detail below.

Disposition: A comprehensive term that refers to the actions associated with implementing decisions about the retention or destruction of records. This may include destruction as well as other actions, such as the transfer and migration of records.

Metadata: Structured or semi-structured information, which enables the creation, management, and use of records through time and within and across domains. Basically, this is the ‘data about data’ which, for example, might include the date a record was created and the name of the individual who created it.

Records Management: The control of the Council records during their lifecycle, from creation to storage, until archiving or destruction.

Why are these definitions important?

In order to provide services and functions, the Council collects a lot of information. The authority holds information about individuals, contracts with outside providers, committee minutes, policies etc. and creates thousands of documents.

Some of these documents are only needed for a short time, such as drafts and most emails and can be destroyed by the individuals who are using them once they are finished with them. Some of these documents need to be kept by the Council as official records.

However, all documents must be handled securely in line with information security and data protection policies and procedures.

The Council’s Records Management Policy is about how we efficiently and systematically control the creation, receipt, maintenance, use and disposition(which could be retaining, destroying or transfer) of records.

Characteristics of authoritative records

Records contain evidence of the Council’s business transactions and/or information relating to those transactions. Records can also contain information the Council requires as part of its legal obligations. The format of the record is not important; what matters is the information the record holds, and whether it relates to Council business or legal obligations.

In order to support the Council’s business and obligations effectively, it is important to keep ‘good’ records. In order to be considered ‘good,’ according to the BS ISO15489-1:2016, a record should have the following characteristics:

• Authenticity: the record is what it purports to be; has been created or sent by the individual/team purported to have created or sent it; and has been created or sent when purported.
• Reliability: the contents of the record can be trusted as a full and accurate representation of the Council’s transactions and activities or facts to which it attests; and which can be depended upon in the course of subsequent transactions or activities.
• Integrity: the record is protected against unauthorised alteration. Any authorised changes are clearly indicated and traceable.
• Usability: the record is one that can be located, retrieved, presented and interpreted. Links between related records should be clear and the metadata for records should support usability by providing information needed to present them, such as identifiers, format or storage information.

Benefits of Good Records Management

Effective, efficient and consistent records management provides a number of business benefits for our Council, highlighted in depth in the Council’s Records Management Policy. In summary, this includes:

• Ensuring legislative and regulatory compliance
• Increased efficiency and effectiveness in delivering our functions and services
• Protecting the interests of the public, employees, clients and stakeholders
• Protecting the reputation of the Council
• Helping us to achieve our business objectives and targets
• Supporting decision making
• Supporting accountability
• Providing business continuity in the event of a disaster
• Making savings in administration costs, both in staff time and storage
• Supporting the development and implementation of new information management technologies

Consequences of Poor Records Management

Without efficient, effective and consistent records management, several negative consequences may result. These include:

• Records which are needed by the Council may be lost.
• Records may be inadequate for the purposes for which they are needed
• Records which are retained for longer than they are needed will give rise to retrieval difficulties.
• Information needed in the course of the Council’s business will take longer to find and incur extra costs, both in monetary terms and in terms of staff time.
• If the Council does not destroy records it no longer needs, this will put excess pressure on storage space (both physical and electronic), also leading to higher costs.
• The rights of our stakeholders (including the public) have the potential to be impaired. For example, the Council has a legal obligation under the Data Protection Act to destroy personal information it no longer needs.

Records Management Process

Records Management is simple – it just does not sound it.

It is about managing a record throughout its lifecycle: from either receiving or creating the record, its capture in a records management system, its subjection to actions (maintenance and use), which may be repeated as necessary, until its potential disposal or transference to the County Archive. The diagram below provides a summary of a records lifecycle:

IMAGE: A records-management lifecycle flowchart shows four steps. Step One is to create or receive a record. Step Two is to capture the record in a system. The record is then managed over time and reviewed against the Records Retention and Disposal Schedule in Step Three. Step Four is to take action: destroy the record securely, transfer it to the Archive, or maintain it if lawfully justifiable. Arrows show that maintained records continue through the lifecycle.

‘Non-current’ Records Definition

Sometimes you may hear a record, in any format, being referred to as ‘Non-current.’ This is the term that we use to describe those records for which there is no current need (e.g. a closed social work file) but that have not been destroyed or transferred yet because they have not reached their destruction/archive date. These records are kept because there may be a legal reason why they should be kept (e.g. many financial records may be needed by auditors) or the Council may need them in the future (e.g. a social work case may need to be reopened).

Naming conventions

It is important to name electronic records and documents we work on in a logical way.

Often, we cannot find files or spend longer than we need to search for files, because they have been ‘eccentrically’ named or stored in a folder that is not obvious. Similarly, knowing which version of a document we are working on (whether it is a draft or a final version) can be difficult and confusing to keep track of if we do not have proper processes in place for tracking this.

This document aims to give a summary of the key points within the file naming and version control guidance produced:

• Remember that before you name a file, folder or document, think about whether you and others could find it easily: If someone happened to accidentally put the document/file into the wrong folder, would you be able to find it? If you could not find it, it is worth renaming.
• It’s a good idea to have a standard way of naming folders, files or documents in your service area, and document how this can be done so that everyone can understand and refer to it. This ensures that naming will be consistent and logical.
• Documents, files and folders should ideally be named after the task or area of work (known as the business function), not individual members of staff. I.E. rather than call a folder ‘Jill’, name it after her area of work, e.g. ‘Planning.’
• Sometimes, it is appropriate to use personal names (for case files or letters). If this is the case there must be consistency: it’s best practice to put surname, followed by first name.
• Keep pathname (i.e. the name of the document, along with all the folders and subfolders where the document is stored) to well under 200 characters as the absolute limit for file pathnames stored on a Windows file system is 255 characters. This character count includes folder names, sub-folder names, share names, spaces and separating characters. It also includes the file format (Word, Excel etc; the date of creation or modification and the title of the file/folder in which the document sits).
• If you include dates in the titles of documents, arrange the elements so that they conform to ISO 8601: 2004 format in the form of YYYY-MM-DD
• If numbers are used when naming a document, we must ensure that we use at least two digits, to ensure that they will be listed numerically, for example, ‘Document 02’ rather than ‘Document 2.’
• In some services (e.g. those dealing with highly confidential information), it is best practice to establish a method where reference numbers or codes (also known as unique identifiers) are attached to a document, and which cannot be translated without an extra table/index/ other source of information. An example is CASE1234567. Here, instead of using an employee’s/ member of the public’s name, a number is used which no-one will know about except those who are supposed to know.

Version Control

Version control is a method of keeping track of changes/ amendments to the documents we work upon. A summary table of the best practice for Version control can be seen here:

IMAGE: A version-control table contains the headings “Final agreed document and major changes”, “Minor changes”, and “Drafts”. It lists Version 1., Version 2., and Version 3. for final or major changes; Version 1.1, Version 1.2, and Version 2.1 for minor changes; and Version 0.0.A, Version 1.1.A, and Version 1.1.B for drafts. A note states: “If you have more than 26 draft versions of a document, you can use AA, AB etc.*”

It is recommended that a version control sheet or table should be added to:

• Policies and procedures.
• Any document once it becomes finalised and needs reviewed (e.g. minutes and agendas).

An example of what a Version control table may look like can be seen below:

IMAGE: A version-control example table records two entries: “28 July 2015. — George Vickers. — 1.1 — Live — Additional information made re CCTV and updated SAR section for employees.” and “25 Jan 2016. — George Vickers. — 1.2 — Agreed. — Added Clear Desk Policy previously agreed.”

• If you are including the version in the title, do not forget to use ‘-‘ instead of ‘.’. For instance, use v-2-0 rather than v2.0 for Version 2.

Guidance on file sizes

This is important because if the servers are full of large documents, it will affect the performance of the system in the same way that your home PC or mobile telephone will go sluggish if it has little spare memory.

• General documents – observe a 5MB size limit where possible.
• Scanned documents – a 300dpi scan will normally support good quality image resolution on larger screens.
• Photographs – a 10Mpixel image will normally support very good quality image resolution on larger screens.
• Use reasonably compressed file types where possible e.g. PDF, JPG, TIF, PNG, (see PDF/A below).
• Avoid scanning documents in full colour unless necessary.
• Avoid uploading raw images from digital cameras – they are large and not universally viewable.
• Bear in mind files may be stored on a remote server and performance could be constrained by network capacity.
• Extremely large documents may be accommodated but uploading and viewing on screens may be slow.

Documents/Files intended for long term preservation

Some of the documents we create will need to be saved as official records for many years. A big problem is that older formats of documents become difficult or impossible to read because the software changes.

Key Points

• Virtually all documents and images can be converted into the global standard ISO19005-1 PDF/A format which is a format designed to be readable in the future. All current Adobe and Microsoft products (from Office 2010 on) support saving files in the PDF/A standard format.
• The process is ‘save-as / PDF / options / PDF options / select PDF/A compliant. I.E. you do not select the option under File to ‘Save as Adobe PDF’ but follow the process above.
• The final Word version should also be retained as well as the PDF, but drafts should be disposed of as ‘process documents.’

IMAGE: A screenshot of Microsoft Word’s PDF export options shows the “Options” dialog with “PDF/A compliant” listed under “PDF options”, alongside settings for page range, document publishing, bookmarks, document properties, accessibility structure tags, image quality, font embedding, and password encryption.

• The above screenshot shows an example of how to save your documents in PDF form.

Brief Introduction to the EDRMS (Electronic Document and Records Management System) Project

The Council is currently conducting a project to deliver an Electronic Document and Records Management System (EDRMS) for electronic documents and records. This project will utilise Microsoft Office 365 tools to allow for easier collaboration, navigation and control of retention and disposal.

Project scope and exclusions

The scope includes all electronic documents and records created and used by council officers during their full lifecycle apart from those specifically listed below. This includes the Integration Join Board (IJB). Compatibility with NHS Orkney will be considered to the extent that is reasonably practicable.

This excludes:

• Documents / records that start in, or once they enter, a specific case management system e.g. HR or social care systems
• Arm’s length external organisations (ALEOs)
  • Orkney Ferries, The Pickaquoy Centre Trust etc
• Schools and college curriculum bases content

Projected Timeline of Project

This project is following a staged approach. In line with best practice, service design and improvement principles, a user-centric approach is being taken. The approximate break down is summarised below (to be reviewed because of Covid-19):

• Stage 1 | discovery, foundations and prototype development | to 31 March 2019
• Stage 2 | piloting | 01 April 2020 – 31 December 2020
• Stage 3 onwards | staged go-live | 01 January 2021 – 31 December 2022
• Final Stage | project close out | 01 January 2023 – 31 March 2023

The project diagram identifies the following document areas:

• Working / rough draft documents — {temporary document area}
• Live formal case files — {working live records}
• Collaborative files — {live project documents and records}
• Formal records like policies, minutes and reports — {reference}
• Archive records — {historic}

Listing the Records that the Council Needs

The Information Governance Group and staff in all the services have drawn up a list of all the Council’s records. The records we have identified are listed in the Council’s Retention and Disposal Schedule.

The Retention and Disposal Schedule

Definition

A records retention and disposal schedule is a policy document that defines an organisation’s legal and compliance record-keeping requirements and it forms the basis for different strands of information governance.

Why do we need a Retention and Disposal Schedule?

The Council implements a retention and disposal schedule in order to ensure that its records are kept as long as legally and operationally required and that records that are no longer actively needed in the conduct of its business are disposed of in a systematic and controlled manner and in line with our legal responsibilities under the Public Records Scotland Act (2011) and Data Protection laws.

The Retention and Disposal Schedule also helps us to understand how long we should keep different records, what our responsibilities are in relation to creating, receiving and working with records and what to do with the records when the Council no longer actively needs them in the conduct of its business.

Staff should ensure that records are kept up until the end of the Retention period and destroyed, retained, or reviewed or transferred to the Archive Service. The development of the EDRMS will make the control of retention and disposal far easier.

‘Non- current’ Paper Records

For paper records, most should be kept in the Council’s Records Stores – Hatston Depot or, for OHAC, Selbro. For those records we are only keeping for a year or so, they may be kept in Council offices etc.

The Procedure for Handling Paper Based Non-current Records sets out how these documents should be handled, including the transfer to the stores and the process when records reach the end of their Retention period.

Destruction of Records

For confidential records, staff should ensure that they follow the Council’s procedures on the destruction of paper and electronic records. The Information Asset Owner is the strategic owner of the information and is the member of the Senior Management Team for the service. They will ensure a member of staff has the responsibility to dispose of records, whether by destruction or transferring to the Archive Service, once the record reaches its retention date.

For many of the specific case management systems used to hold electronic records at the Council, (such as IKEN, ResourceLink, etc) staff can run reports to identify which records are due to be disposed of.

This ability to review and apply retention rules will soon be applicable to all officers’ electronic documents and records within the scope of the EDRMS project. This will be one of the key features set to be brought about by the Council’s EDRMS project-which has an anticipated roll-out completion date in 2023.

For other records out-with the scope of EDRMS, including paper records, staff should carry out manual checks and confidentially destroy according to the advice below.

To help staff identify which records are confidential, the Council is in the process of adopting an Information Classification/Protective Marking Scheme. If staff are unsure whether a Record is confidential or not however, they should assume it is.

Paper records – staff should use one of the paper shredders provided throughout the Council’s offices. For bulk items, D&I Administration should be contacted, and they will arrange to transfer the records for destruction by the Industrial Shredder at Chinglebraes. Until the records are collected, they should be kept in locked cabinets/cupboards.

Electronic devices and hard drives – should be passed to IT, who will arrange for their secure destruction.

Business Classification Scheme

Definition

A Business Classification Scheme is a tool for linking records to the context of their creation. It helps to map out the functions and activities of local authorities.

Why do we need a Business Classification Scheme and how does it work?

To help the Council organise its records, the Council has adopted the Local Government Classification Scheme (LGCS). The hierarchy is structured in three tiers, which the Council has followed:

• Level 1: Functions
• Level 2: Activities
• Level 3: Transactions

For example:

• Level 1: Functions- Corporate finance
• Level 2: Activity - Accountancy
• Level 3: Transaction - Annual report and accounts

The Retention Schedule is organised using this Business Classification Scheme and the Council will be using it more and more to ‘file’ its records, whether they are paper or electronic records. It will be used to form the ‘backbone’ of our information governance infrastructure, including for the EDRMS Project.

Vital Records

Vital records may be identified as those records whose loss would put the Council at greatest risk, or those records, without which, the Council could not continue to function and thus, they allow for business continuity in the event of an incident.

These are the records that directorates will need in order to get their key services running quickly in the event of an incident, such as a fire in the Council’s offices or the loss of the IT systems.

How do we identify Vital Records?

Vital Records are identified in the Retention Schedule and each service should have a plan in place to ensure they can quickly retrieve those records, either by an electronic back up away from the office (laptop, data sticks) or in hard copies away from the main office. For more detailed information, the Council’s Business Continuity Plans include the procedures which should be undertaken in the event of an incident, to help ensure business continuity. The Continuity Plans are available on the Council’s Portal.

Screenshot of the Retention Schedule on the Portal

The Schedule is the key to the Council’s Records Management Policy. The retention and disposal schedule format is being reviewed, but for the time being is as follows:

• Under the Title of Document Column, the three levels of the Business Category can be identified: 1: Functions - Corporate finance, 2: Activity – Accountancy, 3: Transaction - Annual report and accounts.
• Under Retention Period, ‘P’ is entered for Permanent (the key is at the front of the Schedule).
• Under Eventual Fate, ‘P’ is entered because the record will be kept permanently, most have ‘D’ for Destroy.
• The authority column indicates the reason for the Retention Period – whether it is a Council business decision, required by legislation or any other reason.
• The right-hand column identifies Vital Records.

IMAGE: A screenshot of the Retention Schedule under the heading “FINANCE” shows the category “Corporate Finance” and the activity “Accountancy”. Its columns are “Title of Document”, “Retention Period”, “Eventual Fate”, “Current Format”, “Authority”, “Notes / Access”, and “Vital Records”. The visible entries are: “Annual Report & Accounts — P — P — Paper & electronic — Statutory — Signed copy in permanent in Place of Deposit”; “Annual Report Working Papers — Cy+6 — D — Paper & electronic — Statutory”; “Annual Abstract Working Papers — Cy+6 — D — Paper & electronic — Statutory”; “Charity Accounts & Working Papers — Cy+6 — D — Paper & electronic — Statutory”; “Common Good Fund Accounts & Working Papers — Cy+6 — D — Paper & electronic — Statutory”; “Albacs Report for BACS Payments — Cy+6 — D — Paper & electronic — Council”; “Bank Reconciliation — Cy+6 — D — Paper & electronic — Council”; “Bank Statements — Cy+6 — D — Paper — Council”; “LFRS Rating Review Returns / POBE (to Scottish Executive and CIPFA) — Cy+6 — D — Paper & electronic — Council”; “Time Recording Information — Cy+6 — D — Paper & electronic — Council”; “Budget Working Papers — Cy+6 — D — Paper & electronic — Council”; “Asset Register — P — [blank] — Electronic — Council”; “Capital Monitoring — Cy+6 — D — Paper & electronic — Council”; “Grant claim records — Cy+6 — D — Paper & electronic — Council — End of financial year of final receipt of grant payment +6 or +12 for ERDF/ESF Grants”; and “Daily dealing sheets (investments) — Cy+6 — D — Paper — Council”. Red stars identify some entries as Vital Records.

Data Protection and Information Security

Information about what members of staff need to do to keep information safe is set out in the Council’s Information Security Booklet for Staff, the Council’s Data Protection Policy and Code of Practice and the Information Governance Briefings that are issued periodically.

Key Documents

The following key documents are stored on the Portal, under the headings for Records Management and Data Protection & Information Security and on GLOW:

• Records Management Policy
• Retention and Disposal Schedule
• Procedure for Handling Paper-based Non-current Records
• Data Protection Policy
• Data Protection Procedure
• Information Security Information Booklet
• Personal Information Your Right to Know
• Information Governance Briefings
• Information Governance Group – list of members
• Records Management Plan

Links to Policies, Procedures and iLearn:

IMAGE: A table headed “Website links”, “OIC Portal links”, and “GLOW links” lists links for “Data Protection Policy”, “Data Protection and Information Security”, and “Information Governance links”; “Records Management” in the first two columns; “Freedom of Information” in the first two columns; and “iLearn” in the first two columns.

Key Responsibilities:

The Information Governance Officer has overall responsibility for Records Management.

The Data Protection Officer (also Head of Legal Services) has overall responsibility for Data Protection and is supported by the Information Governance Officer.

The Information Security Officer is the expert lead on information Security.

The members of the Information Governance Group (IGG) are a small group of officers who represent Council Services and cascade back through relevant groups. They help with queries from different function areas within the service and records management within their own teams. The IGG members therefore act in a supporting role for services but do not have direct responsibility for information governance for the whole service.

The Senior Archivist, has responsibility for the policies and procedures relating to the transfer of Records to the Archive Service.

Heads of Service have responsibility for content placed by their service.

Further Queries

If there are any queries regarding how to instil good records management practices within your service, seek advice either from the Information Governance Officer (George Vickers) or members of the Information Governance Group).

Control Sheet

Review/Approval History

Change Record Table

Status Description

Final – The document is complete and is not expected to change significantly. All changes will be listed in the change record table.

IMAGE: The control sheet contains the headings “Review/Approval History”, “Change Record Table”, and “Status Description”. The review table records approvals dated 19.01.16., 02.07.19., and 30.04.20. for Versions 1., 1.1., and 2.0. The change record table records changes dated 18.05.16. by George Vickers, Version 1.1., status Final., and dated 28.04.20 by Molly Edmond, Version 2.0., status Final.