Focus on the business

These actions are part of the Digital Continuity Plan and are aimed at achieving the digital continuity outcomes. The other two parts are Focus on the people, processes and technology and Focus on the information.

Digital information is created, captured and used in the conduct of agency business. Proper management of digital information is not only important for accountability and compliance; it also improves operational and strategic outcomes and provides benefit for government, citizens and other stakeholders.

Review your information to understand what information your agency creates, uses and holds and identify accountabilities, opportunities, compliance obligations, cost, value and risks

The purpose of an information review is to identify the information that is needed to optimise the achievement of organisational objectives, who it is needed by, how it will be used, its source and how it flows through the organisation and between the organisation and its external environment.¹

An information review is carried out to document the digital information created, captured and used in conducting agency business and establish its cost and value. The review also identifies opportunities for use of the information and gaps in information management that will then guide improvement plans.

Ideally, the review should cover business information in all formats across the agency because it can identify opportunities for transforming business processes from reliance on paper to digital formats. However, it is important to ensure that the information reviewed is of material importance to the business so that the cost and effort of the review are worthwhile.

The information review can cover the whole agency in one pass or take an incremental approach, focusing first on those areas of agency business with the highest priority or risk. Periodic reviews, audits, system upgrades and other procurement activities also provide opportunities to review information holdings.

Results of an information review can be used to create an ongoing information asset register (as outlined in the Open Public Sector Information Principles).

Information in use

When determining what digital information is being created, captured and kept, consider why it is created and where it may be stored. 'Digital information' may refer to business transactions, decisions, agenda papers, minutes, advice, policy statements, procedures and a range of other materials. It may be found in many systems including databases, business systems, email accounts, shared folders and hard drives. However, regardless of the type, format or location of the information it is important that digital information is managed according to its value.

The National Archives provides guidance on the types of digital information to consider and the systems that create, keep and manage digital information. Advice on storing digital records is also relevant.

Accountabilities

An information review should clarify who is responsible and accountable for the digital information that is identified. Further details on defining, assigning and resourcing accountable information management roles are provided in the section on Define, assign and resource accountable information management roles.

Opportunities

An information review may help agencies to identify better strategic or operational outcomes. For example it can:

• identify opportunities for improvement through analysis of strategic or operational performance information
• lead to more effective services to government, citizens and other stakeholders by providing better quality information, better informed and more consistent decisions, better use of information among systems or agencies or faster responses
• identify opportunities to remove duplicated information
• lead to more efficient services by improving access to required information or information flows.

Agencies can also realise benefits by transitioning to digital information management.

Compliance obligations

A good understanding of the legal, policy, contractual and other obligations imposed on the creation, capture, management and use of information is essential for accountability and managing risk.

Compliance obligations can cover a range of aspects of information management including:

• capture, creation, management and destruction or retention of records and information
• privacy and security of information
• use of information
• disclosure, discovery, sharing and publication of information.

A good starting place for identifying accountabilities is legislation that affects the way your agency manages its information, including information needed for legal proceedings.

Cost and value

It is important to understand the cost and value of the information that is created, captured and used. The value of digital information may vary throughout its life depending on:

• business requirements (the need for accountable and transparent decision-making within agencies) 
• government requirements (the need to meet policy initiatives or fulfil compliance obligations)
• community obligations (the need for information to be made available to the community for use or re-use in innovation, research or projects, and the level of transparency required).

The Office of the Australian Information Commissioner issues paper entitled Towards an Australian Government Information Policy (pdf, 818kb) states, 'the value of information is generally increased, rather than decreased, by making it available. It is therefore in the national interest to get maximum value from public sector information by making it publicly available for creative reuse.'

In this context, cost and value are not necessarily financial, although it is helpful to assign indicators of relative importance, such as 'major significance' or 'vital' so that agencies can assess priorities for action and investment in risk mitigation. A good example of a non-financial approach to the value of information is the business impact levels in the Australian Government protective security governance management guidelines (pdf, 453kb).

Risks

Effective digital information management will reduce risks. Two types of risk should be considered:

• the risks associated with business activities
• the risks associated with managing digital information.

Develop action plans to address the highest-priority issues raised by the information review

Actions on any gaps and opportunities identified in the information review need to be prioritised. The initial information review provides a baseline for monitoring progress.

Update and evaluate the information gathered in the review regularly

The information gathered for the review can be useful in the ongoing governance of digital information. Reviews should be conducted periodically to make sure that the information remains current and useful, progress is tracked and further issues are identified, and incorporated into your agency's governance framework.

Footnotes