Managing Public Sector Records

Conclusion

PROV has achieved positive change since our 2008 audit, overcoming a past lack of support from DPC for initiatives to improve records management. In particular, PROV's release of improved records management standards and agency tools has strengthened the public sector's ability to effectively manage the government's information.

However, further reform is needed, as longstanding weaknesses in Victoria's regulatory framework remain. These weaknesses—particularly the absence of system-wide compliance monitoring and reporting and out-dated legislation—heighten the risk of key government records being lost, inaccessible, inappropriately accessed, unlawfully altered or destroyed.

These risks materialised for key records we examined at DET and DHHS, which are not fully compliant with legislative requirements. Consequently, neither agency sufficiently understands the records it owns and holds, and cannot be assured that their records are being effectively managed and maintained. Encouragingly, both agencies acknowledge these issues, and have started to address them.

DPC's recent positive actions to strengthen PROV's administrative arrangements and the government's announcement that it will review the Act are important reforms with significant potential to address these longstanding weaknesses.

Findings

The issues we identified in this audit are consistent with those identified in the Landell report, suggesting that the following problems are unlikely to be confined to the two portfolio departments we looked at in detail. All public sector agencies should take note of our findings and recommendations.

Supporting oversight of public sector records management

DPC is responsible for whole-of-government information management and has operational oversight of PROV.

The review of the Act—called for by the Minister for the Arts in 2008—was assigned to DPC, along with stewardship of PROV's funding requests to implement the recommendations of our 2008 audit. However:

• DPC did not progress the review past the first of its two stages
• PROV was not funded to address our recommendations and did not reprioritise its resources to implement them.

In 2015, after DPC commissioned a review of PROV's business model, PROV was reassigned to the Special Minister of State's portfolio. In 2016, PROV received $8.2 million of additional funding for the next four years and ongoing funding of $2.57 million a year to better meet service demand.

These changes have given PROV new opportunities to focus on ways to ensure that agencies create, manage and preserve a full and accurate record of government activities for future use.

PROV's assistance to agencies

Although PROV's funding request to address our 2008 recommendations did not progress, PROV received special funding to produce a more comprehensive set of records management standards for use by agencies to comply with the Act.

However, PROV did not introduce recommended competency programs, or better monitoring and reporting on agency compliance. As a result, records management does not have the same level of education, monitoring and reporting that exists for other aspects of public sector information, such as freedom of information and privacy.

PROV has never sought a legal opinion on the accuracy of its interpretation of its powers, but we consider that the Act empowers the Keeper to inspect agency records management programs. The relevant clauses of the Act are shown in Figure A.

Figure A

Public Records Act 1973, section 13A, 13(b) and 21(1),

Source: VAGO from the Public Records Act 1973.

As a result of PROV not implementing our recommendations:

• records management does not have the same level of education, monitoring and reporting that exists for other aspects of public sector information, such as freedom of information and privacy
• agencies have not had the level of specialist oversight and education they need, and PROV's visibility of agencies' records management problems is impaired.

Instead, PROV has used alternative mechanisms to find out what support agencies need. For example, using its Information Management Maturity Measurement Tool (IM3), PROV learned that records management compliance monitoring and reporting programs were not sufficiently developed in government departments.

Agencies' records management

Insufficient executive support for, and attention to, records management is preventing DET and DHHS from achieving full compliance with the PROV standards, and thus fully lawful and effective records management.

Authority

Agency records management units require agency-wide authority to direct staff and third-party providers on all matters related to records management. This includes education and training, compliance management, reporting, recruitment, resource allocation and staff activities.

In both agencies we looked at, the core records management units provide strong support to the rest of the organisation. However, in DET the unit does not effectively exercise its authority, and in DHHS the unit does not have the necessary authority. In both cases, this reduces assurance that departmental staff are managing records lawfully.

Education and training

People who create and manage records—which, in today's digital age is all public sector staff, as well as its contractors, consultants and volunteers—must have enough records management training to enable them to apply PROV's standards. However, neither agency provides or has access to education and training that is adequate for the needs of those who deal with public records.

Compliance monitoring and reporting

Standards under the Act require agencies to have a records management compliance monitoring and reporting program.

DET has no compliance program, but has committed to establishing one. In DHHS, ad hoc monitoring occurs, but more robust assessment is needed, and reports are not made to the secretary, who is ultimately responsible for the program. In both cases the secretaries have diminished visibility of the risks they are accountable for.

Because third-party providers of government services are not subject to the Act, Victoria's records management standards make agencies responsible for ensuring their third-party providers comply with the Act when delivering services on the government's behalf. However, because both agencies have not adequately monitored third-party compliance, there is limited assurance that these providers are lawfully managing records related to the government services they provide.

Compliance with PROV's trustworthiness specification—Capture

The 'Capture' specification contained in the PROV standards focuses on ensuring government records are authentic, reliable and usable, and have integrity—that is, they are protected from undetected and unauthorised alteration, and can be trusted as 'the real thing'.

Neither agency met any of the Capture specification's requirements.

Both agencies are aware of the need to improve their records management and have either committed to or are now addressing the identified weaknesses through initiatives to improve compliance, education and training, and oversight.

Recommendations

We recommend that the Department of Premier and Cabinet as part of its review of the Public Records Act 1973:

1. address the recommendations of the 1996 Public Accounts and Estimates Committee review—in particular, a continuous program of random audits of agencies to ensure that records management practices are compliant with Public Record Office Victoria standards (see Section 2.2)
2. address the complexities and risks for records management arising from increased outsourcing arrangements and advances in technology since the Public Records Act 1973 was first drafted (see Section 2)
3. work to harmonise the Public Records Act 1973 with Victoria's changed information legislation environment—including legislation such as freedom of information, privacy and data protection (see Section 2.3)
4. incorporate the improved regulatory measures that are applied in other jurisdictions—including monitoring, reporting and penalties for noncompliance (see Section 2.3).

We recommend that the Public Record Office Victoria:

5. seek legal advice as a matter of priority on each of its powers and duties, but with particular attention to the extent and purpose of:

• section 12: the requirement to 'assist public officers' to apply Public Record Office Victoria's standards—and what specifically would satisfy this requirement
• section 13A: Public Record Office Victoria's powers of inspection of records management programs (see Section 3.4)

6. implement VAGO's 2008 recommendation to introduce competency‑based training (see Section 3.3)
7. determine the appetite across government for a records manager 'community of practice' similar to that of the whole-of-government information management group—and if the demand is sufficient, establish this forum (see Section 3.3).

We recommend that the Department of Health and Human Services and the Department of Education and Training:

8. establish agency-wide internal records management compliance programs that monitor and report to the agency head on compliance with each of the Public Record Office Victoria standards—a risk-based phased approach should be used to manage the programs' size, complexity and cost, and the program should be linked to the agency's continuous improvement activities to drive agency-wide improvement in records management (see Section 4.2)
9. establish processes to ensure that third-party providers are managing their records in compliance with Public Record Office Victoria's standards (see Section 4.3.3).

Responses to recommendations

We consulted with the Public Record Office Victoria, the Department of Premier and Cabinet, the Department of Education and Training and the Department of Health and Human Services, and we considered their views when reaching our audit conclusions. As required by section 16(3) of the Audit Act 1994, we gave a draft copy of this report to those agencies and asked for their submissions and comments.

The following is a summary of those responses. The full responses are included in Appendix A.

Our recommendations were accepted by the Public Record Office Victoria, the Department of Premier and Cabinet, the Department of Education and Training and the Department of Health and Human Services.

1.1 Victoria's records management environment

The following reviews highlight recurring issues with records management.

1996—Parliamentary inquiry

In 1996, Parliament's Public Accounts and Estimates Committee conducted the Inquiry into the Public Record Office Victoria. Its findings included:

• insufficient attention has been given to managing Victoria's public records
• PROV could not effectively fulfil its role while it was part of the Arts portfolio
• public sector records required an improved legislative framework
• PROV should be assigned ongoing records management audit responsibilities—with agencies meeting the costs in a manner similar to the services provided by the Auditor-General.

2008—VAGO audit

In our 2008 audit Records Management in the Victorian Public Sector, we found that outdated and unfit‑for‑purpose records legislation was hindering the efforts of PROV and agencies to manage records effectively. We also found that Victoria's records management framework lacked mechanisms to:

• monitor and report on agency compliance with the Act and records management standards
• investigate and manage noncompliance with the Act and records management standards.

We concluded that in the absence of these mechanisms, the state cannot be assured that its records management objectives are being met.

2012—VAGO audit

Our 2012 report Freedom of Information (FOI) revealed 'serious flaws in recordkeeping practices and FOI searches'. In 2013, the UK's Information Commissioner's Office stated that the most common basis for upheld complaints in the health sector was not complying with an individual's right of access to their information.

2015—the Landell report

In December 2015, PROV published the Victorian Government Records Management Review (the Landell report)—a high-level analysis of 224 VAGO and Victorian Ombudsman records management findings from 2010 to 2014. It concluded that there was a pattern of systematic and extensive ongoing records management failures within Victorian government departments and agencies. It also reported that across the Victorian public sector, 'records management failures are systemic, chronic and pervasive' and 'greater emphasis and investment in information management within agencies is critical to avoiding waste and loss of public confidence'.

During the course of this audit, DPC presented the Landell report to the Victorian Secretaries' Board (VSB). VSB has referred the report to a VSB subcommittee for further study and advice.

1.3 Related inquiries

Recent high-profile inquiries have increased attention on the need for improved public records management, including the:

• Victorian Parliament's Environment, Natural Resources and Regional Development Committee's 2016 report Inquiry into the CFA Training College at Fiskville, which recommended penalties for noncompliance with records management requirements after identifying deficiencies in the quality and availability of records for people who lived, worked and trained at the Fiskville training college
• Victorian Parliament's Family and Community Development Committee's 2013 report, Betrayal of Trust, on its Inquiry into the Handling of Child Abuse by Religious and Other Non-government Organisations
• 2015 report by the Royal Commission into Institutional Responses to Child Abuse, which revealed the psychological impacts of poor records management practices on abuse survivors.

The Wrongs Amendment (Organisational Child Abuse) Bill 2016

In response to the Victorian Parliament's Betrayal of Trust inquiry and the Royal Commission into Institutional Responses to Child Abuse, the government introduced the Wrongs Amendment (Organisational Child Abuse) Bill 2016.

Survivors of abuse while in state care have historically encountered barriers to obtaining redress. Organisations have been able to argue that they had no knowledge of the abuse, and therefore could not be held accountable. The onus of proof has been on survivors to demonstrate that abuse had occurred—often requiring them to gain access to government records through the Freedom of Information Act 1982.

The new Bill is designed to reverse this onus of proof. Instead of the survivor being dependent on the effectiveness of an agency's records management practices, the agency itself will be dependent on the reliability of its records—and those of the organisations it contracts services to—to prove that 'reasonable precautions' were taken to prevent abuse.

Once the Bill is passed, the laws will apply to all religious institutions, community organisations, childcare facilities and government bodies that exercise care, supervision or authority over children, and these organisations and agencies can be sued.

The Wrongs Amendment (Organisational Child Abuse) Bill 2016 makes compliance with the Act more important than ever. This is because the Act not only requires that agencies ensure that care providers create and keep records, but that they do it in a way that ensures the records are authentic, reliable and usable, and have integrity. Compliance with these legislated requirements provides the assurance that a record can be trusted.

1.4 Why this audit is important

Good records management is the foundation of government accountability—the integrity of government records directly influences public perception of the integrity of the government itself. Well managed records are also central to the government's ability to make informed decisions, efficiently and effectively provide goods and services, protect the community, and demonstrate delivery on its commitments.

Effective records management ensures that:

• the correct information is secure and available to the right person anytime, anywhere, and in the right format
• the ongoing value of records is identified and managed so that the information they hold can be used to its full potential.

Conversely, agencies without effective records management are at risk of:

• limiting government's ability to develop evidence-based policies and strategies
• undermining people's rights to access public sector information
• being perceived to be avoiding transparency and accountability.

1.5 What this audit examined and how

In this audit, we examined whether DET and DHHS are managing their records in accordance with legislative requirements, and whether DPC and PROV are effectively assisting them to do this. We had a particular focus on:

• DET procurement and outsourcing—DET is responsible for hundreds of millions of dollars of procurement‑related expenditure. Recent IBAC findings indicate that DET needs to improve its records management to help prevent fraudulent procurement practices.
• DHHS child protection—DHHS delivers child protection services, and must effectively manage child protection records to ensure the welfare of some of the community's most vulnerable members. A number of inquiries and commissions have highlighted the need for DHHS to ensure that information about children at risk of any type of harm is appropriately created, stored, and made available to the relevant people.

We conducted our audit in accordance with Section 15 of the Audit Act 1994 and Australian Auditing and Assurance Standards. The cost of this audit was $540 000.

1.6 Structure of the report

The remainder of the report is structured as follows:

• Part 2 examines DPC's support and oversight of PROV
• Part 3 examines PROV's assistance to agencies
• Part 4 examines agency records management.

2.1 Conclusion

The limitations we previously identified in Victoria's records management oversight framework persist, and as a result central oversight and monitoring of agency compliance remains inadequate.

The state's oversight mechanisms also continue to lag behind more advanced jurisdictions that have implemented better practices, such as audit programs and significant penalties for not following the Keeper of Public Records' directives.

However, more recent activities signal renewed support for improving oversight, including:

• moving PROV to the Special Minister of State's budget portfolio—creating a better alignment between PROV's legal mandate and its portfolio priorities
• the intention to establish a Victorian Information Commission—centralising authority, regulation and specialist support for better practice in records and information management
• a new commitment to review the Act—to ensure that it is relevant to the government's current operating environment
• responding to VAGO's recommendation to establish a whole-of-government information management framework—ensuring that the Act's requirements are a priority in Victoria's information management landscape.

In combination, these changes present significant opportunities for improvement in Victoria's record management practices.

PROV must have effective support to address the enduring problems in records management and overcome the barriers to improving government transparency and accountability.

2.2 Progress on past recommendations

In our 2008 audit, we found that the Act hinders the efforts of PROV and agencies to manage records effectively. We recommended that the Act be reviewed to make it more relevant to the modern public sector. We also recommended that the review consider PAEC's 1996 recommendations, including that PROV establish robust whole‑of‑government oversight through a records management auditing and reporting program.

We also wrote to PAEC in December 2009, stressing the significance of the recommendation and that it should be rated as a high priority for implementation.

Two key activities were initiated to introduce the recommended oversight—a review of the Act and a request for funding by PROV to implement compliance monitoring and reporting and a competency development program.

2.2.1 Review of the Public Records Act 1973

In response to our 2008 recommendations, the responsible minister at the time—the Minister for the Arts—assigned responsibility for reviewing the Act to the Department of Premier and Cabinet (DPC).

DPC elected to take a two‑stage approach to the review:

• stage 1—develop an options paper to inform the review
• stage 2—provide a report to the minister, with policy development recommendations.

Stage 1—options paper

It took 19 months for DPC to engage a consultant to prepare an options paper to inform the review. We could not find clear evidence of the reasons for this delay because DPC's records of the review are sparse, and details of the actions DPC took to avoid or mitigate delays are unknown. Further, because many of the staff involved in the review are no longer working in DPC, much of this corporate history has been lost.

The consultant submitted the paper to PROV, which then provided it to DPC so that DPC could begin stage 2. The paper offered a number of options to consider in the report to the minister.

Stage 2—report to the minister

Draft documents exist that indicate that DPC had intended to progress this stage of the review. However, no records show that this resulted in a brief to the minister, as initially intended.

After DPC received the options paper, PROV attempted to engage DPC and prompt greater progress. In some instances, responses to PROV's enquires were delayed. In other instances, PROV received no response at all. Further, there is no evidence that DPC responded to requests to finalise the review by:

• the chair of Public Records Advisory Council—a former secretary of both the former Department of Justice and the former Department of Innovation, Industry and Regional Development
• the chief executive officer of Records and Information Management Professionals Australasia—Australia's peak records and information management professional body.

In our 2015 report Access to Public Sector Information, we recommended that the government ensure improvements to public sector information management were underpinned by appropriate legislation. The 2010 options paper that was prepared for the legislative review of the Act supports our recommendation, stating that legislative reform may be a part of creating a sustainable information management strategy into the future.

2.2.2 A records management oversight program

Education is a critical part of an information regulator's mandate. PROV requested funding to implement our 2008 recommendations to establish a compliance monitoring and reporting program and a competency development program. The Minister for the Arts and the DPC secretary both supported the initiative, but PROV's funding request was not submitted to government.

DPC's records do not explain why the funding request was not submitted to government. DPC should improve its compliance with the Act to so that a full and accurate record of government decision-making is created and kept.

2.3 Reform of public records oversight

To better understand what improved oversight might look like in practice, we considered the approaches of other jurisdictions. We compared the requirements for agencies to demonstrate their compliance with records management legislation, including approved records management plans, compliance attestations, self‑assessments, independent assessments and audits. We also looked at penalties in place for noncompliance, in light of the 2016 recommendations arising from the Victorian Parliamentary Inquiry into the CFA Training College at Fiskville.

Figure 2A summarises the breadth of powers and functions of other records management authorities in comparison with Victoria.

Figure 2A

Records management authorities—oversight powers and functions

(a) 'Records authority' may also include a related authority, such as Western Australia's Information Commission or the UK's Information Commissioner's Office.

(b) Authority not applied.

Source: VAGO.

As Figure 2A shows, Victoria's oversight of public records management is significantly behind other jurisdictions, particularly those that have adopted the use of audits or assessments to ensure that agencies implement better-practice records management. The approaches of some other jurisdictions are discussed below.

2.3.1 Investigatory bodies

Archives New Zealand

Under the New Zealand Public Records Act 2003, Archives New Zealand audits agency records management regimes every five years.

New South Wales and the National Archives of Australia

New South Wales and the National Archives of Australia have both used independent auditors with specialist records management skills to perform audits. The 2010 options paper for the review of the Act reports that these audits have had a considerable impact.

2.3.2 Commissions

Some jurisdictions have a commission—a centralised information management authority. This structure can bring together agencies that administer legislation for records management, freedom of information, records and data security, and privacy protection. With effective legislation in place that is consistent across the different bodies, as well as organisational capacity, this structure enables information authorities to work together to ensure the transparency and accountability of government through reliable, accessible and secure records and information. Key examples are described below.

State Records Commission—Western Australia

The State Records Commission (WA) includes the state's Auditor-General, Information Commissioner and Ombudsman. It is responsible for monitoring agency compliance with the State Records Act 2000, and investigating potential or actual breaches.

Information Commissioner's Office—United Kingdom

The Information Commissioner's Office (ICO) in the United Kingdom (UK) has the power to audit the freedom of information and data protection activities of a range of public sector agencies. The ICO recognises the central role that an agency's records management practices play in meeting the requirements of the freedom of information and data protection legislation. As a result, records management is one of the six key areas of scope for ICO audits. The ICO has a memorandum of understanding with the UK government, which authorises the UK National Archives to assess agencies' records on the ICO's behalf.

The UK National Archives also carries out information management assessments. Although these assessments are voluntary, a 2014 review commissioned by the UK Prime Minister recommended that they be made mandatory, with the outcome to be reported to departmental boards and added to risk registers.

2.3.3 Penalties for noncompliance

During our audit, Parliament's Environment, Natural Resources and Regional Development Committee provided us with details about the Country Fire Authority's failure to maintain proper workplace health and safety records. Specifically, the Committee advised that this unlawful lack of records management has prevented people affected by breaches of health and safety legislation from having the documentary evidence necessary to prosecute their claims and seek appropriate compensation.

Through standards issued under the Act, PROV determines what public records agencies must create and manage, and how long they must retain them before they can be destroyed. The current penalty for destroying records without this authority is five penalty units (approximately $777.30).

In comparison, maximum penalties for records management offences in other jurisdictions range from fines of $3 600 at the Commonwealth level, to $30 800 in NT . Offences in NT and SA can also incur prison terms of up to one year and two years respectively.

Other jurisdictions also impose penalties for additional records management offences, such as damaging public records, and obstructing requests for information and evidence of records management compliance. Victoria does not issue penalties for these offences.

The 2010 paper developed for the review of the Act specifically comments that the penalties in Victoria for breaching records management requirements are too low to act as a deterrent.

Given the systemic nature of records management issues reported in the Victorian Government Records Management Review (the Landell report), the recommendation from the Parliament's Environment, Natural Resources and Regional Development Committee to review sanctions is very timely.

Figure 2B shows the penalties for unlawful destruction of records and obstruction offences in Victoria and other jurisdictions.

Figure 2B

Penalties for unlawful destruction of records and obstruction offences

(a) Obstruction includes wilful destruction of public records and noncompliance with official requests.

Source: VAGO.

2.3.4 A new records management environment for Victoria

A new administrative arrangement and central information management authority

The 1996 PAEC Inquiry recognised that 'there seems to be little understanding that records management and information management are the same function'.

PROV's 2015 reassignment to the Special Minister of State's portfolio is positive as it now locates it with Victoria's other information and integrity bodies and more directly connects it as a portfolio agency of DPC. This will also enable greater whole‑of‑government support and oversight.

In 2016 the government introduced a Bill to establish the Office of the Victorian Information Commissioner (OVIC), to consolidate some of Victoria's information authorities. OVIC will provide oversight of Victoria's information management practices from a single body, and will table any investigations in Parliament.

The arrangement is similar to the structure of other jurisdictions that manage public records management issues more proactively. We consider that if OVIC is to have full oversight of public sector information management, it would also need to have oversight of the Act—as is the case in other jurisdictions.

A new information management framework

In our 2015 audit report Access to Public Sector Information, we discussed Victoria's confused and fragmented information management governance framework, and its proliferation of unconnected, overlapping and inconsistent plans.

We recommended that DPC develop a whole‑of‑government information management framework—as recommended in the 2009 Parliamentary Inquiry into Improving Access to Victorian Public Sector Information and Data—underpinned by appropriate legislation, and with records management compliance at its core.

In response to our recommendation, DPC began to develop an information management framework in 2016. A document that captures a high-level view of Victoria's information management landscape was published in December 2016. We anticipate that the framework's functional components will follow in due course.

A new Public Records Act

In June 2016, the government announced a 'root and branch' review of the Act. At the time of our audit, the terms of reference for the review had not been formalised. However, the government also stated that:

• merging the Freedom of Information Commission and the Office of the Commissioner for Privacy and Data Protection into OVIC is only the first stage in improving government transparency and accountability, and creating a fully integrated government information regulation system
• the review of the Act is intended to develop a revised framework for public records and freedom of information.

When we completed this audit in March 2017, the review had not begun.

3.1 Conclusion

PROV has implemented a number of positive changes in response to the recommendations of our 2008 audit Records Management in the Victorian Public Sector, including:

• the release of additional records management standards—providing agencies with an improved framework to help them comply with the Act
• developing and implementing an Information Management Maturity Measurement Tool (IM3)—to help agencies understand their information management weaknesses, and help PROV gather intelligence about how to better support information management by agencies.

PROV considers that it does not have the power to inspect agency records management programs and, on that basis, has not introduced a whole-of-government inspection program. However, its interpretation of the Act's powers is not based on informed legal opinion.

The absence of records management oversight reduces visibility of the state's records management problems, and the capacity to address them. It also means that the regulatory framework in place for records management remains insufficient, and agencies still do not receive the support they need to help them comply with the Act.

PROV's recent reassignment to the Special Minister of State's portfolio, additional funding to meet service demands, and the review of the Act are encouraging initiatives that signal positive change.

3.2 PROV's advocacy role

PROV's advice to government has consistently drawn attention to the need for greater oversight of public sector records management. Its advocacy has taken a number of different forms.

PROV's funding submissions discuss the increased public expectations that government will be able to properly manage records in this digital age. Its submissions emphasise the importance of implementing our recommendations for more effective monitoring and reporting on agencies' compliance with the records management standards. PROV has also reiterated this message in presentations to government, other agencies and the public.

PROV also played a key role in developing Victoria's first—but ultimately not completed—Public Sector Information Release Framework, which we reported on in our 2015 audit report Access to Public Sector Information.

PROV actively worked to ensure that the framework's principles and standards had effective and compliant records management at its core.

PROV played a proactive role in the 2008 review of the Act, which was subsequently abandoned, and continued to campaign to government about the need to improve compliance mechanisms.

Victoria's Public Records Advisory Council (PRAC) was established under the Act to promote cooperation between PROV and public offices. In this role, PRAC may make recommendations to the responsible minister on any matter relating to the Act's administration. PRAC wrote to the then new government in December 2010, advocating the need for improved records management legislation—but did not receive a response.

Over 2011 to 2014, PROV made further attempts to influence government decision‑making about improving compliance with the Act, but without success.

Landell report

In 2015, PROV engaged a contractor to analyse VAGO's audit reports and the Victorian Ombudsman's reports from 2010 to 2014. PROV published the final report of this analysis, Victorian Government Records Management Review (the Landell report), in October 2015.

The Landell report includes an analysis of agencies' noncompliance with the Act, describing it as systemic, chronic and pervasive across the public sector, rather than as a collection of isolated incidents. It also notes that the consistent reporting of records management issues across both sets of reports supported this conclusion.

In the absence of structured oversight of agencies' records management, PROV's publication of the report creates some visibility of the nature, extent and impact of agencies' noncompliance with the Act.

During the course of this audit, the Landell report was presented to the Victorian Secretaries Board for consideration. Department of Premier and Cabinet (DPC) also announced the review of the Act. These actions are encouraging, and indicate that DPC has an increased understanding of the need for whole-of-government oversight of public records management.

3.3 PROV's regulatory role

3.3.1 Implementation of oversight activities

In our 2008 audit, we found that the Act:

• was out of date
• did not outline the roles and responsibilities of PROV and agencies that are relevant to today's work environment
• was hindering effective records management and required comprehensive review.

We also found that the records management framework in Victoria did not include systemic mechanisms to:

• monitor compliance with the Act and records management standards
• investigate and manage noncompliance with the Act and records management standards (including the enforcement of penalties)
• report on agency compliance with the Act and records management standards.

We concluded that without these things, the state could not be assured that its records management objectives were being met. We also concluded that PROV's agency education and training options were insufficient to meet agency needs.

To help address these findings, we made several key recommendations, namely that PROV:

• revise its records management standards
• introduce its planned competency-based training program and additional training courses to address unmet agency training needs
• better assist agencies in the area of compliance monitoring and reporting.

PROV planned to address our recommendations by establishing a standards review program and developing a framework to:

• provide accredited records management training specifically for public sector staff
• introduce a whole-of-government records management compliance assessment program, enabling PROV to use its powers of inspection
• gather information about competency and compliance to use in benchmarking.

PROV advised DPC that implementing these initiatives was dependent on additional funding.

PROV was given funding for—and invested substantial effort in producing—a comprehensive set of records management standards that agencies could use to comply with the Act.

However, PROV's funding submission to government to implement the training and assessment framework was not progressed, and PROV did not receive the extra funding. DPC has no records to explain the government's decision-making process. DPC should improve its efforts to comply with the Act's requirements to ensure that full and accurate records of government activities are created and captured.

PROV chose not to reprioritise its existing resources to develop the framework because the Act does not explicitly require PROV to perform compliance monitoring or agency training.

Implementing these recommendations would have helped to address the finding from Public Accounts and Estimates Committee's (PAEC) 1996 Inquiry into the Public Record Office Victoria that 'records management has not received the status it deserves … [and] has been seen as a function to be staffed at little cost by people of little experience. It is seen as being of low priority, with little or no education standards in records and information management being required by agencies'. It would have also addressed the Inquiry's recommendation to produce a report identifying agencies that do not meet Victoria's records management standards.

We also wrote to PAEC as part of its 2010 Review of the Findings and Recommendations of the Auditor-General's Reports 2008 to reiterate our recommendations. We stated in particular that we considered our recommendation for PROV to implement its training strategy to be a high priority.

To date, the framework has not been implemented, and agencies have continued to operate without effective oversight of whether they are lawfully managing their records.

3.3.2 Information Management Maturity Measurement Tool

Although PROV has not established a whole-of-government compliance monitoring framework, it has developed the IM3—a voluntary questionnaire that agencies can use to assess the maturity of their information management. The assessments range from 'unmanaged' (the lowest maturity level) to 'aware', 'formative', 'operational' and 'proactive'.

PROV uses the results of assessments against the IM3 to gather intelligence on agencies' information management and to better understand the state of records management across the Victorian public sector.

In our 2015 audit report Access to Public Sector Information, we recommended that agencies assess their information management environments using the IM3. In 2016, PROV facilitated these assessments for all departments, including the Department of Education and Training and the Department of Health and Human Services. Only one department did not respond to our recommendation to perform an IM3 assessment.

The results of these assessments show that, collectively, agencies' compliance monitoring and reporting was 'unmanaged'. The highest collective rating was 'formative', in the areas of governance, vision and strategy, and information security. All other areas were rated as only 'aware'.

The IM3 is a useful mechanism for agencies to gain a broad understanding of their information management environments. However, it is not a substitute for a rigorous framework for monitoring and reporting on agencies' compliance with the Act.

Without a regulatory framework for monitoring how effectively agencies manage their records, PROV largely relies on information gleaned from reports from Parliamentary committees and integrity offices—such as audit reports and Victorian Ombudsman reports—to identify agencies with poor systems and practices and offer assistance to them.

PROV is a member of Victoria's whole‑of‑government Information Management Group and, in some cases, is also part of agency records management governance groups. These activities help PROV to understand what kinds of support agencies need.

However, stakeholders have advised that records managers do not have the opportunity to be involved with the IMG, and there is no equivalent group for cross-agency dialogue on records management issues. While PROV hosts a Records Management Network, stakeholders suggest that this more of a showcasing forum with guest presentations—rather than a community of practice for addressing whole-of-government records management issues.

3.4 PROV's inspection powers and reporting requirements

The Keeper of Public Records (the Keeper) is the head of PROV and is accountable under the Act for many of PROV's powers and duties.

PROV interprets these powers to be limited to inspecting the physical storage of records and, on this basis, does not inspect agency records management programs. However, section 13A of the Act reads: 'The Keeper of Public Records may enter, at any reasonable time, a public office or any place in which the public records of that office are stored to inspect the storage and conservation arrangements of the records in the office or place and the carrying out in that office or place of the programme of records management referred to in section 13(b)' [our emphasis].

We interpret section 13A of the Act as giving PROV the power to inspect records management programs.

The Keeper must also report on how PROV has carried out its functions under the Act over the course of the year. In turn, the responsible minister must table the report in Parliament. PROV typically meets this requirement through its annual reporting.

PROV's current interpretation is potentially a missed opportunity for the government to see and better understand the nature and extent of what PROV has identified as systemic failures in records management across the public sector.

PROV should seek legal advice on the extent of its powers under the Act as a matter of priority, as there is the risk that it:

• is not using all of the powers at its disposal to ensure that government records are being lawfully managed
• has set its priorities based on an incomplete understanding of the Act.

3.5 PROV's administrative realignment

Although still a portfolio agency of DPC, PROV was administratively located in Victoria's former Arts portfolio and was subject to the former Arts Victoria's oversight from 1990 to 2001 and again from 2006 to 2014.

Over the years, there have been a number of reviews recommending that PROV be administratively relocated to a portfolio with a greater capacity to support PROV's legislative mandate.

PROV was moved to the portfolio of Victoria's Special Minister of State shortly after the 2014 election. This portfolio has a strong focus on transparency and accountability, with an objective to 'protect the values of good public governance, integrity and accountability in support of public trust'.

The portfolio also includes Victoria's other information agencies—the Office of the Freedom of Information Commissioner and the Office of the Commissioner for Privacy and Data Protection, which the government intends to merge into a new Victorian Information Commission. As a result of this change, PROV now also shares the portfolio's overarching objective.

Because the Act was written before the use of purpose statements, PROV's core objectives are not explicitly defined in the Act. However, PROV has stated that its primary intent is to:

• ensure a full and accurate record of government activities is created, managed, kept and, if appropriate, preserved in a usable form for the benefit of present and future generations
• where appropriate, provide public access to the government's preserved records.

PROV's realignment signals that the government has an increased focus on PROV's role as the authority on how government should create, capture and manage the evidence of its business activity.

The 2016–17 State Budget allocated PROV about $8.2 million over the next four years 'to ensure that its services match increasing demands for public recordkeeping'. This is in addition to ongoing funding of $2.57 million a year.

Together, these activities create the potential for significant improvement in how well agencies manage their records.

4.1 Conclusion

DET and DHHS have recognised the need for improved records management and have shown a genuine commitment to positive change. A number of plans and projects are now either being developed or have been implemented at both agencies to address weaknesses identified over the course of this audit.

But presently, neither DET nor DHHS has implemented a successful records management program, nor are they managing all of their records in accordance with all legal requirements. Consequently, neither agency sufficiently understands their records holdings. This increases the risk of records being lost, inaccessible, inappropriately accessed, unlawfully altered or destroyed.

Both agencies are responsible for large numbers of highly sensitive records that are not all subject to adequate controls. The key control weaknesses we identified in the records management programs of each agency were largely similar:

• insufficient authority given to, or applied by, the central records management unit
• inadequate training for staff, contractors and consultants on their records management responsibilities
• little or no assurance by agencies that where third-party providers are being used, they are lawfully managing records of the services they are delivering on the government's behalf
• compliance monitoring is absent or insufficient and reporting is not coordinated through the records management unit to the secretaries, limiting their visibility of weaknesses and hindering their ability to make informed improvement decisions
• noncompliance with the Capture specification, which requires agencies to have records that are authentic, reliable and usable, and have integrity—these requirements provide assurance that a record can be trusted.

4.2 Governance

Effective governance includes establishing clear accountability and appropriate authority, effective education and training, robust compliance monitoring and reporting, informed risk management, and a commitment to continuous improvement.

4.2.1 Accountability

The Public Records Act 1973 (the Act) recognises the head of an agency as having ultimate accountability and responsibility for compliance.

By assigning accountability to a single person or role, the Act makes clear that agencies need to have a program in place that provides assurance that their records can be trusted. In a 2012 public presentation, Victoria's Deputy Ombudsman stated, 'We frequently ask the question: who is responsible?' It is easy to blame the individual who failed to keep the record or destroyed a document, but the leadership of an organisation is ultimately responsible.

At DHHS, both the secretary's position description and DHHS's records management policy recognise the secretary's accountability for the agency's records.

However, this was not the case at DET—no corporate documentation explicitly recognises the secretary's responsibility for records management compliance. To address this, DET's executive services division is drafting a new policy that explicitly acknowledges the secretary's accountability for records management.

4.2.2 Authority

Standards issued under the Act require agencies to have a unit with agency-wide authority for records management. In an effective records management program, a unit with this authority will have a greater level of records management skill and knowledge than other areas of an organisation—this better equips the unit to provide the agency head with expert records management advice and recommendations. Under such an arrangement, the agency will be well placed to maintain its transparency by maintaining accessible and reliable records.

This arrangement is not in place effectively in DHHS or DET.

At both agencies, the core records management unit operates as part of the head office.

At DHHS, the records management unit provides strong support and guidance to divisional staff, but does not have the authority to direct the records management activities of central business units or divisional records management teams. These teams do not report to the central unit, but up through their respective divisional heads.

At DET, the authority of the core unit is clear—but we did not observe this authority being put into practice. This was not surprising in view of DET's devolved authority model.

In both cases, the end result is two‑fold:

• the core records management unit is unable to provide assurance that staff are lawfully managing agency records, because they either cannot or do not compel staff to comply with, or test staff compliance with, agency policies and procedures
• the secretary is not being provided with a unified and expertly informed view of the agency's records management compliance, needs and risks, due to fragmented reporting.

4.2.3 Education and training

Standards issued under the Act require agencies to identify the records management training needs of staff and key stakeholder groups. The standards also require agencies to provide customised records management education and training to meet those needs.

These requirements aim to address the report of the 1996 Public Accounts and Estimates Committee Inquiry into the Public Record Office Victoria, which stated, 'Training needs to focus on the skills required to manage public records effectively and to apply standards developed by the Public Record Office. Minimum education standards should not be seen as an imposition on employees'.

DET's records management team provides training to increase staff awareness of the importance of records management, but this is not supported by more comprehensive training focused on building staff's records management skills.

DET's procurement training program includes managing records in the department's procurement approval workflow system. However, it is not compulsory and staff can access and use the system without training.

We observed a staff member using the system without knowing how to capture relevant records into it. A lack of records management know‑how creates incomplete evidence trails for procurement processes—which can have adverse consequences for the agency.

DET's executive services division does not know what, if any, records management education and training is provided beyond its central office and regional branches.

At DHHS, records management training aims to raise high-level awareness of the importance of records management. The central office records management unit offers more in-depth training for central office staff, tailored to DHHS's actual practices and processes. However, this is only provided on request, rather than as part of a mandated education and training program.

Despite the Act's requirements, and as discussed in Section 4.2.2, DHHS's central office records management unit does not have the authority to direct records management activities in regional divisions, and cannot mandate what training and education they develop and deliver. Likewise, the unit cannot require DHHS's learning and development team to design or deliver records management education and training—it must rely on its ability to persuade the team of the importance of incorporating records management training into the agency's broader education and training program.

DHHS and DET are both developing initiatives to improve staff records management capability.

DET's executive services division is developing a 'capability uplift' project, which includes further records management training for corporate and regional staff. It is also developing a program for records training of school staff.

DHHS's corporate services division is developing a recordkeeping awareness and training strategy and program to meet PROV's training and education requirements.

If funded and implemented, these initiatives will be a positive step towards improving the way these agencies manage their records.

Part 3 discusses PROV's decision not to carry out VAGO's 2008 recommendation to implement the competency-based training program that PROV had been planning. In the absence of this program, other agencies have developed and implemented their own records management training programs—usually in isolation from each other.

During the audit, a number of stakeholders expressed frustration at not having whole‑of‑government records management training programs in place that provide records management induction for agency staff and specialist competency development.

PROV's records management standards are complex and detailed, and stakeholders felt that PROV could play a greater role in helping agencies to understand and implement them.

Stakeholders also commented on the potential for efficiencies across the whole of government if centralised, PROV-endorsed training and education programs were put in place.

4.2.4 Compliance monitoring and reporting

In 2010, PROV issued a requirement for agencies to monitor and report on their compliance with the Act.

Complying with Victoria's records management standards requires significant and ongoing effort. Agencies must comply with over 200 criteria of varying scope and complexity within the 19 specifications across the eight standards. Meeting the requirements of some criteria is relatively simple, while meeting others requires considerable resources and expert skills.

For example, the requirement for an independent audit of the agency's records management program at least every five years is complex, time consuming, and requires the skills of records management experts. In comparison, the requirement to formally recognise the head of an agency as having ultimate accountability and responsibility for the agency's compliance with the Act and its standards—although just as important to effective records management—is a more straightforward task.

Given the size of an agency's records management compliance program, it is reasonable that the agency would prioritise its approach to compliance in stages, based on a risk assessment—that is, assessing and then prioritising high-risk areas before moving onto lower risk areas. These areas will be different across agencies and will depend on the records management teams' understanding of where the agency is most at risk because of poor records management. Once the agency has addressed noncompliance in high-risk areas, it can then progress to the next level of priority.

As discussed in Part 3 of this report, the 2016 assessment using PROV's Information Management Maturity Measurement Tool (IM3) revealed that audit and compliance were the weakest areas across all surveyed departments and agencies. This, in addition to our findings, supports PROV's repeated calls for more robust oversight of agencies' compliance with the records management requirements in the Act.

DHHS's central records management unit has been assessing DHHS's compliance since 2013. We observed two key monitoring points in 2013 and 2016.

However, the assessments have not been part of the agency-wide compliance program, and the results are not reported to the secretary. Without this information, the secretary—who is accountable for any noncompliance—is unlikely to be fully aware of any compliance issues and the associated risks.

We identified instances where compliance assessments lacked sufficient rigour—such as outsourced services being evaluated as compliant, despite the absence of a process to determine compliance.

Although DHHS's compliance monitoring would benefit from increased rigour, the fact that compliance monitoring takes place shows that DHHS operates in one of the more mature records management environments.

DET, on the other hand, does not perform any compliance monitoring and reporting, and its understanding of the maturity of its records management environment currently comes only from the IM3 self-assessment.

DET achieved an average maturity rating of 'aware', the second lowest of the IM3's five possible maturity levels. The IM3 tool does not have a description for an average rating of 'aware'—this result indicates that an agency has answered the majority of assessment questions at the 'aware' level, suggesting that the agency is aware of issues but has not yet made much progress in addressing them.

DET has started developing a records management compliance program to address its weakness in this area, reflecting a commitment to improvement.

4.3 Agency practices and processes

4.3.1 Legal compliance

DET's and DHHS's records management practices do not comply with all legal requirements. Neither agency fully complies with PROV's records management standards, nor do they have a clear understanding of what records they own and hold.

We assessed compliance by DET and DHHS with the PROV standards. In total, we assessed 218 criteria. DHHS fully complied with 130 criteria, and DET fully complied with 30 criteria. Figure 4A provides a summary of the results. Detailed assessments for each requirement are included in Appendix C.

Figure 4A

Agency compliance with PROV specifications

Note: ● Fully compliant—fully meets every criterion; O Mostly compliant—meets many but not all criterion; ~ Some compliance—meets only a few criterion; ✘No compliance—meets none of the criterion. Ratings are qualitative and not statistically determined. For example, 'mostly compliant' may mean all criterion but one have been met, and 'some compliance' may mean only one criterion out of many has been met.

(a) Storing and managing state archives specification and Approved Public Office Storage Supplier (APROSS) specification not assessed.

(b) Transfer to PROV specification not assessed.

Source: VAGO.

4.3.2 Impact of noncompliance

The principles of the Capture standard are central to the trustworthiness of agency records. Compliance with the standard's Capture specification ensures that agency records are created, are authentic, reliable and usable, and have integrity (are protected from undetected and unauthorised alteration). These principles and supporting requirements provide assurance that a record can be trusted.

The standard's principles are shown in Figure 4B. Neither agency fully met any of the criteria in the standard's Capture specification.

Figure 4B

Principles of PROV's Capture standard

Source: VAGO, adapted from PROV, Capture standard.

DHHS

DHHS has made an effort in recent years to address longstanding records management issues that have been reported by various integrity offices. This includes its management of ward records and the access to these records through online tools.

However, DHHS has advised that its efforts in this area have affected its capacity to undertake other activities to improve records management.

Compliant versus noncompliant systems

Some DHHS staff use TRIM, an electronic document and records management system, for managing some records. DHHS has approximately seven million documents in TRIM. Outside of TRIM, DHHS has approximately 100 million electronic documents across its network of drives and shadow systems (records repositories that are additional to the organisation's records management system). This number does not include the documents in DHHS's email systems.

DHHS was unable to determine how many electronic documents were stored in staff email inboxes, and could only determine the number of emails sent and received across the agency over the last year. Of the combined total of 39.3 million emails, they were unable to determine how many had included records.

In 2012, Victoria's Deputy Ombudsman noted in a public speech that 'very often our investigations identify that only paper records are maintained. That is, copies and originals of correspondence to and from an agency. However, when we delve further into an investigation we identify key decision-making is often recorded in email, faxes and notes not maintained on the departmental file'.

The documents that are outside of DHHS's TRIM system do not have adequate storage, maintenance and access controls. DHHS cannot be assured of what types of documents they are, or the level of risk they pose to the secretary and the agency while they sit in these unprotected areas.

A core reason for so many documents not being captured within DHHS's endorsed records management system, when appropriate, may be because the system has only been deployed to 2 130 staff (20 per cent of the workforce).

DHHS's position descriptions and records management policy make it very clear that all staff are responsible for ensuring their own compliance with the Act—and DHHS's records management unit is able to ensure the lawful management of records that staff capture in TRIM.

However, where staff are choosing to manage their records outside of TRIM, in breach of the Capture specification, the records management unit does not have the authority to compel them to lawfully manage their records.

DHHS's central records management unit has worked hard to establish a system that supports effective records management. However, with so many documents sitting outside of TRIM, this work is not being used effectively throughout the agency. As a result, DHHS is not fully realising the potential benefits of its records management system or managing its risks.

Since our 2008 audit, DHHS's records management unit has submitted several business cases to its executive seeking resources to address the risks posed by records sitting in systems that do not meet PROV's standards. Although DHHS has endorsed the business cases, they have not been fully funded.

'Missing' and 'in-transit' files

We learned that an estimated 16 800 files are recorded in TRIM as 'missing'. These include, but are not limited to, files for:

• hospitals, disability services and palliative care services
• human resources
• youth justice
• housing and homelessness
• protective services
• child protection.

Of the 16 800 files marked as missing in TRIM, 622 are child protection files (0.2 per cent of the child protection files in DHHS's corporate records system), with some marked as missing since 2004 and 2005.

DHHS also advised us that 5 504 TRIM files have been assigned the status of 'in transit' (being transferred from one location to another). Our analysis of these files showed that 3 586 (65 per cent) were client files or contained personal data.

Figure 4C shows the length of time these files have been in transit.

Figure 4C

DHHS files in transit

Source: VAGO, based on data from DHHS.

Because a file can contain one or many records, the number of records within these 16 800 missing files or 5 504 in-transit files is unknown.

We noted that although the secretary is ultimately accountable for these missing and in-transit files, DHHS staff do not report details of missing files to the secretary, or report on the risks they pose to client privacy and DHHS's accountability.

DHHS intends to begin regular monitoring of and reporting on missing files to address this issue, and its statewide audit of uncatalogued physical files registered in TRIM is almost completed. In addition, plans for an annual audit process will help DHHS better manage the risks that such files are being subject to unlawful practices such as unauthorised access, alteration or destruction.

DET

As stated earlier, DHHS operates in one of the more mature records management environments. Because of this, DHHS was able to provide us with a large amount of information on the state of its records management. In contrast, DET's broad noncompliance with PROV's standards means that the agency knows very little about its entire records holdings.

Across the agency, more than 50 different locations are being used for records storage, but the records management unit has no control of them or access to them. There is also a large but unknown number of storage units, storerooms, filing cabinets and other storage repositories spread across the agency in undocumented locations—containing potentially many thousands of boxes of records. DET could not provide information on missing files, or files in transit, and is largely unaware of the extent of the risks related to its records management.

Like DHHS, DET was also unable to determine the number of records held in email inboxes, or the number of sent or received emails that contained records. They could determine the number of sent and received emails over the last six-month period—approximately 196 million.

Unlike DHHS, DET was only able to determine the number of files in one of its eight shared drive areas—approximately 3.8 million files. Because there is no assurance of the uniformity of the eight areas, any extrapolation of file numbers from this single area would only be speculative. As with DHHS, DET is unable to determine how many of those files are agency records.

4.3.3 Managing the records of outsourced activities

In our 2008 audit, we expressed particular concern that agencies were not ensuring that third-party providers were lawfully managing the records related to the services they delivered on the government's behalf.

In 2010 PROV mandated that agencies embed records management clauses in their contracts to improve the way records of outsourced activities are captured and preserved. The requirements are for any arrangement where an agency engages an external service provider—by virtue of a contract or agreement—to perform functions or activities, or to provide services on its behalf.

Figure 4D summarises the requirements, which are detailed in Appendix D.

Figure 4D

Records management contract clauses

Source: VAGO, adapted from PROS 10/10 S1 2.4–Outsourced Activities and Privatisation, 21−29, PROV.

DET contracts

DET has not updated its contract management policies, procedures and templates to incorporate these requirements.

We selected 60 DET contracts created since 2010, to examine whether DET had incorporated the records management requirements. Of these 60 contracts, 20 (33 per cent)—with a combined value of $6 364 535—had not been captured in DET's contract management system and could not be assessed.

We noted that DET staff commonly used generic clauses to impose records management requirements. Victoria's records management standards require that contracts specify details such as custody of the records, storage and security requirements, audit activities, and how records must be disposed of.

Of the 40 contracts we could assess against the nine requirements:

• 14 met none of the requirements
• nine met two of the requirements
• one partially met six of the requirements
• none met all of the requirements.

The weaknesses in DET's contract management process mean that it does not ensure that its third-party providers understand their records management obligations.

DET's integrity reform program includes a procurement reform project. This project is expected to implement improvements to procurement processes, and includes strengthening the documentation requirements of performance management of third‑party providers.

Records of children in state care

Since our 2008 audit raised concerns about the records of third-party providers, the impacts of inadequate records management by third parties have been reiterated in reports such as the Victorian Ombudsman's 2012 report, Investigation into the Management and Storage of Ward Records by the Department of Human Services, and the more recent Royal Commission into Institutional Responses to Child Sexual Abuse.

Before the introduction of records management legislation, staff at care institutions could legally destroy the records of children who had suffered abuse.

The Ombudsman and Royal Commission reports reveal how the long-term mismanagement of records of former wards of the state by community service organisations (CSO) that provide state care services has had a profoundly damaging impact on survivors of abuse while in care.

In many cases, poor records management practices have made the evidence of abuses committed irretrievable, thereby hampering investigations and potentially protecting the perpetrators.

DHHS has been diligent in its recent efforts to address the records management issues that first emerged with the closure of state care institutions in the 1990s.

DHHS's response to the 2012 Ombudsman Victoria Investigation into the storage and management of ward records by the Department of Human Services resulted in its Ward Records Plan. The plan involved indexing over one million physical records about people who had been institutionalised by the state. On the completion of the plan, DHHS also published the website 'Finding Records', with over 200 guides to help those who were once in state care to find and access records about themselves.

This is an important improvement in DHHS's records management, which we hope marks the start of greater investment in these critical resources.

DHHS contracts

PROV's requirement for contracts of outsourced activities to include records management requirements puts the onus on DHHS to ensure that CSOs are managing the records of children in state care in accordance with the Act.

DHHS has incorporated the requirements into its CSO contracts. However, it does not monitor their compliance and so cannot demonstrate that the CSOs it funds are meeting these requirements.

DHHS contracts around 1 178 CSOs to deliver services on its behalf, and 500 of these are subject to an independent accreditation process as part of their contractual arrangements. However, the process does not include examining the compliance of CSOs' records management systems and processes. The remaining CSOs have no assessment requirements.

With hindsight, there is now a better understanding of the negative impact on survivors of abuse when poor management or destruction of records means that they are unable to access information about their past. This highlights the need for agencies to prevent this from happening now and in the future. It also underscores the importance of obtaining assurance from CSOs that such records are being managed appropriately.

RESPONSE provided by the Director and Keeper of Public Records, Public Record Office Victoria

RESPONSE provided by the Secretary, Department of Premier and Cabinet

RESPONSE provided by the Secretary, Department of Education and Training

RESPONSE provided by the Secretary, Department of Health and Human Services