Evaluation of the FCAC Information Management Program - Final Evaluation Report

Prepared for:

Financial Consumer Agency of Canada

Prepared by:

Goss Gilroy Inc.
Management Consultants
Suite 900, 150 Metcalfe Street
Ottawa, ON K2P 1P1

Tel: (613) 230-5577

Email: ggi@ggi.ca

March 31, 2025

1. Executive Summary

1.1 Introduction

The Financial Consumer Agency of Canada (FCAC) is a federal government agency established in 2001 to protect consumers of financial products and services. Consumer protection is an integral part of the Government of Canada’s oversight of the financial sector. FCAC ensures federally regulated financial entities comply with consumer protection measures, promotes financial education, and raises consumers’ awareness of their rights and responsibilities.

Information management is a discipline that directs and supports effective and efficient management of information in an organization, from planning and systems development to disposal and/or long-term preservation.

In the Government of Canada, information is to be managed as a strategic asset to maximize its value in the service of Canadians. Effective information management makes government program and service delivery more efficient, supports transparency, promotes collaboration and informed decision making in government operations, and preserves historically valuable information.

Every government employee is accountable for managing all the information that they create or collect in the performance of their work. Both digital and physical information should be managed according to sound IM principles. Information must be organized within corporate record systems to protect the integrity of information so that it continues to be available and accessible to support decision-making as well as program and service delivery.

Two organizations set the direction and guide Government of Canada IM practices:

• Treasury Board’s Policy on Service and Digital and supporting instruments set requirements for how federal organizations manage service delivery, information and data, information technology, and cyber security in the digital era.
• Library and Archives Canada provides guidance in the Government of Canada IM community by working collaboratively with organizations to develop standards, tools and best practices for IM.

As a regulator with a strong oversight and education role, proper information management is fundamental to FCAC’s success in protecting financial consumers. Information must be captured securely, consistently and efficiently so that it can be used to inform strategic decision-making and identify emerging consumer protection issues. Within FCAC, IM/IT directs a program of IM activities to ensure the effective and efficient management of information.

2. Objectives, Scope and Methodology

The evaluation of information management was identified in the 2024-25 Evaluation Plan due to:

• The high complexity in IM given the large number of information repositories within FCAC and increasing technological changes within this area; and
• The importance of effective IM with artificial intelligence (AI).

The evaluation objective was to determine whether an adequate management control framework was in place for IM and is operating in compliance with relevant Treasury Board policies.

The evaluation focuses on the following areas:

• Governance and accountabilities
  • strategic direction and objectives for IM, including supporting implementation plans, monitoring and reporting
• Program tools and processes
  • mechanisms for information sharing and retention
• Training and guidance
  • IM training, awareness and outreach activities^{Footnote 1}

This evaluation covers the period from April 1, 2023 to March 1, 2025 and was designed to provide comprehensive and reliable evidence to support decisions regarding the delivery of the IM program.

The evaluation methodology includes the following data collection methods:

• Review of documents, including section 4.3 of Treasury Board’s Policy on Service and Digital and its supporting Directive; FCAC’s Data Strategy; IM training materials; and review of relevant committee documentation and Records of Decision (RoD)
• Available metrics on storage size, record number and age for primary information platforms
• Interviews with key stakeholders, including IM/IT and members of the IM Specialist Community, who are now merged into the Data Steward Network
• Consultations with three other federal IM/IT groups on governance structure, systems and tools and accompanying training and guidance materials.

The evaluation relied on a qualitative assessment of effectiveness, largely from internal stakeholder perceptions. The evaluation work was carried out from December 2024 to March 2025.

3. Observations and Recommendations

3.1 Overview

For the 2024-25 fiscal year, the FCAC has planned spending of $64.8 million for programs and internal services, with 259 FTEs.^{Footnote 2}  Within its Corporate Services Branch, IM/IT has an operating budget of $9 million with 35 FTEs and holds the primary responsibility for providing IM direction, procedures, tools and guidance.

Electronic systems at are the preferred means of creating, using, and managing information. Primary information platforms include:^{Footnote 3}

Figure 1. Overview of Primary Information Platforms

Additional information platforms include case management systems to support operations within Supervision and Enforcement Branch and Customer Information Centre. Together, case management systems account for 10-gigabytes of data, less than 1% of storage size of primary platforms.

3.2 Governance and oversight

Information governance defines the overall approach for all organizational information management. It establishes the processes and authorities to enable an organization’s information to be a useful asset based on business requirements and risk tolerance. An IM governance framework allows an organization to manage information throughout its life cycle and to support the outcomes of programmes, services, operational needs and accountabilities. It also supports employees in meeting their IM responsibilities.

Clearly defined roles and responsibilities enable transparent and risk-based decision making and are crucial to achieve proper information management. As stated in the FCAC Data Strategy, clear direction and oversight help to ensure that information is managed safely, securely, holistically and as an agency-wide asset. An effective IM framework also ensures compliance with key legislative requirements and supports reporting to both internal and external stakeholders.

The fundamental elements of IM governance are in place.

The IM governance structure and processes were updated in 2023 to streamline senior management committee oversight and direction for IM-related activities. Reporting to the CIO within FCAC’s Corporate Services Branch, IM/IT is the functional authority for information management within the Agency. IM/IT priority activities are further incorporated and tracked under the Business Plan 2024-25. As well, quarterly IM/IT Updates were provided to senior management committees. The Director’s Committee (DCOM) has responsibility for oversight and decision-making on IM projects.

IM/IT is responsible for the implementation of tools, policies and best practices to meet business needs and support the management of FCAC information assets throughout their lifecycle. To help accomplish this, IM/IT issued the latest Data Strategy in July 2024, with accompanying Action Plan in February 2025.

FCAC’s Data Strategy has a defined strategic direction and objectives for data management that aligns with Treasury Board policy. It aims to improve management of information as a strategic asset through its lifecycle, including its vision, guiding principles, goals, activities and outcomes. Also under the Strategy, the newly created Data Management and Adoption Office was authorized to enforce data management best practices for data-related activities Agency-wide.

The updated Data Strategy had been approved by operational and executive committees but had not been widely communicated across the agency or made available on the intranet.

Functional Specialists merge with Data Stewards.

The Data Strategy tasks two working groups, the IM Functional Specialists Community and the Data Steward Network, with the operational aspects of the IM/IT’s data initiatives and best practices. Under the leadership of IM/IT representatives from operational and administrative branches across the Agency participate with the aim of promoting better data and IM habits. According to its terms of reference, the IM Specialists Community is mandated to advise on and implement FCAC’s IM-related strategies, guiding principles, best practices, and governance. Members are to be specialists within their own business units on the information and tools used in their teams’ day to day work and are to meet as a community quarterly at a minimum.

Interviews with members of the IM Specialists Community^{Footnote 4}  as well as with IM/IT officials indicated that the group was not functioning as intended. Most specialists interviewed were unclear of their role, citing duplication with the Data Stewards, and workload burden in addition to their assigned responsibilities. All raised concerns with the lack of centralized guidance and controls to promote sound information management practices across FCAC’s primary data platforms. The network met less often than prescribed in their Terms of Reference and records of their discussions were not available. In February 2025, the two working groups were merged under Data Steward Network, and its terms of reference were to be updated accordingly.

Limited coverage of corporate repositories.

The current IM framework focuses on the management of records in GCdocs. In 2023-24, members from the IM Specialist Community were consulted over six months to revise definitions, retention triggers and classifications for records held in GCdocs. The resulting Final Master File Plan with Retention Schedule was approved for implementation in February 2024. However, GCdocs represents only 3% of information holdings within the Agency. The governance policy framework did not include a clear vision for current corporate repositories where large volumes of information is stored, such as SharePoint and case management systems.

In the absence of guidance on best practices, inconsistent file structures and management practices have evolved in corporate repositories across branches. IM Specialists all reported challenges in managing information and data sprawl across multiple locations, leading to inefficiencies and compliance issues.

Difficulties in monitoring adherence to IM policies and procedures.

IM/IT provides quarterly updates to management committee that provide high-level monitoring on select projects. However, limited analysis is done on the overall level IM compliance, and there is little oversight for everyday usage and recordkeeping management practices (e.g. IM dashboards) therefore limiting visibility and engagement by senior management. Many practices rely on the users being aware and following the IM protocols. It is largely up to IM functional specialists, now Data Stewards, within each directorate to implement their own monitoring practices.

However, greater detail performance monitoring and reporting, had yet to be articulated.

3.3 Systems and tools

Under Treasury Board guidance, information should be managed throughout its lifecycle. FCAC has several digital tools and repositories to help employees create, collaborate, share and manage the information and data they produce. FCAC’s Data Strategy recognizes operational efficiencies as a key outcome of effectively using data management tools.

At present, GCdocs is recognized as the official corporate repository for documents of business value, with an accompanying master file plan and disposition schedule updated and approved in February 2024.

Retention and disposition schedules are established

Retention periods have been established for information records held in GCdocs. Interviews with IM/IT team members indicated that the disposition of records had not taken placed since migration to GCdocs in 2022. Additionally, challenges with the migration resulted in a limited ability to search and retrieve documents as well as the application of access permissions, and file structure. All Functional Specialists reported difficulties in finding and retrieving documents in GCdocs and some avoided using it altogether. As a result, it is likely that many corporate records are not stored correctly in GCdocs. It is also likely that GCdocs currently contains a large amount of transitory information as well as information past its retention period.

No retention periods or documented disposition processes were in place for information and data held in in corporate repositories outside of GCdocs. Interviews with IM/IT team members indicated that their focus had been on the disposition of paper records, according to LAC authorization and documented processes. The goal was to get down to 441 boxes of paper records held in long-term storage.

At the time of the evaluation, IM/IT was developing an electronic tool to allow the automated disposition of records in GCdocs. A documented disposition process for electronic records held in GCdocs past their retention period was also under development.

Recordkeeping tools needed for efficient management of information and data

Equipping employees with the appropriate tools and resources to carry out their information management responsibilities allows for efficient and effective use of corporate information. As recognized by the Data Strategy, operational efficiencies are expected outcomes of employees having the skills and tools to manage their information and data.

Current IM tools do not support all phases of the IM lifecycle. A master file plan and supporting guidance is in place for GCdocs but not for other corporate repositories where most records are stored.

In the absence of guidance on best practices in recordkeeping for corporate repositories other than GCdocs, inconsistent file structures and management practices have evolved in across branches. IM Specialists reported challenges in managing information and data sprawl across multiple locations, leading to inefficiencies and compliance issues.

Analysis of the usage of each repository indicated a substantial growth in unmanaged information:

• Storage size for OneDrive and SharePoint has tripled since April 2023
• 90% of employees had over a GB of data in OneDrive
• 93% of employees had over 5,000 items in their mailbox, and most were at the 50-megabyte limit

Figure 2. 

By contrast, the size of GCdocs has remained relatively stable since April 2023 at 340-gigabytes, which is one-tenth of the current size of either OneDrive or SharePoint.^{Footnote 5} 

No quality assurance program to support data integrity

FCAC does not have a quality assurance program in place for information or data, presenting a risk to its reliability and integrity, as well as to its potential use for advanced analytics.

Procedures are in place to apply security classification and protective markings as soon as information is created. Upgraded facilities to safeguard secret information are to be in place by the end of March 2025, along with associated training and guidance.

3.4 Training and awareness

Having relevant training and resources available is critical to the overall success of managing information. Training plays a critical role in change management to enable users to realize the benefits of the new processes or tools and respect their information management responsibilities. By clearly demonstrating how to manage information properly, it helps ensure requirements are met.

Additional training materials are wanted to promote effective IM practices

Selected training materials relating to information management are available for staff through the IM/IT intranet site. Through Service Now, the Data Management and Adoption Office within IM/IT received 462 help requests, with the majority covering account creation or deletion. Individual training sessions are also available to individuals or groups upon request: 6 sessions on GCdocs and 11 awareness “Roadshow” sessions were provided across the Agency in 2024-25.

All new employees are required to take an introductory IM training course as part of their on-boarding through the Canada School of Public Service (CSPS).^{Footnote 6}  In addition, all employees are required to take the same IM training course through the CSPS as a refresher. As of February 2025, 60% of employees had completed mandatory IM training. All employees hired in the last fiscal year had completed their mandatory IM training.

Interviews with IM functional specialists within branches across the Agency indicated that the Data Management and Adoption Office was very responsive to training service requests. They also indicated that additional guidance materials would be beneficial on where and how to file their information, particularly for new employees.

IM/IT had not conducted assessed the efficacy of available IM training and resources to identify a gap between the current and desired knowledge, skills, and abilities of employees.

Applying a change management approach is a best practice for IM initiatives

IM/IT has not developed a change management process to support user adoption. A change management process with accompanying communication and training plan that is scalable and repeatable would better support the effectiveness of an initiative’s implementation: even a well-managed initiative may fail if users are not willing to adopt it. Consultations with other federal IM/IT groups confirmed the importance of a change management process for information management.

4. Comparable IM Practices

As part of the evaluation, information management groups in three federal organizations were consulted about their governance and policy frameworks as points of comparison.  All indicated that they were in a time of transition and reported similar success and challenges. Key observations from discussions included:

• All three followed federated system governance management
• All three used SharePoint and M365 as corporate repositories, one continued to use GCdocs for final record storage as they hold a high number of paper files
• Document management needs (folder structure, permissions, size limits) were centrally defined in collaboration with end users (branches)
• IM/IT designed sites in collaboration with branches and set-up of new sites was either delegated to branch or centrally controlled
• Disposition applied when information becomes inactive but automated disposition of inactive information stopped with litigation holds
• Challenges with monitoring IM health: IM dashboards created using Power BI to visually track trends in usage and size across the organization

All three stressed that change management is critical to data adoption and bringing users along with tailored guidance documents (e.g. infographics) and awareness sessions.

5. Conclusion

The evaluation assessed the efficiency and effectiveness of FCAC’s IM policy framework and processes against TB policies and directives. Overall, the design of FCAC’s IM governance structure and key IM activities support its IM objectives and align with applicable Government of Canada legislative and policy requirements.

The evaluation found the FCAC has established fundamental elements of IM governance along with its guiding Data Strategy and Action Plan. However, while current IM governance framework aligns with TB policy requirements, the current level of coverage across corporate repositories is not sufficient to be fully in compliance.

Additionally, the evaluation found that IM tools (i.e., directory structures, processes and procedures) do not support all phases of the IM life cycle, including retention and disposition and storage of corporate information. As a result, inconsistent IM practices across the organization have evolved which threaten the integrity and availability of information assets.

Training and awareness materials support and reinforce sound IM practices and play a key role in the effective delivery of the IM program. A needs analysis is recommended to highlight knowledge gaps and take actionable steps towards improvement. A structured change management process a recommended best practice to ensure a more effective implementation of initiatives.

Annex A: Evaluation Matrix

Evaluation issue: Effectiveness

Question 1: To what extent are information management processes and tools effective?

Indicator:

• Evidence that IM tools are established for phases of IM lifecycle

Method: 

• Document review

Indicator:

• Processes and tools support retention, storage and disposition of unclassified information of business value as evidenced by monitoring and reporting to mitigate risks, timely responses to ATIP requests, sound email management

Method:

• Document review
• Interviews with key stakeholders

Indicator:

• Processes and tools support retention, storage and disposition of sensitive information as evidenced by monitoring and reporting to mitigate risks, timely responses to ATIP requests, sound email management

Method:

• Document review
• Interviews with key stakeholders

Indicator:

• FCAC’s information architecture aligns with requirements or guidelines set in place by Policy on Service and Digital

Method:

• Document review
• Interviews with key stakeholders

Evaluation issue: Efficiency

Question 2: To what extent is the governance and accountability framework appropriate? 

Indicator: 

• Roles and responsibilities are adequately defined and well-understood throughout the Agency

Method: 

• Document review
• Interviews with key stakeholders

Indicator: 

• Oversight bodies are established and functioning as intended

Method: 

• Document review
• Interviews with key stakeholders

Indicator: 

• Accountabilities are defined and communicated

Method: 

• Document review
• Interviews with key stakeholders

Indicator: 

• IM program policies and procedures align with federal legislative and policy requirements

Method: 

• Document review
• Interviews with key stakeholders

Question 3: To what extent employees aware of IM process and procedural best practices?

Indicator: 

• Training and awareness materials are up-to-date, meet requirements, and in use

Method: 

• Document review
• Interviews with key stakeholders

Indicator: 

• Number and nature of IM awareness activities, including participation numbers

Method: 

• Document review

Indicator: 

• Feedback from training course attendees regarding the extent to which the content met their needs and increased their awareness

Method: 

• Document review

Indicator: 

• Employees are aware of document classification best practices

Method: 

• Interviews with key stakeholders

Indicator: 

• Employees are aware of processes and procedures for the retention of documents of business value

Method: 

• Interviews with key stakeholders