Regional development agencies internal audit of information management

RDAs had developed and communicated operational plans to support government-wide and agency-specific IM objectives; however, there are opportunities for ACOA to improve elements of its plan.

Deputy heads are responsible for establishing a departmental program or strategy for the improvement of the management of information.^{Footnote 28} Operational plans outline the steps, activities and initiatives to be taken to achieve the identified broad departmental IM objectives and priorities, which should align with those of the GC IM Strategy. Both RDAs had developed IM plans that align with government-wide and agency‑specific IM objectives and priorities. Agency IM-related risks that impede the achievement of objectives were considered in their IM planning processes. IM risks were also identified in the Corporate Risk Profile of both agencies, which includes risk responses and mitigation strategies. Internal key IM stakeholders were also being consulted as part of the annual review and update of IM plans, and the plans were accessible by all staff through the intranet or collaboration sites.

RDAs had IM plans in place that included a list of IM activities and initiatives. The audit noted that CED’s IM plan included key elements of an IM plan outlined in the Secretariat’s IM guidelines,^{Footnote 29} such as who is responsible, resource allocation, performance measures, and monitoring and reporting schedules.ACOA’s IM plan could be strengthened by including performance measures along with monitoring and reporting schedules. The information in IM plans is the foundation for translating strategic direction into specific actions for which those responsible can be held accountable.

RDAs had developed and communicated policy instruments to support IM objectives; however, some of ACOA’s instruments were not updated.

Both RDAs had developed policy instruments to support their agency-specific IM program, along with a range of internal directives, manuals and guides. These were found to be aligned with the GC IM policy framework. Roles and responsibilities for those involved in the management of information have been clearly defined in the agency IM policies. The IM policy framework had been communicated through each RDA’s intranet portal and was therefore readily available to all employees. In addition, both RDAs had developed and delivered IM training programs and awareness activities to employees. Accessibility of, and training on, IM policies increases the likelihood that IM policies and directives are being consistently applied across the agency.

CED’s IM policy framework was updated to reflect the current GC IM policy framework, and was awaiting final approval. Several of ACOA’s IM guides had not been reviewed and updated in several years.

The Secretariat is currently in the process of developing its GC Enterprise IM Strategy Renewal and related IM policy instruments to reflect current GC priorities. The release of updated Treasury Board IM strategy and policies will be an opportune time for both RDAs to review, align and update their IM operational plans, policies and supporting instruments. This will ensure that government and agency‑specific IM responsibilities and requirements appropriately reflect and address changes in risks and the operating environment.

Recommendation: strategic direction for IM

1. ACOA should update departmental IM plans and policy instruments with consideration given to the Secretariat’s upcoming updated GC IM Strategy and policy instruments.

Both RDAs have defined monitoring and reporting activities, including performance measurement, for the oversight of IM. However, there is an opportunity for ACOA to provide a more comprehensive assessment of the state of IM.

RDA deputy heads are responsible for measuring and reporting on a departmental program or strategy for the improvement of the management of information. Both RDAs have defined IM monitoring and reporting activities, including performance measurement, within their IM policy and/or plans. The IM policies stipulate how the agencies will monitor compliance with all aspects of their IM policy and directives and report on the achievement of expected results.

For the RDAs, monitoring and reporting activities were mainly performed by completing the annual self‑assessments for the Management Accountability Framework (MAF) required by the Secretariat, and periodically using the Recordkeeping Assessment Tool (RKAT) to self-assess their level of IM compliance with the Directive on Recordkeeping. In the 2014 to 2015 fiscal year, both RDAs completed the annual self-assessments for the MAF, which also included the results of the RKAT assessment. Although the MAF and RKAT provide information to assess compliance with the Directive on Recordkeeping, they do not provide comprehensive information to assess overall policy compliance.

In addition, CED had developed a comprehensive performance measurement framework, beyond the requirements of the MAF and RKAT, as the foundation to monitor and report on IM performance and compliance. Their IM strategic plan identified the expected results, as well as performance indicators for each of its strategic objectives for the coming year. Throughout the year, results were monitored and reported against the expected results. At the operational level, planned initiatives to support the IM strategic plan have also defined expected results and were monitored and reported in a similar fashion, in addition to identifying the risks to successful implementation and achievement of results. The agency further monitored IM compliance and followed up on IM issues through its compliance review program. Identified gaps were addressed, where applicable. This type of performance information and monitoring enables agencies to assess and make necessary adjustments to plans and processes to ensure that the expected results and desired outcomes are achieved.

ACOA also reported through the MAF and RKAT. Monitoring and reporting activities were limited to the status on the implementation of specific initiatives rather than achievement of overall IM objectives or desired outcomes. ACOA has not developed or implemented a comprehensive performance measurement framework to monitor and report on IM compliance beyond the requirements of the MAF and the RKAT. Monitoring and reporting IM performance and overall compliance would enable the agency to assess progress toward achieving IM objectives, goals and overall policy compliance. It would also set the foundation to develop, prioritize and allocate resources to remedial action plans that progress toward compliance with IM policies and achievement of IM objectives. ACOA IM representatives mentioned that they have not had the capacity to implement a robust performance measurement framework, as available resources were focused on implementing key IM requirements and initiatives.

Action plans were developed, implemented and monitored in both RDAs to ensure that identified IM compliance gaps were being addressed.

Over the past two years, both agencies focused their efforts on implementing the Secretariat’s requirements under the Directive on Recordkeeping, including taking action to remediate deficiencies. For CED, the RKAT result for the 2014 to 2015 fiscal year demonstrated full compliance, with a score of 100 per cent. The agency also followed up on IM issues resulting from its compliance review program, and identified gaps were addressed, where applicable. ACOA analyzed the gaps identified in the results of the RKAT and included the necessary actions to address the deficiencies in its operational plan. As a result, the RKAT self-assessed score improved from 48 per cent in the 2014 to 2015 fiscal year to 93 per cent in September 2015. However, given that ACOA’s monitoring and reporting activities did not include comprehensive performance information, adjustments made through action plans may not provide opportunities for the agency to improve on the achievement of its IM objectives or overall compliance. ACOA’s practice of developing action plans to address compliance gaps for the Directive on Recordkeeping could be applied to overall compliance with IM policies and the achievement of IM objectives. Developing and implementing action plans to address IM compliance gaps allows organizations to prioritize required actions and determine and allocate the necessary resources. It also provides a baseline to continue to monitor progress and adjust plans as required.

Recommendation: IM monitoring

2. ACOA should implement a comprehensive monitoring framework in order to identify, prioritize and address performance gaps. The monitoring framework should consider a risk‑based approach and relevant performance measures.

Committees were in place within RDAs to support IM.

Each RDA had established committees in support of IM. In particular, CED had established the Internal Governance Committee, which is responsible for the direction of the agency on strategic matters such as IM. ACOA had established a Committee on Information Management and Technology to oversee the direction and activities of IM/IT. The mandates of these committees were defined in their respective Terms of Reference and include definitions of the committees’ responsibilities over IM. The members of these committees represent all sectors of each RDA. The committees report through the executive committee of each RDA and play an advisory role to senior management in support of IM decision making. The chairs of these committees were also members of the executive committee. In addition, both RDAs had designated an IM senior official who provides a liaison role with the Secretariat; these senior officials were also members of the committees. Sound governance and oversight that define the roles and responsibilities of key stakeholders increases the likelihood that IM objectives will be addressed, integrated and achieved throughout the RDA in support of broader departmental objectives.

There are opportunities to improve committee operations and their role in governance of IM activities.

Periodic reviews and assessments of governance structures and bodies ensure that roles, responsibilities and accountabilities are defined, up to date, and fulfilled efficiently and effectively. An appropriate review considers factors such as the mandate, roles and responsibilities, membership (that is, breadth of skills, authority for decision making), meeting frequency, member attendance, due diligence and the focus of discussions relative to the Terms of Reference. In addition, the Policy on Information Management stipulates that deputy heads are responsible for ensuring that decisions and decision-making processes are documented to account for and support the continuity of operations, permit the reconstruction of evolution of policies and programs, and allow for independent evaluation and audit.^{Footnote 31} Moreover, due diligence in ensuring that the committees to support IM are functioning as intended fosters a culture that highlights the importance of IM and supports the achievement of IM objectives.

Neither of the RDAs’ committees met as frequently as intended. In some cases, the agencies’ IM issues were dealt with outside of the committee structures. In addition, documentation on committee operations of both RDAs (for example, Terms of Reference, agendas and records of decisions) were not always available and kept current to reflect the agency’s IM structure and operating environment. For example, CED’s committee minutes were not always documented, and ACOA IM/IT committee’s Terms of Reference had not been updated over the past four years. In addition, the implementation of a comprehensive performance measurement framework, along with remedial action plans as indicated in Recommendation 2 in this report, represents an opportunity to enhance the oversight by both RDA committees over IM strategies, operational plans, and policy implementation and compliance. Performance information could be presented to committees and be used to monitor, reassess and adjust strategic direction in a timely manner to support agency-specific achievement of IM objectives. This also aligns with GC priorities and trends toward data-driven, i.e., evidence-based, decision making.

At the time of the audit, both RDAs had already taken action and explored ways to strengthen their committee operations. CED is now using an electronic database to update its committee agenda and to document records of decisions. ACOA has undertaken an exercise to restructure its IM/IT governance, and has indicated that this will be an opportunity to update the Terms of Reference of its IM/IT committee as per the new IM/IT governance structure. The regular review and update of committees’ Terms of Reference would contribute to maintaining the clarity and relevance of roles, responsibilities and accountabilities, which in turn promote the achievement of IM objectives. Further, sound due diligence to support committee operations fosters a culture that highlights the importance of IM.

Recommendations: committees supporting IM

3. CED and ACOA should continue their efforts to strengthen committee operations by documenting meeting agendas and records of decisions, and periodically review committees’ Terms of Reference.
4. CED and ACOA should provide committees with IM performance information to strengthen their oversight role in the governance of IM activities.

IM plans in both RDAs support government-wide IM enterprise systems and initiatives.

According to the Directive on Information Management Roles and Responsibilities, deputy heads are responsible for ensuring that IM requirements are addressed during the planning phase of departmental program and system design.^{Footnote 33} Thus, IM plans need to demonstrate and report on the implementation of IM activities and specific initiatives as required by the Secretariat. The adoption of sound recordkeeping practices, the implementation of open government, the GC Email Transformation Initiative and the transition to enterprise-wide IM solution systems (for example, GCDOCS) are all examples of initiatives that provide support to RDAs in the delivery of their mandates.

Both RDAs had established a formal plan for complying with the Directive on Recordkeeping. The agencies had also established a plan for managing the disposition of documentation and information. This initiative was done in collaboration with Library and Archives Canada and aligned with the GC IM strategy to adopt electronic systems as the preferred mean of managing information. Adopting sound recordkeeping practices provides for a framework of accountability and stewardship in which information resources are considered vital business assets and knowledge resources to support effective decision making and achieve results.^{Footnote 34}

Both RDAs had developed an Open Government Implementation Plan (OGIP). Each plan demonstrated how each agency intended to comply with the Directive on Open Government, and described responsibilities and authorities for key players involved in its implementation and the desired outcomes. The OGIP was aligned with the commitments of the GC Action Plan on Open Government for 2014 to 2016, which supports progress on the delivery of transparent and accountable programs and services focused on the needs of Canadians.

The IM plans of each RDA also considered the implementation of GC common enterprise data initiative to support grants and contributions programs and services. GCDOCS is the electronic document and records management system that has been identified as the official enterprise document and records management solution of the GC. Its implementation is intended to help GC organizations meet their obligations in relation to information life-cycle management, enabling them to create, collect and preserve data, in addition to easily sharing, organizing, evaluating, identifying and disposing of data. GCDOCS encourages collaboration in the area of IM while providing secure access control through the management of user and group access rights.^{Footnote 35} Consequently, it is strategically positioned to address the challenge of effectively managing public resources, in addition to providing an opportunity to resolve the issue of increasing public integrity and improving public services.^{Footnote 36} The audit confirmed that both RDAs had initiated their adoption of GCDOCS. CED had already developed an implementation plan and expected to complete the migration for March 2016; ACOA is planning to implement GCDOCS in the 2017 to 2018 fiscal year, pending Public Services and Procurement Canada (PSPC) confirmation. The implementation of systems such as GCDOCS further supports the open information stream of the GC Open Government Initiative.

In addition, both RDAs are also part of the 43 GC partner organizations that have completed their email transformation, which aims to provide a common, modern, consolidated, secure, more reliable and more cost-effective email system for the GC.^{Footnote 37} Finally, both RDAs monitor the progress of implementation for business applications and initiatives against expected completion dates to ascertain whether the application contributes to their IM needs.

Both RDAs’ IM business application systems are in place to support their information life cycle and information resources of business value.

Establishing and implementing systems tools that support the information life cycle^{Footnote 38} is an essential element that enables sound IM practices. Information life-cycle management can be defined as a comprehensive approach for the creation, storage and disposition of data, recognizing that the value of information changes over time.^{Footnote 39} Both RDAs had defined and documented their information life cycle.

Key IM business application systems to support their information life cycle were found to be in place and aligned with their IM objectives and needs. Systems include those used as document repositories, systems in support of the business management processes, and integrated record IM systems. Both agencies also maintained an inventory list of business application systems. They also developed training and awareness programs, guidance, and tools to support IM business application systems and initiatives agency-wide (Headquarters and satellite offices), which fosters consistency and uniformity in their application and use. Interviews with IM representatives in both agencies further indicated that the business application systems support effective decision making at each agency.

Information resources of business value (IRBV) consist of published and unpublished materials, regardless of medium or form that are created or acquired because they enable or document decision making in support of programs, services and ongoing operations.^{Footnote 40} The Directive on Recordkeeping stipulates that departmental IM senior officials are responsible for ensuring that IRBV are identified based on an analysis of departmental functions and activities that enable or support its legislated mandate;^{Footnote 41} IRBV therefore support departmental reporting, performance and accountability requirements. Both RDAs had identified their IRBV in support of their information life cycle. Both agencies’ IRBV were aligned with their mandates for delivery of programs and services. Used as strategic assets, the identification of IRBV facilitates decision making and the efficient delivery of government programs and services.^{Footnote 42} Both agencies had also maintained a repository^{Footnote 43} to classify the business value of the agencies’ information, by document type and format, and to identify the business units that are accountable for its maintenance. An information resource identified as having business value and placed into a repository enables effective decision making and provides reliable evidence of business decisions, activities and transactions for program managers, deputy heads, ministers and Canadian citizens.^{Footnote 44}

Agencies face challenges in elevating the priority of IM as an integral element of policies, programs, services and initiatives.

Integrating IM requirements into the development, implementation, evaluation and reporting activities of departmental programs and services is a deputy head responsibility.^{Footnote 50} Embedding IM considerations and requirements into the policies, procedures, initiatives, and training and development programs for business operations increases the likelihood that employees will adopt sound IM practices in their day-to-day activities. The development of strategies to engage and promote IM as an integral element of RDAs’ operations can leverage the importance of IM and enhance employees’ commitment toward adopting sound IM practices. Examples of these strategies include mandatory IM training and individual performance objectives for all employees, and partnerships with departmental programs and services.

The Secretariat is responsible for promoting functional communities for the management of information and to develop and sustain IM specialist capacity and practices.^{Footnote 51} Interviews with IM officials confirmed that the both RDAs engaged and participated in the Secretariat’s activities aimed to promote IM functional communities. The IM Senior Official Day and the Recordkeeping Day were seen as valuable opportunities to exchange GC IM best practices and learn about ongoing IM initiatives. Both RDAs also participated in discussions with the Secretariat on IM-related matters and on activities and initiatives being implemented. IM officials also confirmed being sought to comment on the recent IM strategy renewal as part of these learning events and during departmental consultations. It was also noted that the implementation of enterprise systems such as GCDOCS encourages collaboration in the area of IM.

From an agency perspective, both RDAs’ IM functions had undertaken activities to promote IM, including email reminders and bulletins; internal training and awareness programs; and publishing policies, tools and resources online. However, the audit noted that strategies to ensure that IM requirements are adopted and integrated into departmental programs and services could be improved. For example, IM-related training for all employees focused mostly on the implementation of specific initiatives, such as GCDOCS and recordkeeping, and IM objectives were not included in performance agreements for all employees. In addition, while RDAs indicated in interviews that they had developed partnerships with some other programs and services, there is an opportunity to further leverage these partnerships to embed IM in other program policies, procedures, initiatives and training programs. In order for such leverage to occur, all employees need to apply IM principles, standards and practices in the performance of their duties. The IM function provides specialized support within departments to help deputy heads and employees in recognizing and fulfilling these responsibilities.^{Footnote 52}

Both RDAs have established planning activities to develop and sustain their IM human resources capacity.

Access to competent, skilled and trained IM specialists is important to support the successful implementation of IM initiatives. Both RDAs noted that the availability of qualified candidates to fill IM specialist positions is limited. Despite the fact that both RDAs had indicated the challenges in recognizing IM as a profession (for example, difficulties defining an IM specialist, and outdated competencies and associated classifications), both agencies implemented strategies to overcome these challenges. Use of temporary help, staff assignments and secondments were often used as compensatory measures. The rarity of IM specialists in the GC community is also a factor that contributes to this situation.

Both RDAs had established human resources planning activities to develop and sustain their IM human resources capacity. These planning activities determine the agencies’ human resources vision and direction to assist with identifying resources required for implementing IM activities and initiatives. Learning and development activities to support IM functional specialists are identified from these planned IM activities and initiatives. The audit also noted that CED had developed and documented, as a good practice, IM generic work objectives for IM functional specialist positions. Building the capacity and skills of IM functional specialists increases the likelihood that they fulfill their duties.

Recommendation: IM promotion and engagement

5. CED and ACOA should implement strategies to reinforce departmental responsibilities and integrate IM into departmental programs and services.