Te arotake i ngā mahi pupuri mauhanga i ngā tari tūmatanui
Audit of public office recordkeeping
We audit public offices’ information management practices once every 5-10 years. Find out which organisations are scheduled for audit, how the process works, how the results are released and our expectations after audit.
The audit programme is part of Archives New Zealand’s leadership role in regulating information management (IM) across the government sector. It is a legal requirement under Section 33 of the Public Records Act (PRA). It’s one of the key components of our Monitoring Framework, which also includes:
the survey of public sector IM
the IM Maturity Assessment.
Purpose of the audit programme
The audit is a point-in-time view of an organisation’s IM practices. It recognises an organisation’s operating environment and IM challenges and shows IM strengths and opportunities for improvement. It is a maturity audit rather than a compliance audit. However if deliberate systematic non-compliance is apparent, it will be referred to our non-compliance staff to assess. We are aiming for improvement in public sector IM maturity.
Monitoring government organisations’ IM practices increases public trust and confidence by assuring people that:
organisations create and maintain full and accurate records, supporting business efficiency, accountability and government decision-making
government is open, transparent and accountable by making public sector IM practices known to the public.
Audits also help make sure public offices:
deliver high-quality information to decision-makers, other government organisations, customers and stakeholders
take proper care of information by creating and managing it well
facilitate safe and lawful sharing across government.
Legal requirement to audit
Under Section 33 of the PRA, the Chief Archivist is required to conduct independent audits of public offices, and:
commission and meet the costs of each audit
develop criteria for the aspects of recordkeeping practices audited
conduct audits at intervals of 5-10 years.
Which organisations are audited?
The audit programme covers over 200 public offices. We’re not mandated by the PRA to audit local authorities. Some public offices are not currently included in the scope of the programme, including:
schools
Ministers of the Crown.
People involved
Archives New Zealand
We have staff dedicated to managing the audit programme.
Auditors
We contract KPMG and Deloitte to audit on our behalf. These auditors are required to attend an Archives New Zealand training course on audit processes and the PRA.
Your organisation
If your organisation is due for audit:
the Chief Executive will be notified of the audit
the Executive Sponsor will be our main point of contact
IM staff, the Executive Sponsor, ICT staff, other staff members and contractors will be involved in interviews and focus groups during the onsite audit.
Audit process and timeframes
There are 3 stages to the audit process. These are discussed in the engagement meeting with the Executive Sponsor who may invite other staff.
Stage 1 — Pre-audit
Notifications
1st — we notify your organisation that your audit is due in the next financial year.
2nd — we propose dates for an engagement meeting and the onsite audit. These dates are then mutually agreed. We also send the IM Maturity Assessment for you to complete before the engagement meeting and request a list of the organisation’s digital systems. Templates are provided for these.
Note: IM Maturity Assessment — your self-assessment is sent to the auditors as part of the pre-audit reference material. Your self-assessment is not included in the audit report. Completing the self-assessment helps you understand what areas the audit will cover and what questions will be asked as the IM Maturity Assessment is the framework for audit.
IM Maturity Assessment information
Preparation
At least 6 weeks before the onsite audit, we:
have an engagement meeting between Archives and your organisation
send you a letter of engagement that includes the audit scope and agreed dates for the audit
send you a preparation document.
The preparation document:
lists documents you need to send to us for the auditors reference e.g. IM Policy, Strategy etc.
asks you to set up specific interviews with staff during onsite audit
asks for contact details for an audit coordinator to help the auditor when onsite.
Stage 2 — In audit
Onsite audit
The onsite audit can take between 2-4 days depending on the size of your organisation.
It involves:
interviews
focus groups
inspections
collecting more evidence
the auditors draft the audit report, including deciding maturity levels and giving recommendations for each topic.
Stage 3 — Post audit
Reporting
After the onsite audit:
The auditors send the Executive Sponsor the draft audit report approximately 1 month after the onsite audit for an accuracy review
You will normally have 2 weeks to review and provide comment back to the auditors
Within approximately 2 weeks the auditors finalise the report and sends to us
The Chief Archivist’s Audit Letter is then written commenting on the audit report and prioritising the recommendations
Approximately 5 weeks later you will receive the audit report and the Chief Archivist’s Audit Letter. At the same time, you will be sent a questionnaire for feedback on the audit process and an action plan template related to the prioritised recommendations template (read more details in 'How follow up works after audit' below)
10 days later we release the audit report and Chief Archivist's Audit Letter on our website.
The image shows the audit process, step by step.
How follow up works after audit
Action plan (due 6 months after you receive the audit documents)
Your organisation develops and sends us an action plan to address the priority recommendations. We provide a template and can offer guidance and feedback.
Check-in 1 (6 months after we receive the action plan)
We’ll meet you to discuss progress and how you can access more support, if you need it.
Final check-in (12 months after check-in 1)
We’ll meet you to discuss progress and close off the audit work.
How audit supports Te Tiriti o Waitangi
As a regulator of public sector IM, our leadership role includes encouraging responsiveness to Māori in IM practice. This is consistent with the purpose of the PRA “to encourage the spirit of partnership and goodwill envisaged by the Treaty of Waitangi (Te Tiriti o Waitangi)” (Section 3(g)).
The IM Maturity Assessment requires an organisation to consider whether it has identified information it holds that is of importance to Māori, and whether it understands the IM implications of settlements or other agreements with Māori. It also asks how well this information is managed to ensure that it is identifiable, accessible, and usable by and for Māori.
We acknowledge that there is still a lot to learn in developing capability in this area in consultation with iwi Māori.
Mandated reporting
Under Section 33 of the PRA, the Chief Archivist must prepare a report to the Minister and the House of Representatives on the audits conducted under section 33.
See most recent Chief Archivist's annual report on the state of government recordkeeping
Ask us about the audit programme
We can help if you have further questions about the audit programme. Send us an email and we will get back to you.
Email: praaudit@dia.govt.nz