Manual for the Design and Implementation of Recordkeeping Systems (dirks)

Вид материала

Подобный материал:

1 ... 63 64 65 66 67 68 69 70 71

Reviewing strategies for records access and security

Step H: Post implementation review

Don't forget that an important part of access and security programs is to monitor security and access and to update your schemes on a regular basis. In Step H you monitor access and security regimes to ensure they continue to be based on your broad and specific recordkeeping requirements.

Any breaches to security should be used to initiate or inform your monitoring and revision process.

Further information

For further information about any of the issues discussed in this section please contact ARMS.

Doing DIRKS to ensure records are created and kept of outsourced functions

What is outsourcing?

Why do DIRKS projects for functions that are outsourced?

Identifying recordkeeping requirements that need to be met in your outsourcing arrangements

Further information

What is outsourcing?

Outsourcing is making financial and other arrangements for other organizations to perform ongoing work on an organization's behalf.

Many UN offices outsource common administrative or 'support' activities, such as printing, cleaning, payroll or the storage of semi-current records. Some public offices also outsource core business functions.

Another form of outsourcing is to share common administrative functions such as human resources, information technology and finance, by organising sharing arrangements with other agencies, setting up an internal shared services unit within an agency. This type of outsourcing is always done within a Government environment.

Why do DIRKS projects for functions that are to be outsourced?

Senior management is ultimately responsible for ensuring that the records of the outsourced business are created, maintained and disposed of in accordance with ARMS requirements.

Full and accurate records should be kept of all U.N. activities, including those that are outsourced and all U.N offices must ensure the safe custody and proper preservation and due return of specified records of outsourced business.

U.N. offices who outsource their services can use DIRKS to identify what recordkeeping requirements should be included in contracts and monitored over time to ensure that the provider of these services meet U.N. requirements.

Identifying requirements that need to be meet in your outsourcing arrangements

Undertaking Steps A-C of the DIRKS methodology can help you to identify the types of requirements you will need to identify in your contractual arrangements for outsourcing.

Step A: Preliminary investigation

It is important to approach an outsourcing project with a good understanding of the regulatory framework that governs information and records management in the United Nations. This framework will establish the boundaries for your recordkeeping obligations as a UN office.

The main requirements you need to identify are described in Step C of the DIRKS methodology. However, you may choose to also conduct parts of the preliminary investigation in Step A so that you can understand the context of the function you are outsourcing; in particular, the risks associated with that function.

Step B: Analysis of business activity

Step B is about analyzing your particular business functions, activities and processes, defining how they are performed and creating a business classification framework. This step is unnecessary if you already have an understanding of the function you are outsourcing and its boundaries with other functions and business processes.

Step C: Identification of recordkeeping requirements

Step C is critical to undertake in a project to outsource functions. You should identify all the recordkeeping requirements associated with the function in question and assess the risks of them not being met. You can then compile a list of recordkeeping requirements for the provider of the outsourced services and include it in the contract to ensure they meet their obligations.

Assessing systems for outsourced functions

To ensure your recordkeeping requirements will be adequately met, you may also wish to examine the business systems that will be used by your service provider.

Step D of the DIRKS methodology provide a mechanism by which you can assess these business systems against your recordkeeping requirements. You can use this information to feed further requirements into your contractual arrangements.

Step D: Assessment of existing systems

Undertaking Step D of the DIRKS methodology can enable you to assess the systems intended to support your outsourced activities. In Step D you can examine these systems - their technical infrastructure, procedural support and staff training - as a means to determine whether they are sufficient to support your business requirements. You can then use this step to set criteria or develop a checklist for the systems designed to support outsourced activity.

Alternatively, in Step D you can assess your organizational systems that currently perform the activities that are to be outsourced, and use the knowledge gained from this assessment to develop a checklist for the systems to be used by your service provider to manage your outsourced activity.

In either of these situations, based on an understanding of the recordkeeping requirements pertaining to the outsourced function you could develop a checklist to accompany the outsourcing arrangements that states:

the business systems supporting this function must be recordkeeping systems. Consequently they must:
- be sustained by policies and procedures that specify which records should be created and managed and how these records should be created and managed
- be supported by adequate training procedures to ensure staff performing outsourced functions understand their recordkeeping responsibilities
- implement recordkeeping tools, such as retention and disposal schedules and classification schemes, that are appropriate to the business function
- support adequate metadata attribution and maintenance
- adequately manage disposal class attribution and maintenance
- restrict record access to appropriate users.

Blog