Your agency’s recordkeeping requirements may come from:
- legislative obligations
- your business needs
- community expectations
Table of contents
Recordkeeping requirements may be broad or specific. They can also be explicit but are more often implicit.
Specific requirements apply to a particular record or group of records.
For example, a requirement that a record of the reasons for a decision under an Act be kept for a certain amount of time.
Broad requirements apply to whole functions, types of records, system that holds the records, or the organisation, industry or state as a whole.
For example, s.7 of the Public Records Act 2002 requires that all public authorities create and keep public records.
Explicit requirements are any that clearly state what, when or how something should be done, such as those in legislation, standards and policies.
For example, an internal policy that states a check for any previous complaints about the same matter must be carried out when investigating a complaint.
Implicit requirements are ones that are implied, possibly through an explicit requirement.
For example, the internal policy above implies that a record of a complaint must be created and kept for future reference in order to carry out the check.
Keywords in documents, policies, procedures or legislation that may indicate a recordkeeping requirement include agenda, copy, files, retain, register, document, kept, etc.
We recommend that you document the requirements you identify, their source, and how you are or plan to meet the requirements.
Your agency has two kinds of regulatory obligations:
- obligations in records or information-focused legislation such as the Public Records Act 2002
- recordkeeping obligations found within legislation on other topics e.g. the Local Government Act 2009.
You must also have regard to the recordkeeping requirements within the Records governance policy.
Determine your legislative requirements and obligations
To identify your regulatory requirements, you need to look at any relevant documentary sources (e.g. legislation, policies, guidelines, codes of practice, etc) and identify any requirements that apply to you and your work.
You should also look for regulatory requirements that relate to:
- the industry or business sector in which your organisation operates
- your agency’s functions, and
- the specific activities or transactions carried out by your organisation.
Most recordkeeping requirements are not written explicitly in legislation. The following keywords and phrases may help you find requirements:
- ‘There shall be a register of licences’ means that the register is a record and must be captured
- ‘The form must include the applicant’s name and date of birth’ means that specific information must be captured
- ‘Applications must be lodged using an official form’ means that the record must be created in a specific format
- ‘The Registrar must keep all approved applications for a period of seven years from the date of their lodgement’ means that the record must be kept for a certain amount of time
- ‘The Registrar must destroy all unsuccessful applications one year after the date of their lodgement’ means that the record must be destroyed after a certain amount of time
- ‘The register must be open for inspection by the public’ means that access must be provided to the record
- ‘Applications must be stored in such a way as to keep their contents private’ means that access to the record is restricted.
To determine your business requirements, you need to identify what records your agency needs for its day-to-day work and broader activities.
Business requirements are often related to regulatory requirements.
Regulatory requirements may dictate what records are created, but business requirements will specify what format is used, where or how they are captured.
Business requirements may also be determined by identifying activities or processes where there are inefficiencies or opportunities for improvement.
See examples of business requirements.
Identifying your business requirements
You can do an environmental scan or assessment of your business areas to determine the recordkeeping requirements that relate to your business. You can do this by:
- looking at business processes and procedures
- identifying and assessing business systems
- assessing if and how recordkeeping applications are currently used
- finding out how records are formally and informally managed
- reading related documents (e.g. policies, procedures, plans, annual reports, external reviews)
- conducting employee interviews to get specific knowledge from business areas.
You can use process maps or other diagrams to explain how processes relate to business operations.
When assessing specific business applications, concentrate on ones that provide some evidence of business operations (e.g. applications that facilitate transactions). Think about:
- specific processes that support business operations (e.g. workflows)
- business rules applied within the applications
- policies and procedures that support the applications
- who uses and manages the applications
- training for employees in the use of the applications or business processes
- web-based applications that are used (e.g. customer complaints using social media).
Once you decide what to capture and how, the final collection of records should tell the story of any decisions made or actions taken.
Community expectations are the records the public expect you to keep.
These expectations might relate to community member’s own needs and interests (e.g. historical family birth, death and marriage records) or from their interest in accountable and transparent government (e.g. records on public consultation on a particular project).
Appropriate recordkeeping is crucial to ensure the records that are important to the community are available in the future, to support the accountability and transparency of government and maintain a high level of public trust.
Identify community expectations by engaging with the community and other relevant stakeholders. You can do this through:
- consultation with the public, stakeholder representatives and other agencies (formal or informal)
- parliamentary debates
- media coverage and enquiries
- direct enquiries (by phone or through a website)
- interviews with staff who regularly interact with the public about what issues have previously been raised or that can be anticipated.
Recordkeeping requirements are different for every agency.
Knowing your recordkeeping requirements will help you to determine:
- how records must be created
- when they must be created
- the format they must be created in
- who must create them
- who should have access to them (security)
- how to store and manage them.
When determining how you will meet your recordkeeping requirements, you will also need to consider:
- the risks involved in your work including recordkeeping risks
- what to capture and how
- how the parts of your new records governance framework will work together including:
- how any changes will be implemented
- how you will monitor and review your recordkeeping activities over time.