At risk records notification

The Assessment Tool – Risks to physical and digital public records (DOCX, 333.9 KB) provides a guide for assessing various risk categories to your public authority’s records, such as water damage, data corruption or poor security.

Common causes of loss or damage are outlined for each risk category, alongside suggested or potential treatments and links to further information, which can used to guide completion of a Risk Treatment Plan in accordance with your public authority’s Risk Management Policy or equivalent.

If risks are identified, it may be useful to take photographs of the interior of physical records storage areas and any existing damage to records when you complete the checklist, as these will be required as part of your public authority’s notification to QSA under s21(b).

Risks to your public authority’s records should be managed in accordance with your public authority’s Risk Management Policy or equivalent, including the development of a risk treatment plan and inclusion of the risks and treatments on your public authority’s risk register.

Potential or suggested treatments in the assessment tool for each risk represent options that your public authority may wish to consider based on your public authority’s specific records, risks, resourcing or physical restraints.

A risk treatment plan usually includes the following components:

• Risk description: A clear statement of the identified risk, including its potential causes and consequences.
• Risk assessment: The level of risk (low, medium, high) based on its likelihood and impact (low, medium, high).
• Treatment options: The specific actions or strategies chosen to address the risk. Potential or suggested treatment options for records at risk of loss or damage are included in the assessment tool.
• Responsibilities: Assigning accountability for implementing the risk treatment actions to specific individuals or teams.
• Resources: Identifying the resources (e.g., budget, personnel, tools) required to implement the treatment actions.
• Timeline: Setting deadlines or milestones for implementing the risk treatment actions.
• Monitoring and review: Establishing processes to monitor the effectiveness of the treatment actions and review the plan regularly to ensure it remains relevant.
• Residual risk: Identifying the level of risk (low, medium, high) that remains after the treatment has been applied and determining whether it is acceptable.

Risks and treatments should be added to your public authority’s risk register to ensure appropriate governance and oversight, and to facilitate ongoing monitoring.

Using the At-risk records notification form , any public authority officer can notify QSA of records at risk of loss or damage in accordance with s21(b) of the Act.

To complete the notification, you will need:

• details about the records that are at risk
• details about the storage of your at-risk records
• photographs of the interior of storage areas for physical records
• details about the risks your records are exposed to and any relevant mitigation actions undertaken by your public authority to date
• details and photographs/screenshots of any existing damage to records.

When you submit your notification of at-risk records to QSA, we will assess your proposed treatments and provide a formal response to your public authority’s Chief Executive regarding their suitability.

This response may include recommended or mandatory actions to be executed by your public authority’s chief executive to ensure the safekeeping and preservation of public records in accordance with s15(1) of the Act.