Guidelines and Best Practices for Implementing Revised DEO Policy 4.09, Records Management Procedures

Transcription

1 Introduction The DEO Policy 4.09, Management Procedures, aligns DEO records management with the state laws and Department of State (DOS) rules on records management that apply to all state agencies. Besides the need to comply with existing laws and rules, records management is important to successful agency performance. Proper records management ensures that information is available when and where it is needed, in an organized and efficient manner, and in an appropriate environment. It allows an organization to establish and maintain control over information flow and administrative operations. R.A.C.I. Matrix The R.A.C.I. matrix is used to organize these guidelines and best practices. The matrix explains the roles and responsibilities of the various DEO personnel in the implementation of DEO Policy The DEO personnel are classified in the R.A.C.I. matrix as follows: DEO Management Liaison Office () (DEO Office of Information Systems and Support Services) The R.A.C.I. matrix lists each major activity within the DEO Policy 4.09 and specifies the role for each type of DEO personnel listed above. The possible roles are as follows: R Responsible for performing the task; the person doing the work to complete the task A for the task being done in a satisfactory manner C with and whose input is used to complete the task I as to the status of the task Reemployment Assistance (formerly UC) Experience The Reemployment Assistance (RA) has been working toward implementation of this policy since May 2011, when it was initially a proposed AWI policy. The manner in which the RA Area has organized to implement the policy is instructive and can serve as a useful model for other DEO s. The head of the RA appointed representatives from all the various program areas within RA to a records retention working group. Some participants were from other areas of the state and participated via teleconferencing. This working group began meeting every 3 weeks to identify the required tasks to implement the policy, to make assignments, and to report on their completion. Meeting notes/minutes were distributed to keep everyone informed and working together on a common understanding of the responsibilities and assignments. A Management Plan for the RA program was developed that can be used as a template by other DEO programs. Three sub-groups were formed to address the unique requirements for each major category of electronic records, as follows: Applications (supported by ) Shared Folders/File Servers These three working groups also met regularly to discuss and define the requirements for implementing the policy within the RA as it pertained to those types of records. The RA s experience is an example and a useful reference model for the practical implementation of the policy. 1

2 R.A.C.I. Matrix for the Implementation of DEO Policy 4.09, Management Procedures Establish and maintain an active and continuing program for the economical and efficient management of records. Guidelines: Chapters 119 and 257, F.S., place a variety of public records management responsibilities on agencies. The Department of State has overall authority in these matters and has established administrative rules, guidelines and training to assist agencies in meeting their responsibilities. 1 Responsibility for properly maintaining public records begins with the head of the agency. The and records custodians are also specifically designated with carrying out certain responsibilities. The Department of State document Electronic and Management Practices outlines eleven program elements necessary for a records management program. The link to this document is: A A R,C, I R C C,I Best Practice: A coordinated and collaborative effort that includes the DEO and other DEO management is established for records management and also includes the expertise of the DEO Management Liaison Officer, staff, legal staff, and records custodians. 2

3 Designate a Management Liaison Officer (). Guidelines: Section (5)(a), F.S., requires each agency to designate a records management liaison officer to serve as the primary point of contact between the agency and the Department of State s records management program. To appoint an, an agency needs to submit a Department of State (DOS) appointment form. 2 The might perform a variety of records management functions including : maintaining a current inventory of agency records; liaison with the DEO and DOS to establish new records retention schedules ; liaison with the DEO and DOS to ensure the appropriate disposition of records eligible for destruction; training and advising DEO staff in records management practices; participating in agency decision-making for issues such as microfilming, imaging, storage, and disposal of records; responding to public questions regarding agency records and records management practices; and reporting annually to the DOS regarding the agency's compliance with records management statutes and rules. R, A C I I I I Best Practice: The Department of State recommends that the be a senior-level position or report to a senior-level position, and has the authority to establish and implement an agency-wide recordkeeping program. 3

4 Designate for each Agency Area. 3 4 Guidelines: are responsible for ensuring that official state records are properly maintained and processed according to agency policies and procedures and the appropriate retention schedule. custodians are responsible for paper and electronic records and work closely with the agency. Best Practice: Each Area decides how many records custodians it needs to designate in order to properly manage its records, and ensures that they receive proper training. Ensure that DEO records have an associated records retention schedule, and request agency-specific retention schedules, as needed Guidelines: A records retention schedule describes a records series (a group of related documents) and sets a minimum period of time for which the records must be retained before final disposition of the records can occur. These retention periods are determined by the content, nature and purpose of records, and are set based on their legal, fiscal, administrative and historical values. The Department of State establishes the approved records retention schedules for agencies to use, and publishes them in the General Schedule GS1-SL for State and Local Government Agencies: ( If the retention schedules in the General Schedule for State Agencies (GS1-SL) do not adequately address all of the Area s records, then the Area may apply for an Agency Specific Retention Schedule. A specific form for this purpose, Retention Schedule Form LS5E105, is required to be submitted to the agency s Management Liaison Officer who will forward it to the State Center s Analysis Section for assistance and approval. W:\Taskforce_E_Retention\3- Deliverables\AWI Policy 4.09\Policy and Forms\AgencyUniqueRetentionSchedule_Form.docx R, A C, I I I I A C, I R C I Best Practice: Each DEO Area annually reviews its e-records inventory and revises its retention schedules, as necessary, working with the and requesting agency-specific records retention schedules as needed. 4

5 Ensure that each message and attached document, if any, are examined to determine which retention schedule applies, and are retained for the applicable retention period. Guidelines: There is no single retention schedule that applies across the board to all s. can have a variety of purposes and relate to a variety of program functions and activities. The retention period of any particular message will generally be the same as the retention for records in any other form that document that same program function or activity. For example, if the content of an concerns non-capital improvement agreements, retention schedule GS1-SL Item 65 requires the to be retained for five (5) years after completion or termination of the contract, provided applicable audits have been released. 5 Best Practice: Each DEO Associate determines what the retention period is for each that is created or received by them. The following are categories of s that should be deleted as soon as possible: Personal s s that are transitory records s that are copies that you are not expected to and did not take action on For s that must be retained, each DEO Associate ensures that they are retained for the appropriate retention period. (See Appendix C of these guidelines.) A C R 5

6 Designate which version or format of each record is the official record (master) copy. 6 Guidelines: The official record (master) copy can be in electronic or paper format. These cannot be disposed of until their associated retention schedule has been met. Required disposition documentation must be provided to the agency s Management Liaison Officer (). Most duplicates of records, however, can be disposed of at anytime and do not require the filing of the disposition report with the. Best Practice: DEO ensure that the record or master copies of their records are stored in a system that is regularly maintained and backed up by so that they could be recovered, if necessary, and that duplicates of records are disposed of when no longer needed. A C, I R C I 7 Maintain an inventory of all records retention schedules for DEO records and annually review and update it. Guidelines: The works with the for each Area to conduct an annual review of the records retention schedules for all types of records (paper and electronic) and revises the DEO inventory as necessary. Best Practice: The DEO inventory of all records retention schedules is updated at least annually and made available on the DEO Intranet so that it is easily accessible by the. A I R C, I C, I C, I 6

7 Provide training and technical assistance on records management. Guidelines: The Division of Library and Information Services, Department of State, offers a series of seminars on basic records management in various locations around the state of Florida. These seminars are designed for individuals who have assumed records management responsibilities, are employed by newly created public agencies, or desire a refresher course in records management. The DOS also makes available, upon request, Management Webinars to provide agencies with an efficient and economical alternative to on-site training. Additionally, there is an list managed by the DOS to which all records management staff can subscribe. This list is used by the Management Training Section of the Division to provide members with information regarding records management. 8 Best Practice: The develops, in consultation with the DEO Bureau of Human Resources Management, a training module related to records management that is required for all DEO employees. The also develops more detailed records management training for the records custodians, and DEO may develop training for their unique records management procedures. Additionally, the works with the DOS to ensure that all DEO receive DOS training and are included in the DOS list. A C R C C, I C 7

8 Complete the required Agency Management Training Course and read and understand the policies and procedures for Management. Guidelines: Training for individuals who create, edit, store, retrieve, or dispose of records is an important aspect of records management. Training should enable agency personnel to: 9 identify public records; understand how records are filed in an electronic recordkeeping system; understand how records are safeguarded; know what procedures are used to edit records; and understand how records should be disposed of according to legal requirements. A C, I C R Agencies must ensure that record (master) copies of electronic records are maintained by personnel properly trained in the use and handling of the records and associated equipment. Best Practice: Required DEO records management training includes all the necessary elements and a signed certification by each DEO employee as to their completion of it and their understanding of their records management responsibilities. 8

9 Establish and maintain a records management plan. 10 Guidelines: Document management is the process of handling records or documents in such a way that information can be created, shared, organized, stored and controlled efficiently and appropriately. This can include rules for: creating documents/records, such as a style guide and templates; storing records, such as standard naming conventions for documents, folders, and files; creating an index to the file locations for easy retrieval of records; and securing, sharing and disposing of records. The DOS has published several guidelines to assist agencies in this process Best Practice: Each DEO Area develops and maintains through a regular review process a written records management plan for both its paper and electronic records. A C, I R C, I C, I 9

10 Establish procedures for addressing records management requirements for all electronic recordkeeping systems (existing, new, upgraded, enhanced, replaced, or those to be sunset) Guidelines: DOS Rule Ch. 1B , Electronic Recordkeeping, requires agencies to establish procedures for addressing records management requirements before approving, recommending, adopting, or implementing new systems or enhancements to existing systems. A flowchart of the 7 steps necessary to incorporate records management requirements in systems (applications) is attached as Appendix A to these guidelines. Best Practice: DEO consult with the regarding their records management requirements before a new or enhanced information system is approved for their use. DEO incorporates the DOS rule requirements and the flowchart as part of its project governance approach and methodology. Provide for regular recopying, reformatting, and other necessary maintenance to ensure the retention and usability of electronic records throughout their retention period. Guidelines: that are part of -supported application systems, shared file server system, or system are regularly backed-up to ensure their retention and usability throughout their retention period. If, however, DEO maintain other record systems of their own, they must comply with this requirement to ensure that those records are retained and accessible even if the technology used to originally create them becomes obsolete. Best Practice: DEO that maintain their own software annually test it to ensure that the records maintained by that software are still accessible and usable. A C, I R C C, I A C, I R C C, I 10

11 Ensure that all DEO data sharing agreements providing DEO data to other entities are subject to and will adhere to all Florida laws and policies on records management and will follow the DEO records retention schedules. 13 Guidelines: DEO that enter into data sharing agreements with other agencies or organizations should include a clause that addresses the records management requirements related to those records, including their retention period and disposition. Best Practice: The DEO Office of General Counsel drafts a model clause for inclusion in all DEO data sharing agreements that addresses this topic and ensures its inclusion as part of their review of all such agreements. A C, I R C C, I For paper records, enter information into the DOS Total Recall System to add new records and retrieve records stored at the State Center, order necessary storage supplies, and pack and label cartons in accordance with storage guidelines. 14 Guidelines: The DOS provides detailed instructions on how to store and retrieve paper records. These are included in the DEO Policy 4.09, along with the specific forms to use. Best Practice: All DEO consult with the and follow the storage guidelines established by DOS for paper records. A C, I R C 11

12 Maintain all DEO documentation on compliance with records management. Guidelines: An important element of the agency s records management program is keeping the documentation of all agency actions so that compliance with the records management requirements is easily demonstrated. This documentation includes such items as: 15 inventory; Certification of records management compliance by the ; and Permanent retention of records disposition reports. Best Practice: The DEO maintains up-to-date DEO documentation on compliance with records management that is stored in an electronic system maintained by, so that it is easily accessible and recoverable. A I R C C 16 Make system changes to implement records management requirements. Guidelines: Appendix B of these guidelines is a flowchart that identifies the requirements to be met by the retrofit of the existing - supported applications in order for them to be compliant with the records management requirements. Initial high-level cost estimates to retrofit existing applications to address the disposition requirements for records were calculated in January 2011, by the Application Managers for the AWI - supported applications, at that time. Best Practice: Each DEO Area defines its records management requirements and discusses these with the and their Application Manager in order to pursue needed changes in existing applications, as resources allow. A C, I C, I C, I R 12

13 Identify when records have met their retention period. Guidelines: Once records have met their minimum retention period, as defined by their associated record series, they may be disposed of. Timely disposal of records that are eligible for disposition is an important element of records management. It reduces the volume of records stored and limits the future liability of the agency to review and produce records in future legal cases, public records requests, investigations, and audits. In many cases, the DEO have not established records management procedures that would easily allow for the identification of existing records that are eligible for disposition. Therefore, two separate, yet related, activities to achieve this requirement may be necessary. 17 One activity would focus on existing records and developing a means to identify those eligible for disposition. This may require each DEO Area working closely with in order to understand how their records may be searched for various criteria related to their retention periods. A, I C, I R C C, I The second activity would focus on establishing records management procedures for the creation and storage of future records so that identification of when those records are eligible for disposition would be readily known. This could include developing the functional requirements for an automated system to assist in the records management process. Best Practice: DEO establish mechanisms (manual or automated) for determining when their records have met their identified retention period and are eligible for disposition. 13

14 Implement a required retention hold for legal, audit, public records, or investigative purposes. Guidelines: In certain instances (audits, legal cases, investigations, public records requests) records that would have been eligible for disposition must be retained. This is referred to as a retention hold on those records. Such records must be kept until the triggering event for their retention hold has been completed, at which time the records may be disposed of. 18 Best Practice: The DEO Office of General Counsel, in conjunction with the DEO IG s Office, the DEO Division of Finance and Administration, and the DEO Office of Information Systems and Support Services, develops processes and procedures to provide for the appropriate retention hold on records in the case of legal cases, public records requests, audits, or investigations. A C, I R C, I C, I 14

15 Approve and justify any extensions to retain records longer than their retention period by completing a DEO Justification to Extend Retention Period Form. 19 Guidelines: that have met their retention period are eligible for disposition. If a Area Manager determines that there is a programmatic need to retain those records for a longer period of time, or if there is a retention hold for legal, audit, investigative or public records request, then a special form must be completed and submitted to the. W:\Taskforce_E_Retention\3- Deliverables\AWI Policy 4.09\Policy and Forms\Justification to Extend Retention final for Task Force.docx This form requires additional information to be provided by the Area, if the records are being kept longer than their required retention period for programmatic reasons. The Area must estimate the potential costs associated with that action, based on their previous costs associated with public records searches and other factors. Best Practice: DEO complete a DEO Justification to Extend Retention Period Form each time they decide not to dispose of records that are eligible for destruction. A, R I C C I 15

16 Ensure that all records that have met their retention period are properly documented and disposed of. Guidelines: Section (2)(c), F.S., requires agencies to systematically dispose of records no longer needed.... The Department of State requires that records must have a records retention schedule before they can be disposed of. Electronic records can be divided into three major categories for records management purposes: Applications Shared Folders/File Servers s Identifying when records have met their retention period can be an automated or a manual process. 20 When records have met their retention period, as determined by their retention schedule, they are eligible for disposition, and one option is to permanently dispose of them. When disposing of records that contain sensitive, confidential or exempt information care must be taken to ensure that the records cannot be read or reconstructed. The Information Technology Operations Manual Protocol 5.05,02 governs the process for disposing of electronic data. DEO Information Technology Operations Manual Protocol ( Security / Risk Mitigation Services) With the exception of duplicate copies of records, when disposing of records (whether paper, electronic, confidential or not) a Disposition Document form must be completed and sent to the DEO Management Liaison Officer (). This form is kept by the as a permanent record of the action. Best Practice: All DEO follow proper procedures and document the disposal of their records when those records are eligible for destruction. A C, I R C C, I 16

17 Annually complete and sign a DEO Management Compliance Certification Form. 21 Guidelines: The of each DEO Division must annually complete and sign this form attesting to certain records management actions. Management Compliance Certification Form Best Practice: All DEO Division s annually complete and sign the DEO Management Compliance Certification Form and send it in a timely manner to the. R, A C, I C C 22 Annually complete and sign a DOS Management Compliance Statement. Guidelines: Florida Administrative Code Rule 1B (11) states: "Each agency shall submit to the Division, once a year, a signed statement attesting to the agency's compliance with records management laws, rules, and procedures." It is important that the agency return the Compliance Statement in a timely manner, as the DOS is required to report to the Governor and Legislature annually on records management compliance. Annually, the DOS sends each agency a brief form to complete and return. The form asks: 1) if the agency had conducted certain activities reflecting compliance with records management requirements; 2) the quantity of public records destroyed in the past fiscal year; and 3) what needs, if any, the agency has for records management training or assistance. The agency is also asked to provide updated information. Best practice: DEO annually completes and signs the DOS Management Compliance Statement and sends to the DOS in a timely manner for inclusion in its report to the Governor and Legislature on records management compliance. 17 R, A C C C C

18 Appendix A. Future Opportunities to Address Management Requirements in Electronic Recordkeeping Systems Upgrade or Enhancement to Existing Information System New or Replacement Information System Sunset of Existing Information System Does change affect records? If Yes Area owner of affected Information System consults with the and Application Manager. 1. Are the records series associated with the system accurate and complete? 2. Is there a means to: If No A. Identify records eligible for disposition? B. Extend the retention period? (Hold or Justified) System modification, development, or sunset proceeds, as applicable, incorporating records management requirements determined necessary. management requirements of the system are addressed, including recordkeeping requirements and disposition. C. Review the identified records prior to disposition? D. Sign-off on the records disposition? documents changes in records retention schedules, if any, in the DEO E- Inventory. E. Dispose of records? F. Provide a post-deletion report with required DOS info? 18

19 Appendix B. Addressing Retention and Disposition Requirements in Existing Systems Area owner of Information System(s) consults with the and Application Manager 1. Are the records series associated with the system accurate and complete? 2. Is there a means to: No changes to system(s) required If Yes Are records retention and disposition requirements of the system(s) addressed? A. Identify records eligible for disposition? B. Extend the retention period? (Hold or Justified) If No C. Review the identified records prior to disposition? Requirements to bring system(s) into compliance are defined. D. Sign-off on the records disposition? E. Dispose of records? A project budget(s) for bringing system(s) into compliance is developed and submitted. F. Provide a post-deletion report with required DOS info? No system changes are made to bring into compliance. If No Is budget for project(s) approved? If Yes Service Request or Project developed to bring system(s) into compliance Modifications made to system(s) to bring into compliance 19

20 Appendix C. Disposition Procedures is Sent or Received Is the a personal message? (not a public record) If Yes Delete as soon as possible If No Has short-term value and is not intended to formalize or perpetuate knowledge, does not set policy, establish guidelines or procedures, certify a transaction or become a receipt. Is the a transitory record? If No If Yes Examples: 1. Office announcements 2. Meeting reminders Is the a copy that you were not expected to and did not take action on? If Yes If No Each DEO Associate: 1. Determines for each that is received or sent which retention schedule applies, and 2. Saves the , along with the associated transmission data and attachments, for the required retention period. Examples: 1. Correspondence and Memoranda: and Policy Development Complaints: Citizens/ Consumers/Employees Grant Files: Grantor Agency