This is an HTML version of an attachment to the Official Information request 'VUW: Evidence Of Ability to Comply with the Public Records Act and the OIA'.






Audit Findings Report of Victoria University of Wellington
Year 2010/2011
General Business Activities - Summary
Planning
Stage
Description
Achievement
Initiation
Policy and planning initiated.
Coordinated planning, documentation and review of the 
management of records is evident.
Establishment
Policy and plans are being implemented.
Coordinated planning, documentation and review of the 
management of records is evident.
Capability
Policy and plans are regularly reviewed and updated.
Coordinated planning, documentation and review of the 
management of records is evident.
Resourcing
Stage
Description
Achievement
Initiation
Resourcing requirements for recordkeeping identified.
Effective management of resourcing requirements is fully integrated 
with strategic and operational activities.
Establishment
Resourcing for recordkeeping established.
Effective management of resourcing requirements is fully integrated 
with strategic and operational activities.
Capability
Succession planning and resourcing is part of business  Effective management of resourcing requirements is fully integrated 
plans.
with strategic and operational activities.
1/06/2011 2:56 PM
Page
1 of 37











Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Training
Stage
Description
Achievement
Initiation
Training needs analysis undertaken.
Effective management of training programme is fully integrated with 
strategic and operational activities.
Establishment
Training programme established.
Coordinated planning, documentation and review of training 
requirements for the management of records is evident.
Capability
Training programme actively monitored, reviewed and 
Coordinated planning, documentation and review of training 
updated.
requirements for the management of records is evident.
Reporting
Stage
Description
Achievement
Initiation
Reporting requirements identified.
Effective management of reporting programme is fully integrated 
with strategic and operational activities.
Establishment
Basic operational reporting established.
Coordinated planning, documentation and review of reporting 
requirements for the management of records is evident.
Capability
Recordkeeping is part of organisational risk and 
Effective management of reporting programme is fully integrated 
reporting framework.
with strategic and operational activities.
Legend
absent
aware
actioned
embedded
1/06/2011 2:56 PM
Page
2 of 37







Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Specific Recordkeeping Practice - Summary
Creation & Capture
Stage
Description
Achievement
Initiation
Recordkeeping requirements have been identified.
The existence of coordinated systems and/or controls for the 
creation and capture of records is evident.
Establishment
Systems and controls are implemented.
The existence of coordinated systems and/or controls for the 
creation and capture of records is evident.
Capability
Systems and controls are actively monitored and 
The existence of coordinated systems and/or controls for the 
reviewed.
creation and capture of records is evident.
Retrievability & Security
Stage
Description
Achievement
Initiation
Recordkeeping requirements have been identified.
Effective systems and/or controls for the retrievability and security 
of records is fully integrated within operational activities.
Establishment
Systems and controls are implemented.
The existence of coordinated systems and/or controls for the 
retrievability and security of records is evident.
Capability
Systems and controls are actively monitored and 
The existence of coordinated systems and/or controls for the 
reviewed.
retrievability and security of records is evident.
1/06/2011 2:56 PM
Page
3 of 37











Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Maintenance & Storage
Stage
Description
Achievement
Initiation
Recordkeeping requirements have been identified.
The existence of coordinated systems and/or controls for the 
maintenance and storage of records is evident.
Establishment
Systems and controls are implemented.
The existence of coordinated systems and/or controls for the 
maintenance and storage of records is evident.
Capability
Systems and controls are actively monitored and 
Effective systems and/or controls for the maintenance and storage 
reviewed.
of records is fully integrated within operational activities.
Disposal & Transfer
Stage
Description
Achievement
Initiation
Development of disposal authorities and 
Effective systems and/or controls for the disposal of records is fully 
implementation plans initiated.
integrated within operational activities.
Establishment
Authorised disposal authorities and implementation 
The existence of coordinated systems and/or controls for the 
plans established.
disposal of records is evident.
Capability
Disposal of records actively managed.
The existence of coordinated systems and/or controls for the 
disposal of records is evident.
Legend
absent
aware
actioned
embedded
1/06/2011 2:56 PM
Page
4 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
General Business Activities
Planning
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
A governance framework has been 
Operational
Victoria University's recordkeeping 
Completed and up  All
Completed
established in which the recordkeeping 
governance structure is based on a 
to date
function will operate from Chief Executive 
delegation and escalation model. The 
to Executive Management to recordkeeping 
Vice Chancellor has final 
and other staff.
responsibility for all policy and 
compliance including recordkeeping. 
The VC delegates operational 
recordkeeping responsibilities to the 
records manager, who escalates 
matters as necessary, through his 
manager and the Recordkeeping 
Steering Committee.
Victoria University is a large and 
complex information environment 
characterised by multiple 
recordkeeping systems in both 
physical and electronic form. 
Metadata is managed using a 
devolved model. The Records 
1/06/2011 2:56 PM
Page
5 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

Manager's role is to provide tools, 
policies and education to business 
units, and to be a source of good 
practice. The Records Manager is 
taking a central role in the 
development of Victoria's EDRMS 
project.
2
A profile of systems within the 
Operational
A profile of all electronic systems 
Completed - some  All
Plans in place
recordkeeping framework exists (i.e. 
exists. A profile of all paper systems 
out of date
systems which create and maintain 
has been created as part of Victoria 
records).
University's Records Survey Project - 
this is almost complete.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Records Management policies are 
Operational
Recordkeeping policy is current and 
Completed and up  All
Completed
documented and implemented.
all actions in current policy are 
to date
implemented.
RATING CHANGE:
Progress changed to 'completed and 
1/06/2011 2:56 PM
Page
6 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

up to date'.
Intentions to Progress changed to 
'completed'.
2
Recordkeeping procedures have been 
Operational
Recordkeeping procedures have been  Completed - some  All
Plans in place
documented and implemented, including 
documented based on recordkeeping  out of date
procedures for verifying metadata.
policy. Whole-of-lifecycle procedures 
are available on Victoria University 
Intranet. Guidance on classification 
schema is currently in development.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
3
Business-critical records are identified and 
Operational
The identification and management of  Under way
All
Plans in place
managed.
vital records at Victoria University is 
currently in progress as part of a 
broader Records Survey Project. This 
project is a one year long major 
project that involves a detailed 
analysis of each business unit's 
records and recordkeeping 
environment. Each survey results in a 
Finding Aid. A list of each unit's vital 
records is one of the outputs of the 
consultation process. This list 
includes details of where copies are 
held and their format. Once all units 
have completed the Records Survey, 
1/06/2011 2:56 PM
Page
7 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

and all vital records have been 
identified, a Vital Records Programme 
will be implemented.
RATING CHANGE:
Coverage changed to 'all'.
4
A disaster recovery plan for records is 
Operational
Disaster Recovery planning for 
Under way
All
Plans in place
implemented.
electronic records is managed by ITS. 
Disaster Recovery for physical 
records is in progress and is part of 
the current recordkeeping operational 
plan. Offsite storage has recently 
been consolidated to one provider to 
allow better management of offsite 
records. Victoria University's third 
party offsite storage provider has a 
comprehensive disaster recovery plan 
in place.
RATING CHANGE:
Coverage changed to 'all'.
5
New, redeveloped or replaced business 
Operational
Records Manager works closely with 
Completed - some  All
Plans in place
specific systems are designed to deliver the 
BAs and Enterprise Architect to 
out of date
capability to meet recordkeeping principles.
ensure systems are designed to 
deliver the capability to meet 
recordkeeping principles.
RATING CHANGE:
Progress changed to 'completed - 
1/06/2011 2:56 PM
Page
8 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

some out of date'.
Coverage changed to 'all'.
6
An approved recordkeeping plan is 
Operational
Findings support ratings.
Completed and up  All
Completed
regularly reviewed by senior management.
to date
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Regular reviews of recordkeeping policy 
Operational
Findings support ratings.
Completed and up  All
Completed
and updates are evident.
to date
2
Regular reviews of recordkeeping 
Operational
Recordkeeping practices and 
Completed - some  All
Plans in place
procedures and updates are evident.
procedures are reviewed and updates  out of date
to procedures, where appropriate, are 
evident. A current major Records 
Survey Project is in progress. 
Guidance on Classification Scheme 
application is planned.
RATING CHANGE:
Coverage changed to 'all'.
3
Risk management planning considers 
Compliance
As part of the Victoria University 
Under way
All
Plans in place
recordkeeping risks and mitigation 
business planning project, every 
strategies including legislation and 
manager will have the requirement to 
standards requirements.
reference recordkeeping in their 
operational plan.
1/06/2011 2:56 PM
Page
9 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

RATING CHANGE:
Coverage changed to 'all'.
4
The business/strategic plan references 
Strategic
The Victoria University recordkeeping  Completed - some  Most
Plans in place
recordkeeping outputs and outcomes.
strategy is linked to the wider 
out of date
business strategy and goes through 
an approval process with senior 
management. The ITS Strategy also 
includes reference to recordkeeping. 
Plans are in place to develop an 
Information Management Strategy 
and integrate recordkeeping into the 
business planning life cycle.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
5
The disaster recovery plan is regularly 
Operational
A Disaster Recovery planning 
Under way
All
Plans in place
tested and reviewed.
programme is underway and will be 
applied organisation wide.
RATING CHANGE:
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
10 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Resourcing
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Recordkeeping roles and related support 
Strategic
Recordkeeping roles at Victoria are 
Completed and up  All
Completed
resources are defined in order to meet core 
defined in order to meet core 
to date
information management requirements.
information management 
requirements.
RATING CHANGE:
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
Responsibility for creating and managing 
Compliance
Responsibility for creating and 
Completed and up  All
Completed
records is assigned and communicated to 
managing records is assigned and 
to date
individual staff.
communicated to individual staff 
through the recordkeeping policy, 
intranet guidance, induction process 
and the current major Records Survey 
Project which covers all business 
units.
RATING CHANGE:
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
1/06/2011 2:56 PM
Page
11 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Qualified and/or experienced or skilled 
Operational
Qualified and/or experienced or 
Completed and up  All
Completed
recordkeeping practitioners have been 
skilled recordkeeping practitioners 
to date
appointed for all defined roles.
have been appointed for all defined 
roles.  Victoria University has 
instituted an informal training role that 
is filled by a student of the Records 
Management degree programme. 
These informal staff members, who 
are being trained on the job, also 
attend professional development 
events.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
A proactive human resource management 
Operational
The Records Manager meets with the  Completed and up  All
Completed
programme is in place to maintain and 
Performance Manager on a two-
to date
develop recordkeeping personnel capacity.
weekly basis. The RM's Performance 
1/06/2011 2:56 PM
Page
12 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

Development Career Plan includes all 
areas of recordkeeping and includes 
courses as appropriate. Progress 
against the plan is monitored every 
two weeks.  
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
Future budget and personnel requirements  Operational
Victoria University's planning and 
Completed and up  All
Completed
to sustain improvements in the 
budget cycle involves allocating 
to date
recordkeeping programme is considered.
budgets for new projects, including 
recordkeeping projects. 
Recordkeeping operational plans 
provide details of budget allocated to 
projects.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
1/06/2011 2:56 PM
Page
13 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Training
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
An analysis of management needs and 
Operational
An analysis of management needs 
Completed and up  All
Completed
skills of recordkeeping staff consistent with 
and skills of recordkeeping staff, 
to date
their respective roles and responsibilities 
consistent with their respective roles 
has been conducted.
and responsibilities, is built into the 
performance planning process. All 
training needs are aligned with the 
recordkeeping strategic plan and 
monitored on a two-weekly basis.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
The responsibility for defining the 
Operational
The responsibility for defining the 
Completed and up  All
Completed
recordkeeping requirements is assigned to 
recordkeeping requirements is 
to date
the records manager or equivalent position.
assigned to the Records Manager.
1/06/2011 2:56 PM
Page
14 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

RATING CHANGE:
Intentions to Progress changed to 
'completed'.
2
Staff training is assigned to the appropriate  Operational
Staff training is assigned by the 
Completed and up  All
Completed
trainer by the Records Manager (or 
Records Manager to the appropriate 
to date
equivalent).
trainer: inductions devolved to 
Business Unit Managers include 
recordkeeping responsibilities, 
specialist training conducted by 
Records Manager and other training 
outsourced by the Records Manager 
to specialist providers where 
appropriate (Disaster Recovery 
Training).
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
3
A recordkeeping training plan is 
Operational
Training is embedded into all 
Completed - some  All
Plans in place
implemented and maintained.
recordkeeping projects, and a training  out of date
plan is included in the recordkeeping 
operational plan, with workstream 
initiatives over a three year period. 
Staff inductions that include 
recordkeeping responsibilities are in 
1/06/2011 2:56 PM
Page
15 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

place for every contractor and 
permanent staff member and are the 
responsibility of the Business Unit 
Manager. Inductions are monitored 
through a completion checklist. Plans 
are in place to develop a Strategic 
Capability Plan.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
4
Staff receive recordkeeping training in:
Operational
Training is embedded into all 
Completed - some  All
Plans in place
• policies, procedures and practices  
recordkeeping projects, and a training  out of date
• organisation specific tools and systems 
plan is included in the recordkeeping 
• relevant legislation and standards.
operational plan, with workstream 
initiatives over a three year period. 
Staff inductions that include 
recordkeeping responsibilities are in 
place for every contractor and 
permanent staff member and are the 
responsibility of the Business Unit 
Manager. Inductions are monitored 
through a completion checklist. Plans 
are in place to develop a Strategic 
Capability Plan.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
1/06/2011 2:56 PM
Page
16 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Recordkeeping training and skills are 
Operational
Review of recordkeeping training is an  Approved - but 
All
Plans in place
regularly reviewed.
area for future focus - plans are in 
not yet started
place to implement a Strategic 
Capability Plan that will encompass 
the monitoring and review of training.
RATING CHANGE:
Coverage changed to 'all'.
2
Assigned staff are trained in emergency 
Operational
The Records Manager and Special 
Completed - some  All
Plans in place
procedures to protect and salvage records.
Collections Librarian have both 
out of date
attended specialist disaster recovery 
training. Plans are in place to train 
one staff member for each key 
physical storage area.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
17 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Reporting
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Monitoring and reporting of recordkeeping 
Reporting
Detailed reporting against the 
Completed and up  All
Completed
requirements are defined and documented.
recordkeeping operational plan occurs  to date
at Recordkeeping Steering Group 
meetings on a quarterly basis. The 
operational plan identifies and 
documents recordkeeping monitoring 
requirements. Physical records are 
monitored through control sheets on 
the door of every storage room. A self 
assessment against the PRA occurs 
every six months.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
Monitoring and reporting of recordkeeping 
Reporting
Findings support ratings.
Completed and up  All
Completed
practices is assigned to the records 
to date
manager (or equivalent).
1/06/2011 2:56 PM
Page
18 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Reviews of recordkeeping practices are 
Reporting
Reviews of recordkeeping practices 
Completed and up  All
Completed
undertaken and reported to senior 
are undertaken and reported to senior  to date
management.
management on a quarterly basis.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
Recordkeeping monitoring reports are 
Reporting
Recordkeeping at Victoria University 
Completed - some  Most
Plans in place
distributed to line managers and actioned.
takes place within a devolved 
out of date
structure. Business Unit Managers 
take responsibility for the day to day 
management of their records. The 
Records Manager's role is policy 
development, awareness raising and 
education. Currently Business Unit 
Managers do not report on 
recordkeeping practices on a regular 
basis, however a major 
Recordkeeping Survey Project is 
currently underway. This survey 
allows the Records Manager to 
understand the level of maturity and 
characteristics of each business unit. 
Actions resulting from the survey are 
1/06/2011 2:56 PM
Page
19 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

developed and agreed with line 
managers. Plans are in place for an 
EDRMS - this will allow a more 
granular level of reporting.
RATING CHANGE:
Coverage changed to 'most'.
3
Managers are accountable for 
Reporting
The recordkeeping policy includes a 
Under way
All
Plans in place
recordkeeping objectives being met and 
delegation model that holds managers 
ensuring performance levels are reported.
accountable for recordkeeping 
objectives being met and reporting 
performance levels. Plans are in place 
to build these requirements into the 
recordkeeping life cycle. Plans are in 
place to develop a Training and 
Capability Plan that will also address 
this. These plans are university wide.
RATING CHANGE:
Progress changed to 'under way'.
Coverage changed to 'all'.
4
Creation and capture of records (including 
Compliance
Plans are in place to institute an 
Under way
All
Plans in place
associated metadata assigned manually) is 
EDRMS that will allow the monitoring 
routinely monitored and corrective action 
of the creation and capture of records.
taken.
RATING CHANGE:
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
20 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
The public office undertakes a systematic 
Operational
Findings support ratings.
Completed and up  All
Completed
assessment of their recordkeeping 
to date
capability.
1/06/2011 2:56 PM
Page
21 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Specific Recordkeeping Practice
Creation and capture
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Business processes and functions are 
Compliance
The Records Manager is training 
Completed - some  All
Plans in place
reviewed and analysed to map 
Business Analysts to ensure business  out of date
recordkeeping requirements.
processes and functions include 
recordkeeping requirements. Critical 
systems have been mapped to 
recordkeeping requirements.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
2
Records of all business activities are 
Compliance
Records of all business activities are 
Completed and up  All
Plans in place
systematically and consistently created in a 
systematically and consistently 
to date
records management system.
created in a wide range of records 
management systems that include 
structured and unstructured electronic 
systems and hard copy systems. An 
organisation wide records survey has 
identified all systems.
1/06/2011 2:56 PM
Page
22 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Physical and electronic records are 
Compliance
Plans are in place to institute an 
Completed - some  All
Plans in place
captured routinely in a way which meets the 
EDRMS that will capture records 
out of date
public office's business requirements.
consistently and create greater 
consistency around version control 
and naming conventions for 
documents.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
2
Decisions around the application of 
Operational
All critical business systems have 
Completed - some  All
Plans in place
minimum point of capture and process 
been mapped to the metadata 
out of date
metadata have been documented.
standard. Plans are in place to ensure 
all new systems are designed with 
recordkeeping requirements taken 
into account.
RATING CHANGE:
1/06/2011 2:56 PM
Page
23 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
3
Recordkeeping metadata schema and 
Operational
An organisation wide classification 
Under way
All
Plans in place
schemes are documented, communicated, 
scheme has been developed. The 
maintained and reviewed to reflect 
schema has been verified as part of 
business activities and structure.
the Records Survey Project. 
Organisation wide consultation will be 
undertaken.
RATING CHANGE:
Coverage changed to 'all'.
4
All records are documented and organised  Operational
All records are organised according to  Completed - some  All
Plans in place
according to a classification scheme.
classification schemes in various 
out of date
recordkeeping systems. Plans are in 
place to consolidate these into an 
EDRMS system where appropriate.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Critical business systems/applications have  Strategic
Critical business systems/applications  Completed and up  All
Completed
1/06/2011 2:56 PM
Page
24 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

been identified and mapped to the 
have been identified and mapped to 
to date
recordkeeping metadata schema.
the recordkeeping metadata schema 
in a recent "Metadata Standard 
Mapping" exercise.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
The business classification scheme is 
Strategic
An organisation wide classification 
Completed - some  All
Plans in place
routinely reviewed for relevance.
scheme has been developed. The 
out of date
schema has been verified as part of 
the Records Survey Project. 
Organisation wide consultation will be 
undertaken.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
3
Disposal authorities linked to the business 
Strategic
All disposal authorities have been 
Completed and up  All
Completed
classification scheme to enable record 
linked to the business classification 
to date
sentencing at time of creation.
scheme.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
1/06/2011 2:56 PM
Page
25 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
1/06/2011 2:56 PM
Page
26 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Retrievability and security
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Accessibility, usability, retrievability and 
Operational
Accessibility, usability, retrievability 
Completed and up  All
Completed
retention of records is managed within the 
and retention of records is managed 
to date
recordkeeping system.
within the  recordkeeping systems 
used by Victoria University. Physical 
systems include finding aids, indices 
and clear labelling. Electronic systems 
have agreed structures and defined 
metadata to manage and locate 
records.  
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Recordkeeping systems and storage 
Strategic
Plans to complete protection of 
Completed - some  All
Plans in place
facilities for physical records are protected 
physical records and storage facilities  out of date
1/06/2011 2:56 PM
Page
27 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

from unauthorised access, destruction, 
are almost completed. The 
theft, fire, flood, earthquake, volcanic 
development of a Disaster Recovery 
eruption and vermin.
Programme and the removal of some 
records from inappropriate storage 
areas will complete these plans.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
2
Sensitive and restricted records are 
Compliance
All sensitive and restricted records are  Completed and up  Most
Completed
identified, documented and controlled.
identified and documented. The 
to date
implementation of an EDRMS will 
ensure all sensitive records are also 
controlled in all cases.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'most'.
Intentions to Progress changed to 
'completed'.
3
Access to sensitive and restricted records 
Compliance
Plans are in place to build sensitive 
Completed - some  All
Plans in place
is provided in accordance with the:
and restricted records into the 
out of date
- Official Information Act
recordkeeping policy.
- Privacy Act
- Security in Government Sector (SIGS) 
RATING CHANGE:
Manual
Coverage changed to 'all'.
- Technical Specifications for the Electronic 
1/06/2011 2:56 PM
Page
28 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

Recordkeeping Metadata Standard
4
The access status of public records over 25  Strategic
Records over 25 years old are 
Completed - some  All
Plans in place
years of age is determined according to 
identified as part of the Records 
out of date
Archives New Zealand's Access Standard 
Survey Project in a "Legacy Records 
and registered with Archives New Zealand.
Register". Plans are in place to 
register these with Archives.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
The ability to locate records is monitored 
Operational
Plans are in place to develop internal  Under way
All
Plans in place
and routinely audited.
Quality Assurance processes around 
the ability to locate records.
RATING CHANGE:
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
29 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Maintenance and storage
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
All records (regardless of format or media 
Operational
Electronic backups effectively ensure  Completed - some  All
Plans in place
and including recordkeeping metadata) are 
that electronic records cannot be 
out of date
managed so they cannot be altered or 
altered or deleted. The Shared Drive 
deleted without permission.
Security Policy informs staff of their 
responsibilities. Plans are in place for 
an EDRMS which will manage this 
more consistently. Physical storage 
rooms are managed through an 
Access Standard. 
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
2
Records contain both content and 
Strategic
Business systems, shared drives and  Completed - some  All
Plans in place
contextual information to ensure that a link 
physical systems all contain 
out of date
to the applicable business activity is 
contextual information to ensure a link 
maintained.
to business activity is maintained. 
Plans are in place for an EDRMS 
which will manage this more 
consistently.
RATING CHANGE:
Progress changed to 'completed - 
1/06/2011 2:56 PM
Page
30 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

some out of date'.
Coverage changed to 'all'.
3
A risk-based assessment of records 
Strategic
A risk-based assessment of the nine 
Completed and up  Most
Completed
storage has been undertaken to ensure 
major records storage areas at 
to date
records are stored appropriately.
Victoria University  has been 
undertaken to ensure records are 
stored appropriately. This assessment 
identified several areas for 
improvement. The Records Manager 
has developed a plan to address 
these areas and the plan is now in 
progress.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Intentions to progress changed to 
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Records are reviewed/appraised and 
Strategic
Project to ensure all records storage 
Completed - some  All
Plans in place
stored in accordance with their value and 
areas comply with Storage Standard 
out of date
security needs.
is almost complete, needing only the 
completion of Disaster Recovery 
Plans and the removal of some final 
1/06/2011 2:56 PM
Page
31 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

records from areas already identified 
as inappropriate to long term storage.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
A storage plan must be in place if physical 
Strategic
A Storage Plan is in place.
Completed and up  All
Completed
records of archival value over 25 years of 
to date
age are retained.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
Storage plan must meet the requirements 
Strategic
The Storage Plan meets the 
Completed and up  All
Completed
of the Storage Standard applicable to 
requirements of the storage standard. to date
archival records and inactive records of 
archival value.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
1/06/2011 2:56 PM
Page
32 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

'completed'.
1/06/2011 2:56 PM
Page
33 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Disposal and transfer
Initiation
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Core functional records and associated 
Compliance
Core functional records and 
Completed and up  All
Completed
metadata are appraised and disposal 
associated metadata are appraised 
to date
authorities agreed.
and disposal authorities are agreed. 
Processes cover disposal of records.
RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
Establishment
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
Disposal authorities are applied to classes 
Compliance
Disposal authorities are mapped to 
Completed and up  All
Completed
or groups of records within the 
the classification scheme and applied  to date
recordkeeping framework.
to physical and electronic records. 
Currently disposal authorities are 
applied to electronic records on a 
manual basis. Reporting on disposal 
occurs on a quarterly basis.
1/06/2011 2:56 PM
Page
34 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

RATING CHANGE:
Progress changed to 'completed and 
up to date'.
Coverage changed to 'all'.
Intentions to Progress changed to 
'completed'.
2
Procedures are in place to manage 
Compliance
Procedures to manage records 
Completed and up  All
Completed
disposal of records when no longer needed 
disposal are in place and available on  to date
for business use as per the authorised 
the intranet.
retention and disposal schedule.
RATING CHANGE:
Intentions to Progress changed to 
'completed'.
3
Deferral agreements are in place for 
Compliance
Findings support ratings.
Completed and up  All
Completed
records over 25 years of age which are still 
to date
required by the public office.
4
Minimum recordkeeping metadata as 
Compliance
'Records Destruction Authority' forms  Completed - some  All
Plans in place
defined in the Electronic Recordkeeping 
retain  minimum recordkeeping 
out of date
Metadata Standard is retained after 
metadata. Plans are in place for an 
disposal action for as long as required.
EDRMS which will manage the 
retention of minimum recordkeeping 
metadata automatically.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
35 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
Capability
Question
Risk
Audit Findings
Progress
Coverage
Intentions to 
Progress

1
The public office's disposal programme is 
Compliance
Monitoring and review occurs on a 
Completed and up  All
Completed
monitored and reviewed.
quarterly basis.
to date
RATING CHANGE:
Intentions to Progress changed to 
'completed'.
2
Regular and efficient records disposal 
Operational
Disposal procedures are in place for 
Completed - some  All
Plans in place
occurs as part of the public office's 
physical and electronic records. 
out of date
recordkeeping framework.
Disposal of electronic records 
happens manually. This process will 
be automated - plans are in place to 
develop an EDRMS system.
RATING CHANGE:
Progress changed to 'completed - 
some out of date'.
Coverage changed to 'all'.
1/06/2011 2:56 PM
Page
36 of 37

Audit Findings Report of Victoria University of Wellington
Year 2010/2011
RISKS
Compliance
Operational

Failure to meet legislative and regulatory requirements

Inability to transfer data across organisational systems

Unlawful disposal of records

Inability to deliver services due to the loss of information

Inability to provide assurance of legislative compliance

Inability to retrieve and interpret records in obsolete formats or systems

Inability to provide records or provide evidence

Information is inaccessible or unsuitable for the conduct of business

Inability to provide a record of specific transactions
Reporting

Inconsistent, ineffective and inefficient conduct of business

Inability to provide reliable evidence summarising activities or undertakings
Reputation

Reduced capability to demonstrate good performance

Misleading the minister or other key stakeholders

Embarrassment to the chief executive, minister, the government and individuals

Damage to reputation, loss of credibility, lowered public confidence
Strategic

Loss of records which support New Zealand’s cultural and national identity

Poor strategic planning and poor decisions made on inaccurate information

Inability to use organisational information and knowledge to full potential

Constrained business and information management strategies

Inability to automate processes and to secure efficiency benefits
1/06/2011 2:56 PM
Page
37 of 37