Adequate people numbers with appropriate training to enable the
Enterprise Deep Dive: Recruitment
Environmental
carefully designed electoral processes are a key requirement for
30 June 23
driver description
running a successful high integrity election.
Failure to recruit will impair trust in
Trend: less available staff.
Low or inappropriate staffing in each electorate
Public awareness of
EC’s capability to deliver elections
Unemployment: 3.4%; 102,000.
reduces ability to run voting efficiently. This
available work.
Key factors
ing
1. Is the EC appropriately prepared
could result in insufficient voting places or
What is the
Internal requirements: Number roles
How may
Creating contingency by
for and responsive to the tight
queues which disincentivises potential voters,
required to be recruited ~25,000,
that
Key
sh
xte
recruiting more than we
risk that the
t
employment market?
16,000 VS, 4,000 processing,
this risk or reduces turnout, which can undermine EC and
influence our
data
need.
board
2. Is EC staffed to deliver what is
electoral system reputation.
2,000 other.
issue
success in
abli
needed?
specifically
13 electorates of concern for low
We need to address decreased worker
Timely and appropriate
t
impact us?
this space
3. How is EC placed for and
actions at different
s
Con
recruitment from 2020
availability nationally and the gap that
need to be
(internal and
E
welcoming to employees
historically, election staff and our workforce
periods of the election
concerned
144 permanent staff (39 vacancies)
representative of the
demographic have not been representative of
external)
campaign.
about?
(this informs central capability to
communities they work in?
the NZ population.
support GE and temp staff)
Reducing attrition
Staff involved: P&C, Comms, VSs: regional and
Staff involved: P&C, VSs: regional and electorate
Staff involved: P&C, VSs, business enablement
electorate managers; community engagement
Key area 1
managers; governance: programme board
Key area 2
and Community Engagement (relationships with
Key area 3
Considered: known challenge areas, and
Considered: known challenge areas, timelines required to
partners).
ies
potential staff
mobilise contingencies and train staff
Considered: timeframes for successful resourcing
it Reaching
Contingency
Goals: reach as many people as possible, and
Monitor/
Goals: know when to trigger planned proactive
and training of appropriate staff
potential staff
target outreach in electorate areas of concern;
respond to
interventions, field supported/ responsive to learnings
Goals: EC is able to take additional actions to
for GE
increase representative employment
ensure on
Activities:
Targeted
ensure needed electorate and VP staff in place
activ
Activities:
-
Monitor the progress of recruitment campaigns in real-
Activities:
track for GE
and public
Parts of business / -
Multifaceted advertising approach
time, closely tracking application numbers against
recruitment
-
Detective controls – monitoring
sector co-
on project involved,
- General national comms
targets Including number of applicants received/ hires,
-
Planning the public sector contingent
ordinated
what they have
- Targeted areas (plans, regional
by roles/ electorate.
mobilisation
issi considered, and
partners, voting place approach)
-
regular analysis to identify trends, gaps, and areas
action
-
Compensating controls include over recruiting
the goals they wish
- Targeted groups (plans ,regional
requiring additional focus.
where able to, to transport staff around
to realise.
partners, translations, hui)
-
Information sharing so field can get support/share
regions,
Summarise key
-
Working with other organisations including
challenges and how best to manage.
Next steps:
activities being
-
Recruitment dashboard live early July
Comm
councils, MSD, other government channels.
-
Deliver planned proactive interventions where needed
undertaken to
-
Addressing misconceptions (including that
based on updates (extra support P&C, C&E)
-
Progressing cross government planning on
prepare, address
GE work is unpaid)
-
Working with other organisations including councils,
contingency mobilisation – conversation with
or respond.
MSD, other Government agencies
public sector CEs
Board visibility of previous relevant items
How does
Programme board govern key risks and are actively
July field and numeric monitoring will prompt
has been through:
managing and monitoring
management
proactive interventions in low recruitment areas,
- Programme updates
this will be focused on those tracking lowest on
What visibility
monitor and
- recruitment and associated planning
- Community engagement updates
What key
recruitment.
has the Board
maintain
- Related programmes of work including community
information
engagement and the GE comms strategy contain
oring had of key
confidence in
Low applications and hiring will be considered.
or
it
This month’s programme update includes
programmes
projects which are part of our wider recruitment
these areas?
the draft recruitment dashboard.
push
milestones
and how the
How is
Public sector mobilisation test will be early
Running a dashboard on GE recruitments against
will trigger
August – required as training is mid- Sept.
Mon risk is being
Forthcoming items:
success
target.
action?
dealt with?
- Plan in response to Archives NZ Audit,
monitored?
Field governance – weekly regional managers
Key metrics: 45,000 applications overall
timing tbc
What is the
recruitment update.
considered indicative of meeting overall staff
trend?
needs.
,
Overall, this risk is of both high visibility and has a highly developed networked response within the Commission. Staff have approached the challenge in an innovative and connected manner and considered
w
external issues. Some pieces of work require clarity on resourcing (public sector mobilisation plan – this is being actively managed).
e
We will know early in August we are on track, with 45,000 applicants considered a key indicator on if we will get the overall number we need.
vi
gaps? Assurance
Gap on clarity at this time if planned proactive interventions resourced, or if support being provided in known challenge areas is adequate/ proactively being resourced (Northland, Whangārei, etc – what
er
y assessment extra resource to support those areas?)
Present recruitment for customer service and community engagement staff is tracking well, which is a positive indicator. However, Dunedin monocultural response, and Central NI low applications.
How Public Sector Chief Execs respond will be key to developing a confident recruitment contingency plan. On 4/7/23 Karl had a very positive conversation to progress the mobilisation work w 1
Ov
an
ith Justice
which increases our overall confidence that the public sector mobilisation failsafe is on track.
Enterprise Deep Dive: Privacy and
Environmental
This is a highly regulated area. Core risks/ opportunities to
30 June 23
Information Management
manage include confidentiality of data about persons, integrity of
driver description
and appropriate availability of data/ information to support
business goals.
1. How do we know that the data
7 reports and 3 public complaints in
Key system design
Potential of election integrity impact if core
in our systems has integrity, and
FY – no significant breaches.
systems not secure.
Key factors
Staff behaviours and
ing
that our systems will maintain
Reviews have demonstrated need for
Inappropriate or unlawful data/information
appropriate
What is the
this integrity as it is reshaped as
work on both privacy and information
How may
that
Key
collection or management leads to reputational
sh
xte
preventative, deterrent
risk that the
t
information?
management.
this risk or damage, legal financial penalties.
influence our
data
and directive controls
board
2. Are we appropriately enabling
Reviews identify that not all systems
issue
Inaccessibility of data/info leads to loss of
success in
abli
consistent, efficient, well-
Emerging risk
specifically
which look to require them have had
this space
t
institutional knowledge or operational issues.
impact us?
informed work across the EC?
awareness and ability to
s
Con need to be
Privacy impact assessments (privacy
Insufficient security posture (including shadow
(internal and
3. Are our systems protecting the
respond
E
concerned
programme planning being resourced).
IT, unmonitored personal device use) leads to a
external)
information we hold on
Plan being developed in reply to Public
data or privacy breach.
Ability of our data
about?
individuals?
Records Act audit.
Staff involved: IT, Data and insights, P&C (compliance/ core
Staff involved: IT /data/ privacy officer, all
Key area 1
Staff involved: IT, Data and insights, privacy officer.
Key area 3
training); privacy officer. All staff for institutional knowledge,
Key area 2
Management responsible for relevant detect information
staff for implications in their work areas.
activities/ training etc.
controls in their areas. All staff for being alert to/ reporting
Considered: potential harm, expectations
ies Preventions + Considered: appropriate systems for business purposes, how to
privacy/IM issues. Key 3rd parties, IE telnet and IT system
Detect /
of the impacted, incl timeliness of
Ability to
it
inform staff of behaviours to manage risks, and controls to
directions to
providers.
response, communications, Māori data
respond to,
prevent issues.
correct
Considered: potential identification/ monitoring and reporting
sovereignty
support
Goals: Appropriate policies, controls and behaviours to support
controls for and application controls
recover from Goals: EC can appropriately manage and
activ IM/privacy
IM/privacy goals
Goals: EC aims to identify risks and issues and take corrective
privacy and
and resolve respond to IM and privacy issues.
Activities:
action before harm is caused
IM
Activities:
IM and
-
Have in line processes, IE IT issues log
on
-
IM and privacy policies and procedures
Activities:
Parts of business /
privacy
-
Key systems designed and tested for data integrity, secured
-
Assess our systems via annual PSR/Chief Archivist annual
system (wording?)
project involved,
access, (Electoral systems, data and enterprise systems, etc)
record keeping survey/ 5yrly PS Records Act audit
issues
-
May inconsistency in Te Kauhangaroa
issi what they have
-
New systems have PIAs done
*response to 2023 audit being developed.
data versus MIKE demonstrated
considered, and the
-
Field and core staff trained (privacy, + security, including
-
Detect controls for unauthorised access to our information,
system ability to identify and respond
goals they wish to
security of information)
flagging attempted access
Next steps:
realise. Summarise
-
New Te Kauhangaroa system improves availability of data +
-
Our normal reporting lines/ governance covers privacy/
New issues management approach.
key activities being
Comm
privacy protections
undertaken to
RM issues, so we have reporting channels for IM and
Any suggestions as part of work of new IM
prepare, address or
Next: new IM staff – Plan being developed in response to Public
privacy, incl IT service desk, and contact to our privacy
staff member
respond.
Records Act audit, privacy work programme is under
officer.
Potential privacy secondee or provider
development.
-
Information Systems Strategy for next steps
from AoG panel
Board have received verbal updates on privacy as part of GE
How does
Governance:
Action is triggered via a combination of
programme updates.
Privacy
management
normal business continuous
What key
What visibility Other relevant updates include:
-
Privacy officer in place with appropriate reactive reporting
improvement processes and incident
information
General updates on IT and cybersecurity, and forward
monitor and
has the Board
and PSR annual review and reporting.
response. Note the detection and
planning., including the
maintain
or
had of key
-
GE Programme board on PIA applications
response controls noted above.
oring
22.09-01 - IT strategy update.docx
Information management.
confidence in
milestones Additionally, self-assessment processes
programmes
it
Te Kauhangaroa updates*
-
Data governance group, reports to ELT.
these areas?
and audits, or best practice sector advice
will trigger
and how the
-
Enterprise systems including telnet, monitored by ELT, with
may trigger improvement activity i.e.
How is
action?
risk is being
very regular updates.
public service records act audit, PSR
Mon
Items to come:
success
reviews, etc.
dealt with?
Other key controls
Comply with survey and privacy report for FY 22-23 in line
Te Kauhangaroa now has data integrity dashboard for
monitored?
Next steps
with financial year-end
monitoring consistency with MIKE.
What is the
Action plans in response to reviews in
Action plan following Public Records Act audit
NOTE: Te Kauhangaroa assurance review also coming in July
presently underway, as is assurance in
Continued updates as part of the GE programme
trend?
2023
response to a recent issue.
,
Reviews have identified a number of areas where further work is required as relates to understanding our system-based privacy and information management risks.
w
Whilst EC staff create maintain and access information for a variety of business purposes, there isn’t uniform understanding and approach to IM and privacy and EC don’t have an agreed ongoing
e
assurance approach. There are some known gaps, such as not all systems and processes having current privacy impact assessments, the lack of consistent staff practices around information
vi
Assurance
management policy and the lack of a data retention and disposal plan. These gaps are compliance issues, and a real challenge where they materialise as the EC not being able to access data held for
gaps? assessment operational purposes.
er
y
Resourcing and planning is presently in train. An IM specialist has been hired to address key IM gaps. Management is presently considering bringing on privacy resources.
2
Ov
an
Significant improvements can be observed in the accessibility, use, and the privacy of information held and used by the commission in the new-this-year data platform Te Kauhangaroa and the data
and insights programme which is steadily improving access to information held by the EC significantly.
Enterprise Deep Dive: Disruptive events
Environmental
Disruptive events range from facility issues (fire or utilities),
30 June 23
at voting places
driver description
behaviours which impact on staff or voters, through targeted
criminal or violent activities which prevent a voting place from
operating efficiently, safely, and with electoral process integrity
Failure to prepare for disruptive
Similar events (Census) have had increased
Lack of appropriate preparedness to
Understanding the risk
events may impair trust in the
disruption.
identify, prevent, or detect and respond to a
Key factors
environment and appropriate
electoral process. Has the EC (and
Global trend for increased societal division
variety of potential events, or to prepare so
that
preparations.
ing
What is
staff and voting places are equipped to
delivery partners):
and disruption.
How may
influence
Public understanding of and
Key
sh
xte the risk
reasonably manage disruption, could result
1. Connected to right external
Increase / variation in voting place sites
this risk or
our success voting place rules.
t that the
data
in:
agencies to respond to events?
(~2370 election day sites planned, without
issue
in this space Voting place staff knowing &
- Health and safety implications.
Board
2. Prepared staff, processes and
social distancing required, this is less than
invested in what they need to
(internal
abli
impact
- Potential voters being deterred from voting
t
specifically
facilities to minimise likelihood
2020.
us?
do.
and
s
Con
- The trust of election processes being
need to be
and impact of events?
Voting places incl alternative channels for
Right connections/ ability to
E
impacted, potentially also impacting New
external)
3. Put appropriate contingencies in
voting, IE phone.
flow information should events
concerned
Zealand’s reputation for electoral integrity
Uplift in security preparedness incl regional
place to minimise harm?
occur. Ability to provide/ direct
about?
security advisors.
support where needed
Staff involved: CEA and security, regional
Staff involved: Voting Services, regional security advisors,
Staff involved: VSs, Voting place staff; security, and
security advisors, security risk group* external
CEA and security, ES – BCP and incident management.
Key area 2
escalation channels.
Key area 3
Key area 1
partners incl DPMC, Police, security agencies
Considered: full range of potential disruptions, process
Considered: safety and electoral integrity .
design in ops manual and protocols to mobilise.
Goals: Ensure we know information will flow
ies
NEMA, and FENZ.
Cross security
Internally
Election day
it
Considered: system roles and responsibilities,
Goals: have prepared for disruption and considered
appropriately, and staff have access to what they need
sector
prepared for
ability to
information channels, and processes to share
disruption risk in the design of election processes.
to respond / trigger system support.
connections +
range of
information, prepare or act.
Activities: Incident Management handbook for field
act/respond Activities: Escalation & comms channels in dev
information
Goals: Enable appropriate preventative,
disruption
-
Staffed to support regional risk understanding, analysis
appropriately - BCP, incident management guidance, and election
activ channels
detective corrective and responsive action.
and implementation of controls which will help minimise
while
day information channels presently in development –
Activities: -Cross sector group including
potential disruptive events/ impacts.
maintaining
on track. Includes escalation channel to political
on Parts of business / relevant system players, enabling co-
-
Range of prevention controls in place including physical
trust
parties where acts of parties may result in disruption.
project involved,
ordinated and aligned preparation for election
protective security, staffing strategy at VPs, HR
-
Partner agencies – see key area 1.
issi what they have
security threats.
screening, supplier arrangements, and emergency
-
Guidance to public on rules once voting starts.
considered, and
-
Agreed/ing protocols response to an event.
preparedness. Response guidance in development plans
-
VP staff will have tools to help them identify, act, &
the goals they wish - Information sharing and common.
includes voting place safety and security site standards.
escalate should events occur (Training /handbook/
to realise.
operational response support structure
-
Review of election process/ activities to identify and
staffing levels controls planned/ in place).
Summarise key
Comm activities being
during event.
mitigate potential control gaps in design.
-
Controls/ steps anticipated to support electoral
undertaken to
-
Implementation and testing of controls to
-
Election delivery taskforce to triage issues set up,
integrity /safety also include external visibility of key
prepare, address or
include July table-top exercises for weather
Incident management planning approach developed.
processes, dedicated regional security resources.
respond.
and disruptive events.
The Board have received regular verbal
How does
Overall preparedness is trending upwards against prior EC security
Information shared from partners.
What visibility
security updates and have met with security
and emergency preparedness, but the risks are known to have
General escalation management lines, BCP
management
has the Board
agency CEs to understand cross sector
increased.
What key
monitor and
protocols, and to be agreed election event/risk
activity.
had of key
Risk & security WG govern system protocols
information
maintain
escalation processes will enable appropriate
ELT / programme board regularly hear about relevant topics
or
management of disruptive events up to and
oring programmes Forthcoming:
confidence in including:
milestones during GE23, incl where appropriate prompting
it and how the
-
August/ Sept security readiness update
these areas?
risk is being
- Trust and Security programme
will trigger
formal incident management.
-
August – Business continuity planning,
How is
- Guidance, including handbooks for event occurrences, voting place
July tabletop exercises should test our incident/
dealt with?
action?
Incident management guidance and
success
set up, etc
risk escalation channels including with our
Mon
scenarios will come to the board.
monitored?
- Staff training
partners.
What is the
- Monitoring of security / any incidents are also reported through
Milestones/ information which will trigger action
operational channels, w/ security doing trend monitoring.
trend?
to be confirmed in testing/ simulations.
- Election delivery taskforce daily triage, and IM plan/ team prepped.
,
It is inevitable that there will be disruptive events during the election, not just because polarisation, civil and criminal disruption is on the rise globally and domestically.
w
The Commission and key partners have scaled up activity and devoted staff on the analysis, understanding of preparedness, and preventions, plus the ability to detect, prepare for and respond to
iev
disruption. It is no longer enough to do a good job; we need to control the narrative about the operation of the electoral event. Our preparedness to respond to disinformation is pivotal.
gaps? Assurance Deep understanding and risk focused prioritisation is indicated by recent exercises reviewing internal controls for disruptive events identifying those in place, in development, and either unknown or not in
er
y assessment place status. Whilst some improvement areas have been identified, overall, the increase in BCP, IM, and the reporting and communication lines being implemented look pragmatic and likely effective to
respond to most potential incidents. Whilst preparations are wide ranging, sharing solutions to potential challenges, and how efficiently and effectively staff respond in the moment will be 3
Ov
key to how our
an
success with anticipated disruptions, including black swan events.
Document Outline
