Dear National Disability Insurance Agency,

Please provide a copy of the NDIA Document Storage, Archive and Retrieval Policy and Procedure. That is, the specific NDIA policy and procedure for the capture, recording, storage, archiving and retrieval of public information and documents as a Commonwealth Agency.

Context:

“Information management standards help Australian Government agencies to create and manage business information effectively. Know which standards apply to your agency and how to implement them” [4] so as to build trust in public record keeping. More specifically, “The Building trust in the public record: managing information and data for government and community policy came into effect on 1 January 2021. The policy identifies key requirements for managing Australian Government information assets (records, information and data). It helps Australian Government agencies improve how they create, collect, manage and are able to use information assets. The Australian Government relies on well-managed information to better support, protect and serve the community” [5]. All of which seem aimed at “reducing areas of information management inefficiency and risk” [6], especially where cloud, storage and retainment issues are concerned [7] or transferred to National Archives.

The National Archives Act seemingly specifies the information record storage and retention requirements for Commonwealth entities [1]. The Information Management Standard for Australian Government [2] provides further specific guidance (including citing the National Archives Act 1983) on well-managed business information with Government. In particular, 8 guiding principles. They are:

1. Business information is systematically governed
2. Necessary business information is created
3. Business information is adequately described
4. Business information is suitably stored and preserved
5. How long business information should be kept is known
6. Business information is accountably destroyed or transferred
7. Business information is saved in systems where it can be appropriately managed
8. Business information is available for use and reuse [3]

In short, there seems to be a significant emphasis and requirement for Commonwealth entities to effectively store, archive and retrieve public information, data and documents. The Office of the Australian Information Commissioner (OAIC) has also provides specific advice to ensure information and risks have been adequately mitigated [8]. This would also seem to have been significantly emphasised by the National Archives too [9], especially when it come to metadata. IN sum, there is a significant information governance framework [10], supported but a suite of international standards such as ISO 16175 - Process and Functional Requirements for Managing Records and ISO 15489 Records Management [11]. ISO 15489 in particular relates to “a) records, metadata for records and records systems; b) policies, assigned responsibilities, monitoring and training supporting the effective management of records; c) recurrent analysis of business context and the identification of records requirements; d) records controls; e) processes for creating, capturing and managing records.” [12]. Overall, there seems to be a clear, consistent emphasis on effective and efficient storage and retrieval of Government documents and information.

As part for the Data Interoperability Maturity Model [13] , the National Archives of Australia asserts that “All Australian Government agencies should have assigned responsibilities at a senior executive level for a CIGO to support enterprise-wide information governance. A dedicated role for senior executive represents a best practice approach“ [14]. It would therefore stand to reason that the NDIA has both a CIGO and supporting policies and procedures. Which forms the focus of this request. In particular, to understand why a relatively simple public document retrieval request, taking no more than a few minutes to complete in most other Government Agencies or private corporations, would take the NDIA longer than 30 days to complete. For example:

1. FOI 20/21-0856 NDIA Risk assessment for the Independent Assessments (IA) pilot [17]
2. FOI 20/21-0854 NDIA’s current Risk Management Policy/ies and Procedures and Procurement Risk Management Policy/procedures
3. FOI 20/21-0853 NDIA’s current Investigations Policy/ies and Procedures [20]
4. FOI 20/21-08551 NDIA’s Pandemic/epidemic risk assessment for NSW and VIC [19]
5. FOI 20/21-0848 NDIA’s Pandemic Plan for NSW and VIC [18]
6. FOI 20/21-0843 NDIA’s Risk Management Framework, Audit/Risk Committee Minutes of Meeting, Risk Management Declaration and Risk Management Strategies [22]
7. FOI 20/21-0879 NDIA Project Risk Management Framework, Fraud Risk Assessment, Risk Maturity Level 4 and Risk Champion training [15]
8. FOI 20/21-0882 NDIA Enterprise Risk Management Framework, NDIA Risk Management Strategy approved by COAG [21]
9. FOI 20/21-0885 NDIA Insurance Principles and Strategic Risks
11. FOI 20/21-0877 NDIA Annual and Quarterly Attestation Reports [16]

While consistent with the very broad FOI 30 day extension request [23], 30 days seems more than ample to find and release an electronic public document. In short, an extension seems largely unnecessary. As a result, the NDIA document storage, archive and retrieval policy and procedure will go a long way to informing and clarifying the process.

Thank you for your assistance.

Yours faithfully,

Shirley

References:

1. Archives Act 1983 (2021) Compilation No. 43. Available at: , https://www.legislation.gov.au/Details/C...> Accessed [8 Jul 21]
2. National Archives of Australia (2021) Information Management Standard for Australian Government, Australian Government, Available at: <https://www.naa.gov.au/information-manag...>. Accessed [8 Jul 21]
3. Ibid
4. National Archives of Australia (2021) Information Management Standard, Available at: < https://www.naa.gov.au/information-manag...>. Accessed [8 Jul 21]
5. National Archives of Australia (2021) Building trust in the public record policy, Available at: < https://www.naa.gov.au/information-manag... >. Accessed [8 Jul 21]
6. National Archives of Australia (2021) Building trust in the public record policy: Managing information and data for government and community, Available at: <https://www.naa.gov.au/sites/default/fil...> Accessed {8 Jul 21]
7. Ibid, Page 7 & 11
8. OAIC (2018) Guide to Security Personal Information, Office of the Australian Information Commissioner, Australian Government, Available at: < https://www.oaic.gov.au/privacy/guidance...>. Accessed [8 Jul 21]
9. NAA (2015) Australian Government Record-keeping Metadata Standard, National Archives of Australia, Australian Government, Available at: <https://www.naa.gov.au/sites/default/fil...>. Accessed [ 8 Jul 21]
10. National Archives of Australia (2021) Establishing an information governance framework, Australian Government, Available at: <https://www.naa.gov.au/information-manag...>. Accessed [ 8 Jul 21]
11. Ibid
12. ISO 15489-1:2016 Information and Documentation - Records Management - Part 1: Concepts-and Principles, Available at: < https://www.iso.org/standard/62542.html>. Accessed [8 Jul 21]
13. National Archives of Australia (2021) Data interoperability Maturity Model, Australian Government, Available at: < https://www.naa.gov.au/information-manag...>. Accessed [8 Jul 21]
14. National Archives of Australia (2021) Chief information governance officer (CIGO), Australian Government, Available at: < https://www.naa.gov.au/information-manag...>. Accessed [8 Jul 21]
15. https://www.righttoknow.org.au/request/n...
16. https://www.righttoknow.org.au/request/n...
17. https://www.righttoknow.org.au/request/n...
18. https://www.righttoknow.org.au/request/n...
19. https://www.righttoknow.org.au/request/t...
20. https://www.righttoknow.org.au/request/n...
21. https://www.righttoknow.org.au/request/t...
22. https://www.righttoknow.org.au/request/n...
23. OAIC (2012) Extension of time for processing requests, Office of the Australian Information Commissioner, Australian Government, Available at: < https://www.oaic.gov.au/freedom-of-infor...>. Accessed [8 Jul 21]

Dear foi,

Just checking on this request from 8 Jul 21. Did I miss an update or email?

Yours sincerely,

Shirley