Records Management - Request Handling Monitor Updates

Proposal Sponsor:

Tracey Slaven

Overview

Need:

A tool that allows us to effectively manage and monitor the University’s responses to information requests made under information legislation (the Data Protection Act 1998, Freedom of Information (Scotland) Act 2002 and Environmental Information (Scotland) Regulations 2005.

Problems:

The current request handling monitor was developed in late 2004 and no longer meets this purpose due to changes in requirements and an almost fivefold increase in the number of requests received. As a result we have to use a number of tools to monitor requests, but this is inefficient, leading to duplication of effort and unnecessary manual calculations resulting in a significant administrative burden on our staff.

We are unable to produce accurate statistical and management information without significant manual intervention and checking, including statistics we are required to provide to our regulator, the Scottish Information Commissioner (OSIC).

Opportunity:

To improve processes and understanding of the impact of information requests across the University by having better management information. This will benefit all areas within the University who receive information requests.

Other contributors:

Anne Grzybowski, Ann-Marie Noble, Sara Cranston

What would happen if the project did not take place?:

If the number of requests continues to rise (there has been a rise every year since 2006, in total almost fivefold) the Records Management Section is unlikely to be able to continue to ensure the University’s compliance with information requests. This would likely mean a combination of some or all of the below:

The University stops complying with information request timescales and misses a significant number of legal deadlines
The quality of response of the University to information requests is reduced
The above are likely to lead to reputational damage, including but not limited to potential enforcement action by the OSIC which will be made public
The University makes a choice whether compliance with information requests, and other aspects of our work is more important. A particularly substantial risk here relates to the new EU Data Protection Regulation which is likely to come into force in 2018. This will significantly increase financial and reputational risk relating to compliance with data protection legislation
We significantly reduce the level of service we offer to staff around the University in terms of advice on information requests, and other aspects of information compliance
The workload for individual departments receiving requests is increased, perhaps forcing them to employ their own staff with specialist information compliance knowledge

The above will not be acceptable in accordance with the University’s Risk Policy and Risk Appetite.

http://www.docs.sasg.ed.ac.uk/gasp/governance/riskmanagement/riskappetite.pdf

Additional information:

When the current request handling monitor was implemented in 2004, it was designed so that FOI practitioners within the University could log their own requests and manage them there. This is no longer a central requirement. The Records Management Section now logs nearly every request, and the University takes a more centralised approach than was initially envisaged.

Dependencies:

The request handling monitor application and database is linked to the University’s publication scheme application and database. A separate proposal has been submitted to replace the publication scheme.

This is technically discretionary, but it highly important as we need to be able to comply with Freedom Of Information requests and reporting.

Who does it affect?:

All members of staff who seek assistance from the Records Management Section, about information requests, or other aspects of data protection, freedom of information and records management. It will also benefit all members of staff at the University involved in information requests by increasing efficiency.

Records Management Section – main users of the tool.

Production Management – currently support the service

Why is it needed/What are the benefits?:

A detailed cost/benefit analysis needs to be carried out in order to analyse and appraise available options, for example there is external specialist software available which is worth exploring, and it is possible that there are systems already within the University that could be customised.

We currently estimate that the limitations of the current system result in an additional £5500-£7000 per annum worth of records management staff time spent on clerical work, which otherwise could be freed up. However it is hard to accurately estimate this, as many of the individual issues are relatively minor, but their cumulative impact is significant. If the number of requests continues to rise, this will increase. The number of requests have gone up from 100 in 2006, 200 in 2010 to 500 currently.

If the project does not take place it is likely that we will need to make full use of the support days available from Production Management for multiple small improvements, resulting in further cost to the University without addressing many of the fundamental issues with our system (currently 24 days, shared with other Governance and Strategic Planning applications).

Information requests can have an impact on departments across the University, sometimes causing a significant burden. This project would also benefit them, although not in a way we can quantify.

This project would help to:

Improve experience and efficiency by being able to locate previous responses (i.e. the Records Management Section does not need to ask the same question twice, because we can easily identify relevant previous responses)
Improve the collection of management information about requests, meaning that departments can understand the impact of requests in their area
Improve management information about requests to help identify areas where improvements can be made to our procedures
Support the identification of information which should be routinely published, reducing the burden of relevant areas of the University

For the Records Management Section:

Inefficiency of our current system means that the team spends a lot of time carrying out tasks which could be automated, and inputting the same information in more than one place
We have to manually calculate and recalculate many deadlines, when these are subject to specific rules

The collection of statistics is problematic. For example there are:

Issues with the accuracy of data reported into BI Suite
New requirements, including some from OSIC for data we don’t routinely collect
Valuable statistics we used to collect manually, but which are now untenable due to increased number of requests

BI/MI requirement?:

Yes – requirement to collect accurate statistics and information.

External costs?:

Potentially, dependent on solution to be implemented (may also be infrastructure costs).

Fit with University strategy:

Enablers - People

To value, support, develop and utilise the full potential of our staff, working with each other across our community to make the University a stimulating and successful place to work. - to make sure that we fully utilise the potential of our staff, by having an efficient tool, and minimising unnecessary burden of information requests to the University.

Enablers - Infrastructure

Objectives:

Ensure that we have the information we need to support learning, teaching, research and effective decision-making.
To ensure that we have the appropriate information in order to manage and make decisions about request handling

Planning Status:

Suggestion

Portfolio:

USG

Planned Start:

16/17

Multi-Year:

Yes

Project Owner:

USG

Funding Source:

Core Grant

IS Admin Tab

Estimation Reference:

Basis to start the analysis in 2016/17 as SMALL, and then look at the potential implementation the following year, likely LARGE for now in case of software build. Ideally start 01-Aug-16 to enable the analysis to inform planning for the next round.

If it is not prioritised separately the analysis could be a potential candidate for inclusion in the USG Portfolio Business Support proposal.

This will need workflow – triggers when dates are approaching. This covers a large number of people. Each member of the team is using this multiple times a day, and also using the corresponding excel sheet. This contains a complete records of what has been done with requests, so if review or appeal to commissioner we know how we’ve gone about answering it – who did what.

There is a standard workflow, with other parts of the University involved, with internal deadlines, and external deadlines. Others often need to approve the draft, including the University Secretary. There are frequent deviations from this, for good and necessary reasons. There is a lot of flexibility that will be needed, a certain number of set actions but capacity to deviate from workflow across multiple areas.

There is a similarity to the AIR solution, so building something would be possible.

We are also required to report internally and externally on request handling – the current system makes that very labour intensive. When doing statistics need to proof them, due to oddities within the system. This was easier when there were 100 requests, and now it’s much harder.

Risk – the data currently returned is incorrect as it needs to be manually checked before it goes. If OSIC become more specific about what they require then this would become compliance. There are current optional reports that we don’t provide.

Risk – change of org hierarchy changes the historic data so it is incorrect, also an issue for the publication scheme.

Build – basis of 250d for large project. This is likely worst case.

Alternatives may be possible – there may be off the shelf packages that could deliver a suitable solution.

Estimation Type:

Software Development (in-house)

Business Case/Options Appraisal

IT Solution Procurement

3rd Party IT Solution Implementation

Estimation Confidence:

Reasonably Confident (similar to previous work)

Estimated IS Apps Days:

Large

Estimated Business Partner Days:

Large