Why Do an Information Audit?
The Information Audit provides an objective assessment of an institution's record keeping practices, and the way in which that information is actually used. It is the first and most important step towards getting control of records and the information which they contain. It is a time-consuming and labour-intensive process, but is likely to produce insights into many aspects of the business (including those that some might prefer to keep hidden).
It is likely to highlight where there is unnecessary duplication of records
It is likely to indicate where business processes might be streamlined for more efficient administration
It is likely to show up where records are kept too long
It is likely to highlight filing cabinet 'fiefdoms', where information is treated as a personal asset to be shared grudgingly rather than as a resource to be shared by all as needed
It is likely to highlight what genuinely needs to be confidential and what does not
It is likely to show where there might be cost savings
The methodology and rationale is very similar to undertaking a process review. More detailed information can be found in the Process Review infoKit.
Finally it is a clear example of rational and good management practice and an important element of good corporate governance.
Where to Start
The approach required for success in the audit will depend upon the size and structure of the institution. A large multi-site, multi-school university with a devolved management structure will require a different approach from a small college with a tight, centrally controlled management structure. This is not just a matter of scale, but a fundamental difference in the way in which each goes about its daily business.
However in either case a single person or very small team will be made responsible for the task. In an ideal world, that person will be a professionally trained Records Manager (for whom this infoKit is in the 'Grandmothers-and-eggs' category) but the smaller the institution the more likely it is that it will be a task added to an existing role as an IT Manager, data protection officer, information professional or Management Information officer.
Whatever the starting point, the audit needs to be pre-planned carefully. This should include:-
A clear commitment and support from senior management
A clear list of objectives
A communication strategy
Collection and processing of the data gathered
Design and completion of forms
Senior Management Commitment
Enough has been said in the Steps Towards Good Records Management section to indicate that without Senior Management commitment the audit is likely to fail. At best it will be incomplete. The only reasons for undertaking a partial audit are:
To demonstrate to senior management that there are some 'quick wins', which have immediate and tangible benefits. This is part of the persuasion process. Success here relies on careful selection of the area to be audited.
A preliminary test of the indicative cost/resource requirements of a full-scale audit.
A training exercise for those involved in the larger audit.
We recommend that you view the audit as a project and use a structured approach to achieving the planned objectives. The Project Management infoKit gives advice on how to achieve this.
