Taking a risk-based approach to recordkeeping decisions

"How serious is this risk?"

Understanding how severe (or otherwise) the inherent risk associated with a given recordkeeping activity is starts with weighing up the potential impacts and likelihood of things going wrong as a result of that activity.

The risk that is being assessed in this case study is: 

As a result of not reviewing the contents of all former employee and contractor OneDrive accounts before they are deleted, we lose records that should have been retained.

Using the risk matrix below this produces an inherent risk rating of ‘High’. 

"Do we need to do anything?"

Decisions about accepting or remediating risk should be informed by risk appetite. Risk appetite is the amount of variation an organisation is willing to accept around a specific objective.

In the case of recordkeeping and other information management risks, the public office in this case study has established that it has a risk appetite that accepts ‘Low’ and ‘Moderate’ risks but requires that anything that is rated ‘High’ or ‘Extreme’ should be treated with appropriate controls. 

"How should we manage this risk?"

Common treatment strategies include:

• Avoid: stop or change the activity that creates the risk
• Reduce: add or improve controls to lower likelihood or impact
• Accept: decide to tolerate the risk, typically where the cost of treatment outweighs the benefit. Each public office will have a process for accepting, reporting and monitoring risks that are outside its risk appetite.

Decisions on how to treat a risk must be recorded and approved by the risk owner (the senior role with the ability to apply controls to the risk – in this case, it could be the Chief Technology Officer).

In relation to the potential loss of records from OneDrive accounts, the public office decides it needs to reduce the risk to ‘Low’ so that it is within its risk appetite.

The public office decides to reduce the risk by establishing a procedure to scan OneDrive accounts belonging to senior staff, staff involved in decision-making and members of the legal team, to identify anything that may need to be saved into a recordkeeping system. 

This procedure is a control for mitigating the risk. It is recorded in the public office’s risk register as a control – and linked to the record of the risk. 

"Are we now within appetite?"

As opposed to the inherent risk, which was assessed before it was treated with the control described above, the residual risk must now be assessed and recorded in the risk register. 

To assess residual risk, re-apply the same risk matrix used to assess the inherent risk, this time taking into account the effect of the controls that have been put in place. Ask the same two questions – how likely is it that things will still go wrong, and how serious would the impact be – but now consider how the treatment changes those answers.

In the OneDrive example, the new procedure requires a targeted review of accounts belonging to senior staff, staff involved in decision-making and legal team members before deletion. This control does not eliminate the risk entirely – accounts belonging to other staff are still deleted without review – but it meaningfully reduces the likelihood that records of significant business value will be lost. The potential impact remains ‘Moderate’, since gaps in the review coverage could still result in the loss of important information. However, focusing the review on the roles most likely to hold unique or high-value records means the likelihood can now be reassessed as ‘Unlikely’. Applying these revised ratings to the risk matrix produces a residual risk rating of ‘Moderate’, which is within the public office’s risk appetite.

The residual risk rating, together with the reasoning behind it and the controls on which it relies, should be recorded in your organisation’s risk register. It is important that the rating reflects an honest assessment of how well the controls actually work in practice, not simply their existence on paper. A control that is poorly implemented, inconsistently applied, or not understood by the people responsible for it will provide less risk reduction than one that is well-embedded and regularly tested.

Where the residual risk remains above your organisation’s risk appetite after treatment, consider whether further controls can be applied, or whether the residual risk should be formally accepted by the relevant risk owner and escalated as required by your organisation’s risk management framework.

"Is the risk remaining at an acceptable level?"

Monitoring and managing information and records risks over time is important because the risk landscape is not static – threats evolve, business processes change, legislative requirements are updated, and new technologies introduce unforeseen vulnerabilities. 

A risk that was adequately treated at the time of its identification may increase as controls deteriorate, staff turnover occurs, or the volume and sensitivity of information held by a public office grows. 

The frequency with which risks are reviewed will depend on factors like your organisation’s existing risk management program, and the level and nature of the risk, but it should be done periodically or as circumstances change.