AS/NZS ISO 30300 and AS/NZS ISO 30301 Management systems for records Presented by Judith Ellis
Framework for Good Recordkeeping Records are evidence of business Records system Records system Records Records characteristics characteristics characteristics characteristics 2 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
What is a ‘set of interrelated or interacting elements of an organisation to management establish policies and objectives, system? and processes to achieve those objectives ’ Management system ‘management ‘a management system system to direct to direct & control an and control an organisation with organisation with regard to quality/or info regard to records’ security ’ Quality Quality management /or management /or Management Management Information Information system for system for security security records records management management system system 3 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Why a • Demand for an overarching standard or statement management of principles & requirements system for • Aimed at management - to make the benefits of records? good records creation and control relevant to the modern organisation and get this on management agenda. • Tight integration between records processes and business processes - aim is to provide a systematic & strategic approach to the creation & control of records • Supports all areas of business compliance and good corporate governance • Alignment with areas interested in evidence-based processes (e.g. risk, compliance, or other MSS such as Quality, Info Security) 4 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Information Governance and MSR Framework Framework Operation Operation AS/NZS ISO 30301 AS/NZS ISO 30301 e.g.. AS ISO 15489 e.g.. AS ISO 15489 Systems e.g.. Systems e.g.. AS/NZS ISO 16175 AS/NZS ISO 16175 5 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Management system for records Related standards & standards technical reports Governance framework for records Implementation of records processes ISO 30300 Fundamentals ISO 15489 ISO 23081 ISO TR Management system for Metadata for Records 26122 records - Fundamentals & terminology management records. Work and vocabulary General-1 Principles-1 process analysis for Conceptual and records ISO 30301 implementation Requirements Guidelines-2 Management system for issues-2 records - Requirements Self assessment ISO 30303 method-3 Management system for records - Requirements for bodies providing audit and ISO 16175 ISO 13008 ISO TR certification Digital records Principles and 13028 conversion and functional Implement- migration requirements for ation ISO 30302 Guidelines process records in guidelines Management system for Support high level electronic office for records - Guidelines for structure elements environments-1 digitization implementation of records ISO 30304 2 Management system for records - Assessment 3 guide 6 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
MSR standards Published: (AS/NZS ISO AS/NZS ISO 30300 – Information & documentation 30300 series) – Management systems for records – Fundamentals & vocabulary AS/NZS ISO 30301 – Information & documentation – Management systems for records – Requirements Under development: ISO 30302 - Information & documentation – Management systems for records – Guidelines for implementation 7 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
AS/NZS ISO 30300 – Information & AS/NZS ISO 30300 documentation – Management systems for records – Fundamentals & vocabulary Explains the reasons for the creation of an MSR • Provides the guiding principles for the • successful implementation of an MSR Provides the terminology which ensures that it is • compatible with other management systems standards (MSS ) 8 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
AS/NZS ISO 30301 – Information & AS/NZS ISO 30301 documentation – Management system for records – Requirements Specifies the requirements to develop a records policy • Sets objectives and targets for an organization to implement • systemic improvements This is achieved through: • - designing records processes and systems - estimating the appropriate allocation of resources, and - establishing benchmarks to monitor, measure and evaluate outcomes This ensures that corrective action can be taken and • continuous improvements are built into the system to support an organization in achieving its mandate, mission, strategy and goals 9 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Structure of an MSR 10 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Relationship Integrated use and implementation with other MSS The MSR can be one element of an organisation’s overall management system – i.e. whereby the organisation establishes policies and objectives, and processes to achieve those objectives. Can be integrated with & implemented with other MSS, e.g. ISO 9000 Quality management systems – Demonstration of compliance & business processes – Documentation of traceability, evidence of preventive & corrective action ISO 31000 Risk management systems – Records & recordkeeping = key supporting elements of an organisation’s strategies, processes & controls for the identification & management of risk 11 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
How to implement – Strategic level ✔ X Appropriate to the organisation 50 pages Framework for records objectives Records processes & operations Management endorsed Procedures Communicated, accessible Understandable only by RM Meaningful people 12 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
How to implement – Strategic level The organization knows what records are to be created and captured • for each business process Metadata for controlling records and records processes are • appropriate to the business process Procedures, systems and formats are in place that ensure the • usability of records over time Records are retained or disposed of in an authorised and appropriate • manner 13 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
How to implement – Strategic level Establish strategic direction – link the MSR to the organisation’s • goals, requirements & priorities Sign off the records policy & objectives • Mandate adoption of MSR requirements – lead by example • Define, assign & communicate RM responsibilities • Assign resources • Review adequacy & effectiveness of the MSR • Direct & support continual improvement • 14 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
How to implement – Strategic level E.g. E.g. • Regulatory re quir ements for • Compliance obligations recordkeeping are defined, • Security understood & implemented • Internal RM capabilities • Roles and responsibilities for information management are • Environmental risks defined and understood • Rules exist & are implemented for information availability & access 15 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
How to implement – Operational level Implementation of records processes in records systems Best practices of AS ISO 15489 Records systems mainly IT converted to requirements of systems for paper & electronic AS/NZS ISO 30301(Annex A) records Using related standards and technical reports General Specific Records systems SA/SNZ ISO TR 26122 Work AS/NZS ISO 16175 AS ISO 15489 Records process analysis Functional requirements, 1-3 management, 1&2 AS/NZS ISO 13028 Digitization AS ISO 23081, 1-3 Metadata 16 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Records Processes and Controls Creation Control Determine requirements for Registration • • records Classification • Creation Select (metadata) • • Disposition schedule Event history • • Capture methods Access rules • • Determine metadata elements Procedures for authorised use • • Form & structure of records Accessibility of records, • • Technology selection including e-records • Implement disposition • Transfer of records • Removal of records • Destruction • Administration of records • systems 17 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Certification? Certification regime not established for Aust Compliance? • Many countries looking at it – Spain leading • Enables formally recognised compliance against • international standards Any certification body can build its own certification • scheme within its country, e.g. SAI Global Reasons for certification: Image • Meet customer demands • Preferred supplier status • Better control over business operations • Foundation for continual improvement • 18 Reproduced with permission from SAI Global Ltd under Licence 1407-c120
Recommend
More recommend
