documents andrecords. ordisposalofall approving finalpreservation the ultimately hassoleresponsibilityof for storagethe ofrecorded The Archivist information. government directivesets outrequirements that for Archives. and ownership ofthe destroyedto beeither custody to ortransferred the from five to the records are that, 100 After years. Archives, usually by range the authorized schedule arerecords, set which usingarecord-retention 1,April 2007. Storage semi-active for these periods responsibility since Archives’ hasbeenthe which StorageInformation andRetrieval unit(ISR), stored inwarehouses operated government’s by the oragency to arebasis by transferred and aministry value andmake public. itaccessibleto the andpermanent recorded ofhistorical information andmostby agencies, ministries andto preserve tion inpaper, created forms electronic, andother mandate to oversee andmanage recorded informa (Archives) hasabroad The Archives ofOntario Background Chapter 4 Chapter Ministries andmost agenciesMinistries must follow a areRecords not neededonanongoing that Section 4.01 Follow-up onVFMSection3.01,Follow-up Retrieval Services Storage and Information and ofOntario Archives Ministry ofGovernment Services Ministry - of identifying and cataloguing archival records archival of of identifyingandcataloguing challenge paperandelectronic, exacerbate the both sheer volume ofrecords Archives, destined for the readily accessible to Thelarge and users. growth stored, orarchived safely and securely, andmade significance tion ofhistorical was beingidentified, systems andprocedures informa to ensure that systems, itdidnotinformation yet have adequate number ofinitiatives itsfacilitiesand to upgrade Archives hadrecently introduced the a although . pleted itsmove to anew head-officefacilityinnorth com Archives ofOntario 2009,the InApril staff. 2006/07) Archives employed andthe about100 wereexpenditures $18.8 million ($16.7 million in website. Archives’ to the loan requests, andapproximately 70 millionvisits rooms, 21,000 requests, research 7,000 microfilm tions include16,000 reading Archives’ visitsto the collec andart and accessrequests archival for the Annually,microfilm program. customer inquiries interlibrary-loan viathe and publiclibraries Internet, itsreading rooms, the through obtained In our 2008/09fiscal year,In the the Archives’ collectionscanbe Access Archives’ to the 2007 AnnualReport 2007 Annual Report Annual 2007 , we concludedthat - - - 337

Chapter 4 • Follow-up Section 4.01 338 2009 Annual Report of the Office of the Auditor General of Ontario

historical value. Our more significant observations were as follows: Status of Recommendations • The Archives did not have adequate systems and procedures for ensuring that the more According to information received from the than 10,000 record-retention schedules of Archives, progress is being made in implementing government ministries and agencies, which most of our recommendations. Given the magni- are used to identify records with archival tude of the actions required, substantially more value, were complete and up-to-date. time will be needed for the Archives to fully imple- The Archives had no information on whether • ment or address several of our recommendations, ministries and agencies were following such as the recommendations that involve dealing required storage and archival policies. with the large quantity of archival electronic rec- The Archives needed to be more proactive • ords, reducing the growth in the volume of stored in working with ministries and agencies records, and fully describing archival records in the to reduce the significant growth in stored Archives Descriptive Database system to make them records. more accessible to the public. The Archives did not have a comprehensive • The status of the action taken on each of the strategy for dealing with the extensive elec- recommendations is described in the following tronic documents that will need to be archived sections. nor the technical expertise and capacity necessary to store and make them available to the public. Record-Retention Schedules We found a number of weaknesses in inven- • Recommendation 1 tory control practices, which may have To ensure that records created by all program areas of resulted in significant losses, including thefts, ministries and agencies are assessed for their archival over the years. value and the length of time they should remain in Many archival records were not readily access- • storage, the Archives, in collaboration with ministries ible to the public because they had not been and agencies, should: processed or fully described in the Archives complete its analysis of each ministry and Descriptive Database system. • agency, establish a list of all program areas that Although the Archives has made good • are required to prepare record-retention sched- progress in developing a modern new storage ules, and periodically update that list; and facility for archival records, the storage facili- complete its system enhancements so that it can ties and storage methods for the more current • ensure that it obtains and authorizes record- semi-active records that are destined for the retention schedules from all those required to Archives pose a risk of deterioration or loss of provide one. these records.

Chapter 4 • Follow-up Section 4.01 We made a number of recommendations for improvement and received commitments from the Overseeing of Ministry and Agency Archives that it would take action to address our Record-Management Practices concerns. Recommendation 2 To ensure that the Archives can fulfill its obligations to monitor compliance by ministries and agencies with record-management requirements, it should: Archives of Ontario and Information Storage and Retrieval Services 339

• establish a cost-effective means of periodically In December 2008, the Archives contacted all obtaining the information it needs to monitor ministries asking for confirmation on their use of ministry and agency compliance; and updated record-retention schedules for common • use this information to identify best practices records, such as human resources and finance. Over among ministries and agencies and address any half of ministries had responded to the Archives as gaps between the directive, Archives policies of June 2009, with responses from all ministries and guidelines, and actual record-management expected by September 2009. The Archives plans to practices. make a similar request to agencies before the end of the 2009/10 fiscal year for completion by Septem- Status ber 2010. The Archives plans to issue compliance The following covers the status of both Recommen- reports on record-retention schedule coverage for dations 1 and 2. individual ministries by December 2009 and for The new Archives and Recordkeeping Act that was agencies by December 2010. Analysis of inactive implemented in 2007 strengthened the responsibil- record-retention schedules will also be completed ities of both the Archives and Archivist and the min- for ministries and agencies by these dates. istries and agencies. The Archives informed us that The Archives has converted approximately since that time, it has been working with ministries 14,000 approved record-retention schedules and designated provincial Crown agencies to mod- (formerly paper-based) to an electronic database. ernize records management across government. On-line access to the database and an information A multi-year strategy has been put in place for resource site for records management is available the Archives to complete its high-level analysis of to ministries on the government intranet. We were each ministry’s and agency’s creation of records informed that the agencies are to be provided with with archival value and record-retention require- on-line access to the database in the fall of 2009. ments. The Archives plans to complete all analyzes Subject to Management Board of Cabinet by the end of the 2010/11 fiscal year. It intends to approval, the Archives was planning to publish a use these analyzes in monitoring ministries’ and government-wide standard for storage of semi- agencies’ compliance with the Act. The Archives active paper records by September 2009. advised us that as of March 31, 2009, it had com- pleted or updated 46% of ministry analyzes and 48% of agency analyzes. Electronic Records In April 2008, the Archives streamlined the Recommendation 3 requirements and procedures for the approval of In order for the Archives to oversee, manage, and record-retention schedules. The Archives has estab- archive electronic documents and records created by lished a team of six records advisors that is provid- ministries and agencies, the Archives should: ing advice and training to ministries and agencies ensure that it has the necessary technical exper- on record-retention schedules and other related • tise and capacity to deal with electronic records; issues. According to the Archives, as a result of an

and Chapter 4 • Follow-up Section 4.01 increase in requests from ministries and agencies to then establish and implement strategic plans update and add record-retention schedules, more • that would permit the efficient transfer of than 2,000 updates were made in the 2008/09 archival electronic documents and records to fiscal year. In addition, more than 700 obsolete or the Archives in accordance with recognized best superseded record-retention schedules have been practices for information management. deleted to date. 340 2009 Annual Report of the Office of the Auditor General of Ontario

Status Growth in Volume of Stored The Archives continues to rely on the govern- Records ment’s information technology (IT) community Recommendation 4 for preserving and maintaining electronic records. To fulfill its obligations to manage the growth in the According to Archives estimates, by 2013 approxi- volume of stored government records, the Archives mately 144 terabytes of ministry and agency should, in collaboration with ministries and agencies, electronic records will need to be preserved by the develop strategies and timetables for reducing the Archives. To put this amount in perspective, it is the growth in and minimizing the volume of records that equivalent of approximately 3.6 million containers require storage. of paper-based records—that is, nine times larger In order to manage the expected significant growth than the Archives’ current holdings of 0.4 million in the number of records destined for the Archives and containers. The Archives noted that finding a solu- to ensure that the Archives can manage its operations tion to the preservation of electronic records has cost-effectively in future, the Archives should identify been identified as a priority in Ontario’s five-year and accept only those records that clearly have perma- Corporate I&IT Plan (2008–2013), and it is also rec- nent and historical significance. ognized as a key priority in the Archives’ Strategic To ensure that records are not being stored longer Plan for 2007–2010. than they need to be, the Archives should determine In March 2009, a project to establish archival the number and types of records that remain in ISR processes and procedures for arranging, describing, storage facilities past their originally authorized and providing access to electronic archival records retention dates or are unaccounted for and the was completed. These processes and procedures reasons for the delays in their disposition. It should were tested using a collection of electronic records use this information to evaluate its policies and pro- as a pilot. cedures and those of ISR with the objective of reducing The Archives informed us that it has conducted any unnecessary or prolonged storage of records and research to examine various national and inter- delays in transferring archival records. national programs being undertaken to preserve In addition, the Archives should investigate min- electronic records and make them accessible. istries and agencies that have not returned records According to the Archives, its research suggests that that they retrieved from ISR and should implement it should base its program on the Open Archival controls that will ensure that unreturned records are Information System model developed by the Inter- followed up. national Standards Organization (ISO). A multi-year project is to start in the 2009/10 Status fiscal year to establish a trusted digital repository Standardized record-retention schedules for based on the ISO standards. Such a large-scale transitory records (such as records of temporary or enterprise-wide project will require obtaining fund- minor transactions having no ongoing value—for ing and approval for development of functional example, memos or messages) were issued to min-

Chapter 4 • Follow-up Section 4.01 requirements for the repository, and for analyzing istries and agencies in 2008, making it clear that the marketplace to identify suppliers of the com- duplicate copies and records of short-term value ponents needed for the repository. can and should be discarded quickly. The transitory record-retention schedules allow paper records to be discarded if the same information is maintained in electronic form. The Archives informed us that following this policy change, it observed a decrease in the proportion of revised record-retention Archives of Ontario and Information Storage and Retrieval Services 341 schedules submitted for approval that specified us that the number of yearly destructions increased retention of paper as well as electronic versions of approximately 40% between 2006 (before the new information. process) and 2008. We were advised that the work done so far and As well, the Archives informed us that it has planned by the Archives to promote modern record- established a process to help ministries and agen- management practices, such as its efforts to ensure cies identify any records that they have retrieved that ministries’ and agencies’ record-retention from ISR warehouses but not yet returned. Each schedules are up-to-date, is likely to result in a ministry and agency has received a report identify- modest reduction in both the length of time records ing all outstanding unreturned records, which will are stored at ISR and the proportion of records assist them in locating and returning the records. transferred to the Archives. The adoption of the Subsequently, ISR sends monthly reports identify- standardized record-retention schedules was still ing retrieved records that have been outstanding in progress, and given the natural time lags in the more than 90 days. Once a year, ISR flags all transfer of records, it may be some time before the unreturned records. The Archives noted that most impact in reducing records will be seen at ISR or ministries are using the reports to better manage the Archives. their ministry’s retrievals process and are providing The Archives continues to review incoming information on files that are not being returned transfers of records that have reached their dispos- because of operational use. The Archives claims ition date at ISR and to apply selection strategies that there was a significant drop in files that remain where possible to reduce the overall quantity of out—from more than 500,000 before the reporting records held as archival. We were informed that as process was initiated to 380,000 as of March 31, a result of its review process, the Archives reduced 2009. by over 30% the volume of records originally sched- uled to be transferred to the Archives during 2008. Inventory Control for the In late 2009, the Archives was planning for a Archives review of the retention and appraisal policies for court records, which account for a large volume of Recommendation 5 the paper records that are destined for the Archives To ensure that proper and effective inventory controls but stored in the interim at ISR warehouses. are established and maintained for archival records The Archives has developed new policies and collections and to reduce the risk of loss and theft, and procedures for monitoring, controlling, and the Archives should conduct, possibly with the assist- reducing the volume of records placed on hold by ance of ministry internal auditors or other experts, ministries and agencies in ISR warehouses past the a thorough assessment of its inventory and security originally established destruction date. A tracking controls and other loss-prevention measures and cor- database has been implemented to document a rect any deficiencies identified. ministry’s or agency’s rationale for the need to store Status the records and for the recommended hold period. Chapter 4 • Follow-up Section 4.01 We noted that the Archives has made some progress This approach allows for more timely follow-up in improving its inventory and security controls. when the hold period expires. Annually, the new The Archives informed us that it has completed process requires a ministry’s program area to pro- its project to bar-code all of its remaining contain- vide a rationale (for example, ongoing litigation) ers of records and enter those records into its for requests to hold records past their designated electronic container-tracking system. More than destruction date, as well as an indication of how 48,000 entries were added to the system during the long they need to be held. The Archives informed 342 2009 Annual Report of the Office of the Auditor General of Ontario

2008/09 fiscal year in anticipation of the Archives’ 2008 to follow up on artworks that are reported as March 2009 move to a new head-office facility. The unaccounted for or stolen. We were advised that Archives’ current process is to capture new records since the procedure was put in place, there have in the tracking system as they are acquired. been no instances of unaccounted-for or stolen art. However, records inside containers (such as photographs and documents) are still not cata- Access to Archival Collections logued at the item level. As a result, the Archives’ inventory systems cannot provide complete details Recommendation 6 of the records inside the containers, including In order to improve access to archival collections, the whether any of the records are missing. The Archives should identify records that have not been Archives advised us that cataloguing at the item listed or described fully in its Archives Descriptive level is not feasible given the large volume of docu- Database system and should establish a plan and ments and its limited resources. However, it expects timetable for their inclusion. that its enhanced security at its new head-office Status public facilities will minimize the risk of theft. We were advised that a project to review the rec- Furthermore, we were informed that, although the ords not listed or fully described in the Archives’ Archives began sealing containers during transit on-line catalogue, called the Archives Descriptive in 2007, sealing containers when in storage is not Database, was under way at the time of our follow- being considered for the government-operated or up. As part of the Collections Management Backlog privately operated storage facilities, because the Reduction Strategy that the Archives established in Archives did not feel that this security measure was the 2008/09 fiscal year, the Archives has developed practical. Instead, it planned to continue to rely on selection criteria for prioritizing backlog projects to the security measures already in place at the facili- be added to the database. This multi-year strategy ties. We were advised that the facilities’ security identified that approximately 60% of non-govern- measures, such as ensuring that doors are locked, ment collections and 33% of government records are tested during routine inspection of storage required some degree of processing to be complete. facilities carried out by Archives staff. The Archives informed us that it no longer adds The Ministry’s internal auditors were engaged to to the backlog. All newly acquired collections, help assess the physical security and environmental whether private records or government records, risks, such as fire and flood, of the Archives’ new are to be fully described in the Archives Descriptive head office and to help develop policy and proced- Database system within a year of receipt in order ures to support secure access, and the Archives to ensure that the backlog is capped at its current informed us that it has acted on recommendations level. We were advised that, as of the end of March made by the internal auditors. We were advised 2009, about 88,000 updates had been entered in that only retrieval staff now have access to vaults the database and made publicly accessible. This containing certain valuable archival holdings. How- reflected the processing of 57 recent acquisitions,

Chapter 4 • Follow-up Section 4.01 ever, we noted that the Ministry’s internal auditors the archival records transferred from ISR ware- were not asked to help assess security and inventory houses during 2008, and 15 high-priority backlog controls and risks for records and archival holdings collections. at ISR and Archives storage warehouses. Work was to continue on the backlog but we A province-wide inventory and secure mounting were advised by the Archives that it could take of artworks in the art collec- 10 years to complete, depending on the Archives’ tion were in progress at the time of our follow-up. available resources and competing operational The Archives put a procedure in place in March Archives of Ontario and Information Storage and Retrieval Services 343 priorities. In the interim period, backlog collections The new agreement with its private storage- will be made physically available to the public and facility provider includes stricter and clearer are listed in the container-tracking system. requirements for the storage environment. Informa- tion on temperature and humidity is being cap- tured and monitored at all warehouses. We were Storage Facilities informed that quarterly environmental inspections Recommendation 7 of the private storage facility are being conducted. In order to better protect and preserve records that Also, a contracted company was hired to provide are destined for the Archives and that are normally the Archives with monthly reports that outline the not stored in facilities with suitable environment and results of environmental conditions at each ware- building conditions, the Archives should: house facility, whether government-operated or • conduct a cost-benefit and feasibility analysis to privately run. determine if it should make greater and earlier We were advised that water-detection sensors use of its environmentally sound storage facility; have been installed in government-owned • examine ISR’s storage policies, procedures, and warehouses, and precautions have been taken to facilities to identify changes that would improve eliminate the risk of flood damage to containers the environment and building conditions for stored at these warehouses. Formal inspections records in their facilities that are scheduled to be have increased to quarterly for government-owned transferred to the Archives; and facilities and monthly for the private company’s • evaluate and make improvements to its inspec- facilities. We were advised that issues identified at tion program and reporting requirements for inspections are brought to management’s attention ISR’s storage facilities and establish policies and for resolution. procedures for requiring corrective action when Artworks are no longer permanently stored in inspection results are unsatisfactory. a basement storage room of a Queen’s Park build- In addition, the Archives should ensure that ing. Most artworks not on display were moved to a government of Ontario artworks are protected and secured environmentally controlled storage vault preserved by storing them in environmentally sound at the Archives’ new head office in May 2009, and a and secure facilities. few remaining artworks were planned to be trans- ferred in July 2009. A new Art Collection Tracking Status System was also established, and artworks are to The Archives informed us that it was in the process be bar-coded and scanned into the new system for of considering options for its long-term storage inventory tracking. facilities requirements for semi-active records, which are currently met by ISR’s two government- owned-and-operated warehouses (which hold Privacy Controls over Records about 400,000 containers) and by a private-sector Recommendation 8 company’s warehouse facility (which holds about

In order to ensure that the confidentiality of records Chapter 4 • Follow-up Section 4.01 600,000 containers). A business case and cabinet in storage is protected and that service providers are submission for approval were planned for during in compliance with the security and confidentiality the 2009/10 fiscal year. In the interim, as a result requirements of their contracts, the Archives should: of a tender, a new three-year agreement with its conduct a thorough privacy risk assessment of private storage-facility provider was established • its storage facilities operated by private-sector in January 2009, with options by the Archives for contractors; three one-year extensions to the term. 344 2009 Annual Report of the Office of the Auditor General of Ontario

• restrict activities and impose security controls at private-sector storage contractor’s staff to retrieve storage facilities that will minimize the exposure individual files from storage containers, a practice of confidential records; that risks exposing potentially sensitive informa- • revise its inspection program of storage facilities tion. Second, no changes were made to require that to include formal assessments of its security and ISR’s approximately 600,000 containers be separ- privacy controls; and ated from containers belonging to the contractor’s • develop classification criteria for confidentiality other clients. ISR containers represent about 30% and security levels and establish special storage of the total holdings at the contractor’s facilities, arrangements for the most sensitive records. and separating these containers could help to reduce the risk of loss or security breaches. Status At the time of our 2007 audit, a government- Guidelines issued during the 2006/07 fiscal year wide file-classification plan was established to by the Information and Privacy Commissioner of promote consistency across the government in the Ontario and the Chief Information and Privacy Offi- identification and organization of records and to cer recommend that when ministries contract with classify information according to its sensitivity. private firms, a thorough risk assessment should However, at the time of our follow-up, the Archives be conducted. The Archives informed us that, had not changed its systems and procedures so that in response to our recommendation in the 2007 it could use this information to designate records Annual Report, a privacy risk assessment was under that should remain in facilities with enhanced way that would examine both the government-run security arrangements. and private-sector storage facilities. Although the Archives did complete a privacy risk assessment for its government-run warehouses in September 2008, Contract Management no privacy assessment had yet been performed Recommendation 9 at the private storage facilities at the time of our In order to ensure that contracts with service provid- follow-up. ers are managed properly and that procurement pro- The Archives informed us that it has nonethe- cesses are documented properly, ISR and the Archives less completed a project to eliminate personal should evaluate the way in which they manage information from the exterior of boxes at both its procurement documents, and ISR should ensure that private- and public-sector facilities. Going forward, payments are made only for amounts and services staff at these facilities are required to ensure that that are in accordance with contractual requirements. no personal information is noted on the exterior of storage containers. In addition, the Archives’ recent Status contracts for storage and transportation services The Archives informed us that it has implemented include provisions regarding confidentiality and a document-management system to track procure- the Freedom of Information and Protection of Privacy ment and contract management documentation. Act, and monthly inspections of the private storage A Contract Tracking Report is also reviewed and Chapter 4 • Follow-up Section 4.01 facility include testing security. updated on a monthly basis. However, we noted that certain control weak- Documentation was provided to us for several nesses we identified in our2007 Annual Report large contracts recently awarded by the Archives were not addressed in recent contracts awarded for transportation services and private storage to the Archives’ private-sector storage contractor. facilities. Procurement decisions in each of these First, the Archives advised that, because this is an cases were well documented and in accordance with industry-standard practice, it continues to allow its established policies and procedures. However, the Archives of Ontario and Information Storage and Retrieval Services 345

Archivist of Ontario recently asked the Ministry’s The Archives informed us that, due to weak- internal auditors to review a contract for file-storage nesses in its ISR container-tracking system and shelving and related services, valued at $775,000. In backlogs in data entry regarding storage and con- January 2009, the internal auditors concluded that tainer movement activities, it is unable to establish this contract, already spent, had been inappropri- procedures for reconciling differences between the ately awarded because it had not been competitively volumes reported by its container-tracking system tendered. The Archives responded to the internal with its contractor’s monthly billings for storage auditors that it would comply with the procurement services. We noted that discrepancies continue to policies and procedures in the future. exist between the information in the ISR’s con- Controls for ensuring that the Archives’ private tainer-tracking system and its contractor’s invoices, storage-facility provider meets contractual require- which the Archives continues to pay without verifi- ments for maintaining suitable environmental cation procedures. The Archives was planning for a and security controls were also enhanced through new container-tracking system, which will permit it improvements to inspection procedures and fre- to verify contractor invoices. quency and to reporting requirements. Chapter 4 • Follow-up Section 4.01