Progress Update Review - Fife Council and Licensing Board

Home
Publications
Progress Update Review - Fife Council and Licensing Board

Share this page

Click here to share this page on Facebook. Click here to share this page on LinkedIn. Click here to share this page on X (formerly known as Twitter).

Contents

Public Records (Scotland) Act 2011
Progress Update Review (PUR) Mechanism
Executive Summary
Authority Background
Assessment Process
Progress Update Review (PUR): Fife Council and Licensing Board
The Public Records (Scotland) Act Assessment Team’s Summary
The Public Records (Scotland) Act Assessment Team’s Evaluation

1. Public Records (Scotland) Act 2011

The Public Records (Scotland) Act 2011 (the Act) received Royal Assent on 20 April 2011. It is the first new public records legislation in Scotland since 1937 and came into force on 1 January 2013. Its primary aim is to promote efficient and accountable record keeping by named Scottish public authorities.

The Act has its origins in The Historical Abuse Systemic Review: Residential Schools and Children’s Homes in Scotland 1950-1995 (The Shaw Report) published in 2007. The Shaw Report recorded how its investigations were hampered by poor recordkeeping and found that thousands of records had been created, but were then lost due to an inadequate legislative framework and poor records management. Crucially, it demonstrated how former residents of children’s homes were denied access to information about their formative years. The Shaw Report demonstrated that management of records in all formats (paper and electronic) is not just a bureaucratic process, but central to good governance and should not be ignored. A follow-up review of public records legislation by the Keeper of the Records of Scotland (the Keeper) found further evidence of poor records management across the public sector. This resulted in the passage of the Act by the Scottish Parliament in March 2011.

The Act requires a named authority to prepare and implement a records management plan (RMP) which must set out proper arrangements for the management of its records. A plan must clearly describe the way the authority cares for the records that it creates, in any format, whilst carrying out its business activities. The RMP must be agreed with the Keeper and regularly reviewed.

2. Progress Update Review (PUR) Mechanism

Under section 5(1) & (2) of the Act the Keeper may only require a review of an authority’s agreed RMP to be undertaken not earlier than five years after the date on which the authority’s RMP was last agreed. Regardless of whether an authority has successfully achieved its goals identified in its RMP or continues to work towards them, the minimum period of five years before the Keeper can require a review of a RMP does not allow for continuous progress to be captured and recognised.

The success of the Act to date is attributable to a large degree to meaningful communication between the Keeper, the Assessment Team, and named public authorities. Consultation with Key Contacts has highlighted the desirability of a mechanism to facilitate regular, constructive dialogue between stakeholders and the Assessment Team. Many authorities have themselves recognised that such regular communication is necessary to keep their agreed plans up to date following inevitable organisational change. Following meetings between authorities and the Assessment Team, a reporting mechanism through which progress and local initiatives can be acknowledged and reviewed by the Assessment Team was proposed. Key Contacts have expressed the hope that through submission of regular updates, the momentum generated by the Act can continue to be sustained at all levels within authorities.

The PUR self-assessment review mechanism was developed in collaboration with stakeholders and was formally announced in the Keeper’s Annual Report published on 12 August 2016. The completion of the PUR process enables authorities to be credited for the progress they are effecting and to receive constructive advice concerning on-going developments. Engaging with this mechanism will not only maintain the spirit of the Act by encouraging senior management to recognise the need for good records management practices, but will also help authorities comply with their statutory obligation under section 5(1)(a) of the Act to keep their RMP under review.

3. Executive Summary

This Report sets out the findings of the Public Records (Scotland) Act 2011 (the Act) Assessment Team’s consideration of the Progress Update template submitted for Fife Council and Licensing Board. The outcome of the assessment and relevant feedback can be found under sections 6 – 8.

4. Authority Background

Fife is Scotland's third largest local authority area by population. It has a resident population of just under 360,000, almost a third of whom live in the three principal towns of Dunfermline, Kirkcaldy and Glenrothes. Kirkcaldy is Fife's largest town by population (48,108 in 2006), followed by Dunfermline (45,462 in 2006) and then Glenrothes (38,927 in 2006). Fife Council is a unitary authority which provides all local government services for the Fife area. The Council Headquarters are located in Glenrothes. There are 78 councillors.

http://www.fifecouncil.co.uk/index.cfm

Licensing is the responsibility of licensing boards under powers contained in the Licensing (Scotland) Act 2005. Local licensing boards have wide discretion to determine appropriate licensing arrangements according to local needs and circumstances and their own legal advice. Each local government area must have a licensing board. Fife Licensing Board consists of 10 Board members.

5. Assessment Process

A PUR submission is evaluated by the Act’s Assessment Team. The self-assessment process invites authorities to complete a template and send it to the Assessment Team one year after the date of agreement of its RMP and every year thereafter. The self-assessment template highlights where an authority’s plan achieved agreement on an improvement basis and invites updates under those ‘Amber’ elements. However, it also provides an opportunity for authorities not simply to report on progress against improvements, but to comment on any new initiatives, highlight innovations, or record changes to existing arrangements under those elements that had attracted an initial ‘Green’ score in their original RMP submission.

The assessment report considers statements made by an authority under the elements of its agreed Plan that included improvement models. It reflects any changes and/or progress made towards achieving full compliance in those areas where agreement under improvement was made in the Keeper’s Assessment Report of their RMP. The PUR assessment report also considers statements of further progress made in elements already compliant under the Act.

Engagement with the PUR mechanism for assessment cannot alter the Keeper’s Assessment Report of an authority’s agreed RMP or any RAG assessment within it. Instead the PUR Final Report records the Assessment Team’s evaluation of the submission and its opinion on the progress being made by the authority since agreeing its RMP. The team’s assessment provides an informal indication of what marking an authority could expect should it submit a revised RMP to the Keeper under the Act, although such assessment is made without prejudice to the Keeper’s right to adopt a different marking at that stage.

Key

Green

The Assessment Team agrees this element of an authority’s plan.

Amber

The Assessment Team agrees this element of an authority’s progress update submission as an ‘improvement model’. This means that they are convinced of the authority’s commitment to closing a gap in provision. They will request that they are updated as work on this element progresses.

Red

There is a serious gap in provision for this element with no clear explanation of how this will be addressed. The Assessment Team may choose to notify the Keeper on this basis.

6. Progress Update Review (PUR): Fife Council and Licensing Board

Element 1: Senior Officer

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

The nominated post and named individual will change at RMP revision to Eileen Rowand, Executive Director, Finance and Corporate Services, who is Council SIRO.

Meantime, provision remains nominally unchanged with the role and responsibilities delegated to the above. The resting of PRSA strategic-level responsibility with SIRO is set out in the Council IRM Strategy and Policy documents.

Please see evidence documents:
FCPUR21-02: Council IRM Strategy, 2021-23;
FCPUR21-03 Council IRM Policy, 2021-23

The Keeper’s Assessment Team thank Fife Council and LB for this update which has been noted, alongside the evidence provided.

1.1 Overview
No changes to report.

Thank you for letting the Assessment Team know that there have been no changes to this Element. Update required on any future change.

Element 2: Records Manager

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

2.1 Overview
Provision remains as described in the 2018 year-end PUR and the July 2020 update.

Update required on any change.

2.1 Overview
No change to report. Meic Pierce Owen remains in post as the Council Records Manager and the nominated individual. There are no significant changes in the job description of the post to report.

Update required on any future change.

Element 3: Policy

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

3.1 Overview
Provision continues to develop in line with that stated in the 2018 year-end PUR and July 2020 update

3.2 Council IRM Strategy and Policy
The scheduled review of the Council’s IM Strategy and IRM Policy was completed with corporate sign-off coming in January 2021. These documents are date and approach aligned with the Council’s Digital Strategy-which was signed off in the Autumn of 2020. The naming of these documents is now standardised to IRM Strategy and Policy.

The linking of the IRM Strategy and Policy to the Digital Policy (which is a major corporate direction strategy document) is significant and is indicative of the benefits to PRSA delivery from the Records Manager being positioned within Business Technology Solutions (BTS)- the Council’s IT Service. The Digital Strategy is the brainchild of Charlie Anderson, BTS Head of Service and the role of the Head of BTS as a sponsor and driver of PRSA delivery is flagged in the IRM Policy.

Additional benefits of the Records Manager being positioned within BTS can be seen in the points below relating to Records Manager involvement in tech development. This involvement is accepted as part of the landscape rather than having to be sought (as has been the Records Manager’s experience elsewhere).

See evidence documents FCPUR21-01: Council Digital Strategy, 2020-23;
FCPUR21-02: Council IRM Strategy, 2021-23;
FCPUR21-03: Council IRM Policy, 2021-23

3.3 PRSA Records Management Plan (RMP)
The proposed linked revision of the Council’s Records Management Plan (RMP) that would have aligned with the IRM Strategy and Policy documents as (in part) a PRSA-mapped work delivery programme for the period was not, in the end, completed. This was because of the impact of the Pandemic on work programmes and the Keeper’s decision to suspend the receipt of RMPs that are being revised on a voluntary basis.

The decision was then taken in the Summer of 2021 to shelve the voluntary revision of the RMP until 2024 (unless requested by the Keeper in the meantime) and to align the Council’s with the next iterations of the Digital Strategy, IRM Strategy and IRM Policy at that time.

This decision was taken because of a/ the scale of a voluntary RMP revision being beyond Pandemic resource capacity and b/ with likely Keeper sign-off on a revised RMP not likely to be in place until 2022, this would require a further revision in around 18 months in order to maintain the required alignment with the IRM Strategy and Policy. This was felt to offer a poor return on required effort.

3.4 IRM Delivery in the Services Programme (IRMDS) (please see July 2020 update item 4.2)

This is a new initiative relating to how the Council will deliver operational level IRM within the Business. It is founded on assigning defined and focussed roles and responsibilities within the business and on a concept called ‘IRM light’.
Roles and responsibilities are set on a/ the Information Asset Owner (IAO) as information and information risk owner in a defined business area (or for Directorate data within a major technology platform); b/ the Information Administrator (Info Admin) being responsible for operational delivery at team level and c/ the Information Handler (Info Handler) assisting the Info Admin in basic operations (such as box labelling or moving) as required.

The concept of ‘IRM light’ is predicated on the recognition that staff time resource for IRM tasks is limited. From this acceptance, IRM light focusses of the defined core requirements of a/ delivering destruction as per the Council Records Retention Schedule (PRSA elements 4, 5, 6 and 7); b/ maintaining the Council Information Asset Register (PRSA Element 4) and c/ prompt exception reporting of any issues.

The Programme gained overview approval in January 2020 and since that time it has been developed in detail.

Please see evidence documents:
FCPUR21-04 to FCPUR21-13 (IRMDS documentation and guidance)

Planned launches across 2021 were delayed because of staff resource and corporate calendar issues.

The launch is now scheduled for the first quarter of financial year 2022-23.

Thank you for this update on Information and Records Management Policy and Strategy work, including linking these to Digital Policy. The Assessment Team also acknowledges the receipt of these policy and Strategy documents with thanks. It sounds like the positioning of Records Management within BTS has been a productive move, resulting in a more streamlined suite of policies.

Thank you also for the explanation on Fife Council and LB plans to prepare a voluntary resubmission of RMP, now pragmatically postponed. It seems a sensible and considered approach in present circumstances.

We also appreciate the update on the IRMDS project and an overview of the planned ‘IRM light’ approach. We hope this approach helps Fife Council and LB to make sure core requirements are consistently being met in the long run,

The receipt of then indicated IRDMS documentation is noted with thanks.

We look forward to hearing how these projects progress in consecutive PURs.

3.1 Overview
No significant changes to report.

3.2 Council IRM Strategy and Policy
No significant changes to report.

3.3 PRSA RMP
No significant changes to report.

3.4 IRMDS:
The planned roll-out linked to a general review of the Council IAR (4.3) has adapted due to a change in approach to that review (see below: 4.3). The launch has shifted to a ‘soft-launch’- with ‘branding’ of the roles with linked responsibilities being used to raise awareness and make move towards promoting effective operations across the Council.

Looking at each IRMDS facet in turn:

3.4.1 Roles and responsibilities:

3.4.1.1 IAO
Where an Information Asset Owner (IAO) action is required, this is passed to the relevant Service Manager. The link between the Service Manager role and the IAO has been in place for a number of years. However, it is now being asserted on a more consistent basis with a view to ensure that IAO decisions are made at an appropriately high management level. Comms and Guidance now being issued are using the term ‘IAO’ to define the person carrying out these activities. These documents define the IAO a ‘the relevant Service Manager.’

3.4.1.2 Info Admin
The Info Admin role as a named role remains implicit rather than explicit. However, the activities identified as those of the Info Admin continue to be delivered by various nominated individuals at team level across the Council. These are nominated individuals under previous initiatives and projects. Examples here include ‘champions’ from the SharePoint Project (who act as SharePoint Admins) and Business Support staff ( who carry out various IRM functions on behalf of a number of business areas). Where Business Support staff carry out such activities, ownership and control of the Information remains with the Business. Comms and Guidance now being issued are using the term ‘info admin’ to define the person carrying out these activities. As set out in the role guidance, Info Admin activities are managed at Team level.

3.4.1.3 Info Handler
As with the ’info admin’ role, that of the ‘info handler’ as a named role remains implicit. The activities identified as within the Info Handler role continue to be carried out on an ad hoc basis by appropriate grade staff members across the Council. As set-out in the role guidance, these activities are managed by the relevant ‘info admin’ and line manager.

3.4.2 IRM light
Both the term ‘IRM light’ and its three facets of effective document security and access control; retention and destruction; and prompt exception reporting are set out in relevant comms and guidance. This is very much a ‘product placement’ approach.

The Assessment Team appreciates this update to section 3.4. of Fife Council and Licensing Board’s Records Management Plan, and the approach to the roll-out of IRMDS. The details on specific roles and responsibilities (Information Asset Owner, Information Administrator, and Information Handler), and IRM Light ‘product placement’ approach, are also greatly appreciated.

Update required on any future change.

Element 4: Business Classification

Status:

November 2014 - agreed plan - Amber
20 May 2022 - review - Green
14 January 2025 - review - Green

The Business Classification Scheme (BCS) is currently being rolled out across the different service areas as part of a major redevelopment of records management systems based around the use of SharePoint 2013.

The Keeper agrees this element on ‘Improvement Model’ terms. This means that he is convinced of the authority’s commitment to implement the BCS fully over time, but would request that he is updated as this project progresses. Fife Council have suggested that they provide an update every 6 months to alert the Keeper to progress. The Keeper welcomes this.

4.1 Overview
Provision continues to develop in line with that stated in the 2018 year-end PUR and July 2020 update

4.2 Business Classification Scheme (BCS)
The Council has a comprehensive BCS developed as part of the SharePoint Project (please see also 4.3- IAR)
(evidence document previously submitted and acknowledged).

4.3 Information Asset Register (IAR)
The Council has an IAR in place that dates from 2017.
(evidence document previously submitted and acknowledged). This is to be revised and expanded as part the work of the IRMDS Programme. Once established, the IAR will be reviewed and refreshed annually. It is envisaged that it will inform information-risk based priority tech platform renewal as well as staff awareness of what data is where and what data they can legitimately access.

Please see evidence documents:
FCPUR21-11 to FCPUR21-13 (IAR Review documentation and guidance)

Note: the IRMDS Programme (including the IAR Review) would have formed part of the work programme in the proposed RMP covering that period.

4.4 SharePoint Project update (please see also 5.3- SP retention)
The Council SharePoint Project is now substantively complete. The Project has created a Council-wide EDMS environment of retention-controlled SharePoint libraries arranged by document type within a BCS structure.
Sitting within the Council’s wider O365, this configuration provides the Council with a ‘put it there’ system for Council staff to either simply create and work on documents within the appropriate SharePoint Library or move them there when they are completed.

Thank you for updating the Assessment Team on progress made regarding the Business Classification and information Asset Register frameworks. The receipt of supplied IAR Review documentation and guidance is noted with thanks.

It is acknowledged that the SharePoint Project was a major undertaking, and it is great to hear this has now been completed. It sounds like Fife Council and LB have a solid grasp of the requirements connected to this major project, and that supporting Business Classification framework documentation has been properly considered, reviewed and delivered, including guidance documentation for staff to follow.

This PUR Element has now been turned from Amber to Green to celebrate the significant leaps, in SharePoint implementation and the associated BCS and IAR frameworks, made in the last couple of years. If this was a formal resubmission, this Element might well turn Green in the formal assessment of Council’s RMP.

4.1 Overview
No significant changes to report.

4.2 BCS
See 4.4 below

4.3 IAR
The planned review of the Council IAR has seen a shift in emphasis over the past year. The approach now being taken is a phased approach. This focusses in the first instances on data relating to those activities identified as business critical in the Council’s Business Continuity Plan (BCP). Please see Element 10.

This phased approach has seen the completion of a successful proof of concept pilot within Business Technology Solutions (BTS- the Council’s internal IT Department). The next stage is to complete the Review process on a Directorate by Directorate basis. This work is commencing in March 2023.

4.4 SharePoint Project
The SharePoint Project has now ended. Residual Project ‘builds’ for a small number of minor business areas has been passed to the relevant Team within BTS (Collaboration and Productivity Solutions). This Team has also taken up the on-going management and development of the Council’s SharePoint provision. Within this provision, the Council Record Manager has the role of working with Business areas to maintain and develop BCS and retention provision (please see 5.3 below).

Thank you for this update on the approach to the Council’s Information Asset Register review. This is noted with thanks.

The Assessment Team acknowledges that ongoing development and management of the SharePoint solution is ongoing, and that Council Record Manager continues to work with business areas to maintain and develop the Business Classification Scheme, and records retention provision.

Update required on any future change.

Element 5: Retention schedule

Status:

November 2014 - agreed plan - Amber
20 May 2022 - review - Amber
14 January 2025 - review - Amber

The retention schedule is being revised at time of submission using the well regarded SCARRS system. The Keeper commends the functional approach being adopted in the new system.

The retention schedule will be imposed on the shared drives as the SharePoint solution is rolled out through the authority.

The Keeper agrees this element on ‘Improvement Model’ terms. This means that he is convinced of the authority’s commitment to implement the revised Retention Schedule fully over time, but would request that he is updated as this project progresses. Fife Council has suggested that they provide an update every 6 months to alert the Keeper to progress. The Keeper welcomes this.

5.1 Overview
Provision continues to develop in line with that stated in the 2018 year-end PUR and July 2020 update.

5.2 The Council Records Retention Schedule (retention schedule)
As stated in the RMP, the Retention Schedule is SCARRS. The review of those record types that are stored within SP is now substantively complete (evidence previously submitted and acknowledged). Over 2022-2024, the Records Manager will engage with the Business to expand this review to include document types not stored within SP.

Note: this Project was originally to be scheduled 2021-23 and would have formed part of the work programme in the proposed RMP covering that period.

This process will see the creation of a single unified Retention Schedule that will then be posted on the Council’s website. Currently, retention schedule outwith those record types stored within SP is a mix of SCARRS and stand-alone Retention Schedules generated since the adoption of SCARRS in 2014. This provision includes a number of updated Retention Schedules prepared as outlined in the update of July 2020. These projects are a mix of routine housekeeping and projects that seek to address specific issues not resolved by SCARRS.

Please see evidence document FCPUR21-14: HR Disciplinary records retention proposals paper. Please note that this report is under consideration at date of submission.

5.3 SharePoint retention
As outlined above (please see also 4.4- SP Project), the SP project is now substantively complete and the operation of SP is moving into BAU. Part of BAU will include both maintaining and developing retention provision within SP. The Records Manager will be involved in this at all times in their capacity as manager of the Retention Schedule.

One thing that is being done in this regard is to procure a stand-alone back-up platform for O365. This is being done in part for Information Security compliance reasons and also to assist in automated retention bedding-in as accepted and understood practice within the Council. The concern here is that business-based best practice retention periods may take a time to reach what they should be with documents initially cycling out of the system ahead of the end of the time of their legitimate business need.

Note: this provision is in live discussion at time of submission.

5.4 Retention in the wider Council MS Office365 (O365)
Within the wider O365, the Council has set retention to 2 years in both Teams and OneDrive. This has been suspended over the term of the Pandemic but is to be introduced over the coming time. The purpose of this is to ensure that these areas do not become log-term storage areas with no retention control. To ensure onward retention of documents, staff will simply move completed documents to the appropriate SP library. This practice has already been adopted by a number of work teams and individuals.

In addition, retention has been considered for other O365 apps. Of particular note here is the recording of video.

Please see evidence documents FCPUR21-15: recording meetings technical overview & overarching DPIA;
FCPUR21-16: staff guidance note on considerations when thinking about recording a meeting.

5.5 Technical Specification Document
This is a new development that has relevance across a number of PRSA elements. However, one of its primary benefits is in the area of records retention so it is included here.

The Technical Specification Document (tech spec) is an early-stage assessment tool for use in the purchase/ procurement of new technology solutions for the Council.

Its purpose is to map solution technical capability and compatibility with the Council network and, where there are issues, spark discussion and resolution of those issues and risks.

There has been a document of this type focussed on purely IT technical matters for a number of years. However, the revised document has both slimmed down the IT Technical asks and includes IG capabilities. From a PRSA pov, these include both retention (element 5) and destruction (element 6) as well as export to specified destination (element), IS and DP (elements 8 and 9) and audit trail (element 11).

The Records Manager is a member of the Working Group that has managed, and continues to manage, the development of the Tech Spec.

Please see evidence documents FCPUR21-18: tech spec form; FCPUR21-19: tech spec work instruction.

Thank you for this update on the Council’s Records Retention Schedule (the continuing use of SCARRS).

It is very welcome news that the review of record types stored on SharePoint is now complete, and that a review of other document types will follow in the next couple of years. It appears that the Council has a solid plan to improve its retention procedures through a unified Retention Schedule, and the Assessment Team would like to encourage this approach.

The receipt of evidence provided is noted with many thanks.

The planned procurement of a standalone back-up platform for O365 is also acknowledged. It is clear that Fife Council has carefully considered the various implications of O365 suite implementation. The TechSpec approach also sounds like a positive step. All of the evidence attached is received with thanks.

It is clear that significant progress has been made with regard to this Element. While the unified Records Retention Schedule is in development, it will remain at Amber. Fife Council and LB have made encouraging progress, however, and are close achieving to Green RAG status.

We look forward to hearing on how these projects progress in consecutive PURs.

5.1 Overview: no significant changes to report.

5.2 Council Records Retention Schedule
It is now planned to start the Retention Schedule Review Project in April 2023.

5.3 SharePoint retention
Please see SharePoint Project summary (above 4.4).

5.4 Retention in the wider Council M365 environment
Provision continues to evolve within the System. This is generally discussed and included via the DPIA completion process.

The previously-mentioned planned retention provision for MS Teams and OneDrive remain suspended. It is planned to look at this area in 2023.

5.5 Tech spec document
Use of this document is now embedded within the Procurement process. The wording and content of the document is reviewed by a Standing Working Group that meets every 6 months. The Council Records Manager is a member of this Group.

Thank you for letting us know of the upcoming Retention Schedule Review Project, and that planned retention provision for OneDrive and MS Teams will be addressed this year.

It is clear that Fife Council and Licensing Board continue to work on this Element, and that progress is being made.

While the unified Records Retention Schedule is not fully implemented, this Element will remain at Amber. Fife Council and LB have made encouraging progress, however, and are close achieving to Green RAG status.

We look forward to hearing on how these projects progress in consecutive PURs.

Element 6: Destruction arrangements

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

6.1 Overview
Provision for the destruction of paper and electronic records remains as stated in the 2018 year-end PUR and July 2020 update.

6.2 RecordPoint tech replacement.
The development of an in-house replacement for RecordPoint as an in-house paper records box management system is in its final stages.

This will manage not only retention-controlled box destruction (element 6) but will also operate first-line issue and return controls for boxes of documents loaned from the Store (element 12).

The Records Manager has been involved in the development of both this replacement solution and the review of related procedures.

6.3 Scanning of paper records
The Council back-scanning and scanning of documents programme continues and has been expanded in consequence of the Pandemic.

The Records Manager has been involved in developing QA-test based destruction of back-scanned paper original documents and the 90-day retention of office-scanned in-coming documents. These provisions are typically developed via DPIA documentation.

Please see evidence document FCPUR21-staff guidance on scanning.

6.4 Destruction certificates
Destruction certificates are required to be completed for paper records being destroyed and electronic records being manually destroyed.

Where a technology platform carries out automated destruction, the ability to produce destruction reports is sought by the Council. This is looked-at as part of both the Tech Spec and DPIA processes.

Please see evidence documents
FCPUR21-20: paper records destruction form;
FCPUR21-21: electronic records destruction form; FCPUR21-22: Staff guidance on document destruction

The Assessment Team is grateful for this update on Records Destruction arrangements, including RecordPoint tech replacement, continuing back-scanning and scanning of paper documents, and the best practice approach of obtaining and retaining records destruction certificates.

It is positive to see that this Element continues to be properly addressed, including staff training. The evidence provided here is noted with thanks.

Based on this update, the Assessment Team have no specific concerns. This element will remain at Green.

6.1 Overview: no significant changes to report.

6.2 RecordPoint tech replacement
The in-house replacement platform previously-outlined is now in place. The version currently live at time of writing this report (February 2023) is an interim version. This offers a partially-manual deposits process (with the Business submitting Excel templated deposit schedules being submitted for addition to the System by BTS staff) along with a fully tech-based loans and return system. Over the course of 2023, it is planned to expand this to full tech-based provision for deposits; loans and returns; and destruction.

6.3 Scanning of paper records
No significant changes to report.

6.4 Destruction certificates
No significant changes to report.

The Assessment Team notes the update on completed RecordPoint replacement, and ongoing work to build a full tech-based provision for deposits, loans returns, and records destruction.

It is clear from this update that Fife Council and Licensing Board continue to meet the Keeper’s requirements under this Element. Update required on any future change.

Element 7: Archiving and transfer

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

7.1 Overview
Provision remains as described in the 2018 year-end PUR and the July 2020 update.

7.2 Novell Network Drives (Novell) decommissioning
The proposed actions by Records Manager and Archivist as outlined in the July 2020 update were in the end unrequired. Decommissioning of Novell is being completed with all content either migrated to SharePoint or deleted. The Council Records Retention has been taken not account in assessing content for migration. This, along with the amount of data destroyed will be noted in an end of decommissioning report.

7.3 Digital Preservation
It is planned to look at the Council’s requirements in this area. This work will be led by the Records Manager and will involve the Archivist. This work would have formed part of the Work Programme in the proposed revised RMP. The precise scheduling of this work has not at this point been finalised.

The Assessment Team thanks you for this update on Archiving and Transfer arrangements. Thank you, in particular, for the update on the arrangements for the decommissioning of Network Drives and on digital preservation.

This Element remains at Green.

7.1 Overview
No significant changes to report.

7.2 Novell decommissioning
Decommissioning is now substantively complete. Work to resolve a small number of network drives with complex issues (most-especially content with links to other systems) is in progress.

All documents identified as being ‘in retention’ have been migrated to SharePoint. In some instances, content has been migrated to ‘transition’ libraries- from which staff are migrating required content. Retention on these libraries has been set for review at 2 years.

A summary of retention and destruction activity will be included in end of project reporting.

7.3 Digital Preservation
Some initial mapping of current provision along with looking at required provision has been completed by the Council Records Manager and Council Archivist. It is noted from mapping to date that the Council now has a significant amount of digital content that is being held within systems under a defined retention period of ‘permanent.’ It is also noted, however, that, at this point, issues of preservation beyond system term of life and direct appropriate researcher access have not been looked at in any detail.

Once completed, this mapping work (which will include talking to other organisations similar to the Council) will lead to the writing and submission of a report to Management. This report will set out requirements, current arrangements and considerations in looking at what provision the Council might put in place. It is noted that, because of extreme budgetary constraints, it is unlikely that the Council will be in a position to put major funding into this area over the short to medium term. The Report will therefore take this factor into account when making its suggestions.

Thank you for this update on ongoing work on network drives, and that Novell Network Drives decommissioning has now been completed. The Assessment Team also notes that relevant files have been migrated to SharePoint, or, in some instances, temporary ‘transition’ libraries, from where the process of relevant content migration continues.

It is positive to hear that mapping of current and required digital preservation provision has been commenced. It is clear that challenges remain, but that Fife Council and Licensing Board are aware of these, and intend to address them in the future.

Thank you also for sharing your plans beyond the mapping work, including notifying us the extreme budgetary constraints the Council is under. The Assessment Team sympathise with this circumstance which is prevalent across the public sector.

The Assessment team looks forward to hearing about this project’s completion in due course.

Update required on any future change.

Element 8: Information security

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

8.1 Overview
Provision remains as described in the 2018 year-end PUR and the July 2020 update.

Please see evidence documents:
FCPUR21-23: Council IS Policy;
FCPUR21-24: Council IS incident management policy;
FCPUR21-25: IS PUR 2021 year-end summary;
FCPUR21-26: Logj4 CREW notice vulnerability response December 2021;
FCPUR21-27: Protect and Assure Q3 2021-22 Report (includes reference to Logj4 CREW notice as above).

Note: item 8.2 from the July 2020 update is now discussed at item 12.3

Thank you for the comprehensive evidence suite provided in support of this Element. The Assessment Team look forward to being updated on any change in consecutive PURs.

8.1 Overview: no significant changes to report.

Please find below summary report from Sheila M Smith, Lead Officer, BTS Security and Compliance (the Council’s Information Security lead officer):

Fife Council has recently carried out it's annual IT Health Check which is a requirement of the UK Cabinet Office in order to comply with the requirements of the PSN network.

Internally, there is a mandatory requirement for every individual across Fife Council to bi-annually complete the Cyber Security E-learning module: Stay Safe Online which is recommended as best practice by the NCSC.

The Scottish Government requires all public sector organisations to ensure we do our best to protect our systems, our workforces and the people using our services. In relation to this, we regularly update our own security posture as well as implementing measures to ensure that those of our suppliers meet a suitable security standard. We do this after having implemented the Scottish Government Tool (CSPST).

Also, we have recently embarked on an important Cyber Improvement Project, the outcomes of which are 4 key elements; additional Security Analyst Resource, Privileged Account Management Review, Managed SOC, On-Call cover for Incident Response and an Air-gapped and Immutable Backup Solution.

The Assessment Team thanks you for the BTS and Security Compliance Lead Officer’s summary report provided. This indicates continuing focus on information security, including IT health, cyber security learning, legal compliance, and the use of Scottish Government’s Cyber Security Procurement Support Tool. The details of the Cyber Improvement Project are also noted with many thanks.

Element 9: Data protection

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

9.1 Overview
Provision remains as described in the 2018 year-end PUR and the July 2020 update.

Please see evidence documents
FCPUR21-28: Council DP Policy;
FCPUR21-29: Data Handling Policy;
FCPUR21-30: DP PUR year-end summary;
FCPUR21-31: FC Community Booking solution DPIA;
FCPUR21-32: Putting people first privacy notice.

Note: at date of submission, the Council was in the process of recruiting a new DPO, the previous post-holder having moved to a new role elsewhere. In the interim, the remaining two members of the DP Team (who are both professionally qualified) remain in post.

Thank you for this update, the evidence suite provided, as well as the update on Data Protection Officer recruitment. The Assessment Team have no concerns over this Element and look forward to updates in consecutive PURs.

9.1 Overview: no significant changes to report.

Please find below summary report from Fiona Smyth, Council Data Protection Officer (DPO:

Fife Council has in place a Data Protection policy and a wide range of procedures and processes which aim to ensure compliance with Data Protection legislation and the meeting of the Accountability Principle in the UK GDPR. Standard requirements include:

- Carrying out of Data Protection Impact Assessments (DPIA’s)
- Requirements for Data Breach Reporting and Assessment
- Processes to respond to Data Subject rights requests
- Preparation of Information Sharing and Data Processing Agreements where required
- Overarching Fife Council privacy notice and provision of function based privacy notices to meet transparency principle
- Inclusion of Data processing clauses within procurement contracts
- Mandatory training on Data Protection for all new staff and refresher training for existing staff every two years

The Data Protection Officer reports to quarterly meetings of the Information Governance Working Group (IGWG) and the ICT Governance Board. With the focus of the IGWG being on operational Information Governance issues, the report it receives provides a summary of data protection performance across the key areas detailed above as well as a summary of government and regulatory data protection updates. Reports to the ICT Governance Board focus on the effectiveness of internal Council processes and the on-going actions to improve these.

On an annual basis, the Data Protection Officer provides a report to the Councils Audit, Standards & Scrutiny Committee to ensure that Elected Members who are tasked with scrutinising the performance of the Council can do this with respect to Data Protection matters. The 2021/22 report was considered at the Committees meeting held on 28 November 2022.

Key activities planned for the Data Protection team in 2023 include:
- Revision of the Councils DPIA procedure and associated guidance and training for staff
- Further refinement of the Councils arrangements for assessment of international data transfers including the roll out of IDTA and SCC Addendum requirements in contracts
- Development and implementation of a Data Protection Maturity and Assessment Framework
- Enhancement of internal communications about key data protection themes

Thank you for providing us with the Council Data Protection Officer’s detailed update on Data Protection. It is great to hear that robust procedures and processes continue to be in place. It is also great to hear of the authority’s Data Protection Team’s plans for the current year regarding key activities.

It is clear from this update that Fife Council and Licensing Board continue to meet the Keeper’s requirements under Element 9, as well as their other legal obligations.

Update required on any future change.

Element 10: Business continuity and vital records

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

10.1 Overview
Provision remains as described in the 2018 year-end PUR and the July 2020 update.

Please see evidence document FCPUR21-33: Emergency Resilience Manager overview.

Thank you for this update on business continuity and vital records, as well as the Emergency Resilience overview document. Update is required on any change.

10.1 no significant changes to report. This includes no significant change from the position set-out in evidence document FCPUR21-33.

Over the course of 2022, the Emergency Resilience Team have engaged with the Records Manager on the linking of the IAR to the Council’s Directorate level business critical activities (please see above 4.3).

Thank you for this update, and confirmation that the Emergency Resilience Manager Overview document remains up to date. It is also reassuring to hear that the Records Manager and the Emergency Resilience Team are working on linking the Information Asset Register to the Council’s business-critical activities at directorate-level.

Update required on any future change.

Element 11: Audit trail

Status:

November 2014 - agreed plan - Amber
20 May 2022 - review - Amber
14 January 2025 - review - Amber

The roll-out of SharePoint will greatly enhance audit function relating to electronic records whilst the creation of a centralised records store in a new repository will help in the tracking of paper records. The Keeper commends these initiatives and requests updates on these developments.

The Keeper agrees this element on ‘Improvement Model’ terms. This means that he is convinced of the authority’s commitment to implement systems to track and identify records fully over time, but would request that he is updated as this project progresses.

11.1 Overview
Audit trail provision within the Council remains strong for paper records and in a developing state for electronic records.

11.2 Paper Records
Document issue and return
Guidance is in place and good practice is in existence across the Council. This provision has performed well over the Pandemic.

In addition, the replacement tech for RecordPoint (please see 6.2 above) will offer strong audit trail on record boxes.

Please see evidence document FCPUR21-34: staff guidance on the control of paper records.

11.3 Electronic Records
Audit trail provision for electronic records is mixed and is dependent on technology platform capability. The requirement for audit trail provision is included within both the tech spec (see 5.5 above) and DPIA (see 9.1 above) processes.

The Assessment Team is grateful for this update on Audit Trail arrangements. It is good to hear that arrangements concerning analogue records continue to be strong. The evidence provided is noted with thanks.

With regard to electronic records, it is understandable that the more straightforward, single-platform solution will take time to bed-in properly.

This Element will remain at Amber while the process on electronic record audit trails is being perfected.

11.1 Overview
No significant changes to report.

11.2 Paper records
No significant changes to report.

11.3 Electronic records
No significant changes to report.

Update required on any future change.

Element 12: Competency framework

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

12.1 Overview
Provision continues to develop in line with that stated in the 2018 year-end PUR and July 2020 update

21.2 Professional Records Manager
The Council currently employees two professionally qualified and experienced Records Managers. These are

Meic Pierce Owen, the Council Records Manager

and

Lesley Gauld, Manager (Compliance) Health and Social Care Partnership Localities

Relevant competency frameworks are in place for each post. Each current postholder was appointed under these frameworks.

In terms of CPD, each post-holder is given reasonable access to CPD opportunities within budget constraints.

21.3 Staff Competency
Whilst no formal IRM competency frameworks exist for staff in general, post competencies for posts involving information appear appropriate for the posts.

Looking at the plans outlined in both the 2018 year-end PUR and the July 2020 update for tiered IRM training have not substantively progressed. However, a suitable ‘off-the shelf’ IRM awareness training module for all staff has been identified within the Council’s Oracle Cloud platform. It is planned to add a multi-choice questionnaire to this Module and introduce it as part of the Council’s all-staff training programme.

Meantime, staff guidance has been prepared on a number of topics and pages have been published on the Council’s new Intranet. These are gaining a small but positive response.

There have also been IRM messages included within all staff updates issued over the course of the Pandemic. As noted in 8.2 in the July 2020 update, these have very much been about ‘please do this’ rather than ‘do not do that’. The same approach has been taken to IRM guidance issued to staff around the Council’s current round of Estate reduction. Finally, a small number of ‘talking head’ recorded PowerPoint presentations have been made as learning aids for the IRMDS Programme. It is planned to us this technique for more general staff awareness and guidance topics.

Please see evidence documents
FCPUR21-35 to FCPUR21-40: IRM intranet pages;

FCPUR21-16, FCPUR21-19, FCPUR21-22, FCPUR21-34: staff guidance notes;

FCPUR21-09, FCPUR21-10, FCPUR21-13: IRMDS programme ‘talking head’ PowerPoint presentation recordings.

12.1 Overview
No significant changes to report.

12.2 Professional Records Manager
Lesley Gauld no longer works in a Records Management role within the Council.

Lesley’s role within HSC has been filled by internal recruitment. The post has been split in two, with one staff member looking at Data Protection and the other at IRM matters. The Council Records Manager is assisting the new IRM post-holder in coming up to speed.

12.3 Staff Competency
No significant changes to report in the area of developing an All Staff Record Management Training Module.
Guidance and advice for staff continues to be developed and issued via notes and guidance documents issued on the staff intranet as well as via key messages in the weekly news update issued to Council staff.

1.1 Overview
No changes to report.

The Assessment Team is grateful for this update on Fife Council and Licensing Board’s records management team composition, and for letting us know that no significant changes in the records management training provision have taken place.

Update required on any future change.

Element 13: Assessment and review

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

The authority will review the RMP annually with a major review every three years. The Keeper commends this approach and would welcome updates on the findings of any reviews or internal audits.

13.1 Overview
Provision remains as described in the 2018 year-end PUR and the July 2020 update.

Note: In July 2020, at the request of the Council and because of personal Records Manager circumstances in January/February 2020 and subsequent Pandemic work pressures, the Keeper kindly agreed to accept and update statement in place of the planned year-end PUR for 2019. No year-end PUR for 2020 was undertaken.

Please see evidence documents:
FCPUR21-27 & FCPUR21-41: Q3 2021-22 IG and IS reporting.

13.2 RMP: annual and three-year review
IRM activities, as they relate to PRSA delivery, are reviewed across the Year each year. The plan to fully-review the RMP at three-year intervals (or to align with the term of the Digital Strategy and IRM Strategy and Policy if the current three-year term of those changes) will commence from 2024 (unless the Keeper requests a revision of the RMP ahead of that date).

The comments of the Keeper that the Assessment Team should be engaged with before commencing a revision of the RMP have been taken on board and such engagement took place in 2020 ahead of the Keeper placing a hold on voluntary submissions of revised RMPs.

This Element remains on a strong footing, and Fife Council are commendably engaging with the PRSA Team on records management matters – including regular participation in the PUR process.

The evidence provided is also noted with thanks.

The plan to fully review the RMP every three years is a particularly praiseworthy one, and the Team encourage the planned voluntary submission in 2024. We look forward to hearing about progress on the various projects in the next PUR.

13.1 Overview
No significant changes to report.

13.2 RMP
No significant changes to report.

Update required on any future change.

Element 14: Shared information

Status:

November 2014 - agreed plan - Green
20 May 2022 - review - Green
14 January 2025 - review - Green

Update required on any change

14.1 Overview
Development of provision continues as set out in the 2018 year-end PUR and the July 2020 update.

Please see evidence document FCPUR21-42 Council data sharing guidance.

The Assessment Team thank you for this update, and acknowledge the receipt of Fife Council’s Data Sharing Guidance.

Update required on any change.

14.1 Overview
No significant changes to report.

Update required on any future change.

Element 15: Records created or held by third parties

Status:

November 2014 - agreed plan - N/A
20 May 2022 - review- N/A
14 January 2025 - review- N/A

N/A

15.1 Overview
Provision in this area is not explicitly included in current PUR process as the RMP (2014) pre-dates the introduction of element 15 (2018-19). It is, however, included by the Council on a voluntary basis ahead of the submission of a revised RMP

15.2 Tender and contract inclusion
The Council is making progress in including PRSA requirements within both tendering documentation and also within annual amendments to existing contracts.

Please see evidence document FCPUR21-44 draft Occupational Health solution tender document (includes Records Management and Transfer section, p.17)

The Assessment Team thank you for including an update on Element 15. The sample tender document is received with thanks, and shows that Fife Council continues to take its public records management responsibilities seriously, including when outsourcing its functions.

This Element will not get a RAG status in the PURs, but we encourage Fife Council to Include it in the revised RMP for proper assessment as intended.

15.1 Overview
No change in the preceding statement to report.

15.2 Tender and contract
The process previously outlined continues.

Thank you for letting the Assessment Team know that there have been no changes to this Element. Update required on any future change.

7. The Public Records (Scotland) Act Assessment Team’s Summary

Version

The progress update submission which has been assessed is the one received by the Assessment Team on 27th February 2023. The progress update was submitted by Meic Pierce Owen, Council Records Manager.

The progress update submission makes it clear that it is a submission for Fife Council and Licensing Board.

The Assessment Team has reviewed Fife Council and Licensing Board’s Progress Update submission and agrees that the proper record management arrangements outlined by the various elements in the authority’s plan continue to be properly considered. The Assessment Team commends this authority’s efforts to keep its Records Management Plan under review.

General Comments

Fife Council and Licensing Board continues to take its records management obligations seriously and is working to bring all elements into full compliance.

Section 5(2) of the Public Records (Scotland) Act 2011 provides the Keeper of the Records of Scotland (the Keeper) with authority to revisit an agreed plan only after five years has elapsed since the date of agreement. Section 5(6) allows authorities to revise their agreed plan at any time and resubmit this for the Keeper’s agreement. The Act does not require authorities to provide regular updates against progress. The Keeper, however, encourages such updates.

The Keeper cannot change the status of elements formally agreed under a voluntary submission, but he can use such submissions to indicate how he might now regard this status should the authority choose to resubmit its plan under section (5)(6) of the Act.

8. The Public Records (Scotland) Act Assessment Team’s Evaluation

Based on the progress update assessment the Assessment Team considers that Fife Council and Licensing Board continue to take their statutory obligations seriously and are working hard to bring all the elements of their records management arrangements into full compliance with the Act and fulfil the Keeper’s expectations.

The Assessment Team recommends authorities consider publishing PUR assessment reports on their websites as an example of continued good practice both within individual authorities and across the sector.

This report follows the Public Records (Scotland) Act Assessment Team’s review carried out by

Iida Saarinen
Public Records Officer

File downloads

NRS Public Records (Scotland) Act (PRSA) Fife Council And Licensing Board Progress Update Review (PUR) 2022 Final Report

File type: PDF,
File size: 310.27 KB

Was this page helpful? *

Yes

Yes, but

Your comments