Browse our range of reports and publications including performance and financial statement audit reports, assurance review reports, information reports and annual reports.
Take our Insights reader feedback survey
Help shape the future of ANAO Insights by taking our reader feedback survey.
Insights: Audit lessons
Records Management
Published
Friday 20 June 2025
Contact
Please direct enquiries through our contact page.
Audit Lessons aims to share insights from our audit work and to make it easier for people working within the Australian public sector to improve performance.
Records Management is targeted at all Australian Government officials. It also benefits those in information management roles.
Introduction
The management of government records plays an integral role in Australian Government performance, integrity, accountability and transparency. A ‘record’ is information that is created, sent or received in the course of work done for the Australian Government (essentially, information with business value).
Effective records management is required by law and helps entities retain critical sources of evidence for robust public administration, responsive service delivery, and accountability to the Parliament and public.
Benefits of effective records management
- Better ability to meet business needs and outcomes.
- Greater assurance that legislative requirements are being met.
- Improved decision-making capability, including a reliable evidence base for decisions.
- Decreased risk of corporate knowledge loss and enhanced business continuity.
- Increased business efficiency.
- Improved network space management.
- Enhanced data security.
- Better preparedness during periods of change and emergencies.
- Greater parliamentary and public trust.
Records management requirements
Records management frameworks
Public Governance, Performance and Accountability Act 2013
The Public Governance, Performance and Accountability Act 2013 (PGPA Act) establishes a system of governance, performance and accountability for resources managed by Commonwealth entities. It requires entities to exercise the proper use and management of public resources — with ‘proper’ meaning efficient, effective, economical and ethical.
Records management in the PGPA Act
Other Australian Government frameworks that address specific aspects of records management include the Data Availability and Transparency Act 2022, Australian Government Investigations Standard, the Commonwealth Grants Rules and Principles 2024, and the Commonwealth Procurement Rules.
Archives Act 1983
Paragraph 5(2)(c) of the Archives Act 1983 outlines obligations relating to the management of Commonwealth records and establishes the National Archives of Australia (National Archives).
National Archives is the lead agency within the Australian Government for guidance and advice on information management. As part of this function, National Archives:
- determines information management standards for Australian Government agencies;
- issues whole-of-government information management policies (National Archives’ current policy is Building trust in the public record: managing information and data for government and community);
- ensures the Australian Government creates and keeps records of its decisions and actions to demonstrate accountability to the community and evidence of the integrity of the operations of the Australian Public Service (APS);
- authorises destruction of records with no ongoing value to government or community; and
- selects and preserves the most significant records of the Australian Government and makes them available to government and community.
National Archives developed the Information Management Standard for Australian Government to assist Australian Government entities to create and manage information effectively. The standard presents eight principles for good information management and National Archives’ expectations for the management of business information.
Principles of the Information Management Standard for Australian Government
Public Service Act 1999
Good records management is aligned to the APS values, including the values of stewardship and being accountable, as set out in the Public Service Act 1999.
- Accountable: The APS is open and accountable to the Australian community under the law and within the framework of Ministerial responsibility.
- Stewardship: The APS builds its capability and institutional knowledge, and supports the public interest now and into the future, by understanding the long-term impacts of what it does.
Records management in the APSC’s Values and Code of Conduct in Practice
Under the APSC’s Stewardship Guidance, employees are responsible for: ‘ensuring complete, accurate, and appropriately accessible recordkeeping of key actions and decisions’. Information stewardship sustains public trust and confidence in the integrity of the APS.
Senate Procedural Order of Continuing Effect 12: Orders for documents
As a transparency measure, entities are required to table file lists every six months. The list should be indexed and comprise titles of all files relating to policy-advising functions of the agency, including any relating to the development of legislation and other matters of public administration. The list should be accessible on the entity’s Internet home page.
ANAO findings on records management
Performance audit
In the past five years, the majority of ANAO performance audit reports, including all 45 performance audit reports presented for tabling in the Parliament in 2023–24, included findings on deficiencies in records management.
Mentions of records management in performance audit reports, 2019–20 to 2023–24
Note: Audits without mentions of records management in overall conclusions or recommendations had comments on records management in the audit findings, key messages, and/or opportunities for improvement.
When the 41 records management recommendations are mapped against the National Archives’ Information Management Standard principles, the majority of recommendations relate to Principles 1 (governance of information) and 2 (creating necessary information that is fit-for-purpose).
Percentage of 2023–24 ANAO records management recommendations by Information Management Standard principles
The majority of performance audit reports presenting for tabling in 2023–24 examined governance or procurement (51 per cent). Procurement audits were the most likely to include records management recommendations, with seven (88 per cent) of eight procurement audits including recommendations on records management in 2023–24.
Government activities examined in 2023–24 ANAO performance audit reports
|
Government activity |
Number of audits |
Number (and %) of audits with records management recommendations |
|
Governance |
15 |
10 (67%) |
|
Procurement |
8 |
7 (88%) |
|
Regulation |
7 |
3 (43%) |
|
Service delivery |
7 |
4 (57%) |
|
Grants administration |
4 |
1 (25%) |
|
Policy development |
3 |
2 (67%) |
|
Asset management and sustainment |
1 |
0 (0%) |
|
Total |
45 |
27 |
Performance statements audit
The ANAO audits annual performance statements to provide assurance to the Parliament that the information contained in the statements can be relied on and is supported by accurate records. By requiring entities to provide records to support their performance statements, the audits strengthen the ability of entities to produce high quality performance information.
In February 2025, the ANAO’s report on the 2023–24 performance statements audits of 14 entities was presented for tabling in the Parliament. Entities’ progress and capacity to produce meaningful performance information were examined against a maturity model for performance frameworks. The model comprises five categories including ‘reporting and records’, which considers whether performance statements are clear, meaningful and tailored to user needs, and whether records are accurate, complete, reliable, and easily retrievable. Across the 14 audited entities, the average maturity rating for ‘reporting and records’ was 2.8 (on a scale of 0 to 5), with three entities assessed at 4 or higher — Attorney-General’s Department; the Department of Industry, Science and Resources; and the Treasury.
Financial statements audit
The ANAO provides independent assurance on the financial statements and financial administration of all Australian Government entities.
Entities tend to have well-established systems configured to produce easily reconcilable financial statements. However, occasionally the ANAO has findings related to records management and financial statements (see Case study 2).
Audit lessons
Analysis of recent ANAO audits highlights eight lessons on improving records management practices in Australian Government entities.
- Lesson 1: Promote a culture where records management is valued
- Lesson 2: Establish an information governance framework
- Lesson 3: Make records available for use and reuse
- Lesson 4: Use compliant records management systems
- Lesson 5: Ensure that official business communications are appropriately recorded
- Lesson 6: Integrate records management into business processes
- Lesson 7: Prioritise records management during machinery of government changes
- Lesson 8: Ensure records are complete and accurate
The further reading section provides links to: relevant ANAO and National Archives resources, and additional Insights products.
Lesson 1: Promote a culture where records management is valued
Entities should take ongoing steps to promote a culture where the creation and maintenance of necessary records is valued for the benefits it can bring to individuals and the organisation, including the achievement of organisational objectives.
Actions entities could take to promote a culture where records management is valued include:
- in accordance with Principle 1 of the Information Management Standard, establishing an information management framework, including an information management policy, that supports information governance and the management of records;
- requiring that the role of the entity’s chief information governance officer includes advocating for, and setting the culture for, effective records management;
- advising staff of their responsibilities through induction and training;
- making good records management a component of individual performance agreements;
- informing staff of how to keep proper records through internal guidance, standard operating procedures and protocols;
- integrating specific records management actions into work procedures and processes;
- promoting the individual and organisational benefits of good records management;
- making the use of records management systems mandatory and addressing non-compliance when it occurs;
- prioritising records management systems when allocating business improvement resources;
- consulting users when designing and implementing records management tools and systems to ensure they support business processes and user needs;
- conducting regular compliance checks or internal audits of records management systems and practices;
- analysing annual information management maturity check-up survey scores to identify areas for improvement; and
- considering the implications of change management processes on records management.
Case study 1. Records management in DEWR
The Department of Employment and Workplace Relations (DEWR) is responsible for the Australian Apprenticeships Incentive System (Incentives System). The Incentives System provides primarily financial support to eligible individuals with the aim of developing a skilled and relevant Australian workforce that supports economic sustainability and competitiveness. In 2023–24, the ANAO examined the design and implementation of the Incentives System. Positive record keeping practices included:
Several factors helped shape a culture of valued records management:
Lesson 2: Establish an information governance framework
Principle 1 of the Information Management Standard sets out the importance of establishing and maintaining systematic governance of business information, including records. This is achieved by having an overarching information governance framework supported by an information management strategy and policy. Together, these should outline how business information will be managed in practice to:
- support and improve operational processes and strategic outcomes;
- satisfy stakeholder needs and legislative and regulatory obligations;
- support the implementation of whole-of-government policies and initiatives such as transitioning to digital practices; and
- meet industry and information management standards and codes of practice.
Commitment to regular review and update of the information governance framework and information management strategy ensures that information management practice remains current and relevant.
Alignment of an information governance framework’s strategy, policy and practice
Source: Adapted from National Archives of Australia, Establishing an information governance framework, National Archives, Canberra, available from https://www.naa.gov.au/information-management/information-governance/establishing-information-governance-framework [accessed 19 June 2025].
2022–23
The ANAO identified a moderate finding related to records management at the Bureau of Meteorology. A history of records management deficiencies had contributed to errors in the measurement of revenue, leases, and property, plant, equipment and intangibles. The underlying causes were:
These issues were exacerbated in an environment of frequent staff turnover with change management weaknesses.
2023–24
The Bureau of Meteorology resolved the previous year’s moderate finding by improving its policies and practices for records management, including:
Lesson 3: Make records available for use and reuse
Several principles of the Information Management Standard relate to the availability, use and reuse of records:
- Principle 2: ‘Necessary business information is created’ to effectively support business needs;
- Principle 4: ‘Business information is suitably stored and preserved’, such that business information is stored in a secure and fitting environment, and preserved to ensure ongoing usability; and
- Principle 8: ‘Business information is available for use and reuse’ refers to creating and managing business information in a way that can be accessed over time by staff and other users.
To maintain the ongoing usability of its records, entities could regularly review:
- how information can be more easily shared with internal and external stakeholders;
- what information must be restricted (for example, for security or privacy reasons);
- whether business systems and governance structures should be integrated with system functionality that enables and disables information sharing as needed; and
- whether tools and systems should be updated to enable consistent entry of standardised descriptive data that supports sharing of information, with automated capability if possible.
By making records discoverable and reusable, entities build public trust in government information and operations. Records that are shared externally should:
- enable public discovery and reuse;
- meet open government objectives, including open access to information as a default position;
- comply with the public’s right of access, under the Archives Act 1983, Freedom of Information Act 1982 and Privacy Act 1988;
- maximise government, industry and public benefit from Australian Government information and data; and
- position entities well for the audit process.
Case study 3. Records management for annual performance statements in Treasury
The ANAO has audited the performance statements of the Treasury since the 2021–22 reporting period.
- strong oversight by internal bodies such as the Audit and Risk Committee;
- sign-off of detailed information by senior staff to ensure measures are appropriate and results are certified;
- documented roles and responsibilities in performance reporting;
- high-quality methodology documentation; and
- regular reporting timeframes with a mid-cycle performance review.
- paragraphs 22, 2.8 and 3.12 of Audits of the Annual Performance Statements of Australian Government Entities — 2022–23; and
- paragraph 3.7 of Performance Statements Auditing in the Commonwealth — Outcomes from the 2023–24 Audit Program.
Lesson 4: Use compliant records management systems
Principle 7 of the Information Management Standard is ‘Business information is saved in systems where it can be appropriately managed’. A suitable records management system protects the integrity of records and supports trusted and reliable use of records. Records management requirements should be considered when selecting an appropriate system for information capture.
An electronic document and records management system (EDRMS) is a software application used to manage:
- digital information, for example: word-processed documents, spreadsheets, images and datasets;
- digitised or scanned documents; and
- physical information, for example: paper records and physical objects.
Other applications such as enterprise content management systems can also be used to manage information and data. These types of systems can help with information classification, management, use and search, storage and disposal.
The selected system should:
- meet key standards such as ISO 16175, which provides internationally agreed principles and functional requirements for software applications used to create and manage digital information in office environments;
- integrate with other key business systems; and
- be fit for the entity’s purposes.
Entities may manage electronic records via other means, such as through network drives or cloud-based file storage and collaboration systems. The suitability of these alternatives should be carefully considered for each entity. Managing electronic records in an EDRMS (instead of, for example, a network drive) reduces records management risk. Network drives are not intended for information management and are unlikely to meet Australian Government or international standards.The evolving nature of cloud-based file storage and collaboration systems requires entities to monitor their configuration to meet business needs and information requirements over time. While these systems usually have some information management functionality, some local configuration or governance may be needed to ensure it continues to be fit-for-purpose. It may need to be integrated with an EDRMS to be suitable and meet requirements.
Entities may benefit from referring to the Business System Assessment Framework to assess the information management functionality of its systems. This enables entities to identify opportunities for improvement to the management of its business information.
Case study 4. AITSL’s record keeping system
The ANAO examined the Australian Institute for Teaching and School Leadership’s (AITSL’s) administration of national standards and frameworks in 2023–24.
- communication with stakeholders, and
- changes to project plans during implementation.
The audit suggested that the AITSL review its information management risks to inform decision-making regarding storage of information and records.
Lesson 5: Ensure that official business communications are appropriately recorded
Entities should consider how communications records (such as those generated through emails, text messages, instant messages, group chats, and other messaging applications) are used in entity business, and how meetings are recorded. Communications used to conduct official business (including on personal devices) are Australian Government records and need to be appropriately managed. The appropriate recording of meetings is particularly important for meetings that introduce probity risks, such as those related to procurement, contract management and grants management activities.
National Archives provides guidance that emails containing information with business value must be saved and managed appropriately. This includes emails:
- sent or received in the course of work;
- relating to work projects;
- approving actions; and
- providing business advice, giving a direction or recording a decision.
Guidance for managing email can also be applied to instant messaging records. Emails or messages with little or no business value can be deleted according to the entity’s normal administrative practice.
All digital information created from 1 January 2016 must be managed digitally (action 9 of the Building trust in the public record policy). Emails and messages should be stored in only digital format (not printed and stored on paper). Meetings with business value should be recorded and appropriately saved and managed. For meetings held with third parties, entities should consider developing meeting protocols that contain guidelines regarding risks associated with holding meetings in informal venues and properly recorded minutes.
Case study 5. Management of email records for a Tourism Australia procurement
In 2023–24, the ANAO examined Tourism Australia’s procurement and contract management activities, including its management of records.
Lesson 6: Integrate records management into business processes
Integrating records management into business processes helps make the creation and storage of necessary business information easier and more likely to be implemented.
Embedded records management practices can be achieved by setting up business rules in systems that require proper collection, filing and storage of records before enabling the user to advance in a business workflow.
- A case management system is recommended for entities looking to embed decision-making workflows for the management of contracts, investigations, services, human resources, complaints, compliance and claims. The system may be configured so that, before a file can be closed and/or another stakeholder can view and edit content, certain mandatory actions must be completed (for example, attaching key documents or signing off on procedural milestones).
- In processes such as the development of annual performance statements, ‘signing packs’ containing key documents may also be implemented to help staff understand key record-keeping requirements.
Case study 6. Integrating records management into business processes
The primary purpose of Australia’s trade measurement system is to ensure that the pricing of traded goods is based on accurate measurement. In 2023, the ANAO examined the effectiveness of trade measurement administration at the Department of Industry, Science and Resources (DISR). Three of the ANAO’s six recommendations to DISR mentioned the need for improvements to its records management practices.
Lesson 7: Prioritise records management during machinery of government changes
Records management is an important component of business continuity, especially during periods of change, such as a machinery of government change. During a machinery of government change, part of an Australian Government entity and its business, staff and records are transferred to another Australian Government entity and/or a new entity is created. By prioritising records management during this period, affected entities can reduce risks to business continuity; decision-making; adherence to laws, rules and frameworks; and maintaining public accountability.
Record-related issues encountered during implementation of machinery of government changes include:
- insufficient planning and timeframes for system integration;
- difficulty migrating records due to differing system infrastructure;
- differences in system security classification levels between transferring and receiving entities;
- entities receiving inaccurate information about the physical records assets of transferred entities;
- difficulty verifying relevant records to transfer; and
- organisational and whole-of-government requirements being overlooked.
The Machinery of Government Changes Guide helps Australian Government entities navigate the practicalities of machinery of government changes. The guide states that records management is integral to due diligence entities are expected to exercise. Suggestions include:
- governance mechanisms and protocols for recording key decisions and tracking progress should be established by a steering committee overseeing the implementation of the machinery of government change;
- the steering committee should assign a sole responsible owner of records policy and management; and
- sole ownership of records policy and management should continue beyond the completion of the machinery of government change.
Entities should also ensure that when they are absorbing additional functions, the records on the implementation of parliamentary committee or ANAO recommendations made to the former holder of those functions are transferred and become the responsibility of the receiving entity.
Records management advice and support related to machinery of government changes, including transfer of records, can be sought from National Archives and the Department of Finance’s guidance on Information Assets.
Case study 7. Machinery of government changes for climate change commitments
The Department of Climate Change, Energy, the Environment and Water (DCCEEW) was established in 2022 by combining functions from four entities. This machinery of government change intended to establish a sole authority for leading integrated delivery arrangements for the implementation of the Australian Government’s climate change commitments.
In 2023–24, the ANAO recommended that DCCEEW develop and implement an information assets management policy consistent with the Archives Act 1983 to ensure that records are complete and accurate. DCCEEW would have benefited from establishing records management policy and practice under a sole responsible owner from the outset of the machinery of government change.
Subject to available resourcing, DCCEEW committed to developing and implementing a department-wide information assets management policy to improve the quality of its records management practices.
Lesson 8: Ensure records are complete and accurate
Quality records are sufficiently complete, accurate, and understandable so as to be useful. The quality of reporting and records generally reflects the quality of underlying data and systems, as well as leadership in governance practices.
Principle 3 of the Information Management Standard lays out three recommended actions to help facilitate complete and accurate record keeping.
- Analyse and describe what needs to be known about business information so that all needed information can be easily found, understood and used.
- Determine what level of description is adequate.
- Design or provide tools and systems that:
- where possible, automate the collection and management of descriptive information;
- enable staff to enter descriptive information in a consistent manner; and
- where required, standardise description to support sharing and interchange of quality data between internal and external systems.
With the rapid growth in technology, entities increasingly have opportunities to adopt tools and systems to support complete and accurate record keeping. For example, voice-to-text technologies can be used to generate transcripts of panel meetings on grants or procurement assessments, to ensure comprehensive records on the selection process.
Case study 8. Completeness and accuracy of records for program transition arrangements
In 2022–23, the Department of Social Services (DSS) was responsible for overseeing the transitional arrangements of the Cashless Debit Card program to the Enhanced Income Management program. The aim of the programs was to assist people in budgeting their welfare payments. Services Australia supported both programs and the transition between them. In 2023–24, the ANAO identified that coordination between DSS and Services Australia would have been enhanced by maintaining complete and accurate records.
Areas for improvement included ensuring that: joint risk registers were complete and meeting minutes were recorded.
Questions for reflection
|
Lesson 1: Promote a culture where records management is valued |
|
Does our entity have a culture that values records management?
|
|
Lesson 2: Establish an information governance framework |
|
Does our entity have an information governance framework that provides an overview of how enterprise-wide information assets are created and managed?
|
|
Lesson 3: Make records available for use and reuse |
|
Are records at our organisation readily available for use and reuse by all stakeholders?
|
|
Lesson 4: Use compliant records management systems |
|
Does our entity use an appropriate records management system, such as electronic document and records system, enterprise content management system, or equivalent?
|
|
Lesson 5: Ensure that official business communications are appropriately recorded |
|
Does our entity record information that holds business value, including those generated through emails, text messages, instant messages, group chats, other messaging applications, and meetings?
|
|
Lesson 6: Integrate records management into business processes |
|
Does our entity have records management practices embedded into its systems and workflows?
|
|
Lesson 7: Prioritise records management during machinery of government changes |
|
For entities that will undergo a machinery of government change: Has our entity prioritised records management as part of machinery of government change considerations?
|
|
Lesson 8: Ensure records are complete and accurate |
|
Are our records complete, accurate, and understandable so as to be useful?
|
Further reading
ANAO links
- 2023–24 Performance Audit Outcomes | Australian National Audit Office (ANAO)
- ANAO Annual Report 2023–24 | Australian National Audit Office (ANAO)
- Audit Matters 1 — September 2024 | Australian National Audit Office (ANAO)
- Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2024 | Australian National Audit Office (ANAO)
- Performance Statements Auditing in the Commonwealth — Outcomes from the 2023–24 Audit Program | Australian National Audit Office (ANAO)
- Public sector accountability – the ANAO’s role | Australian National Audit Office (ANAO)
- Reporting Meaningful Performance Information | Australian National Audit Office (ANAO)
External links
National Archives of Australia
- Agency Service Centre | naa.gov.au
- Building trust in the public record | naa.gov.au
- Getting started with information management | naa.gov.au
- Government Agencies Information Network (GAIN) Australia | naa.gov.au
- Information management for records created using Artificial Intelligence (AI) technologies | naa.gov.au
- Information management legislation | naa.gov.au
- Information Management Standard for Australian Government | naa.gov.au
- Integrity and Information Management: guidance for Australian Government agencies | naa.gov.au
- Managing social media and instant messaging (IM) | naa.gov.au
- Your social media policy – what about records? | naa.gov.au
Legislation
- Archives Act 1983
- Public Governance, Performance and Accountability Act 2013
- Public Service Act 1999
Other
- APS Values and Code of Conduct in practice | Australian Public Service Commission
- Australian Government Investigations Standards | Attorney-General’s Department
- Case Management Standard | Australian Government Architecture (DTA)
- Commonwealth Procurement Rules | Department of Finance
- Information management | Department of Finance
- Machinery of Government (MoG) | Australian Public Service Commission
- Machinery of Government Changes Guide | Department of Finance