Audit of information management

On this page

• Executive summary
• 1.0 Introduction
• 2.0 Detailed observations, recommendations and management responses
• 3.0 Conclusions
• Annex: About the audit

Executive summary

Information Management (IM) is a discipline that directs and supports effective and efficient management of information in an organization, from planning to disposal and/or long-term preservation.

In the Government of Canada, information is managed as a strategic asset to maximize its value in the service of Canadians. Every government employee is accountable for managing all of the information that they create or collect in the performance of their work.

Within Agriculture and Agri-Food Canada’s (AAFC) Information Systems Branch (ISB), the Information Management Program provides IM tools, policies and best practices to meet business needs and support the lifecycle management of AAFC information assets. To help accomplish this, the Department issued the latest Information Management Strategy 2020-23 (the Strategy) in April 2021.

The Audit of Information Management was included in the Office of Audit and Evaluation’s 2022-23 to 2026-27 Audit and Evaluation Plan.

The audit objective was to determine whether an adequate management control framework is in place for IM and is operating in compliance with relevant Treasury Board policies.

The audit examined IM governance to determine whether a defined and communicated strategic direction and objectives were in place, as well as supporting implementation plans, monitoring and reporting. The audit also assessed controls and process mechanisms for information sharing and retention to determine if they existed and were documented, communicated and followed.

Overall, the audit found that AAFC had some elements of a management control framework in place for IM. However, to ensure that IM risks are adequately mitigated, improvements are needed in several key areas, including: governance, training and information lifecycle management. These should be addressed by:

• Reviewing and updating the next IM Strategy for some key missing elements;
• Developing transition and risk mitigation plans for the next IM Strategy;
• Reporting on IM performance measures and providing annual updates;
• Revising mandatory course(s), guidance and monitoring completion rates;
• Finalizing and providing guidance materials in a central location;
• Obtaining a validated disposition authority for AAFC and implementing processes to regularly dispose of information assets past their retention period.

1.0 Introduction

1.1 Risk context and objective

In the Government of Canada, information is managed as a strategic asset to maximize its value in the service of Canadians. Every government employee is accountable for managing all of the information that they create or collect in the performance of their work.

AAFC has a number of digital tools and repositories to help employees create, collaborate, share and manage the information they produce. At present, Knowledge Workspace (KW) and AgriDOC are AAFC’s official corporate repositories. Corporate information can also be found on shared server drives and in paper files within the Department. AAFC is planning to transition to SharePoint Online on the Microsoft 365 platform as the new official corporate repository over the course of fiscal year (FY) 2023-24 and 2024-25.

The Audit of Information Management was included in the 2022-23 to 2026-27 Audit and Evaluation Plan due to:

• The high complexity in IM given the large number of information repositories within AAFC and increasing technological changes within this area; and
• The importance of effective information management increasing with the majority of AAFC employees largely working from home since the onset of the COVID pandemic.

The audit objective was to determine whether an adequate management control framework was in place for IM and is operating in compliance with relevant Treasury Board policies.

The scope of the audit included the most recent corporate information repository of KW. Other corporate repositories, such as AgriDOC and paper files were considered for certain audit criteria.

The audit focused on the following areas:

• Governance
  • strategic direction and objectives for IM, including supporting implementation plans, monitoring and reporting
• Controls and processes
  • IM training, awareness and outreach activities.
  • mechanisms for information sharing and retention

More details about the audit objective, scope, criteria and approach are in Annex: About the audit.

1.2 Overview of information management

IM is a discipline that directs and supports effective and efficient management of information in an organization, from planning and systems development to disposal and/or long-term preservation.

Two organizations set the direction and guide Government of Canada IM practices:

• Treasury Board’s Policy on Service and Digitaland supporting instruments set out strategic direction and guiding principles for sound information and technology management practices across the Government of Canada.
• Library and Archives Canada provides guidance in the Government of Canada IM community by working collaboratively with the central agencies, departments and others to develop standards, tools and best practices for IM.

Within AAFC’s Information Systems Branch, the IM Program provides IM tools, policies and best practices to meet business needs and support the management of AAFC information assets throughout their lifecycle. To help accomplish this, ISB issued the latest IM Strategy 2020-2023 in April 2021.

Each branch and its employees are responsible to understand IM policies and implement IM practices. Branches, business units and employees must liaise with ISB’s IM experts directly, to support the achievement of the Strategy’s goals, activities and outcomes.

2.0 Detailed observations, recommendations and management responses

The following sections present the key observations, based on the evidence and analysis associated with the audit and provide recommendations for improvement. Management responses were provided and include:

• An action plan to address each recommendation;
• A lead responsible for implementation of the action plan; and
• A target date for completion of the implementation of the action plan.

2.1 Governance

Information governance is the overarching and coordinating strategy for all organizational information. It establishes the authorities, supports, processes, capabilities, structures and infrastructure to enable information to be a useful asset and reduce liability to an organization, based on that organization's specific business requirements and risk tolerance.

Audit criteria: The audit examined whether AAFC has a defined, communicated strategic direction and objectives for IM, including supporting implementation plans, monitoring and reporting.

2.1.1 Information management strategy

The Treasury Board Secretariat (TBS) Policy on Service and Digital states that Deputy Heads are responsible for “approving an annual forward-looking three-year departmental plan for the integrated management of service, information, data, IT and cyber security, which aligns with the Chief Information Officer of Canada’s enterprise-wide integrated plan, [and] is informed by subject-specific plans or strategies as appropriate….”

An IM Strategy outlines the strategic direction that an organization will take to improve management of information as a strategic asset through its lifecycle, including its vision, guiding principles, goals, activities and outcomes. It is also used to direct IM investments and activities to areas that best align with the organization’s business priorities.

What the audit found: AAFC has a three-year IM Strategy that was approved in April 2021. The Strategy has a defined strategic direction and objectives which aligned with Treasury Board policies. The Strategy was communicated across the Department through operational and senior management committees and the intranet. However, there were several missing elements identified within the Strategy, such as: clear and consistent governance structure, outlined roles and responsibilities and coverage of prior corporate repositories.

IM strategic direction and objectives

The current Strategy was approved by the Departmental Management Committee (DMC) in April 2021. The audit determined that the Strategy was aligned with the requirements of the Treasury Board Policy and Directive on Service and Digital (April 2020) and included key elements such as: mission, guiding principles, strategic goals and strategic actions for IM at AAFC.

ISB consulted with other business areas across the Department in the development of the Strategy. Also, the Strategy had been communicated through KW, AgriSource (AAFC’s corporate intranet) the Information Management Advisory Group (IMAG) and senior management committees.

Governance structure

The audit team found that the IM governance structure was inconsistently documented between the Strategy and the IM site within KW. The Strategy document listed IM governance comprised of: The Director General Management Committee (DGMC), IMAG and Branch Information Management Working Groups. While the “Information Management at AAFC” KW site, also included the Deputy Minister, Chief Information Officer, DMC and the Architecture Review Committee.

An unclear governance structure may impede senior management oversight of the Strategy’s implementation and its links to other departmental priorities.

Roles and responsibilities

The audit observed IM governance roles and responsibilities on the “IM at AAFC” site within KW which aligned with the previous IM Strategy 2016-2021. This included the roles and responsibilities of several key positions and committees, such as the Chief Information Officer, DMC, DGMC and the Architecture Review Committee.

However, the Strategy 2020-2023 did not include a roles and responsibilities section listing key roles, IM decision-making authorities, or who was responsible for implementing, monitoring and reporting on the strategy’s action items.

Without consistently documented roles and responsibilities, there may be reduced accountability to ensure the implementation, monitoring and reporting of the IM strategic actions.

Coverage of corporate repositories

The audit team found that the Strategy focused on the Microsoft 365 platform, including the transition from KW to SharePoint Online. This focus was necessitated by the accelerated adoption of the Microsoft 365 platform. While the Strategy included the development of a Legacy Content Plan, it did not itself include a clear vision for the current corporate repositories or the decommissioning of older IM repositories, such as AgriDOC and the shared server drives.

As a result, AAFC employees currently have several IM repositories available to them to store their documents:

• Either in one of the two official corporate repositories (AgriDOC or KW); or
• In one of the prior corporate repositories, such as the shared server drives.

Also, interviews with branch representatives indicated that this situation has led to some confusion as to where to save information.

Without a clearly defined strategic direction for all current and prior IM repositories, there is a risk that employees may not be following AAFC’s IM processes and Treasury Board standards.

Recommendation 1: Information management strategy

The Assistant Deputy Minister, Information Systems Branch, should review and update the next IM Strategy for missing elements, including:

• Governance and oversight;
• Roles and responsibilities including monitoring and reporting; and
• Coverage of main corporate repositories.

Management response and action plan

The next Information Management Strategy (2023-2026) will be finalized and issued in FY 2023-24, and will include information on governance and oversight, roles and responsibilities (including monitoring and reporting), as well as an overall strategy for the evolution of corporate repositories.

Leads responsible: Assistant Deputy Minister, Information Systems Branch; Director General, Strategic Management; Director, Knowledge Services

Target date for completion: March 2024

2.1.2 Implementation plans

The TBS Independent Reviewer’s Handbook outlines that a detailed management plan should include detailed business deployment plans, including data (that is, information) migration and conversion, training and transition plans.

What the audit found: An implementation plan was in place to support the Strategy, but the “Legacy Content Plan Development” only covered KW and did not address AgriDOC and other legacy systems (for example shared server drives). The audit also noted the absence of a risk mitigation plan for the Strategy.

IM Strategy Implementation Plan

The audit team noted that the Strategy had an implementation plan which detailed 13 action items scheduled for completion within the 2020-2023 time period. As of July 2022, the majority of these action items (12) had been completed or were on track to be completed by the end of 2022-23:

• 5 action items were completed;
• 7 action items were on track to be completed by March 2023; and
• 1 action item involving the Disposition Authority Validation was delayed and would not be completed by March 2023.

Legacy content plans

In June 2022, ISB issued a “KW Transition Strategy Options” document to support the decommissioning of KW by March 2025. At the time of audit conduct, this transition document was considered draft and had not been finalized.

However, the audit team observed there was no transition plan drafted for AgriDOC and any previous IM repositories (for example shared server drives). The previous IM Strategy 2016-2021 included timelines to decommission AgriDOC and shared server drives in 2020-21, but these were never enacted.

There is a cost to maintain multiple IM systems. This also contributes to operational inefficiencies, such as the additional time and effort needed to respond to Access to Information and Privacy requests and perform litigation holds across multiple IM repositories. There are also significant project costs and employee effort required to decommission these legacy systems due to technical complexities, content migration and records and litigation issues.

Risk mitigation plan

The audit observed that a number of milestones had not been met in the previous IM Strategy. Also, interviews indicated the lack of potential buy-in for adopting new IM processes. For these reasons, the audit team expected to find a supporting plan to address potential risks in the implementation of the current Strategy, but found that risk analysis and mitigation strategies had not been compiled.

With the absence of a risk analysis and mitigating strategies for implementing the Strategy, there is a risk that the action items may not be completed and that AAFC’s IM processes may not follow Treasury Board policy.

Recommendation 2: Implementation plans

The Assistant Deputy Minister, Information Systems Branch, should develop transition plans to phase out AgriDOC and other legacy systems (for example: shared server drives) and a risk mitigation plan for the implementation of the next IM Strategy.

Management response and action plan

The transition strategy for KW has been completed and implementation is in progress.

A Legacy Content Plan will be developed by March 2023 as a deliverable of the current IM Strategy (2020-2023). This plan will define a strategy to address legacy information management applications including AgriDOC and shared drives.

A risk mitigation plan will also be completed in support of the next Information Management Strategy (2023-2026) that will be issued in FY 2023-24.

Leads responsible: Assistant Deputy Minister, Information Systems Branch; Director General, Strategic Management; Director, Knowledge Services

Target date for completion: March 2024

2.1.3 Monitoring and reporting

According to the Treasury Board’s Audit Criteria related to the Management Accountability Framework, oversight bodies should request and receive sufficient, complete, timely and accurate information.

What the audit found: Strategic discussions on IM activities were occurring at operational and senior management levels within the Department. An IM Performance Measurement Plan and IM Performance Indicators were drafted, but they had not been finalized, nor implemented. At the time of audit conduct, senior management had not received an annual update on the Strategy’s implementation.

Strategic discussions on IM activities

The audit team reviewed the records of decision from April 2021 to August 2022 and observed that AAFC senior management and operational management committees received updates and held discussions on Microsoft 365 and other large IM initiatives.

IM Strategy performance measurement

The Strategy outlined an IM Performance Measurement Framework, which consisted of an IM Performance Measurement Plan and IM Performance Indicators.

The audit team found that the IM Performance Measurement Plan was well defined in terms of roles and responsibilities, data collection, reporting and escalation procedures. The IM Performance Indicators provided metrics for 13 strategic actions from the Strategy, with a reporting schedule as follows:

• DMC: Twice a year and as needed;
• DGMC: Twice a year and as needed;
• IMAG: Quarterly/monthly/ad hoc.

However, the audit team found that the IM Performance Measurement Plan and IM Performance Indicators had not been finalized and implemented at the time of the audit conduct.

Without performance measurement, there is a risk that senior management is unable to effectively monitor and oversee AAFC’s IM activities.

Annual updates on IM Strategy

As listed in the Strategy, annual updates were to be provided to the IMAG and senior management. The audit team examined the records of decision for IMAG, DMC and DGMC and determined that one update was provided to IMAG in April 2022, and there were no annual updates on the Strategy provided to DGMC and DMC up to the time of audit conduct.

The absence of progress updates on IM strategic activities may impede senior management’s decision-making in this area.

Recommendation 3: Monitoring and reporting

The Assistant Deputy Minister, Information Systems Branch, should finalize and report on the IM performance measures and provide annual updates to senior management on the IM Strategy implementation.

Management response and action plan

A Performance Measurement Framework for the Information Management Program will be completed by March 2023. The Framework will be used to provide annual updates to senior management committees starting in FY2023-24.

An annual update on the implementation of the Information Management Strategy will be provided to senior management.

Leads responsible: Assistant Deputy Minister, Information Systems Branch; Director General, Strategic Management; Director, Knowledge Services

Target date for completion: December 2023

2.2 Training

Training and awareness activities are fundamental controls used to support a culture of strong IM practices within an organization. Training provides users with the necessary knowledge, skills and abilities to follow standardized IM practices and facilitate the adoption of IM tools and processes.

Audit criteria: The audit examined whether IM training, awareness and outreach activities are in place and updated to reflect a changing environment.

2.2.1 Training and awareness

The Treasury Board Policy on People Management outlines that departments should support and promote a continuous learning environment within their organization which encourages and enables employees to acquire and maintain the knowledge, skills and competencies to succeed in their work, including the completion of mandatory training.

What the audit found: Both mandatory and recommended training courses were available to employees and a number of awareness activities were held on a regular basis. However, ISB had not been tracking the completion rates of mandatory IM training. Also, interviews with AAFC branch representatives indicated that employees were uncertain as to which IM tools and applications to use for saving corporate information.

Training

IM training consisted of general IM courses and specific IM system and user training. The audit found that training links were available to AAFC employees through AAFC’s Learning and Development and ISB’s AgriSource sites, as well as through a centralized training calendar in KW.

AAFC employees were required to complete a general, mandatory IM course: Fundamentals of Information Management (COR501), within 30 days of being hired. ISB had designed a performance indicator to track the completion of this course within the draft Performance Measurement Plan, but it had not been performed.

Mandatory training was also provided for specific IM systems, including AgriDOC and KW. Training was also given for specific user roles, including KW Site Administrators and individuals requiring specific training.

The audit noted that ISB had a number of feedback mechanisms in place to develop new training and enhance awareness activities. These included the Change Makers Network, IMAG which consisted of representatives from across the Department, early adopter groups to test new information systems (for example: Microsoft 365 and SharePoint Online), as well as surveys from training courses.

By not tracking the performance indicator for mandatory training, there is a risk that AAFC employees may not be aware of or correctly follow Government of Canada and AAFC’s IM processes and guidelines.

Awareness

ISB used various awareness tools to promote existing and develop new training, such as: committee presentations, All-Staff emails, news@work, Microsoft Teams video sessions and supporting information within AgriSource and KW.

However, interviews with branch representatives indicated that employees were unsure as to which IM tools and applications to use for saving corporate information, given the multiple options available to them.

As some staff may be unsure as to which IM applications to use and IM practices to follow, there is a risk of incorrect corporate repository usage and non-compliance with lifecycle management practices.

Recommendation 4: Training and awareness

The Assistant Deputy Minister, Information Systems Branch, should revise the mandatory course(s) and/or post guidance on the intranet to address potential gaps in IM awareness and monitor the completion rates for the mandatory IM course(s).

Management response and action plan

The Information Management Program reviewed the content of the mandatory Canada School of Public Service IM course in August 2020 and identified gaps. The AAFC Information Management Awareness course was developed to bridge these gaps and has been available since April 2021. This course is not currently mandatory.

ISB will review the IM mandatory training needs for AAFC and recommend any changes by June 2023 in consultation with CMB.

The performance indicator and reporting on completion rates of mandatory training will be reviewed and implemented by Q1 of FY 2023-24.

Leads responsible: Assistant Deputy Minister, Information Systems Branch; Director General, Strategic Management; Director, Knowledge Services

Target date for completion: March 2024

2.3 Information management lifecycle

The IM lifecycle refers to overseeing information from its creation through to its final disposal. Steps in the IM lifecycle include: planning; receiving, creating and capturing; organizing; using and sharing; as well as preserving and disposing. Lifecycle management is important as it ensures that information is not mishandled or accidentally deleted.

Audit criteria: The audit examined whether IM lifecycle requirements are documented, communicated and supported by departmental IM processes and tools for KW.

2.3.1 File creation

According to the Treasury Board Policy on Service and Digital: “when creating or collecting information of business value, departments need to ensure that metadata for key profile fields is maintained” and information should be “aligned with departmental architecture taxonomies and classifications.”

What the audit found: The audit found that a metadata structure and business information architecture had been defined and implemented for KW.

Metadata

Metadata provides a consistent set of standard terms that describe a file’s content and captures its key business function within a department. Metadata also supports a retention and disposition schedule and the identification of archival materials as defined by Library and Archives Canada.

The audit team observed that a metadata structure was in place for KW and included information such as: document title, author and last modified date. KW’s metadata structure included both mandatory and optional metadata fields. The audit examined the use of the 3 mandatory metadata fields: “Content Type,” “Business Activity” and “Document Type” and found that mandatory fields were being filled-in most (98.7%) of the time.

Business information architecture

A business information architecture is designed to capture the business purpose of all information assets for an organization.

The audit found that ISB designed a departmental Business Information Architecture for KW. The “Content Type” metadata field of the architecture identified a document’s departmental business function. Some examples of Content Type were “Management Oversight” and “Science and Innovation,” which are key mandated and internal functions delivered by the Department.

2.3.2 File management

According to the Treasury Board’s Audit Criteria related to the Management Accountability Framework, there should be “formal and well-understood mechanisms for IM, retention and sharing, (which) are well documented and communicated…” and followed.

What the audit found: The audit found that AAFC IM lifecycle requirements were generally documented and communicated through directives, processes and guidelines on AgriSource and KW. However, some key process documents were still in draft version, such as: KW Document Disposition, the IM Program AgriDOC Operational Disposition and Information Management Guidelines for Employee Exits and Moves documentation. The “Disposition Processes Update” and “IM Exit Guideline refresh” were identified as strategic actions within the IM Strategy 2020-23 and are due to be completed by March 2023.

File management

In addition, the audit observed that IM guidance was not stored in a central, readily accessible location for employees. For example, metadata guidance was not located on the IM Program’s home page in AgriSource or in KW and could only be found in training materials and by searching various other KW sites.

Incomplete or difficult to locate guidance may result in employees not being able to understand and follow AAFC’s IM processes.

Recommendation 5: Guidance materials

The Assistant Deputy Minister, Information Systems Branch, should update, finalize and provide guidance materials in a central location, including documentation on metadata and disposition processes for AAFC corporate repositories.

Management response and action plan

The Information Management Program will finalize and post guidance material on AgriSource and KW, including documentation on metadata and disposition processes for AAFC corporate repositories.

Information will also be provided to explain the processes prior to and following the completion of AAFC’s validated disposition authority

Leads responsible: Assistant Deputy Minister, Information Systems Branch; Director General, Strategic Management; Director, Knowledge Services

Target date for completion: December 2023

2.3.3 File disposition

According to the Treasury Board Guideline on Service and Digital: “transitory (information not of business or enduring value) information should be destroyed as soon as they are no longer needed.” Also, from the Treasury Board Directive on Service and Digital “the departmental Chief Information Officer, in collaboration with other department officials as necessary, is responsible for developing a documented disposition process and performing regular disposition activities for all information.”

What the audit found: The audit found that transitory information was being disposed of and information assets were being transferred when employees left the Department, however regular disposition of information assets was not occurring.

Transitory information disposition

The audit team noted that AAFC had ongoing activities to manage transitory information. Examples included: a departmental digital clean-up week that occurred in winter 2022 and focused on developing and practising good email management practices. The audit observed that as part of the “Future of Work at AAFC”^{Footnote 1}, the Corporate Management Branch was coordinating the branches to clean up paper files and the IM Program provided an IM/Litigation awareness video with guidelines to support clean-up initiatives in spring 2022. At the time of audit conduct, office clean-up initiatives were occurring at National Headquarters in Ottawa and the Winnipeg regional office.

Transfer of information assets at employee exit

The audit observed that a new Entrance, Internal Mobility and Separation System was in place to manage the transfer of information assets from departing employees. This system was fully launched in January 2022 and was mandated for all employees working 6 months or more at AAFC.

Regular disposition of information assets

The audit found that the AAFC IM Program had issued a Records Retention Schedule (latest version effective as of 2020) that recommended the length of time that different types of information assets should be kept to meet operational requirements.

In 2016, AAFC was issued a disposition authorization by Library and Archives Canada. This disposition authority identified organizational areas within the Department that were most likely to produce archival material.

As a next step, ISB planned to obtain a validated disposition authority which was included as an action item in the Strategy. Without a validated disposition authority, all of AAFC’s disposition activities require consultation with Library and Archives Canada on a case-by-case basis to identify potential information of archival value and to obtain authorization to dispose of other information assets. Due to this extended process, AAFC had only been seeking authorization to dispose of information on an as needed basis. Once AAFC obtains its validated disposition authority, the Department would be in a position to perform its own identification and transferring of archival information to Library and Archives Canada in a more efficient manner.

As a result, the audit team observed that regular disposition of information assets past their recommended retention period was not occurring. A review of executive governance committee records within KW in July 2022 showed that 204 of 652 records reviewed (31%) were kept beyond their recommended retention period.

Without regular disposition activities, information assets continue to accumulate within the Department, resulting in inefficiencies for document retrieval and storage, particularly for Access to Information and Privacy requests and litigation holds. In addition, without a validated disposition authority, AAFC is not meeting its obligation to transfer information assets of archival value to Library and Archives Canada once recommended departmental retention periods have been surpassed.

Recommendation 6: Validated disposition authority

The Assistant Deputy Minister, Information Systems Branch, should:

• complete the process to validate AAFC’s disposition authority; and
• develop and implement processes to regularly dispose of information assets beyond their retention period for KW, AgriDOC and other legacy systems.

Management response and action plan

A plan for completion of validating AAFC’s disposition authority will be developed in consultation with Library and Archives Canada (LAC).

The validation of the disposition authority could be completed by December 2024, dependent on resource availability and competing pressures. This will be included in the risk mitigation strategy that is being developed as part of the next IM Strategy for AAFC.

In the interim, AAFC will perform disposition activities on a priority basis with oversight from LAC. Once the disposition authority is validated, LAC oversight will no longer be required and AAFC will re-establish a process for the ongoing disposition of departmental records in all AAFC systems.

Leads responsible: Assistant Deputy Minister, Information Systems Branch; Director General, Strategic Management; Director, Knowledge Services

Target date for completion: December 2025

3.0 Conclusions

The audit concluded that the Department has some elements of a management control framework in place for IM. However, to ensure that IM risks are adequately mitigated, improvements are needed in several key areas, including: governance, training and IM lifecycle management.

Annex: About the audit

Statement of conformance

The audit conforms to the Institute of Internal Auditors' International Professional Practices Framework, as supported by the results of AAFC’s internal audit quality assurance and improvement program. Sufficient and appropriate evidence was gathered in accordance with the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing to provide a reasonable level of assurance over the findings and conclusion in this report. The findings and conclusion expressed in this report are based on conditions as they existed at the time of the audit and apply only to the areas included in the audit scope.

Audit objective

To determine whether an adequate management control framework is in place for IM and is operating in compliance with relevant Treasury Board policies.

Audit scope

The scope of the audit included the most recent corporate information repository of KW. Earlier corporate repositories, such as AgriDOC and paper files were considered for certain audit criteria. Other business area specific repositories were not included within the audit scope.

Also, the audit did not assess the following areas:

• Document Classification and Security of Information: these areas fall under the responsibility of Corporate Management Branch’s Departmental Security Services and a document author’s responsibility for classifying and handling the information.
• Data management: AAFC’s IM Strategy does not cover data management as this area is covered by the Department’s Data Strategy.

Period covered by the audit

To assess IM processes and practices, the audit focused on the period from March 2021 to September 2022. However, to gain a more complete understanding of certain IM areas, the audit examined prior year activities and processes where applicable.

Audit criteria

The audit examined the following criteria during the audit’s conduct phase:

• Governance: AAFC had a defined and communicated strategic direction and objectives for IM, including supporting implementation plans, monitoring and reporting.
• Training: IM training, awareness and outreach activities were in place and updated to reflect a changing environment.
• IM lifecycle: requirements were documented, communicated and supported by departmental IM processes and tools for KW.

Audit approach

The audit approach was risk-based and consistent with the Institute of Internal Auditors' International Professional Practices Framework. These standards require that the audit be planned and performed in such a way as to conclude against the audit objective. The audit was conducted in accordance with an audit program, which defined audit tasks to be performed to obtain and examine sufficient and appropriate evidence to assess each audit criterion.

The audit team performed the following work to complete the engagement:

• Review of documents, such as Treasury Board Policy and Directive on Service and Digital (April 2020); Government of Canada Strategic Plan for IM and IT 2017-2021; AAFC IM Strategy 2020-2023 (April 2021); AAFC Information Management Exit Directive (April 2021); and IM training materials.
• Interviews with key stakeholders, including representatives from the following organizational areas: Corporate Secretariat; Senior Branch Advisers; Digital Services and Innovation, ISB; Digital Transformation and Service Integration, ISB; Business Applications, ISB; Knowledge Services, ISB; Information Management Program, ISB; and Collaboration Technical Services Group, ISB.
• Review of documents stored in KW sites as of July 21, 2022; and a review of Records of Discussion/Decision from 4 governance committees as of July 2022.