Download Final assignment: Record Management Policy and more Assignments Library science in PDF only on Docsity!
Charting a Course for Effective
Record Management at BC
Hydro
Proposed Records Management Policy for BC Hydro
December 2024
SUBMITTED BY
The RIM First Team (Amruta Phansalker, Josiah Nworie, & Sunday Olaniran)
STAKEHOLDER
Dr. Inaam Charaf School of Information: University of British Columbia LIBR 516: Information Asset Management Table of Contents Company Overview................................................................................................................................................
Workforce & Department Overview....................................................................................................................
Benefits of a Record Management Policy...............................................................................................................
Policy Framework.....................................................................................................................................................
Data Gathering......................................................................................................................................................
Implementation.....................................................................................................................................................
Change Management & Training..........................................................................................................................
Policy Objectives.......................................................................................................................................................
Key Challenges for BC Hydro.................................................................................................................................
Legal & Regulatory Considerations.......................................................................................................................
Budget & Personnel Considerations.......................................................................................................................
Responsibilities of Records Management Office (RMO).....................................................................................
Responsibilities of Managers................................................................................................................................
Responsibilities of Employees..............................................................................................................................
Classification of Information................................................................................................................................
Retention & Disposition Schedule...........................................................................................................................
Governance and Corporate Records........................................................................................................... Legal & Regulatory Records........................................................................................................................ Communication & Marketing Records......................................................................................................... Facilities & Safety Management................................................................................................................... Finance Management................................................................................................................................... HR Management.......................................................................................................................................... IT.................................................................................................................................................................. Community & First Nations........................................................................................................................... Storage Recommendations..................................................................................................................................
Storage Options.....................................................................................................................................................
Record Availability...............................................................................................................................................
Responsibilities.....................................................................................................................................................
Security Recommendations.....................................................................................................................................
General Recommendations...................................................................................................................................
Security Categorization.........................................................................................................................................
Security Levels......................................................................................................................................................
Business Continuity Plan (BCP)..............................................................................................................................
Business Impact Assessment............................................................................................................................
Risk Assessment...................................................................................................................................................
Technological Issues and Concerns.........................................................................................................................
Challenges with Policy Design.................................................................................................................................
Team Attitude & Collaboration..............................................................................................................................
Areas Not Addressed in This Policy........................................................................................................................
References..................................................................................................................................................................
Appendix A: Questionnaire...................................................................................................................................
Part I: Policy Proposal
Company Overview BC Hydro, a short name for British Columbia Hydro and Power Authority, is a Canadian Electric utility company that supplies power to 95% of British Columbia residents. It was founded in 1961 by the government of BC as Crown Corporation to provide and make accessible electricity across the province (BC Hydro, n.d.). Today, BC Hydro remains one of the largest electric utilities in Canada. The company is recognised for its commitment to clean energy, innovation, and ongoing work with indigenous communities and environmental groups to ensure sustainable energy practices (BC Hydro, 2023.).
Workforce & Department Overview
BC Hydro currently has about 7700 employees, who work in departments that span a wide range of operations and support functions, organised to manage its expansive utility responsibilities across British Columbia (BC Hydro, n.d.). These include Customer Service, Power generation, Transmission and Distribution, Corporate Services, and Safety, among others. BC Hydro’s organisational structure features about 50 functional departments, led by key executives in each area, to handle specific responsibilities such as asset strategy, indigenous relations, project support, and community programs. This structure enables BC Hydro to provide efficient service delivery while focusing on energy sustainability and community engagement. Benefits of a Record Management Policy BC Hydro powers 95% of British Columbians and is committed to meet their future energy needs as well. During the 12-month period that concluded on April 1 2024, B.C.’s population witnessed a growth of 3.3% (BC Stats, 2024). BC Hydro must therefore, prepare to meet the rising needs of a growing population, while ensuring its commitment to safety. A robust policy mitigates risks associated with
implementing this framework as best as possible will create a solid foundation for the records management program at BC Hydro.
Data Gathering
To assess the recordkeeping practices and expectations of the employees, we made use of purposive sampling to select participants, who were then invited to participate in semi-structured and in-person interviews. Appendix A is an example of a questionnaire that was sent to participants. Responses were used to create affinity maps for grouping of similar ideas and responses, giving rise to themes , which informed record keeping requirements. Company information was collected from official documents such as annual reports, service plans, and strategic plans to ensure alignment with BC Hydro's priorities. Our research also spanned regulatory documentation & records management recommendations of the Government of BC.
Implementation
This policy has been designed to be rolled out in phases, which will allow for a less disruptive implementation process without overwhelming the staff. An example policy rollout plan has been described in Appendix C.
Change Management & Training
We propose a top-down approach to policy implementation , relying on the formal organization to drive the proposed changes to recordkeeping practices (Bright & Cortes, n.d.). The records management office will conduct training sessions to ensure awareness on proper recordkeeping practices. Effective communication is the cornerstone of successful change management, and helps create a shared understanding of common goals and expectations (Valo & Mikkola, 2019). We will use different
communication channels such as emails, messenger service, and regular in-person meetings to promote the new policy. Appendix D contains a template for a change management and communications plan, while Appendix F contains a proposal for budget increases to account for new hires & training costs.
in the nascent stage (ARMA, 2009). We postulate that this policy will result in BC Hydro elevating its recordkeeping maturity to LEVEL 3 (Essential). This policy shall apply to all employees, contractors, and third parties involved in creating, receiving, maintaining, and managing records on behalf of BC Hydro. It covers both physical and electronic records regardless of their form or location. Key Challenges for BC Hydro Compliance complexity : It is expected of BC Hydro to adhere to multiple legislative and regulatory frameworks, including FOIPPA, the Information Management Act, and BC Utilities Commission (BCUC) guidelines; understanding and integrating all of the requirements into a cohesive policy became daunting. Balancing diverse stakeholder expectations (e,g,. Legal, IT, Operations, Customer service etc) presented delays and conflict during policy development. We discovered that departments maintained their own records systems , resulting in fragmented storage and inconsistent practices. We discovered that there were inadequate security measures which could lead to breaches, and protecting customer information and operational records against cyber threats is critical. We discovered that determining appropriate retention periods for different types of records could be challenging especially when records fell under overlapping regulatory requirements. Developing a strategy for vital records and ensuring their protection during disasters posed a challenge. There were budget and personnel constraints , which had the potential to hinder the implementation of the policy.
Legal & Regulatory Considerations The primary regulatory body is the British Columbia Utilities Commission (BCUC), which regulates BC Hydro's rates, service quality, and infrastructure investments. (BCUC, n.d.). The Utilities Commission Act empowers BCUC in mandating BC Hydro to maintain comprehensive records and their accessibility. (BC Laws, 1980). Our policy adheres to the GARP Principle of Compliance , which ensures BC Hydro can meet legal and regulatory obligations and respond effectively to audits and litigations. Sections of the Utilities Commission Act that informed this policy have been provided as Appendix E. BC Hydro is subject to a wide range of provincial and federal laws, some of which are briefly described below: Act Description Hydro & Power Authority Act Provides the legal & operational framework for BC Hydro. Environmental Management Act Defines the environmental regulations, as they relate to water quality, air emissions, and waste management that BC Hydro must abide by.
● Policy evaluators , who will from time to time, evaluate & update the policy as needed.
Responsibilities of Managers
● Ensure compliance with the policy, procedures, standards, and recommendations ● Educate their organisations on classification schemes, retention & disposition schedules ● Coordinate with managers and third parties in ensuring adherence to this policy
Responsibilities of Employees
● Classifying records according to the record classification scheme ● Ensuring appropriate handling, storage, retention, and disposition of records ● Practising policy compliance, and reporting violations Classification of Information We recommend using the Functional Classification Scheme to classify BC Hydro’s records. Functions of a business rarely change, and implementing this scheme will help ensure that users are able to retrieve information as and when needed (Shepherd & Yeo, 2003). Our long-term goal is to align it with the Government of British Columbia's Administrative and Operational Records Classification Systems (Province of BC, 2024). The following table lists the primary classification schemes, and more will be added in subsequent revisions of the policy. Classification Description Governance & Corporate Records that reflect relationships with the government, other corporations, corporations, and community interest groups. Legal & Regulatory Records that pertain to legal and regulatory framework, which may be required for legal advice, lawsuits, claims, dispute resolution, and access to information. Communication & Marketing Records of communications with internal and external stakeholders such as company messaging, promo videos, press releases, events, and photographs.
Equipment & Supplies Management Records related to planning, acquisition, use, and disposition of equipment used by BC Hydro. Facilities & Safety Management Records related to all the properties of BC hydro, as well as day-to-day operations of the office. Also includes quality and safety of operations, including, but not limited to quality standards, employee safety procedures, and safety operations. Finance Management Records such as financial statements, general ledger, accounts receivable and payable, tax statements, payroll records, bank statements, and any other records that support the finance function of BC Hydro. HR Management Records pertaining to current and past employees of BC Hydro, including, but not limited to employee information (PII), payroll records, job details, and performance reviews. IT Records such as email systems, computer-based systems both hardware & software, IT security standards, network infrastructure, and managed storage. Community & First Nations Records related to connections with First Nations and other communities, including but not limited to agreements, litigations, disputes and claims. Retention & Disposition Schedule Creating a Records Retention and Disposition Schedule for an energy company of BC Hydro’s size requires identifying the record categories, understanding recordkeeping needs, legal and regulatory requirements, and balancing operational needs with compliance obligations. The retention & disposition schedules are based on federal & provincial recommendations, such as the CRA’s recordkeeping recommendations on tax records, BC’s Records Retention Guide for Workers Compensation Act, & the Records Classification & Retention Schedule for FIPPA. Acronym Key : CY = Calendar Year; D = Destroy; FY = Fiscal Year; FR = Full Retention by Archives; SR = Selective Retention; SO: Superseded or Obsolete; A: Active Record; IA: Inactive Record Governance and Corporate Records Vital Record: No Record Action Board Meeting Minutes, Government and External Relations CY +5Y, SR
Finance Management Vital Record: Yes Record Action General Ledgers, Accounts payable and Receivable, bank statements CY +10Y, FR Tax Reports & Audits, Payroll Retain permanently Bank statements, Budget forecast, reports, and audits, procurement CY +5Y, SR Other reports and statements CY +3Y, SR HR Management Vital Record: Yes Record Action Employee files, Payroll records, Safety incidents, claims, litigations CY +7Y, FR Benefit, pension, & disability records, Policies, procedures, standards, guidelines Retain permanently until SO Recruitment, competition, awards, advices, other reports CY +3Y, SR IT Vital Record: IT Security Policies only Record Action Computer assisted systems, including hardware, software, firmware, system backups, Policies, procedures, standards, guidelines, advices CY +10Y, FR Email correspondence, IT incident logs, licenses A: Retain permanently; IA: +2Y, D Other reports and statements CY +3Y, SR
Community & First Nations Vital Record: Yes Record Action Policies, procedures, guidelines, advices, special reports, litigations Retain permanently until SO Community programs & workshops, Resources, issues, committees CY +3Y, D Other issues & reports, program materials, press releases CY +5Y, SR Storage Recommendations The storage recommendations are specific to digital or electronic records , the implementation of which ensures alignment with the GARP Principles of Availability & Integrity.
Storage Options
The choice of storage shall be based on the record's nature, format, and therefore, its retention period. To optimize storage costs, vital records will be securely stored on-site, while non-critical records will be stored in the cloud by partnering with a reliable cloud service provider.
Record Availability
According to Waldron (2024), one of the major advantages of cloud storage is improved accessibility. By making appropriate use of cloud solutions,records can be available when needed, in order to support the business operations of BC Hydro. The RMO will identify the value of records , and ensure that these records are protected against unauthorized access. Access should be granted by means of implementing
General Recommendations
Digital records should be maintained in their electronic form, to preserve their context. Robust security measures, such as audit trails and system testing, must be implemented. The on-site server where vital records reside must be protected using industry recommendations. Backup sets of vital records should have appropriate levels of protection consistent with the standards applied at the main site.
Security Categorization
For the purpose of enforcing security, the records of BC Hydro shall be categorized as follows: Category Description Highly restricted Information that is highly valuable and highly sensitive Confidential Information that is highly valuable, but not highly restricted Internal Use (^) Information that may not be released to the general public Public Information that may not be released to the general public
Security Levels
Data capture The RMO shall thoroughly evaluate the value of records, the criticality of those records, potential vulnerabilities, as well as threats. Data at rest Sensitive records will be encrypted using industry standards. Encryption for internal or public use records shall be evaluated on a case by case basis. Data in transit The same rules as Data at rest apply. Data transmitted to third parties must be protected to the same level as highly restricted data.
Business Continuity Plan (BCP) We propose planning for business continuity as a way to minimise disruptions and enable a swift recovery from incidents. The BCP formulation consists of the following (adapted from the Business Continuity Management Policy of the DePaul University):
Business Impact Assessment
A Business Impact Assessment (BIA) identifies key business records and assesses the potential consequences of a business disruption if the records are lost. Department heads must complete: ● Identification of business critical operations and resources ● A high-level plan to mitigate the likelihood and/or severity of a threat ● A high-level plan to recover from data loss, and as a result business function Vital records such as engineering schematics and grid operations data must be prioritised for full recovery. Redundant copies of these vital records should be in secure offsite locations.
Risk Assessment
Each department shall determine the risks that have the greatest likelihood of occurrence and/or the severity of impact on the department’s day to day operations. The results of this assessment along with the BIA inform the BCP. The BIA, BCP, and the Risk Assessment report must be stored in a special repository designed for this purpose. Appendix H contains a risk assessment questionnaire for determining the business value of records.
