RECORDS MANAGEMENT AND THE …

1 RECORDS MANAGEMENT AND THE ACCOUNTABILITY OF governance A thesis submitted to the University of Glasgow for the degree of Doctor of Philosophy in the Faculty of Arts APRIL 2009 AZMAN MAT ISA HUMANITIES ADVANCED TECHNOLOGY AND INFORMATION INSTITUTE AZMAN MAT ISA 30 APRIL 2009 iiERRATUM iiiABSTRACT governance is the process by which power and authority are exercised in a society by which government, the private sector, and citizens groups articulate their interests, mediate their differences, and exercise their legal rights and obligations. governance in public organisations is different from that in private organisations as they both possess different types of institutional stakeholders.

2 Governments are directly answerable to the public. Therefore, it is essential for governments to be transparent in order to avoid any triggers in the accountability process that might adversely affect people s trust. The proper creation, capture, distribution and preservation of juridical evidence in the form of RECORDS can help avoid these problems. A trusted government is one that can demonstrate its accountability and transparency and is continually striving to improve value delivery and increase cost-effectiveness. The freedom of information demands governments to be more transparent and accountable for their actions and decisions. Whilst governments promote corporate governance to provide transparency and objectivity it can only give stakeholders better tools to do their job, it does and cannot do it for them.

3 The need for managing risk and audit culture is imperative to balance and satisfy the expectation of citizen and stakeholders. The accountability of a government can arguably only be achieved when it demonstrates considerable transparency, which in turn can only happen when trust is supported by authentic and reliable RECORDS . The RECORDS MANAGEMENT community claims that RECORDS have to be preserved for accountability, but they rarely explore what accountability is and what role RECORDS play in the accountability processes. In addition, the contribution of RECORDS MANAGEMENT to good governance and accountability are often not recognised by other professions and MANAGEMENT . In an age where corporate governance and transparency is a global agenda, it is imperative for the RECORDS MANAGEMENT community to scrutinise their present role and approach in order to change the perception by other professions about their contribution towards achieving organisational goals in a highly regulated and compliant bound environment in the public and private sectors.

4 The contention of this thesis is that record keeping is just a tool that ensures the availability of evidence for the accountability of governance , which in turn relies on the ethical standard of those involved. ivTABLE OF CONTENT RECORDS MANAGEMENT AND THE ACCOUNTABILITY OF governance ..i ERRATUM .. ii ABSTRACT ..iii List of Figures .. v List of Tables ..vi List of Abbreviations and ACKNOWLEDGEMENT ..ix DECLARATION OF AUTHOR S COPYRIGHT ..x RESEARCH PROBLEM RESEARCH RESEARCH RESEARCH RESEARCH LITERATURE REVIEW ..6 RECORDS THE RECORDS LIFE PHASES OF RISK MANAGEMENT AND MANAGING RECORDS AND ACCOUNTABILITY OF CASES OF POOR CASES OF POOR DISCUSSION ON VARIOUS THEMES RELATED TO THE CASE METHODS OF DATA STANDARD LIFE PLC, THE EUROPEAN INVESTMENT BANK, NHS GREATER GLASGOW AND CLYDE DISCUSSION AND APPENDIX.

5 27980 v List of Figures Figure Page The life cycle concept of RECORDS .. 35 The record life cycle .. 37 Combination of the life cycle models .. 38 Hierarchy of risk .. 57 The risk MANAGEMENT process .. 59 Corporate governance technology components .. 62 Oracle compliance architecture comprehensive, sustainable and compliance .. 64 Model of accountability .. 69 The structure of Standard Life .. 152 Risk MANAGEMENT directorate of the EIB .. 178 The ISIS programme .. 185 The governance of risk MANAGEMENT of the NHSGGC .. 208 vi List of Tables Table Page The timeline of critical events for Enron in the period August to December 2001.

6 114 The timeline of events surrounding the Hutton Inquiry and the Butler Report .. 117 An example of a risk scorecard in Standard Life .. 158 An example of a record retention schedule in Standard Life .. 163 The governance structure of the NHSGGC .. 203 viiList of Abbreviations and Acronyms AIRMIC : The Association of Insurance and Risk Managers, United Kingdom ALCO : ALM Committee, European Investment Bank ALP : Australian Labour Party APPM : Archives, Personal Papers and Manuscripts BCBS : Basel Committee on Banking Supervision BCS : British Computer Society CEO : Chief Executive Officer CFO : Chief Finance Officer CHPs : Community Health Partnerships CHCPs : Community Healthcare Partnerships CID.

7 Communication and Information Department, European Investment Bank CMT : Corporate MANAGEMENT Team, NHS Greater Glasgow CRAG : Credit Risk Assessment Group, European Investment Bank DERA : Defence Evaluation and Research Agency, United Kingdom DFS : Department of Family Services, Queensland, Australia DFSAIA : Department of Family Services and Aboriginal and Islander Affairs, Queensland, Australia DIRKS : Designing and Implementing of RecordKeeping System EIB : European Investment Bank ERPANET : Electronic Resource Preservation and Access Network EU : European Union FOI : Freedom of Information Act 2002 FOISA : Freedom of Information (Scotland) Act 2002 FSA : Financial Services Authority GAO : Government Audit Office, United States GED : Gestion lectronic de Documents GMC : General Medical Council GP : General Practitioner ICT : Information and Communication Technology IRM : The Institute of Risk MANAGEMENT , United Kingdom ISIS : Integrated Strategic Information System ISO : International Standards Organisation IT.

8 Information Technology JIC : Joint Intelligence Committee, United Kingdom JOYC : John Oxley Youth Detention Centre, Queensland, Australia LHCC : Local Health Care Co-operative MAS : Metropolitan Ambulance Service, Victoria, Australia MCCD : Medical Certificate of Cause of Death viiiMoD : Ministry of Defence, United Kingdom MoReq : Model Requirements for the MANAGEMENT of Electronic RECORDS NAO : National Audit Office, United Kingdom NARA : National Archives and RECORDS Administration NHSGG : National Health Service Greater Glasgow NHSGGC : National Health Service Greater Glasgow and Clyde NHS QIS : National Health Service Quality Improvement Scotland OAIS : Open Archival Information Systems PACE : The Police and Criminal Evidence Act 1984 QPOA : Queensland Professional Officers Association, Australia QSSU : Queensland State Services Union, Australia QTU : Queensland Teachers Union, Australia RMD : Risk MANAGEMENT Directorate, European Investment Bank RMSG : Risk MANAGEMENT Steering Group, NHS Greater Glasgow RMU : RECORDS and MANAGEMENT Unit, European Investment Bank SDLC : System Development Life Cycle SEC : Securities and Exchange Commission SEHD.

9 Scottish Executive Health Department SIC : Statement on Internal Control SOX : Sarbanes-Oxley Act (2002) SWD : Social Work Department UK : United Kingdom UNSCOM : United Nations Special Commission US : United States XML : eXtensible Mark-up Language WMD : Weapons of Mass Destruction ixACKNOWLEDGEMENT This thesis would not have been possible without guidance and support from numerous people. Firstly, I am greatly indebted to my supervisors, Professor Michael Moss for the knowledge, patience and understanding that he has contributed throughout the whole duration of my research; and to Professor Seamus Ross and Lesley Richmond for their valuable support and comments throughout my research.

10 Secondly, I would like to thank Alistair Tough and Dr James Currall for their support and constructive insight. Sincere thanks to all interviewees for sharing their professional experience and enthusiasm in assisting me with this study. Mr Alan Murdock and his colleagues in the European Investment Bank, Luxembourg; Mrs Kate Knight in Standard Life, Edinburgh; Mr Alistair Tough, Mr John Hamilton, Dr Harry Burns, Mrs Elinor Smith, Mr Alan Lindsay, and Mr Andy Crawford in the NHS Greater Glasgow and Clyde; and Mr Mark White in PricewaterhouseCoopers, Glasgow. Many thanks also extended to all staff of HATII especially Adele Redhead, ERPANET and fellow PhD candidates for their kind assistance and support.