managing electronic records in governmental bodies - National ...

41
The electronic records management software must be able to prevent changes to
the content of records and must provide the functionality to record all events that
affect the records to make it possible to track deliberate or accidental alterations of
records. It is imperative that the system logs an audit trail of all actions that were
taken against a record including the date of the action and the identification of the
person who has taken the action. It should log changes to the records and to the
metadata. The system should also be capable of preserving the audit logs as
records in the electronic repository and must prevent them from being changed.
Audit trail
An audit trail is a record of actions taken on records within the electronic repository.
Records must be able to be deleted from the system. The electronic records
management software must provide the functionality to record all events that affect
the records to make it possible to track authorised and unauthorised deletion of
records.
The National Archivist is the only authority who can authorise the legal destruction of
records in terms of a disposal authority. It must not be possible to destroy or delete
records or their metadata information outside of the normal disposal function. It must
also not be possible to hide records by deleting their metadata. All disposal actions
should be logged to ensure that illegal destruction of records could be traced.
Proper records management also requires that files and their metadata should be
transferred from one storage medium or location to another, as their activity
decreases and/or their use changes. This transfer can be to either near-line, offline
or into archival custody.
It must at all times be possible to trace the precise location of records by recording
references to the new location of the records. The destruction and transfer audit log
should be kept as part of the records of a fully documented disposal process and
should be unalterable.
The records management software must keep an audit trail of:
• all the actions that are taken upon an electronic record, electronic file or file plan;
• the user initiating and/or carrying out the action;
• the date and time of the event.
The system must also provide an audit trail of all changes made to:
• groups of electronic files;
• individual electronic files;
• electronic volumes;
• electronic records;
• electronic documents
• metadata associated with any of the above, and
Managing electronic records_Policy Guidelines.doc
First Edition
Version 1.1
April 2003