Records Management

Records Management Audit

Objective

To determine the extent to which the Office of the Clerk and Recorder’s operations are governed by effective and efficient controls and processes.

Background

The Office of the Clerk and Recorder is headed by Denver’s elected clerk and recorder. The office includes both an Elections Division and a Recording Division, which has five departments including the City Clerk Department.

That department is responsible for preserving and distributing records as well as making that information available online to the public and other city agencies. The department also records documents on behalf of the public, including real estate documents and marriage and civil union licenses. These records become part of the public record and are available online.

Why this matters

The Office of the Clerk and Recorder is headed by Denver’s elected clerk and recorder. The office includes both an Elections Division and a Recording Division, which has five departments including the City Clerk Department.

That department is responsible for preserving and distributing records as well as making that information available online to the public and other city agencies. The department also records documents on behalf of the public, including real estate documents and marriage and civil union licenses. These records become part of the public record and are available online.

Findings

The Office of the Clerk and Recorder Has Not Developed a Strategic Plan, Impacting Its Ability to Effectively and Efficiently Manage Records

  • The office does not have a formalized plan to prioritize the digitization of records, has not assessed what documents are considered historical or what risks threaten stored records, and is not destroying records in accordance with the city’s records retention schedule.
  • The office has not identified how to organize staff to effectively and efficiently perform work and prevent unnecessary disruptions. The office has not conducted a workforce analysis and does not have sufficient succession planning to ensure work continues when staff leave.
  • The office operates without sufficient policies and procedures, which impacts the efficiency and effectiveness of its operations.

The Office of the Clerk and Recorder Is Not Taking Sufficient Measures to Protect Individuals’ Personally Identifiable Information

  • The office does not proactively redact certain personally identifiable information when recording documents and there are inconsistent redaction practices among staff.
  • The office does not adequately disclose to individuals and organizations that information being recorded will become part of the public record and therefore will be accessible online.

Recommendations

1.1 Develop and Document a Strategic Plan – The Office of the Clerk and Recorder should use best practices, such as those from the Government Finance Officers Association, to develop and document a strategic plan that focuses on officewide and specific goals for records management. The plan should include, at a minimum, goals related to records storage, digitization, and retention. The plan should also allow for progress to be measurable and objective based.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.2 Develop and Document an Action Plan – The Office of the Clerk and Recorder should develop an action plan to describe how strategies will be implemented, including activities to be performed, associated costs, designation of responsibilities, priority levels, and time frames.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.3 Develop Measurable Objectives to Monitor Progress – The Office of the Clerk and Recorder should develop measurable objectives to monitor progress on achieving goals outlined in the strategic plan. Progress towards meeting goals should be monitored and the Office of the Clerk and Recorder should make adjustments to the plan as needed.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.4 Assess and Update Strategic Plan – The Office of the Clerk and Recorder should periodically assess and update the strategic plan based on internal and external factors such as demographic and economic factors.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.5 Establish and Document Criteria for Historical Documents – The Office of the Clerk and Recorder should use best practices to establish and document criteria for historical documents to ensure valuable documents are kept and preserved beyond the established retention period.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.6 Develop an Appraisal Process – The Office of the Clerk and Recorder should develop an appraisal process for evaluating the historical value of documents based on established criteria. The process should be documented in a procedure.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.7 Review and Revise Retention Period for Contracts – OThe Office of the Clerk and Recorder should work with the City Attorney’s Office to review and revise the retention period for contracts to align with the definition of historical documents and existing retention practices.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.8 Review and Revise the Retention Schedule – The Office of the Clerk and Recorder should review and revise Schedule 15 of the city’s general records retention schedule to ensure all inventory is accounted for and to clarify and consolidate categories of records.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.9 Complete Workforce Analysis – The Office of the Clerk and Recorder should complete a workforce analysis and document a strategy to meet its goals, including plans for job and organizational design, internal development, training, recruitment, and succession planning.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.10 Create and Document Review Processes – The Office of the Clerk and Recorder should create and document review processes to provide quality assurance for the following procedures: digitizing and retaining copies of older documents, recording and marriage processes, and city clerk processes. Management should periodically review the procedures for continued relevance and effectiveness in achieving the office’s objectives or addressing related risks.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.11 Obtain and Review Service Provider Reports – The Office of the Clerk and Recorder should obtain and review service provider reports from contracted vendors on a yearly basis. The office should develop a policy and procedure to ensure this task is completed every year. The office should identify the staff who should perform this duty.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.12 Establish Contract Oversight – The Office of the Clerk and Recorder should establish policies and procedures focused on ensuring contract compliance while clarifying and formalizing roles within the office for contract oversight.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

1.13 Create Customer Service Policies and Procedures – The Office of the Clerk and Recorder should draft customer service-related policies and procedures for identifying, collecting, documenting, and analyzing data associated with both positive and negative reviews. Additionally, the office should define specific roles and responsibilities related to customer service.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

2.1 Follow Executive Order No. 143 – The Office of the Clerk and Recorder should follow the city’s Executive Order 143 related to data and information privacy to protect the personally identifiable information of individuals.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

2.2 Develop and Document Policies and Procedures for Redaction – The Office of the Clerk and Recorder should work with the Information and Governance Committee to develop and document a policy and procedure that is in alignment with Executive Order No. 143, and is also more stringent than state law, in order to proactively redact certain personally identifiable information on all document types before the document becomes publicly available in the city’s online records database.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

2.3 Redact Personally Identifiable Information – The Office of the Clerk and Recorder should retroactively redact certain personally identifiable information from its online records database. The office should document the steps they took to retroactively redact this information.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

2.4 Develop and Document Policies and Procedures for Public Disclosure – The Office of the Clerk and Recorder should develop policies and procedures to inform anyone who records a document that their document will become part of the public record and will be posted publicly in the city’s online records database, which can be viewed by anyone on the internet.

Agency Response: Agree, Implementation Date – Aug. 5, 2021

 

Auditor's Letter

May 20, 2021


The objective of our audit of the Office of the Clerk and Recorder’s records management program was to determine whether its operations are governed by effective and efficient controls and processes. The clerk and recorder requested this audit after having been elected in 2019. I am pleased to present the results of this audit.

The audit found the Clerk and Recorder’s Office needs to develop a strategic plan to effectively and efficiently manage records. Additionally, the office has not identified how to organize staff to perform work and prevent unnecessary disruptions. The office operates without sufficient policies and procedures and is not taking adequate measures to protect individuals’ personally identifiable information. Because of their sensitive nature, the specific details of that finding, as well as a third finding also related to personally identifiable information, were reported confidentially to the Clerk and Recorder’s Office and the independent Audit Committee.

We also note that office leadership initially denied our ability to access copies of legal documents required to complete our analysis. We encountered significant delays before the information was eventually provided.

By implementing recommendations to use leading practices to develop a strategic plan and identify priorities, to conduct a workforce analysis to determine necessary resources for meeting its goals, to develop and document policies and procedures, and to proactively remove personally identifiable information, the office will be better equipped to effectively and efficiently manage records as well as prevent potential identity theft.

This performance audit is authorized pursuant to the City and County of Denver Charter, Article V, Part 2, Section 1, “General Powers and Duties of Auditor.” We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

We extend our appreciation to the personnel in the Office of the Clerk and Recorder as well as the City Attorney’s Office and the city’s Technology Services agency who assisted and cooperated with us during the audit. For any questions, please feel free to contact me at 720-913-5000.

Denver Auditor,

Auditor's Signature
Timothy O'Brien, CPA

Follow-up

A follow-up report is forthcoming.


 


 

Tim_mug.png

AUDITOR TIMOTHY O'BRIEN, CPA
Denver Auditor



Denver Auditor´s Office

201 W. Colfax Ave. #705 Denver, CO 80202
Emailauditor@denvergov.org 
Call: 720-913-5000
Follow us on Facebook     Connect with us on Twitter
Read our social media policy

Auditor´s Office Logos for Footer