Records Management

What is it?

Public entities which practice good procurement management view record management as important. This is because sound record management is an important way in which public entities ensure transparency and accountability in their procurement processes. This reduces the vulnerability to legal issues or even financial losses, as well as promoting efficiency.

Most countries have developed legislation in relation to records management for public procurement. The table below outlines the information and documents required in Ghana.[1]

As well as identifying the required records to be kept, legislation in Ghana also stipulates how public entities are required to keep the records. Procurement records should be organised and filed according to the contract package, type of procurement, and the method adopted. Records should be kept in a way to enhance easy identification and retrieval. Thus, it is recommended that all procurement processes should bear an identification code which is based on the type of procurement, method of procurement, name of project, year of procurement, and a unique sequence number. This identification code should be specific to individual procurement processes and should be the means of process identification right from the procurement plan.

ISO 15489-1:2016 defines the concepts and principles from which approaches to the creation, capture and management of records are developed.

Organisations increasingly utilise electronic data management software for managing their procurement records, because they are more efficient and records stored electronically are easily retrievable whenever needed. This increases the need to establish security and data protection protocols to protect the access to and confidentiality of the information stored. A records management and information security policy should be documented and implemented that defines retention times (how long the information is stored) and outlines secure methods of retention, including back-ups. Data protection should be applied to all procurement activity.

What does it look like?

Namukasa (2017), of the Makerere University Business School in Uganda, has developed a conceptual framework of procurement records management and its relationship with procurement performance.[2] This is shown below.

How does it work in practice?

A study in Ghana identified four main gaps in procurement record management by public entities. These gaps were identified as: fragmentation of files; different departments keeping the fragmented files; unavailability of certain required records; and difference between process file name and number in comparison with the process name and number in procurement plans.[3]

Another study in Tanzania identified non-compliance with procurement records and documentation, which was caused by three major factors: the absence of a procurement records procedure manual, lack of training, and inadequate support.[4]

In South Africa, a records management and information security policy has been documented and implemented that defines retention times and outlines secure paper-based and electronic methods of retention, including back-ups. Data Protection is applied to procurement activity.

The Records Management Policy and Procedures are embedded into Standard Operating Procedures. Physical records of contracts are stored in safes, and scanned on to microfiche. There is a back-up and recovery system in place for electronic data storage. However, there is no particular focus on data protection of procurement activity evident.

In Kenya, there is a Procurement Records Management Procedures Manual and a Records Management Policy, which appear to be sound documents. The latter could be improved with the inclusion of a record retention period matrix for all documentation across all functions, both hard copy and electronic.

Regarding ICT and the protection of information, this should be detailed in a dedicated Information Security Management Policy and Procedure, under the ownership of the ICT Department. The updated Records Management Policy and newly created Information Security Management Policy should be a mandatory training requirement for all staff. The protection of personal data requires examination in accordance with the requirements of Kenya Law.

In Nigeria, it is clear that records are retained for a long period of time. However, there is no clear policy evidenced. With a wide range of information collected and generated, a clear policy needs to be in place supported by sufficient controls to support commercial decisions, respect intellectual property and maintain confidentiality. There do not appear to be appropriate controls for the removal of data in both hard copy and electronic forms. For example, policies on document visibility in offices and restrictions on the use of unsecured data keys.

[1] Ottou, Jemima; Baiden, Bernard; Nani, Gabriel; Gaps in public procurement records management; International Journal of Procurement Management; Vol. 12, No. 5, 2019

[2] Namukasa, Juliet; Records Management and Procurement Performance: A case of NAADS program in the central region of Uganda; Records Management Journal, August 2017

[3] Namukasa, Juliet; Records Management and Procurement Performance: A case of NAADS program in the central region of Uganda; Records Management Journal, August 2017

[4] Matto, Mordecai; Athumani, Haruna; Investigating non-compliance with procurement documentation and records keeping in Tanzania public procurement; International Journal of Economics, Commerce and Management; Vol. VI, Issue 9, September 2018