Step 1.  Identify and reduce risks (Risk assessment)

Understanding risk is vital to developing strategies to respond to disasters.

A risk assessment covers the identification, analysis, and assessment of risk to work out which events are likely to occur and their potential impact on records.

Risks can be reduced through implementation of the Standard on records management and Standard on physical storage of State records. These standards help lessen the impact of a disaster, through:

• knowledge and documentation of the types of records held
• identification of high value / high risk records and where to locate them
• regular records sentencing to reduce unnecessary holdings
• assessment of appropriateness of storage areas
• regular site monitoring and maintenance activities, and
• site access and security provisions.

A review of your Public office’s level of conformity with these standards will help inform your risk assessment and assist in the mitigation of risks.

3.1 Identifying risks

Some risks will apply generally to multiple storage areas or public offices, others are site specific or unique to a single storage area or public office. It is important to consider both types of risk.

Public offices will be able to re-use existing risk assessments for storage or business continuity plans, and determine:

• Compliance with standards issued by NSW State Archives and Records
• Site-specific risks, for example:
  • building structure and state of repair (tip: Conduct regular audits of the building)
  • geographic positioning and surrounds (e.g. near airports, chemical plants, waterways or in a bushfire prone area)
  • history of natural disasters in the area
• Ability to respond to disasters and resources available
• The impact that the loss of records would have on business
• Priority records and where they are located
• The acceptable level of risk.

Further risk considerations are outlined in Principle 1 of the Standard on physical storage of State records.

3.2 Analysing risk

Once identified, risks can be analysed and ranked on a risk matrix (a scale of probability versus impact). Remember the scale of risks affecting records may differ to the scale of risks affecting health and safety or business continuity.

Fig.1 Example of disaster risk matrix (for risk relating to records)

Considerations for analysing and ranking risks include:

• investigating the frequency of particular types of disasters (often vs. rarely)
• determining the degree of predictability of the disaster
• analysing the speed of onset of the disaster (sudden versus gradual)
• determining the amount of forewarning associated with the disaster
• estimating the duration of the disaster, and
• effectiveness of existing prevention measures.

3.3 Treating risks

After an informed analysis, measures can be put in place to treat gaps and reduce the impact of identified risks.

Treatment for risks may involve:

• site monitoring programs
• choosing a new storage building at a low risk site
• modifying an existing building to ensure risks are removed or minimised, for example upgrading fire suppression systems and security systems
• installing fireproof safes for priority records
• modifying operations, for example, not storing records on the floor, or changing security and access arrangements
• implementing procedures for severe weather warnings including additional site monitoring activities before and after severe weather events (e.g. storms, cyclones, dust storms)
• creation and maintenance of disaster bins and disaster stores
• rehousing records into more suitable packaging, e.g. archival boxes, Mylar sleeves
• digitisation or copying programs for State archives and business critical records
• transfer of State archives to the State Archives Collection
• developing and implementing a counter disaster plan for physical records.

Implementation of the Standard on records management and Standard on physical storage of State records will reduce risk and lessen the impact of a disaster.

Site monitoring activities

Routine building monitoring and maintenance programs play a key role in disaster prevention. For example, clearing leaves from gutters regularly will help prevent blockages in gutters and reduce fire risk.

When severe weather is scheduled, additional site monitoring and maintenance activities should take place before and after. Prior to severe weather, it is important to ensure that downpipes, gutters, and emergency systems are fully functional.

Additional monitoring should also take place within 24 hours after severe or wet weather incidents to ensure that any damage to records and/or the building is quickly identified. This would involve checking a sample of records and their packaging at each storage area within the site(s) and a visual inspection of the building and surrounding area to identify any maintenance issues.

Wet records must be dealt with promptly, including managing humidity and ensuring that the records are dried within 48 hours to prevent mould growth.

Disaster bins

Ready access to supplies can significantly reduce the impact of a disaster (particularly small scale disasters) by enabling a quick response.

Basic supplies can made available through the creation and maintenance of a disaster response bin (usually a wheelie garbage bin). Each storage area should have disaster bin containing supplies, such as absorbent paper, gloves, and torches, to meet immediate needs following a disaster.

See Disaster response bin (PDF) for list of recommended supplies.

Disaster response bins should be easily identifiable and located strategically around the storage facility. Consider the layout and accessibility of your site when choosing the setup of your bins and their locations. If you have a lot of stairs to negotiate, perhaps smaller caches on each level are better suited than large wheelie bins.

Locations of disaster bins should be noted on site maps accompanying the Plan.

Bins should be checked periodically to ensure that all items are available and functional.

Disaster stores

Public offices might also choose to keep reserve supplies and larger necessities such as packing crates, fans and dehumidifiers in a disaster store. This is normally a lockable area onsite or nearby in a shared facility.

See Disaster store (PDF) for equipment and supply suggestions.

A disaster store may not be necessary if arrangements are made with nearby suppliers or equipment hirers.

3.4 Accepting risks

Preventative measures protect and reduce the impact of disasters, however not all risks can be practically treated or completely avoided.

The public office needs to determine an acceptable level of risk, and acknowledge the risk through disaster reaction and recovery strategies, inclusion on the public office’s risk register, and appropriate insurance coverage.

3.5 Risk register

Your organisation’s wider response to risk management should include a risk register, a document listing all the risks that have been identified and assessed through all risk management processes across the organisation (e.g. inaccessible office locations, influenza pandemic, network failure etc.).

Risks affecting records should be added to your public office’s risk register to inform stakeholders of the associated level of risk, mitigation measures in place (i.e. counter disaster reaction and recovery plan), as well as flag the risk for periodic monitoring and review.

3.6 Insurance coverage

Records, like other organisational asset need to be sufficiently insured for salvage and recovery, and restoration in the event of a disaster. Records are often irreplaceable and contain information vital to meeting business needs, accountability requirements, and community expectations.

Disaster recovery can be expensive, costs to take into account include:

• salvage and repair of items
• freezing of records
• employing disaster recovery companies
• supplies (e.g. new boxes, hiring of vehicles)
• restoring the site (e.g. structural repairs, cleaning/drying carpets and walls, replacing shelving)
• temporary alternate sites for air drying and for storage of records
• business interruptions, and
• staff overtime and hiring of temporary staff.

Relationships with insurers

Insurers need to be made aware of the Protocol for assessors which outlines ‘do’s and don’ts’ for records recovery. Some techniques such as chemical fumigation, gamma irradiation, and freeze drying of photographic and film collections must never be used on State records. (Refer to Protocol for assessors).

Establishing a relationship with your insurer and/or the person within your public office that manages insurance is essential. During a large-scale disaster, control and decision-making is often transferred to the insurer, or the chosen remediation service provider. When establishing contracts for response and recovery, decision-making responsibilities should be determined.

3.7  Monitoring and review of risks

Monitoring and review of risk management programs should be on-going and should cover seasonal, short and long term risks.  Scheduled assessments of the effectiveness of risk reduction measures help to ensure changing circumstances do not alter risk priorities. As risks are reviewed the risk register should also be updated.