Introduction
The programme “Professional Auditing of Documents and Content” develops professional practice in Records and Archives. It connects the subject with workplace challenges by examining existing evidence and practices and choosing methods appropriate to the organization and its available resources.
The learning progresses from risk-based auditing and evidence gathering to information protection and incident response, with practical work on document, records, and digital preservation management, information systems analysis, integration, and service management, governance, accountability, and compliance management. Participants prepare outputs to support workplace application and review the quality and results of implementation.
Learning objectives
- Design an audit engagement connecting risks, objectives, tests, and evidence in an application related to “Professional Auditing of Documents and Content”.
- Build a document life cycle controlling classification, permissions, retention, and retrieval.
- Analyze information system requirements and design acceptance, integration, and operational criteria.
- Define decision-making authority, accountability mechanisms, and obligation monitoring.
- Assess information risks and select suitable preventive controls and a response plan.
Learning areas
1. Risk-Based Auditing and Evidence Gathering
- Define the engagement subject, objectives, scope, and assessment criteria, and develop an initial understanding of the process and its main risks.
- Assess control design and suitability for the objectives, and select tests and samples proportionate to risk levels and available data.
- Collect sufficient, appropriate evidence, document sources and verification procedures, and maintain independence, objectivity, and information confidentiality.
- Write a finding connecting the criterion, condition, cause, and effect, and discuss the response and agreed action with the relevant party.
- Prepare a clear report and action follow-up plan, applying current professional requirements relevant to the audit type and work environment. The application examines a case related to “Professional Auditing of Documents and Content”.
2. Document, Records, and Digital Preservation Management
- Inventory document and record types, owners, and reasons for retention, and distinguish operational copies from the authoritative record.
- Design classification, coding, metadata, and version control rules, with clear naming, indexing, and search criteria.
- Define viewing, editing, and approval permissions and usage tracking, and protect confidentiality and record integrity throughout circulation.
- Prepare a retention and disposal or permanent preservation transfer schedule after reviewing legal and regulatory requirements specific to each record type.
- Test retrieval, migration, backups, and file integrity verification, and set indicators for indexing accuracy and continuity of access.
3. Information Systems Analysis, Integration, and Service Management
- Analyze system users, processes, and the decisions it supports, translating needs into clear functional and nonfunctional requirements.
- Model data flows, entities, relationships, and interfaces, identifying each data item's source and the party responsible for its quality and updating.
- Compare build, buy, integration, and hosting alternatives according to constraints, security, total cost, and available support capabilities.
- Design test cases covering performance, permissions, usability, and integration, and connect each test to a testable acceptance criterion.
- Prepare a transition, operations, support, change management, and backup plan, defining indicators for service availability, fault resolution, and improvement review.
4. Governance, Accountability, and Compliance Management
- Map decision-making, oversight, and execution levels, and identify separation of roles and potential conflicts of interest.
- Review policies, committees, delegated authorities, and reporting frequency, and connect each responsibility to clear authority and limits.
- Create an obligations register specifying the source, scope, responsible party, and compliance evidence, and review applicable local requirements.
- Define disclosure, accountability, complaint handling, and misconduct reporting mechanisms, and protect information confidentiality during follow-up.
- Assess a practical governance case and prepare a gap remediation plan with review indicators and evidence of action closure.
5. Information Protection and Incident Response
- Inventory assets, data, accounts, services, and their interdependencies, classifying sensitivity, criticality, and accountable owners.
- Analyze threats, vulnerabilities, and potential misuse, and identify necessary controls according to risks, resources, and applicable law.
- Review identity and access management, updates, backups, and logs, and identify evidence for verifying control effectiveness.
- Build a process for incident detection, classification, containment, escalation, and evidence preservation, specifying authorized internal and external communication.
- Conduct an exercise using authorized training data and an authorized training environment, and evaluate response and recovery times, lessons learned, and a gap remediation plan.
Practical outputs
- An audit engagement program, working papers, and an actionable finding.
- A classification plan, retention schedule, and document metadata template.
- A requirements document, data flow map, and testing and acceptance plan.
- An authority matrix, obligations register, and escalation and review mechanism.
- An information asset and risk register, response plan, and recovery test.
Who should attend
- Practitioners, specialists and supervisors whose work relates to the programme subject.
- Managers and teams working in records and archives, according to their practical responsibilities.
- Professionals responsible for applying the outputs of “Professional Auditing of Documents and Content” within their organizations.
Prerequisites
- Working familiarity with the programme field and the ability to discuss a professional case or challenge.
- Confirm the suitability of your experience and any specialist prerequisites with the Union before participation.
Conclusion
The programme “Professional Auditing of Documents and Content” brings together concepts, case review and a practical application. Participants prepare steps that can be adapted to their responsibilities and organizational resources, with an indicator to follow application and review results after returning to work.
Participation arrangements and any special requests are specified in the confirmation issued by the Union.