3 Multiple sources of information For accountability purposes, information Ensure all information You may need to manually If the approval process involves multiple from multiple sources, systems or supporting the approval can link or relate information or sources of information or data, can the locations supporting the approval should be linked throughout the data supporting the approval, approval request, final approval and the be linked or able to be related together. approval process and for example by documenting information or data subject to approval, be document any relevant file all related file references with clearly linked? references. the approval request. Continue to Q4. Continue to Q4. Question Considerations Y/N For responses For responses ‘Yes’ ‘No’ 4 Access to authoritative information The authoritative version of the Document the details of the Confirm and document how Will all relevant stakeholders have access to information subject to the approval must authoritative version and access to the authoritative the authoritative version of the information be available and readily identifiable to any relevant file references. version of the information or data subject to approval? support accountable and effective decision can be made available to making. Continue to Q5. applicable stakeholders. Continue to Q5. 5 Event logging and auditing All actions and changes to an approval and Document what Identify the of event Can the system or location where the associated information should be recorded functionality the system or logging and auditing approval is being made track actions and by the system’s audit logs and be available location has to track actions functionality required. events on the approval and associated to support accountability and authenticity. and events related to the information or data? approval and associated For a lower risk process information or data. managed outside of a system with information Continue to Q6. management functionality, consider available mitigations. Continue to Q6.
3 Multiple sources of information If the approval process involves multiple sources of information or data, can the approval request, final approval and the information or data subject to approval, be clearly linked? For accountability purposes, information from multiple sources, systems or locations supporting the approval should be linked or able to be related together. Ensure all information supporting the approval can be linked throughout the approval process and document any relevant file references. Continue to Q4. You may need to manually link or relate information or data supporting the approval, for example by documenting all related file references with the approval request. Continue to Q4. Question Considerations Y/N For ‘Yes’ responses For ‘No’ responses 4 Access to authoritative information Will all relevant stakeholders have access to the authoritative version of the information or data subject to approval? The authoritative version of the information subject to the approval must be available and readily identifiable to support accountable and effective decision making. Document the details of the authoritative version and any relevant file references. Continue to Q5. Confirm and document how access to the authoritative version of the information can be made available to applicable stakeholders. Continue to Q5. 5 Event logging and auditing Can the system or location where the approval is being made track actions and events on the approval and associated information or data? All actions and changes to an approval and associated information should be recorded by the system’s audit logs and be available to support accountability and authenticity. Document what functionality the system or location has to track actions and events related to the approval and associated information or data. Continue to Q6. Identify the of event logging and auditing functionality required. For a lower risk process managed outside of a system with information management functionality, consider available mitigations. Continue to Q6.
DigitalAuthorisationsFramework-August2018.docx