IM BLOG: Surviving the Temple of Compliance

At its core, recordkeeping compliance means following the laws, standards and obligations that govern information from creation through to disposal. But the way we frame that responsibility matters.

Think of a lighthouse. Its light provides a clear, guiding purpose, naturally keeping ships on the right path. Their safe passage is the result of the lighthouse doing its job. Too often, organisations treat compliance very differently. They turn it into something hidden deep within policies, systems and processes: a temple full of traps, something to navigate and survive, hoping they reach the exit without triggering consequences.

That framing misses the point. When information is governed well, findable when needed, reliable, appropriately managed and transparent, compliance follows. It is not the treasure at the centre of the temple. It is the outcome of managing what we hold with discipline and purpose.

The myth of compliance

Compliance is often reduced to a checklist. But a completed checklist tells us little about whether an organisation can withstand audit, inquiry, litigation, an access request or a breach. It does not prove that information can be found, trusted or explained when it matters.

Failures rarely begin because a policy is missing. Policy without managed information is aspiration, not governance. The rules may exist, but they are not embedded in daily work. People do not know what applies to them, when to create a record or where it should be kept.

Audits and inquiries do not create these failures, they expose them. What appears to be a sudden compliance problem is often the moment an organisation discovers that it cannot trace its way back through fragmented systems, incomplete records and eroded context.

Information risk: the unseen threat

Most information risk is hidden until it becomes enterprise risk. It accumulates in duplicated systems, undocumented decisions, poor metadata, unclear ownership and inconsistent lifecycle controls. Each gap may seem manageable on its own. Together, they undermine accountability.

This is why recordkeeping is not a back-office task. Records are the evidence of decision-making. When that evidence is incomplete or unreliable, integrity weakens, uncertainty increases and public confidence is put at risk.

The shift organisations need to make is from waiting for failure to managing the risk before it surfaces. Reactive organisations act after an audit finding, breach or crisis. Proactive organisations identify information risk early, assign ownership and manage it alongside financial, operational and security risks. Retention, disposal, privacy and preservation are not administrative chores in that model, they are enterprise risk controls.

The traps we normalise

The temple's traps are familiar: information fragmented across platforms with no reliable source of truth; ownership shared so widely that no one is accountable; disposal deferred because inaction feels safer; information kept 'just in case'; and policies that bear little resemblance to daily practice.

These are governance failures not technical ones. Together they increase privacy exposure, access burden, inefficiency and reputational risk. Complexity is not the danger. Gradual slippage is.

A whole-of-lifecycle approach matters. Information must be managed deliberately from creation through use, retention, disposal and preservation. Otherwise, risk and cost simply accumulate out of sight.

Trust is the lynchpin

When records cannot be found or understood, accountability collapses. When accountability collapses, trust erodes, often long before an audit detects the problem.

The National Archives' Building Trust in the Public Record policy asks Australian Government agencies to manage information assets strategically, implement fit-for-purpose practices and systems and reduce information management inefficiency and risk. The emphasis is important: trust is sustained through visible, disciplined behaviour, not statements of intent.

Good governance supports that behaviour. It clarifies who decides and why, documents the basis of decisions and protects people when scrutiny arrives. Governance is not the wall that slows an organisation down. It is the map that allows the organisation to move with confidence when conditions change.

The margin for error is disappearing

Our obligations may be familiar, but the scale and speed of information have changed. Data volumes are growing, systems are multiplying and automation, including AI, does not correct poor practice. It compounds it. If information is fragmented or inconsistently governed, errors move faster, gaps widen and exposure increases. The organisations best placed to succeed will not necessarily be those with the most tools. They will be those with clear governance, strong discipline and the maturity to manage information deliberately at scale.

Are we actually in control?

The simplest test is to ask five questions:

• Can we find the information we need quickly and reliably?
• Can we trust its accuracy, completeness and context?
• Can we explain how and why decisions were made?
• Can we show who was responsible?
• Can we dispose of information confidently when required?

If any answer is 'no' or 'it depends', the risk is not theoretical. It already exists, it simply has not been tested yet.

That is the shift we need: from compliance as a checklist to compliance as an outcome; from policy-focused to information-focused; from reactive response to proactive risk management; and from hidden information risk to visible enterprise risk.

Complexity is inevitable. Failure is not. Information professionals often see fragmentation, drift and weak controls long before they become audit findings or reputational damage. Our role is not only to manage records but to translate complexity into accountability, helping organisations explain what they did, why they did it and stand behind it with confidence.

When information is governed deliberately, owned collectively and managed with discipline, compliance becomes the outcome, trust becomes sustainable and the structure holds. We stop searching for a way out of the temple and start building something far more stable.

Meet your blog author:

 

Simon Froude, Director-General at National Archives of Australia