Last updated:

April 18, 2017
Before you commence the process, please refer to our High value, high risk introduction page.


High value, high risk records should be appropriately managed as a priority over time in stable, accessible and secure physical and/or digital environments.

The process of identifying and managing high value, high risk records can be divided into three main steps:

HVHR Steps


  1. STEP 1 - Conduct a records assessment

    If you do not have a comprehensive list and/or knowledge of the records in your agency, you can conduct an assessment to gain an understanding of the records which are of value and/or risk.

    Before you begin the assessment, refer to our High value, high risk introduction page so you can specify the criteria for determining value and risk.


    Depending on the scale of your agency and records, it may be practical to take a staged and/or targeted approach to the assessment. For example, focus on the most important business activities and related records first.

    By undertaking an assessment, you should be able to rate the value and risk of your agency’s records and gain general knowledge about:

    • the range, volume and types of records your agency creates and manages
    • how the records relate to the business of your agency
    • the physical and digital environments in which the records are managed
    • the people and processes in place to manage records.


    The following approaches can be undertaken to source information during the assessment:

    • refer to documentation:
      • Information Asset Register
      • Retention and Disposal Authorities (note records with long retention periods)
      • Records registers and lists, such as vital records register.
    • inspect the storage environment (physical and/or digital)
    • review the business systems and processes that manage records
    • interview staff in the agency and/or conduct workshops or surveys to gain information.


    See Conducting an Information Review from National Archives of Australia for further information about the assessment process from an information asset perspective.

    STEP 2 - Analyse findings and prioritise

    Once you have conducted the assessment and determined the value and risk ratings of your agency’s records, the next step is to prioritise the records which require the most attention.

    Rate the records which should be prioritised due to their high value and risk and define:

    • the limitations and factors that impact on the management of the records
    • the required approaches to mitigate the risks to the records.


    Also refer to the principles and requirements outlined in the PROV Standards and Specifications and flag those which are not being met and which are of primary importance to managing the records.

    STEP 3 - Develop a strategy and plan

    A plan and strategy will communicate the required actions, timelines and potential resourcing and/or funding requirements to manage the high value, high risk records identified as a priority. This may include projects to:

    • update the agency’s recordkeeping program
    • change or implement new processes, systems or technologies
    • migrate, relocate and/or transfer records
    • train staff on recordkeeping requirements.

    See PROS 10/10 G5 Records Management Strategy Guideline for guidance on developing a strategy.


    Some of your proposed projects may require developing a Business Case to gain agency investment in a project that requires funding and resources.

    See PROS 10/10 G4 Writing a Business Case Guideline for further information.