Considering and assessing the risks facing your records will help determine the amount of resources that should be devoted to mitigating them. The level of risk is primarily tied to the value of the records associated with your system. The greater the value of the records, the greater the risk to having those records lost, damaged or tampered with. Therefore, the greater the value of the record, the more resources that should be devoted to reducing the risks to them. For example, if your system is designed to generate mailing labels, then the value is relatively low. In this case the resources devoted to mitigating risks to that system and those records is relatively low as well. A new information system designed to track voting records, on the other hand, has more value and will likely have more resources devoted to reducing the risks that those records will be somehow lost, damaged, or tampered with.

In performing a risk assessment, agencies need to consider a variety of risk factors in order to determine the likelihood that a damaging event might occur. There are risks associated with the system itself and there are risks associated with the transaction and records.

Risks are greater if a security intrusion would benefit potential attackers and damage parties in a predictable transaction and are lower if the transaction includes information that is of little value to potential attackers and would do little or no harm to the parties in the transaction.

– regular or periodic transactions between parties that are more predictable resulting in a higher likelihood that an outside party would know of the scheduled transaction and be prepared to intrude on it; a high perceived value of the information by an outside party (information relatively unimportant to an agency may have a high value to an outside party); transactions involving an agency that presents an attractive target because of its perceived image or mission (the act of disruption can be an end in itself).

– intermittent or one-time transactions that are less predictable; a low perceived value of the information by an outside party; transactions involving an agency that presents a less attractive target.

The risk is greater when there is a greater chance that the system will be obsolete in a few years or the agency lacks the necessary skills to maintain the system over time, lower when the technology is predicted to have a longer life and there is a pool of skilled technology staff to maintain the system.

Higher risk – proprietary and highly complex systems; systems that have multiple interfaces with other systems; systems for which there are no robust back-up and disaster recovery procedures; legacy systems that rely on older programming languages; cutting-edge systems based on new technologies for which there may be a shortage of skilled staff.

Lower risk – systems based on open standards; systems with a small number of interfaces; systems for which there are robust back-up and disaster recovery procedures; systems based on newer, generally accepted technologies.

Risks to the authenticity and validity of transactions and related records tend to be lower in cases where there is an ongoing relationship between the parties, higher for one-time transactions.

Higher risk – one-time transaction between and agency and a non-governmental entity that has legal or financial implications; transactions with non-governmental entities where the agency has law enforcement responsibility but does not have an ongoing relationship.

Lower risk – intra- or inter-governmental transactions of a routine nature; transactions between a regulatory agency and a known entity regulated by that agency.

Risks are greater when the transaction is valued highly, as in the case of money or private information, and lower when the value of the transaction is lower. The value of the record depends on the perspective of the agency and the transaction partner.

Higher value – transactions involving the transfer of funds; transactions where the parties commit to actions or contracts that may give rise to financial or legal liability; transactions involving information protected under a state’s access to public records legislation³ or other agency-specific statutes, information with state or national security implications, or information for which restricted access is a requirement; transactions where the party is fulfilling a legal responsibility, which if not performed creates a criminal or civil legal liability.

Lower value – transactions where no funds are transferred, no financial or legal liability is involved, and no privacy or confidentiality issues are implicated.

Risks are higher when there will likely be a need to produce reliable information regarding the transaction at various points in time after the record is created. These requirements also depend on records retention and disposition schedules and other requirements prescribed by the records retention oversight agency.

Higher need – transactions where the information generated may later be subject to audit or compliance checks; transactions where the information will be used for research, program evaluation, or other statistical analyses; transactions where the information generated may later be subject to dispute by one of the parties (or alleged parties) to the transaction; transactions where the information generated may later be subject to dispute by a non-party to the transaction; transactions where the information generated may later be needed as proof in court; transactions where the information generated will be archived later as permanently valuable records.

Lower need – transactions where the information generated will be used for a short time and then discarded.

The risks associated with capturing and managing government electronic records in transaction systems have to do with the relationship between the parties, the value of the transaction and the evidentiary value of the record, as well as the technology and security risks of the electronic system. Assessing these risks is the first step in determining the costs and benefits of adding system requirements that will mitigate the risks to effective electronic transactions and record keeping.