By the end of this chapter, you will be able to:
These skills are essential to keep important office information safe, organized, and accessible, helping your workplace run smoothly and securely.
Compiled by: Catherine Kimani
Safeguarding office records is a critical responsibility for Office Administration professionals in Kenya, as these records contain vital information that supports business continuity, legal compliance, and organizational accountability. Effective management of records protects sensitive data from loss, damage, or unauthorized access, ensuring that operations run smoothly and information is accessible when needed. This chapter delves into the frameworks, assessments, and recovery strategies that underpin the security of office records, equipping administrators with the knowledge to implement robust safeguarding measures.
An office policy manual is the written document in which an organisation states how its records are to be created, stored, used, moved, backed up and destroyed. It turns decisions about security into rules that every employee can read and follow, so that protection does not depend on what each person happens to remember. A policy manual for records usually names the types of record the office holds, who may see each type, where each is kept, how long it is kept and what to do when records are lost or damaged. Example: an accountancy firm writes in its manual that client tax files are kept in a locked cabinet in the records room, that only the partner and the file's assigned accountant may open them, and that a copy is backed up to an offsite store every night.
Office policy manuals are essential tools for making record safeguarding the same in every part of an organisation. Their importance can be seen in the following aspects.
A manual gives step-by-step instructions on how to create, manage, store and dispose of records. This clarity reduces the errors that lead to loss or exposure of information. A freight forwarding company, for example, may require that every shipping document is filed under the shipment reference within one working day, so that no document stays loose on a desk.
Kenyan law, including the Data Protection Act, 2019, requires organisations to protect personal data. A manual builds these legal requirements into daily routines, such as who may collect personal details, how long they are kept and how they are destroyed. An office that follows its manual has a record of the care it has taken, which helps if its practices are questioned.
When procedures are written down, all employees follow the same method regardless of department or branch. A hotel group with several front offices, for instance, can keep guest registration records in the same format at each site, which makes audits and retrieval easier.
A manual identifies the risks to records, such as unauthorised access, theft, fire, water damage and accidental deletion, and sets out the preventive measures for each. In a property management office, for example, the manual may require tenancy agreements to be stored in a fire-resistant cabinet and scanned copies to be kept on a protected drive.
A written manual is the reference for training new and existing staff. It also makes each employee's responsibility clear: when the manual says that only the records clerk may remove files from the registry, a missing file can be traced to the person who signed for it.
A manual is only useful if it is applied, so the office checks regularly that its rules are being followed. The checks include:
Office records are the documents and data an organisation creates or receives as evidence of its work. They are grouped by the level of protection they need, because a pay slip and a printed product brochure should not be handled in the same way. Two main types are separated in a policy manual: confidential records, which only certain people may see, and public records, which may be shared openly.
Confidential records contain information that could harm a person or the organisation if it reached the wrong people. Access is limited to those who need the information to do their work, which is called the need-to-know principle. Examples are:
Confidential records are marked "Confidential", kept in locked cabinets or on password-protected drives, listed in an access register, passed only by hand or by secure email, and destroyed by shredding or secure deletion when their retention period ends. A visitor, a cleaner or a junior member of staff outside the team should never find them on a desk or an open shelf.
Public records are records that the organisation may share openly because they contain nothing sensitive, or because the organisation is expected to make them available. Examples are annual reports, published price lists, product brochures, notices of vacancies, tender advertisements, public notices and minutes of open meetings. Public bodies also hold records that the public has a right to request under the Access to Information Act, 2016, so their offices must know which records can be released and which must be withheld.
Public does not mean unprotected. A public record still has to be accurate, complete and kept in its approved form, because someone altering a published price list or an annual report is changing the organisation's official word. Office staff keep an authorised master copy, control who may edit it and check that outdated versions are removed from display and from the website when a new version is approved.
A back-up is a copy of records kept separately from the originals, so that the records can be restored if the originals are lost, damaged or corrupted. Disaster recovery is the plan for restoring records, equipment and normal work after a serious event such as a fire, a flood, theft or a failed server. Together they keep the office running when something goes wrong, and they are written into the policy manual so that every member of staff knows their part.
Copies kept in the same room as the originals can be destroyed by the same fire or flood. Keeping a copy offsite, in another building or on a cloud storage service, protects against such local disasters. A good guide is to hold three copies of important data, on two different kinds of storage, with one copy offsite. A property management office, for example, may back up its tenancy and lease records to a cloud service each evening, so that nothing is lost if the main office is damaged.
The manual states how often each type of record is backed up, such as daily, weekly or monthly, and who is responsible. The more often records change, the more often they need to be backed up. A schedule that is written down and signed off each time it is done shows that the work has been carried out.
A back-up that cannot be restored is of no use, so the office tests its recovery procedure from time to time by restoring selected files to a spare computer and checking that they open and are complete. A test also shows how long recovery takes, which helps decide whether the plan is fast enough for the work the office does.
The office keeps a log of back-ups made, tests carried out and any recovery that took place, with dates, the person responsible and the result. Such logs serve as evidence for audits and help the office improve its plan after each event.
Redundant storage means duplicating hardware, such as a set of disks that mirror each other (a RAID array) or a second server, so that a single failure does not stop access to records. It keeps records available but is not a replacement for back-ups: a deleted file, a virus or a fire damages every copy at once, so separate back-ups are still needed.
Create a free account to open more of this chapter.
Free: practical guides, quick cards, workplace scenarios and more.
Create a free accountThis chapter explores the critical role of office policy manuals in establishing guidelines for safeguarding office records, emphasizing their importance in protecting both confidential and public records. It discusses different types of office records assessments, highlighting how back-up and disaster recovery plans serve as essential safeguards against data loss. The chapter then details the components of an office records inventory, including identification, title, location, creation date, format, ownership, and retention schedules, which together ensure systematic management and accessibility. It also examines the procedures governing the movement of office records, focusing on the purpose and protocols for borrowing and returning documents to maintain security and accountability. The importance of document follow-up is outlined as a mechanism to track records and prevent misplacement. Furthermore, the chapter addresses official records access control, stressing the need to restrict unauthorized entry to sensitive information. Finally, it covers control measures for upgrading office records, ensuring that records remain accurate, current, and compliant with organizational standards.
At the start of this chapter we promised you would be able to:
Tick each one you can genuinely do.
So, are you there yet?
You're competent when you can confidently do 50% or more of what this chapter promised.
Sign in to record how you're doing.