Whose System Holds the Public Record?
A ministry, a county department or a state corporation keeps records that belong to the public and outlive any supplier. Why that changes the hosting question, and what a public body should be able to say about the system that holds them.
When a private company chooses a business system, the records are its own. When a public body chooses one, the purchase orders, asset registers, stores ledgers and staff files are public records. They will be read by an auditor, possibly by a committee, and occasionally by a court, long after the officer who chose the system has moved on.
Why the question is different
Three things set a public body apart, and each of them bears on where its operational records are held.
- Accountability outlives the contract. An audit query about a tender can arrive years later. The body must still be able to produce the records, whoever the supplier is by then.
- Procurement is itself scrutinised. The choice of system is a procurement decision, and the hosting arrangement is part of what an evaluation committee and an auditor will read.
- Some data may have to stay in the country. In several countries, certain categories of public data must be processed or held within national borders. Whether that applies to a given body’s records is a legal question for that body, but it is the first one to settle.
A public record does not belong to the supplier who hosts it, or to the officer who chose the system.
What a public body should be able to say
Before signing, the accounting officer and the head of ICT should be able to state, in writing, four things about the system: whose infrastructure holds the records, whether any other organization shares it, how the records come back if the contract ends, and whether every change to a record can be traced to a person and a time.
On a shared service the second statement needs a paragraph. On a dedicated instance it needs four words: no other organization does. The instance has its own database, its own encryption key, its own storage and its own backups, and it runs the same release as everyone else, so the body is not left on an old version when the original team moves on.
When the contract ends
Every public contract ends, by expiry, by retender or by a change of policy. The test of a hosting arrangement is what happens then. The records must come back complete and usable, and the body must be able to confirm they have been removed from the supplier’s systems afterwards. Ask for the export and removal process during evaluation, not at handover.
The same applies to the trail behind the records. An audit trail that records who changed what, and that cannot be quietly edited, is what lets a body answer an audit query about a record it no longer remembers creating.
What AWRA OpsHub does today
- A dedicated instance used by one public body alone, with its own database, encryption key, storage and backups.
- Procurement, stores, assets, HR and finance records in one system, on the current release.
- An audit trail of who changed which record, and when.
- An export of the body’s records at the end of the contract, followed by removal.
More we can add to your workspace
- Hosting in your own country, set in the contract, for records that must be processed within national borders.
- Your own government domain in place of the awraops.com address.
- A sub-processor list trimmed to your contract, with optional services switched off.
Where we point you to a specialist
- We do not decide whether your records must be held in-country, or advise on how public records law applies to you. That is for your legal office and your records authority, and we will build to what they conclude.
- We are an operations system, not your national archive. Records due for permanent preservation should be transferred to the body responsible for them.
Each of these can be scoped into a dedicated-instance quote.
For a public body
Where a public body’s obligations go beyond the standard instance, these are the additions we build.
In-country hosting
Hosting set in your own country, written into the contract.
Your government domain
The system at an address on the body’s own domain.
A trimmed provider list
Optional services switched off so the provider list matches your contract.
How it works: share the requirement from your tender or your legal office, and we return a written scope and cost.
See the dedicated instanceNotice
A public body choosing an operations system should be able to say whose infrastructure holds its records, that no other organization shares it, how the records come back, and how every change is traced. A dedicated instance makes the second of those a single sentence; the rest should be asked of any supplier.
For the evaluation committee
Whose infrastructure holds the records?
Ask the bidder for
The operator and the hosting region, in writing.
Why it matters
It is part of what the auditor will read.
Does any other organization share the system?
Ask the bidder for
A yes or a no.
Why it matters
A paragraph here invites a query later.
How do the records come back at contract end?
Ask the bidder for
A described export and removal process.
Why it matters
Retender should not mean losing history.
Must any of our data stay in the country?
Ask the bidder for
Ask your own legal office first.
Why it matters
It decides whether region goes in the contract.
A system that is the body’s alone
A dedicated instance of AWRA, run by us, available to set up now.
See how it worksFrequently asked questions
Can a government agency use a cloud ERP?
Often, yes, subject to the rules that apply to its data. Some categories of public data must be processed within the country, so the agency’s legal office should confirm the requirement first and the hosting region should then be written into the contract.
What should a public body ask about where its records are held?
Whose infrastructure holds them, whether another organization shares it, how the records come back at the end of the contract, and whether every change can be traced to a person and a time.
Is a dedicated instance shared with other organizations?
No. It has its own database, encryption key, storage and backups, used by one organization alone.
What happens to the records when the contract ends?
They can be exported and then removed. The process should be confirmed during evaluation rather than at handover.
