This presentation provides an extensive introduction to the Digital Repository Audit Method Based On Risk Assessment (DRAMBORA). After considering how the ideas of risk and trust might affect digital repositories, the DRAMBORA methodology is applied using two practical exercises. DRAMBORA can also be applied using an interactive Web-based version of the tool, and the presentation provides an illustrated guided tour of this version of the tool. The presentation was given as part of the final module of a 5-module course on digital preservation tools for repository managers, presented by the JISC KeepIt project. Concluding by comparing DRAMBORA with DAF, the Data Asset Framework, also produced by the DCC, brings the KeepIt course effectively full circle, as the course began in module 1 with DAF. For more on this and other presentations in this course look for the tag ’KeepIt course’ in the project blog http://blogs.ecs.soton.ac.uk/keepit/

1. DRAMBORA: Risk and Trust and Data Management Martin Donnelly DCC, University of Edinburgh [email_address] (and Andrew McHugh, Sarah Jones, Joy Davidson, Seamus Ross, Raivo Ruusalepp, Perla Innocenti…)

11. Risk and Repositories

13. Standard Risk Management Model

25. The Audit Process in a bit more detail

33. Risk Impact, Risk Management and DRAMBORA

36. DRAMBORA Workflow Preliminary collecting and analysis of repository documentation Organise appointments and onsite visits with repository staff (managers, curators, IT, legal experts…) Risk registry finalisation Audit report finalisation Impact on individuals and organisations

42. Anatomy of a risk The name of the individual who assumes ultimate responsibility for the risk in the event of the stated risk owner relinquishing control Escalation Owner: Name of risk owner - usually the same as owner of corresponding activity Owner: Hardware, software or communications equipment and facilities Operations and service delivery Personnel, management and administration procedures Physical environment Nature of Risk: Date that risk was first identified Date of Risk Identification: Example circumstances within which risk will or may execute Example Risk Manifestation(s): A longer text string offering a fuller description of this risk Risk Description: A short text string describing the risk Risk Name: A text string provided by the repository to uniquely identify this risk and facilitate references to it within risk relationship expressions Risk Identifier:

43. Anatomy of a risk A targetted risk-severity rating plus risk reassessment date Risk Management Activity Target: Individual(s) responsible for performance of risk management activities Risk Management Activity Owner: Practical activities deriving from defined policies and procedures Risk Management Activity(ies): Description of policies and procedures to be pursued in order to manage (avoid and/or treat) risk Risk Management Strategy(ies): A derived value, representing the product of probability and potential impact scores Risk Severity: This indicates the perceived impact of the execution of this risk in terms of loss of digital objects' understandability and authenticity Risk Potential Impact: This indicates the perceived likelihood of the execution of this particular risk Risk Probability: A description of each of the risks with which this risk has relationships Risk Relationships: Parties with an investment or assets threatened by the risk's execution, or with responsibility for its management Stakeholders:

44. Risk Relationships where risks exist in isolation, with no relationships with other risks Atomic where avoidance or treatment associated with a single risk renders the avoidance or treatment of another less effective Domino where avoidance or treatment mechanisms associated with one risk also benefit the management of another Complementry where a single risk’s execution will increase the likelihood of another’s Contagious where the simultaneous execution of n risks has an impact in excess of the sum of each risk occurring in isolation Explosive Definition of Risk Relationship Risk Relationship

50. DRAMBORA Interactive www.repositoryaudit.eu

53. Repository Registration

57. Repository Administration

59. Define Repository Scope

61. Functional Classes

63. Add/Edit Repository Staff

65. Add, Edit & Assign Roles

67. User Administration

70. Define Mandate

72. Define Constraints

74. Define Objectives

76. Define Activities etc.

79. Identify Risks

82. Risk Assessment

84. Risk Relationships risks exists in isolation, with no relationships with other risks Atomic where avoidance or treatment associated with a single risk renders the avoidance or treatment of another less effective Domino where avoidance or treatment mechanisms associated with one risk also benefit the management of another Complementry where a single risk’s execution will increase the likelihood of another’s Contagious where the simultaneous execution of n risks has an impact in excess of the sum of each risk occurring in isolation Explosive Definition of Risk Relationship Risk Relationship

85. Manage Risks

87. Audit Reporting

89. Snapshot View

94. Overlaps and Differences self-management tools to assess the effectiveness of approach to data management or preservation - Repository focus - Process emphasis - Lifecycle: Preservation phase - Researcher focus - Data emphasis - Lifecycle: Creation phase

97. Integrated Data Management Planning tool AIDA http://aida.jiscinvolve.org http://www.life.ac.uk/ http://www.data-audit.eu/ coming soon…