IT for Local Government: Records, Sites and Service

A records request arrives on a Tuesday morning. It asks for all correspondence about a consent decision made four years ago.

The correspondence exists. Some sits in a shared drive, some in the mailbox of a planner who left in 2023, some in the consenting system, and a few photographs on a phone handed back at the depot.

Nobody can say where all of it is without going to look. The search is the cost, and it lands on the people meant to be processing this month’s consents.

Put an illustrative number on that search. A council fielding 250 requests a year at fourteen hours each is spending 3,500 staff hours, or about $192,000 at an internal cost of $55 an hour.

Bring the search down to nine hours by putting records where they can be found and the same workload costs about $124,000. The difference is a full-time salary, and it comes out of a filing problem.

The deadline is statutory. Section 13 of the Local Government Official Information and Meetings Act 1987, known across the sector as LGOIMA, requires a decision as soon as reasonably practicable and in no case later than twenty working days after the request is received.

None of that is a problem the council chose to have. IT for local government has to be built around it, and around a set of duties no ordinary business has to meet.

What Does IT for Local Government Cover?

IT for local government covers the connectivity, core systems and support behind every council service, from the rates database at a service counter to the telemetry on a rural water plant.

The list is longer than most people expect, because a council is several unrelated businesses under one logo. A district council runs a library, a regulatory function, a roading programme, three or four utilities and a customer service counter.

Each of those brings its own software. The centre is usually one vendor’s council management suite, holding the rates roll and the property file, plus consenting and requests for service.

Around it sits an electronic document and records management system, shortened to EDRMS, and a geographic information system, or GIS, for anything with a location attached. Then the asset register, the payroll system and the finance ledger.

Then there is the operational technology, usually called OT. Supervisory control and data acquisition systems, known as SCADA, run the water and wastewater plants.

Those plant systems were built to run for decades without interruption. Patching one means booking a planned outage with the plant manager, so the monthly office schedule does not apply.

The public-facing channel is its own workload. A council website runs rates payments, dog registrations, request logging, land information memorandum (LIM) orders and the agenda papers for every meeting, and each one hands data to a system behind it.

Those integrations are where an outage becomes visible. A ratepayer who cannot pay online at 9pm rings the counter in the morning instead.

Which council sites need a network connection?

Every site where a person delivers a service or a plant sends telemetry needs a connection, and in a small district that is usually somewhere between eight and twenty locations.

• The main office and council chamber, with the finance ledger, the consenting workload and the webcast of council meetings.
• Service centres and libraries, where counter staff and public internet terminals share one link.
• The works depot, where field crews collect jobs and where a yard camera and a fuel system often live too.
• Water and wastewater treatment sites, which need telemetry back to a control room and almost no staff internet.
• Transfer stations and landfills, which take payments at a weighbridge on the worst connectivity in the district.

Some sites sit on fibre, others on fixed wireless, and one on a cellular link that drops in heavy rain. Decide which ones need a second path.

Why Is Council IT Different From Business IT?

Council IT is different because a council cannot choose its obligations, its customers or the timeframes it works to. Three of those constraints land directly on the IT budget.

The first is that records are evidence. Section 17 of the Public Records Act 2005 requires every local authority to create and maintain full and accurate records of its affairs, including the records of work contracted out to an independent contractor.

The second is that some services cannot stop. A water treatment plant, an after-hours noise line and a flood response do not wait for a business-hours ticket queue.

The third is procurement. Buying IT runs through a procurement policy, a public accountability trail and often an elected council asking why a number moved, so the work has to be specified in writing before it is bought.

Councils share ground with the community sector on stretched budgets and mixed workforces, which we cover in IT for not-for-profits, though a charity has no LGOIMA clock and no disposal authority.

What is a council-controlled organisation and does it change the IT picture?

A council-controlled organisation, or CCO, is a company, trust or similar entity the council owns or controls under the Local Government Act 2002, and it does change the picture because a CCO is normally a separate legal entity with its own systems.

Holding companies, venue operators, port interests and economic development agencies are commonly run this way. The technology question is where the boundary sits. Shared identity and email are convenient, while sharing everything widens the scope of every information request that touches either organisation.

Put that boundary in writing, and list which systems sit on each side of it.

What Is LGOIMA and How Does It Affect Council IT?

LGOIMA is the Local Government Official Information and Meetings Act 1987, and it shapes IT for local government because it turns every system holding correspondence into a place somebody will have to search under a deadline.

The Act starts from a principle of availability. Information held by a local authority should be made available unless there is good reason to withhold it, and section 13 sets the decision deadline at twenty working days.

A requester unhappy with the decision can complain to the Ombudsman, so the reasoning behind a refusal has to be recorded too.

Nothing in the Act mentions technology. Every hour of the burden it creates is spent inside a system, because the search runs across email, file shares, the EDRMS, the consenting system and whatever staff kept locally.

Search all of those from one place and twenty working days is enough time. Without that, answering a single request means a dozen people put their own work down and go hunting.

Where do LGOIMA requests get stuck?

Requests get stuck at the search and redaction stages, both of which depend on how the information was stored in the first place.

• Mailboxes of former staff, archived or deleted somewhere nobody can name.
• Text messages and photographs on personal phones used for council work, which are council records wherever they sit.
• Drafts in personal drives that never reached the EDRMS.
• Systems run by a contractor on the council’s behalf, which the council still has to search.
• Redaction by hand on scanned PDFs, which burns hours and leaves the underlying text readable if it is done badly.

Two controls remove most of that cost. Retain leavers’ mailboxes on a defined schedule, and give staff one place to file a record.

The redaction stage rewards better tooling. Redact in software that strips the text layer, and have a second person check a sample before release.

How Should a Council Manage Records Retention and Disposal?

A council manages retention against a disposal authority approved by the Chief Archivist, and it cannot shorten those periods for its own convenience.

Section 18 of the Public Records Act 2005 provides that no person may dispose of public records or protected records except with the authority of the Chief Archivist. A council’s retention schedule is the local expression of that authority.

This is where council practice separates from commercial practice. Any business can set its own retention rules around risk and storage cost, while a council is implementing an instrument approved outside the organisation and has no authority to vary it.

The mechanics of writing and enforcing a schedule are covered in our post on data retention policy. The council-specific part is the authority behind the periods.

Auditors keep finding the same two problems: records destroyed early with nothing authorising it, and records kept forever because nobody wanted to make the call.

Both are cheaper to fix while a system is being replaced, so put retention into the migration plan for any core platform. Audit findings on recordkeeping reach the elected council.

What does a disposal authority control?

A disposal authority sets how long each class of council record must be held and what happens at the end of that period, whether that is transfer to Archives New Zealand or destruction.

It covers building consent files, rates records, committee minutes, contracts, resource consents and correspondence, each with its own period, and some classes are permanent.

The practical test is whether your systems apply those periods without somebody having to remember. If retention lives in a spreadsheet beside the EDRMS, it is not being applied.

What Cyber Security Does a Small Council Need?

A small council needs the controls any business needs plus two additions: separation between the corporate network and the plant control systems, and a plan for the day a public-facing service is the target.

A security failure at a council becomes public faster than one at a private firm. An outage at a service counter is visible within the hour, and a breach will be on the elected council’s table the same week.

Councils hold rates records, building consents, dog registrations, licensing files and, in some districts, social housing tenancy details. All of that is personal information, and the general obligations are set out in our guide to NZ Privacy Act compliance.

Information privacy principle 5 requires security safeguards that are reasonable in the circumstances to protect personal information against loss, unauthorised access and other misuse.

Reasonable is judged against the size and the risk of the organisation. A council holding a district’s property and tenancy data is held to a higher standard than a two-person consultancy.

Multi-factor authentication, tested backups of the council management suite and monitoring that watches both networks are the baseline. An incident plan that names who speaks to the public belongs beside them.

Should council water and wastewater systems be on the same network as the office?

No. Operational technology running a treatment plant should sit on a separated network with controlled crossing points, so a compromised office laptop cannot reach a pump or a dosing controller.

Segregation costs less than most councils assume: a firewall rule set, a separate management network and monitoring on the boundary traffic.

Test it once a year with someone who did not build it, and ask them to reach the plant from a machine in the library.

As an illustration, a wastewater plant held on manual control while a control system is rebuilt needs two operators on site around the clock. A fortnight of that at overtime rates runs past $40,000 before anyone counts a consent breach.

How Does a Council Support Staff Across Many Sites?

IT for local government has to reach people who are never at a desk, so it runs on one identity, one device standard and a help desk that can get to a depot, a plant or a roadside without asking anyone to drive to the main office.

The workforce splits in two. Desk-based staff in planning, in finance and on the customer counter work the way any office worker does, while field crews spend the day in a vehicle with a tablet or a rugged phone.

Field work sets the harder requirements. Coverage is patchy in a rural district, so an asset inspection app has to work offline and sync later, and a locked-out worker at a water intake needs an answer by phone.

Shared logins are the usual shortcut on a depot PC or a weighbridge terminal. They are also the reason an audit trail stops at ‘depot user’, so give every person their own credential and use a fast sign-in method on shared hardware.

How does a council handle after-hours IT calls?

An after-hours roster covers the services that cannot wait, and IT support has to match whatever the council has committed to answering.

A duty officer taking noise complaints at eleven at night needs the request system, the phone system and the contact list. If one of those is down, the complaint never gets logged and the caller rings back angrier.

Agree the list with your provider in advance. Name the systems, the response times and the escalation path, then walk the path once before you need it.

What Should a Council Ask an IT Partner For?

Ask for evidence on multi-site network support, records searchability, operational technology experience and a security position the council can point to in an audit. Work through it in this order.

1. Write down the sites, the systems and the services that cannot stop. Two pages is enough and it becomes the specification.
2. Ask how the provider searches across email, file shares and the EDRMS for a single request, and have them demonstrate it on test data.
3. Ask what they have done with SCADA or building management systems, and what they will decline to touch.
4. Ask for their own security position. A provider certified to ISO 27001 can hand an auditor a scope statement and a certificate.
5. Ask how support reaches a person at a depot with one bar of signal.
6. Ask what happens at renewal: who owns the data, how it is exported and how long a transition takes.

Most councils buy this as a managed service with a named team, and our managed IT work is structured that way.

Time the procurement to the council’s own calendar. A decision needing elected approval waits for a committee cycle, so a project scoped in March may be unsigned until June.

What does council IT cost per user and per site?

Support runs $90 to $160 per user per month and connectivity $200 to $900 per site per month, with one-off work quoted as a project. The ranges below are indicative for a small district council and move with site count and plant complexity.

A council answering 250 requests a year has a search cost that dwarfs the records readiness line above.

Get Your Council’s Sites and Records Under Control

Exodesk has supported South Island organisations since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. Our IT for local government work maps your sites, puts your records where they can be searched, and separates the plant network from the office network.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

What is council IT in simple terms?

Council IT is the set of networks, core platforms and support services that let a local authority run its public services and meet its statutory duties. The scope reaches from the rates system on a service counter to the telemetry on a rural water plant, and it has to work at every site the council operates.

Which laws apply to council IT that do not apply to an ordinary business?

LGOIMA and the Public Records Act 2005 are the ones that change the technology picture, and the Privacy Act 2020 applies to a council the way it applies to any organisation. LGOIMA puts a twenty working day decision deadline on information requests. The Public Records Act governs what a council must keep and when it may destroy it. Both sit on top of the ordinary duties any employer has.

How long does a council have to answer a LGOIMA request?

Twenty working days from the day the request is received, with the decision made as soon as reasonably practicable inside that window. The chief executive can extend the deadline where a request covers a large volume of information or needs consultation, provided the requester is told within the original twenty days.

Can a council delete records to save on storage costs?

No. Disposal of public or protected records needs the authority of the Chief Archivist, so storage cost is never a lawful reason to destroy anything. A council reduces cost by moving records to cheaper storage tiers and by applying its approved retention schedule on time.

Do council-controlled organisations share the council’s IT systems?

Sometimes, and the answer should be a deliberate decision. Many CCOs share identity and email with the parent council for convenience, which widens the scope of any information request touching both entities. Agree the boundary in writing and record which systems each entity owns.

What happens if a council’s core system goes down for a day?

Public-facing services stop first, so counter payments, request logging and consent processing all queue up while the statutory clocks keep running. A council should know which services it can run manually for a day and which it cannot, and that list belongs in a written business continuity plan. Test it before you need it.

How much does council IT support cost?

Managed support for a small council commonly runs $90 to $160 per user per month, with connectivity charged per site and project work quoted separately. A district council with 80 staff and a dozen sites should expect an annual figure in the low hundreds of thousands once connectivity and licensing are counted, along with after-hours cover. Ask what happens at renewal before signing anything.

Do council field crews need different IT from office staff?

Yes. Field crews need devices that survive a work vehicle, apps that keep working with no signal and sync later, and support they can reach by phone from a roadside. Both groups should still sit on the same identity system so access is granted and removed in one place.

How does a council make LGOIMA requests cheaper to answer?

Put every record somewhere it can be searched centrally, retain leavers’ mailboxes on a defined schedule, and stop council business happening in personal drives and on personal phones. Most of the cost of a request is the search, so the saving comes from knowing where things are before anybody asks.

Can an IT provider help with a records audit?

Yes, for the technical half of it. A provider configures retention, proves what is searchable and shows how disposal is executed and logged, while the retention periods themselves come from the council’s approved disposal authority. Ask for that evidence in a form an auditor will accept, which means exported settings and a disposal log.

Does a small council need ISO 27001 certification?

No, certification is not a legal requirement for a New Zealand council. It becomes worth the cost when the council needs to show an auditor or a partner agency that security management is systematic, and many councils meet that need by requiring certification of their IT provider.

Can Exodesk support a council in Canterbury or Otago?

Yes. Exodesk works with organisations across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, and has operated in the South Island since 1989. We cover multi-site connectivity, records searchability, plant network separation and after-hours response.