ARTICLE IN PRESS

International Journal of Information Management 28 (2008) 150–160

www.elsevier.com/locate/ijinfomgt

The information audit: Theory versus practice

Steven Buchanan, Forbes Gibb
Graduate School of Informatics, University of Strathclyde, 26 Richmond Street, Glasgow G1 1XH, UK

Abstract

This paper presents and discusses five information audit (IA) case studies, which tested the application and usability of an IA
methodology. The studies also trialled an IA scope matrix and incorporated process modelling. The main strengths of the IA
methodology were found to be the logical structuring of stages, provision of a comprehensive toolkit, and the flexibility to remove stages
not relevant to the client brief. A limitation of the methodology was found to be its lack of instructional depth. The IA scope matrix was
successfully trialled, and process modelling proved extremely valuable, encouraging participant involvement by focusing on readily
understandable aspects of day-to-day work, and providing an organisational model of information flow.
r 2007 Elsevier Ltd. All rights reserved.

Keywords: Information audit; Information resource management; Information strategy; Information systems; Process modelling

1. Introduction siveness and applicability of the methodology; and

This is the final paper in a series of three providing a
comprehensive review of the information audit (IA). The
first paper in this series (Buchanan & Gibb, 2007) examined
role and scope, while the second (Buchanan & Gibb, 2008)
reviewed key methodological approaches. This paper
presents and discusses case studies from the field, focused
upon application of the Buchanan and Gibb (1998) IA
methodology. This methodology has five main stages:
1. Promote: communicating the benefits of the audit,
ensuring commitment and cooperation, and conducting
a preliminary survey of the organisation.
2. Identify: top-down strategic analysis followed by identi-
fication of information resources and information flow.
3. Analyse: analysis and evaluation of identified informa-
tion resources and formulation of action plans.
4. Account: cost/value analysis of information resources.
5. Synthesise: reporting on the audit and development of
the organisation information strategy.
The case studies are presented in two stages: firstly, two
studies conducted by the authors, which tested comprehen-
Corresponding author.
E-mail address: steven.buchanan@cis.strath.ac.uk (S. Buchanan).
secondly, three further studies conducted by independent
parties to test usability. This paper is, in part, a response to
Botha and Boon’s (2003) call for more methodologies to be
tested in practice.
2. Stage one methodological testing
Two audits conducted by the authors are presented here
as suitable test cases. It should be noted that neither study
was conducted solely for the purposes of methodological
testing as in both instances the organisations had requested
IAs. As a consequence, the scope of the IA was dictated
not by the auditor but by the brief provided by the
organisation, with the methodology and approach then
tailored accordingly. While this removed the opportunity
to establish a controlled test case it ensured that the IA met
the requirements of the participating organisation and
maintained confidence in test results by removing the
opportunity for the auditor to scope the IA to suit the
methodology, rather than the requirements of the partici-
pating organisation.
The tool utilised for scope setting was the IA scope
matrix (Buchanan & Gibb, 2007), which identifies two key
dimensions to IA scope: firstly, component, which identi-
fies the key orientations of an IA based upon Earl’s (2000)
information strategy taxonomy (information management,

0268-4012/$ - see front matter r 2007 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ijinfomgt.2007.09.003
 ARTICLE IN PRESS
S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160
information technology, information systems, information
content1); and secondly, perspective, which identifies the
required organisational view (strategic, process, resource).
2.1. Study one
Case study one was conducted within a University
department consisting of 37 staff, 50 researchers, and 340
students. At the time, the department was responding to a
university wide directive to better manage information
resources. In consideration of this directive, the sponsor
wanted to know what his information resources were, how
effective information flow was within the department, and
what was required to improve information flow. However,
when discussing the scope and stages of the IA at the initial
meeting (facilitated by the IA scope matrix), the sponsor
also indicated that he would like to conduct a strategic
review of the department’s overall goals and objectives,
and wanted to involve staff as much as possible in this
process. To meet these requirements the IA was scoped to a
predominantly strategic orientation, but to include both
process and resource elements (see Fig. 1). Described
another way, the IA would focus on strategic objectives,
and then on those information resources and information
flows key to the achievement of those objectives. During
this meeting the sponsor also stated that he did not require
costing of information resources and that the IA was to be
completed in 12 weeks across the summer academic recess.
The IA methodology was tailored to these requirements
by removing the account stage, and establishing a working
group to participate in a series of strategy-oriented work-
shops during the identify stage, supplemented by interviews
with further members of staff during the analyse stage to
validate working group output and to explore further
information resource use and flow.
2.1.1. Promote
There are three steps to this stage: firstly, conference or
seminar to communicate the purpose of the IA to staff;
secondly, passport letter to staff from sponsor encouraging
cooperation; and thirdly, preliminary organisational survey
by auditor. Largely due to the previously noted time
constraints, this IA bypassed step one and went straight to
step two, which it was felt could substitute for step one to a
large degree. Step three occurred as per the guidelines.
The sponsor sent out a passport letter, via email, to all
staff, introducing the auditor, outlining the purpose and
benefits of the IA, and providing a high level summary of
the schedule (effectively combining steps one and two by
providing much of the information that would have been
communicated by step one). The email also invited
volunteers to participate in the working group. Initial
meetings with potential working group members, supple-
mented by early discussions with the sponsor, acted as the
1
Adapted from ‘information resource’ as per Gibb, Buchanan, and Shah
(2006).
151
Management Technology Systems Content
Strategic
Process
Resource
Fig. 1. The IA scope matrix (Buchanan & Gibb, 2007).
preliminary survey step, which allowed the auditor to make
a valuable preliminary assessment of the level of awareness
and value of information among staff. The survey found
evidence of poor organisational cohesion (the department
appeared to work in small, very loosely coupled groups),
and staff alluded to disparate administrative systems and
procedures.
2.1.2. Identify
There are six steps to this stage, which were completed in
workshops with the working group: definition of mission,
environmental analysis, definition of organisational struc-
ture, cultural analysis, identification of general information
flow, and identification of information resources.
With regard to recommended tools, Abell (1980), Porter
(1980), Pellow and Wilson (1993), and PEST analysis were
all successfully utilised to: define the business of the
organisation, review objectives, and conduct environmen-
tal analysis. The department’s mission was confirmed as
part of this exercise, which was described as: ‘‘to produce
high calibre graduates through the best available standards
of education, founded on a base of excellence in theory and
practice of the subject, and advancement of knowledge
through research’’. The mission statement provided overall
strategic direction to guide more detailed objectives, and
also described the department’s main activities and key
values.
The next step was to define the organisational structure,
which is, according to Buchanan and Gibb (1998), the
step where process modelling can substitute for more
traditional mapping of organisational structure. While an
organisational structure is necessary to define reporting
lines and to organise physical assets, an overemphasis on
organisational structure can create barriers to effective
information flow and inadvertently encourage staff to
operate in silos, thereby constraining the overall value that
can be generated by the enterprise. A process view
transcends these structural boundaries as it forces the
enterprise to look at ‘‘end-to-end’’ work and information
flow, illustrating how discrete areas must co-operate in
order to achieve end goals and/or overall customer
satisfaction. It was therefore deemed desirable to adopt a
process view of the organisation; however, although
Buchanan and Gibb (1998) identify process modelling
as an approach, they do not recommend any particular
tool or approach. As a consequence, Ould’s (1995)
STRIM process modelling methodology was identified
and (successfully) utilised.
 ARTICLE IN PRESS
152 S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160
One of the initial steps in STRIM is to establish an
overall picture of the organisation. Workshop participants
identified seven high-level processes within the department
(classified according to Ould, 1995):
1. Undergraduate teaching (core)
2. Post graduate teaching (core)
3. Research (core)
4. Consultancy (support)
5. Administration (support)
6. Facilities management (support)
7. Strategic management (management)
The next step would be to map each process from start
to finish, identifying individual activity and associated
inputs/outputs. However, this can be a time consuming
activity (Ould, 1995) and as previously noted, the IA was to
be completed in 12 weeks. Consequently, it was recom-
mended by the auditor that a key process should be
identified and prioritised with the possibility of one or
more follow on exercises for the remaining processes, either
as a continuation of the IA, or conducted internally by
members of the working group.
In order to prioritise a process, there were three impo-
rtant considerations: the current and potential contribution
of each process towards achieving the departments mission
(e.g. core value-adding processes versus support processes);
the resources consumed or utilised by each process
(e.g. does the resource requirements or utilisation of
resources give cause for concern); and the time, cost, and
management commitment required to model each key
process (e.g. given a choice, start big or small?). The
prioritised process was undergraduate teaching. As well as
being a core process of the department, a number of
problems had already been identified by workshop
participants during earlier discussions.
The objectives, critical success factors (CSFs) and
measures for the prioritised process were then identified.
Table 1 provides an example for the ‘‘provide a course
portfolio taking account of the dynamic and diverse
requirements of stakeholders’’ objective.
The next step was to develop a lifecycle model of the
prioritised process identifying the sub-processes within
(see Fig. 2). The model was developed and refined
(iteratively) in four stages: identification of processes,
identification of linkages between processes, identification
of key inputs and outputs, identification of process owners.
For the purposes of the IA, information flow was captured
as part of this modelling step in a manner similar to Orna’s
(1990) flow-based approach through the identification of
key information inputs and outputs.
Workshop participants were then asked to describe the
function and key activities of each sub-process, and to
identify any problems they associated with the sub-process.
This information was captured on a process description
template, which was developed by the auditor during this
study (see Table 2). These textual descriptions provided
Table 1
Objectives, critical success factors (CSF) and measures
Objective: provide a course portfolio taking account of the dynamic and
diverse requirements of stakeholders
CSF Measure
Funding SFC, grants, sponsorships, studentships
Industrial links Sponsorships, placements, projects,
employment, student prizes
Course relevance Course reviews, graduate employment
figures
Graduate knowledge Graduate employment figures, graduate
tracking (alumni)
Market knowledge Competitor figures, market trends,
recruitment trends
Professional accreditation Accreditation bodies
Course range Applications, entry standards
definition for each sub-process, identified issues, and could
substitute for, or to be used as the basis for, more detailed
process modelling (decomposition) at the next level.
It should be noted that no database was developed for
the preliminary IR inventory associated with this stage as
the development effort was felt to outweigh the benefits
(inventory was collated as simple MS Word tables).
2.1.3. Analyse
There are four steps to this stage, which were completed
through combination of survey, workshop, and auditor
analysis: evaluation of information resources, production
of detailed information flow diagrams, production of the
preliminary report, and formulation of action plans.
Identified process owners were surveyed (interviews) to
discuss and validate the process model, to identify more
comprehensively key information resources (based on the
preliminary inventory), and to model information flow for
sub-processes. Participants were also asked to assign a
value on a scale of 1–5 to each identified information
resource according to its relative strategic importance or
contribution to the associated process:
5: the information resource is critical to the process.
4: the information resource provides significant benefits or
adds value to the process.
3: the information resource contributes directly to this
process but is not essential.
2: the information resource provides indirect or minor
support to this process.
1: the information resource is not presently used or has no
perceived benefits.
Information flow is illustrated in Fig. 3 for the course
development sub-process. The values assigned to each
information resource are the mean values. The diagrams
were developed based upon simple input/output models
similar to Orna’s (1990) flow based approach, as per
Buchanan and Gibb’s (1998) recommendations.
 ARTICLE IN PRESS
S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160 153

1.1. Develop
Course

1.4. Manage
1.2. Market 1.3. Validate
Course
Course Course
Resources

1.7. Develop
1.5. Support 1.6. Recruit
Teaching
Students Students
Material

1.8. Manage
1.9. Deliver
Student
Course
Records

1.10. Assess
Students

1.11. Hold
Exam Board

1.12. Confer 1.13. Review

Awards Course

Note. Process numbers are for referencing purposes only

Fig. 2. Process model: 1. Undergraduate teaching (refined for illustrative purposes).

Table 2 information gaps were identified with both market course

Process description (illustrative): 1.1. Develop course
Process: 1.1. Develop course
Purpose/function of this process
1. To develop a full specification of a course from market need and
statement of goals, to class descriptors and regulations, within
identified constraints (e.g. resources)
2. To modify the design of an existing course following output of a
review, or modifications to market need, or course constraints
Key activities (or sub-processes) performed as part of this process
1.1.1. Propose course structure
1.1.2. Develop detailed course design
1.1.3. Produce course specification and regulations, etc.
Problems/difficulties associated with this process
Obtaining industry partners
Complex interactions with other courses
Uncertainty of market assessment, etc.
Analysis of information flow with process owners made
it possible to evaluate information use, information
requirements, and gaps in information (for example,
(lack of market knowledge) and review course processes
(lack of student employment knowledge)).
The next step was to collate and evaluate the problems
identified by process owners in order to identify the key
information problems experienced by the department
(captured as textual descriptions/statements). These were:
complex and disparate information systems; duplicated
effort, unnecessary data entry, and inefficient data proces-
sing; knowledge gaps; lack of standardisation including
several ad hoc or informal processes; no formal policy
statement, procedures, or operational guidelines for the
management of information resources; and a predomi-
nantly paper culture.
The preliminary report was then prepared and distrib-
uted to the working group in preparation for formulation
of action plans to improve identified problematic situa-
tions. Buchanan and Gibb (1998) refer to Checkland and
Schole’s (1990) soft systems methodology as a method
to deal with complex, unstructured, or poorly defined
situations, but this was not adopted firstly because it was
felt that, through the previous stages the problem had been
 ARTICLE IN PRESS
154 S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160

INPUTS PROCESS/OWNER OUTPUTS

Standards &
routes to 5
registration

Staff loading Staff loading

UG
schedule 4 schedule 4
Director

SFC funding SFC funding

5 5

SAAS Develop SAAS

funding 5 Course funding 5

EPSRC EPSRC
funding 5 funding 5

Course
Course Course
Co-ordinator
review 5 review 5
report report

Course
approval 5

Fig. 3. Information flow: 1.1. Develop course.

well documented and defined; and secondly, that after
extensive process modelling the working group would not
have welcomed another modelling exercise. Instead an adap-
tation of force field analysis was adopted for this final work-
shop, as recommended by Buchanan and Gibb (1998), but
more commonly associated with a previous stage of the IA.
Force field analysis (Lewin, 1947) was used to visually
highlight the positive or negative impact each CSF had on its
associated strategic objective. Three steps were as follows:
1. Each objective was positioned on a scale of 0–100%
according to approximate group estimates of current
achievement of the objective.
2. Associated CSFs (see Table 1) were identified as either
strengths or weaknesses based on evaluation of the
previously identified process and information problems.
For example (see Fig. 4), for the ‘‘provide a course
portfolio taking account of the dynamic and diverse
requirements of stakeholders’’, professional accredita-
tion was considered a strength, but market knowledge
was considered a weakness.
3. For each CSF, a shaded bar identified its relative
strength or weakness.
Finally, each weak CSF was then examined to determine:
 Why it is a weakness (referring to the identified
problems).
 How important an influence it is on the objective
(identifying priority).
 What action is required (formulating action plans).
The output of this step (particularly the action plans)
was recorded for incorporation in the final synthesise stage,
conducted by the auditors.
2.1.4. Synthesise
The main output of this IA was the IA report, which
included: revised strategic objectives and goals, a detailed
process model for undergraduate teaching, a series of
associated information flow diagrams, and the identifica-
tion and evaluation of key information resources.
The key IA recommendations were: to establish an
information policy, to initiate systems analysis to rationa-
lise and manage disparate administrative database and
information systems, and to establish an intranet/content
management system.
The IA was completed on schedule within the allocated
12-week period. Four members of staff participated in the
workshops and a further nine in interviews. Twenty-two
attended the post audit meeting. In total, the resource
requirement for the participating organisation was 22
full time equivalent (FTE) days (not including post
audit meeting). Auditor time for this IA amounted to 15
FTEs.
 ARTICLE IN PRESS
S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160
Provide a course portfolio taking account of the dynamic and diverse requirements of
stakeholders.
0%
STRENGTH
Funding
Industrial Links
Course Relevance
Course Range & Level 
Professional Accreditation
Fig. 4. Force field analysis.
2.1.5. Participant feedback and auditor observation
Sponsor and participant feedback was extremely posi-
tive. A post audit meeting was held with the working group
and sponsor, which explored participation and perceived
value of IA output. The strengths of the IA, as stated by
participants, were as follows:
 Staff benefited from the facilitated workshop approach.
The structured top-down process-based approach (and
tools/techniques adopted) was simple to follow, greatly
increased participant understanding of department goals
and requirements, and helped illustrate the role of
effective information management.
 Through the working group, wider interviews and
regular communications, staff felt involved at all stages.
 The short timeframe facilitated quick results, and limited
the impact on staff. Focusing on a prioritised process
shortened the project duration, and demonstrated max-
imum value by focusing on the area of greatest perceived
impact. Process descriptions for sub-processes substituted
for more time-consuming process modelling.
Notably, systems support staff immediately recognised
the value of IA output to systems analysis, particularly the
process models and information flow diagrams. This aligns
with the authors’ recommendations for greater synergy in
this area (Buchanan & Gibb, 2007).
2.2. Case study two
For case study two, the participating organisation was a
public body within the arts sector consisting of 90 staff.
The agency had recently undergone an external review,
which had identified, at a high level, several issues with the
management and processing of information and had been
critical of their core management information system. The
review had recommended that the organisation: become
more transparent and accountable, reduce time to process
applications, streamline evaluation and approval processes,
and improve communication between stakeholders.
155
Current Position (estimate)
100%
WEAKNESS
Graduate Knowledge
Market Knowledge
The sponsor wanted the IA to further explore these
problems and produce a series of recommendations which
could be incorporated into a planned change management
programme. The organisation’s business strategy was to be
taken as a given, as outlined in their Corporate Strategy
document; however, given that two of the four recommen-
dations from the organisational review related to process
issues, it was agreed that major processes should form the
background to the IA prior to more detailed analysis of
information usage and flow. Similar to case study one, the
sponsor stated that he did not require costing of informa-
tion resources. The audit was to be completed in eight
weeks so as not to delay the planned start date for the
change programme.
To meet these requirements the IA was scoped to be
primarily resource orientated but to include the process
perspective (see Fig. 5).
The IA methodology was tailored to these requirements
by once more removing the account stage. In-depth
interviews followed by a structured survey were the main
data gathering methods.
2.2.1. Promote2
The sponsor sent out a passport letter via email to all
staff, introducing the auditors, outlining the purpose and
benefits of the IA, and providing a high level summary of
the schedule of activity. The initial meetings with potential
participants to explain the IA process, supplemented by
early discussions with the Director, once again acted as the
preliminary survey step of this stage. The survey found
staff frustrated with information flow, organisational
communication, and ICT provision.
2.2.2. Identify
As per the brief, business strategy was to be taken as a
given with no strategic analysis required. This removed the
need for the initial two steps of this stage. However, it
2
Summaries for each of these respective stages will not be repeated
(see Sections 2.1.1–4).
 ARTICLE IN PRESS
156 S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160

Management Technology Systems Content

Strategic
Process
Resource
Fig. 5. The IA scope matrix (Buchanan & Gibb, 2007).
should be noted that the auditor did conduct key document
analysis to confirm strategy and to provide overarching
strategic direction, and that this is a recommended step in
these instances.
This stage, which as per the brief, would focus on
information use and flow, was completed primarily
through in-depth interviews and a structured survey. Initial
interviews were held with two senior managers to discuss
general information use and flow (e.g. initial exploratory
discussion), and to identify processes at a high-level.
Fourteen key processes were identified, discussed and
classified:
1. Administering funding applications (core)
2. Administering grants (core)
3. Developing arts strategies (core)
4. Performing advocacy (core)
5. Disseminating information (core)
6. Servicing customer enquiries (core)
7. Performing audits and compliance (management)
8. Developing corporate strategy (management)
9. Managing estates (support)
10. Managing financial resources (support)
11. Managing human resources (support)
12. Managing information resources (support)
13. Performing research (support)
14. Providing secretarial support (support)
Processes were captured, but not modelled, as this was
not part of the brief. The focus was on capturing process
information rather than process modelling, which would
have been impractical regardless given the limited time-
frame. Similar to case study one, Ould’s (1995) methodol-
ogy was followed, although adapted to describe rather than
model process (and proving amendable to this adaptation).
Follow on interviews with a further 11 (representative)
members of staff were semi-structured open-ended discus-
sions framed around the following questions:
1. What information do you use in your job?
2. What are the key barriers to obtaining and sharing this
information?
3. What do you do with this information?
4. What information do you supply to colleagues?
5. How could your job be made easier from an information
perspective?
6. What works well: what are examples of best practice in
this area that could be built upon?
Opinions and issues gathered during the interviews were
mapped to the process with which they were most
associated, rather than simply to the functional units from
which the interviewees were nominated (interviewees were
provided with the list of processes in advance). Process
information was captured (which included verification of
the processes) and subsequently documented according to:
description of process, inputs, outputs, and associated
issues. The template used (see Table 3) was an evolution of
the one developed for the first case study (see Table 2),
capturing more descriptive information than its predeces-
sor in lieu of detailed process modelling (including the
process cycle or sub-process of the process, which would
facilitate later modelling if required). Information flow was
also captured textually through definition of process inputs
and outputs.
Interviews were then followed by a questionnaire, which
was distributed to all members of staff. The questionnaire
focused on the following aspects of user role and
information use:
1. Main responsibility
2. Other important activities
3. Distribution of activity (talking to people, using a
computer, handling paper)
4. Contacts
5. Importance and accessibility of sources of information
6. Proportion of information that is sent out from
internal and external sources
7. Proportion of information that is received from
internal and external sources
8. The usefulness, frequency and difficulty experienced in
receiving information
9. The usefulness, frequency and difficulty experienced in
sending information
10. Serious barriers when using or sharing information
11. Quality of information
12. Current and future preferences
13. Awareness of information related policy and proce-
dures
Respondents could complete the questionnaire on screen
and return it via email, or print it out and return it via
internal post. Thirty-eight of the 90 questionnaires
distributed were completed and returned (a 42% response
rate).
As previously discussed, information use was to be pri-
marily identified through in-depth interview and structured
Table 3
Process description template
Process:
Description:
Lifecycle:
Inputs: Outputs:
Issues:
 ARTICLE IN PRESS
S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160 157

survey. In practice, the interviews provided an opportunity Table 4

to identify and explore processes in more depth, while the Identifying common themes
structured survey provided more detailed data regarding 1. Dissemination of information (internal)
information use, flow, and value, which was then statis-
tically analysed and graphically presented in the final Issues Requirements
report. In combination, the interviews and survey provided
 Too much e-mail is distributed on a  Better targeting of
a comprehensive profile of information use and flow. scatter-gun basis. e-mail.
 E-mail is often distributed without  E-mail etiquette.
2.2.3. Analyse guidance on how it should be  Understanding of costs
handled. to receiver need to be
As previously noted, information flow was captured as  People are unaware of certain key demonstrated.
part of the process descriptions, the analysis of which developments (both internal and  Online alerts.
naturally preceded the evaluation of information resources, external).  Automatic posting of
as process provides valuable context, and respects the top-  Different versions of documents can new documents and
exist. proposals on intranet.
down nature of the Buchanan and Gibb (1998) methodo-
 Director requires key figures to be  Key statistics on
logy. One other variation from Buchanan and Gibb’s pushed to desktop. applications, grants,
methodology is that no preliminary report was produced,  Content and structure of intranet overall financial
purely due to time constraints (but key findings were and web-site needs to be agreed. position, etc.
verified). It is also important to note that although a degree  Comprehensive coverage
and commitment of
of quantitative data was provided by the structured survey,
departments.
this stage predominantly involved qualitative data analysis.
Miles and Huberman (1994) identify three major phases to Recommendations
qualitative data analysis: data reduction, data display, and 1. Corporate information policy document required which, interalia,
conclusion drawing and verification, which were incorpo- defines how e-mail should be used, and establishes clear accountability
and ownership of information.
rated into this stage.
2. An intranet should be established as a matter of priority.
Analysis of the findings from the in-depth interviews and 3. An e-bulletin or news area should be a feature of the intranet where
survey identified several shared issues and requirements, key developments could be announced.
which through the process of data reduction, were grouped 4. An EIS should be considered which extracts figures from underlying
and categorised as follows: systems.
5. Web content should include: corporate information, policy
information, news information, jobs information. key external links,
1. Dissemination of information (internal) funding information, publications and administrative documents, plus
2. Dissemination of information (external) facilities to register, provide contact information, and complete
3. Information management and organisation applications forms and audit forms online.
6. The intranet should have similar coverage (but including documents
4. Information acquisition
for internal circulation only) plus access to underlying systems.
5. Research and query handling
6. Funding
7. Organisational issues
8. ICT
the IA scope for this IA (see Fig. 5). In summary, these
recommendations were:
Each category of findings was displayed in tabular
format as illustrated in Table 4. The complete sets of tables  Management
were discussed with a representative selection of partici- o Create an enhanced information service
pants as part of the conclusion drawing and verification o Develop a corporate information policy
step (substituting for one of the key purposes of the o Define information processes and accountability
preliminary report, e.g. confirmation of findings). Findings o Create a Chief Information Officer (CIO) role at
were accepted and verified, all emergent conclusions agreed senior management level
with.  Content
o Specify an information architecture to organise and
2.2.4. Synthesise navigate information
The key outputs of this IA were: identification, descrip- o Enhance research and monitoring of the external
tions and classification of key organisational processes; environment and make accessible to staff and
process-based analysis of information flow, an inventory of stakeholders
key information resources; and detailed action plans and o Define information flows and processes integral to
recommendations. The recommendations were then further core and peripheral functions
extrapolated and categorised according to Earl’s (2000)  System
taxonomy of information strategy components to provide o Two new related database components are required
an overarching strategic framework and to be traceable to to support critical data requirements: one to manage
 ARTICLE IN PRESS
158 S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160
contacts, and one to hold statistical data for detailed
analysis, decision support, and responding to external
mandatory requests
o Create mechanism for completing grant applications
and audit forms online (including website upgraded
to an extranet)
o Develop a content/document management system
o Establish a single contacts application accessible
to all
 Technology
o Create a central intranet, accessible to all, based on
clear ownership and accountability for documents
o Technologies should be implemented which facilitate
browser-based intranet access to extract information
from underlying systems
o Establish an extranet
o Create an electronic log form on the intranet
The IA was completed on schedule within the allocated
8-week period. Fifteen members of staff participated in
interviews and a further 38 completed the questionnaire.
Eighteen attended the post audit seminar. In total, this
IA required approximately 12 FTEs from the auditor,
and 5.75 FTEs from the participating organisation
(not including the post audit meeting). A notable observa-
tion was the significantly reduced resource requirement
(from 22 FTEs to 5.75 FTEs) for the participating
organisation where interviews replaced workshops
(and strategic analysis was out of scope). However, the
time saving for the auditor was less dramatic (from 15 to
12) as some workshop savings were offset by the need to
prepare for and conduct multiple interviews.
2.2.5. Participant feedback and auditor observation
The overall IA experience could once again be described
as positive. Interviewees appeared comfortable with the IA
process, and welcomed the opportunity to consider ways in
which to improve organisational processes and information
management. In the post-report seminar, which was
provided for the senior management team (the majority
of which had participated in the interviews), there were two
notable points of feedback:
 Staff expressed confidence in the methodological process
undertaken to conduct the IA, considering it to be both
understandable and comprehensive.
 Staff appreciated the two levels of recommendations,
and the use of Earl’s taxonomy to structure and simplify
the information strategy.
The shift from in-depth process modelling to capturing
process descriptions for all organisational processes
worked well and is recommended. The only exception
would be where participating organisations include re-
quirements in their brief which call for process modelling;
for example, resolving specific process-related problems,
automating manual processes, etc.
3. Stage two usability trials
Three usability trials were conducted in total. All three
auditors had no previous IA experience, but all had
successfully completed post-graduate level studies in
Information Management and were about to embark on
careers within the information profession (two were
employees of the audited organisations). All were volun-
tary participants invited to participate through an online
University forum, which described the proposed research.
For the usability trials, volunteering organisations were
invited to participate through a letter and/or email to the
appropriate head of business, explaining the proposed
research and outlining the IA process. Similar to the stage
one studies, IA scope and approach was dictated by the
brief provided by each organisation. Scope was set by
auditor and client utilising the IA scope matrix.
The author adopted an observational, non-participatory
role throughout each trial. Once each trial was completed,
semi-structured interviews were held with each auditor to
discuss the general IA experience and usability of the IA
methodology.
For the first of the usability trials, the participating
organisation was a public body in the education sector. The
organisation had recently completed a small, high-level
knowledge audit, as a precursor to the development of a
knowledge strategy, which had highlighted several general
information management problems and shortcomings. In
parallel to the knowledge audit, the organisation was also
initiating a process-reengineering project to look at new
ways of developing new products and services, with the
dual goals of promoting greater reuse of existing products/
services, and reaching markets faster with new products/
services. The findings of the knowledge audit had serious
implications for the success of this new process, so more
detailed investigation of information flow and require-
ments was called for.
In the initial scoping session, the sponsor confirmed that
the IA should focus on the product and service develop-
ment process, and identify and evaluate associated
information resources (a process oriented IA). The sponsor
viewed the IA as a follow on activity from the knowledge
audit, which had included strategic analysis; consequently,
the sponsor felt there was no need for this activity as part
of the IA identify stage. The sponsor also did not require
the account stage. The primary means of investigation
established by the auditor was in-depth interviews,
supplemented with a follow-up questionnaire, and includ-
ing analysis of key documents provided by the sponsor.
The final output was the information report for the
prioritised process, which included: the product and service
development process model and sub-process descriptions,
process-based information flow models, key information
resources, issues and requirements, and recommendations.
For the second usability trial, the participating Uni-
versity department was only 12 months old and had been
formed from the merger of five existing non-academic
 ARTICLE IN PRESS
S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160
service departments (the merger had arisen from the
recommendations of an organisation wide review which
had called for increased synergy and coordinated effort
across the five departments). The sponsor was primarily
focused on issues of integration, most notably to create
synergy across individual units and to improve organisa-
tional communication and information flow. In the initial
walkthrough session between auditor and sponsor, a
process-oriented approach was agreed as most appropriate,
including mapping of information flow for core processes.
The sponsor felt this should take priority over detailed
information resource inventory and analysis, and did not
feel the need for the account stage. The sponsor acknowl-
edged the importance of the promote stage and wished to
involve staff as much as possible in the IA processes.
Again, the primary means of investigation was in-depth
interviews, supplemented with follow-up questionnaire,
and including analysis of key documents provided by
the sponsor. The final output was the IA report, which
included: organisation process model and process descrip-
tions; process-based information flow models; key asso-
ciated information resources; and recommendations.
For the third and final usability trial, the participating
organisation was a private sector legal firm. The sponsor
confirmed that the IA should focus on a single department
within the organisation (the corporate library), and identify
and evaluate information services and associated informa-
tion resources. In contrast to the previous organisations,
which had all recently undergone either change or review,
this organisation was experiencing neither. The organisa-
tion simply wished to review its core information service.
The sponsor felt there was no need for strategic analysis
as part of the IA identify stage, or for costing of
information resources and/or associated services, which
consequently removed the need for the account stage. The
sponsor indicated a preference for selected individual
interviews over workshops, as this was considered easier
to manage from a resource and cost management
perspective. It was also agreed that an online structured
questionnaire would be developed for wider participation
and feedback. There was no requirement for an informa-
tion strategy. The final output was the IA report, which
included: service model, key information resources, service
evaluation, and recommendations.
In all three trials, selection of the Buchanan and Gibb
(1998) methodology by the auditors was based on
perceived flexibility of approach and incorporation of
comprehensive tools and techniques to support each of the
IA stages. Tailoring of the methodology proved to be a
straightforward task with none of the auditors conducting
the usability trials noting any problems. The methodology
proved extremely flexible in this respect, allowing the
auditors to tailor to individual requirements, with all three
trials adopting a similar tailored approach: promote
completed in full, identify streamlined, analyse completed
in full, account omitted, and an IA report produced but
no information strategy produced. The dominant tools/
159
techniques for data gathering in all cases were interviews
and questionnaires, which aligns with the findings from
previous published case studies (Buchanan & Gibb, 2008).
The IA scope matrix proved to be extremely useful when
tailoring the methodology as it helped the auditors to
understand and focus the scope of the audit; and secondly,
to identify appropriate tools and techniques to select for
each of the stages (e.g. strategic analysis tools and/or
process modelling tools).
However, while methodological flexibility was proven,
problems were noted by all three auditors regarding the
tools and techniques provided to support each of the
stages. The first auditor commented (Kassenova, 2005):
The author would recommend Buchanan & Gibb to
expand the level of details, as currently it is a
summarised version and not easy to use, especially for
the people new to the information audit. All key stages
would benefit from templates, examples and case studies
to support and explain how to use them y
The second auditor commented (Roussakis, 2005):
The significance of the (Buchanan & Gibb, 1998)
methodology is the initiation of tools and techniques
to be followed during the stages of the IA process. The
author feels the need to remark that it would have been
more useful during the whole process if there were
information concerning the use of the tools and the
benefits of using them, in the IA process. y It is
strongly believed that y for the benefit of the IA
process (there is) publication of further research,
including analytic descriptions of tools and techniques.
If this occurs, then the author believes that the
methodology can provide a standard approach to
information auditing.
The third auditor commented (Martin, 2005):
Were Buchanan & Gibb able to outline each of these
external models within the text of their own methodol-
ogy, and how best to tailor it for the information audit
rather than for the more specific situations for which
they were designed, this would result in a more self-
contained methodology. This would, in turn, make the
extra reading an option rather than a requirement, and
permit the more time-constrained auditor the option of
a more comprehensive audit.
The main limitation of the methodology, from a user
perspective, was its lack of instructional depth, particularly
with regard to tools and techniques; ironically considered a
strength by each auditor during initial selection of the
methodology. The auditors highlighted a particular need
for further guidance regarding: strategic analysis; interview
preparation; process modelling; and qualitative data
analysis. It is also highly likely that the account stage
would have presented similar challenges had it been
required by any of the participating organisations.
 ARTICLE IN PRESS
160 S. Buchanan, F. Gibb / International Journal of Information Management 28 (2008) 150–160
4. Conclusions
The main strengths of the Buchanan and Gibb (1998)
methodology are the logical structuring of stages, provision
of the toolkit, and the flexibility to tailor the methodology
to the brief. A weakness of the methodology is its limited
instructional depth; however, aside from process model-
ling, direction is provided to appropriate tools and
techniques for each of the stages/steps.
The Buchanan and Gibb (2007) IA scope matrix has
proven extremely useful. Process modelling has also proven
extremely valuable, encouraging user involvement by
focusing on readily understandable aspects of day-to-day
work, and providing an organisational model of informa-
tion flow. Earl’s (2000) IS taxonomy can also be used to
structure recommendations and provide traceability back
to the IA scope matrix.
A notable observation was that none of the participating
organisations felt the need for the account stage. As a
consequence this stage remains untested, but it also raises
the question as to whether or not formal accounting is
required for the purposes of information auditing. While
this research has not been extensive enough to be
conclusive on this matter, the evidence gathered thus far
does suggest that a formal account stage is not always
necessary, and that simple value tables can substitute in
those instances (aligning with the methodological ap-
proaches of both Orna (1999) and Henczel (2001)).
References
Abell, D. F. (1980). Defining the business: The starting point of strategic
planning. Englewood Cliffs, NJ: Prentice-Hall.
Botha, H., & Boon, J. A. (2003). The information audit: Principles and
guidelines. Library Review, 53(1), 23–38.
Buchanan, S., & Gibb, F. (1998). The information audit: An integrated
strategic approach. The International Journal of Information Manage-
ment, 18(1), 29–47.
Buchanan, S., & Gibb, F. (2007). The information audit: Role and scope.
The International Journal of Information Management (in press).
Buchanan, S., & Gibb, F. (2008). The information audit: Methodology
selection. The International Journal of Information Management
(in press).
Checkland, P., & Scholes, J. (1990). Soft systems methodology in action.
Chichester: Wiley.
Earl, M. J. (2000). In D. A. Marchand, T. H. Davenport, & T. Dickson
(Eds.), Mastering information management (pp. 16–22). London:
Financial Times Prentice-Hall.
Gibb, F., Buchanan, S., & Shah, S. (2006). An integrated approach to
process and service management. International Journal of Information
Management, 26, 44–58.
Henczel, S. (2001). The information audit: A practical guide. London:
K.G. Saur.
Kassenova, A. (2005). Information audit at the British Council. Unpub-
lished MSc dissertaion, University of Strathclyde.
Lewin, K. (1947). Frontiers in group dynamics: Concepts, method, and
reality in social science; social equilibria and social change. Human
Relations, 1(1), 23–32.
Martin, E. (2005). Information audit at MacFarlanes Law Firm.
Unpublished MSc dissertation, University of Strathclyde.
Miles, M. B., & Huberman, A. M. (1994). Qualitative data analysis (2nd
ed.). Newbury Park, CA: Sage.
Orna, E. (1990). Practical information policies: How to manage information
flow in organisations. Aldershot: Gower.
Orna, E. (1999). Practical information policies (2nd ed.). Aldershot:
Gower.
Ould, M. A. (1995). Business processes: Modelling and analysis for
re-engineering and improvement. Chichester: Wiley.
Pellow, A., & Wilson, T. D. (1993). The management information
requirements of heads of university departments: A critical success
factors approach. Journal of Information Science, 19(6), 425–437.
Porter, M. E. (1980). Competitive strategy: Techniques for analysing
industries and competitors. New York: Free Press.
Roussakis, C. (2005). Information audit at the Office of Marketing
and Communication. Unpublished MSc dissertation, University of
Strathclyde.
Steven Buchanan is an Information Systems Lecturer in the Graduate
School of Informatics, University of Strathclyde. He has carried out
extensive consultancy work and research in the areas of information
strategy, enterprise architecture, information systems, and information
audits. He has worked across Europe and throughout Australasia for a
number of public and private sector organisations, spanning telecommu-
nications, finance, education, government, and microelectronics.
Forbes Gibb is a Professor of Information Science in the Graduate School
of Informatics, University of Strathclyde. He has been involved in several
major EU funded research projects (SIMPR, STAMP, AUTOSOFT,
MIND) and teaches in the areas of information strategy, service
management and content management.