3.4.2 Financial transparency, compliance, and audits

From aptrust
Jump to: navigation, search


3.4.2 Financial transparency, compliance, and audits
Status Ready for review
Compliance Rating Fully compliant
Responsible


The repository shall have financial practices and procedures which are transparent, compliant with relevant accounting standards and practices, and audited by third parties in accordance with territorial legal requirements.

Supporting Text

This is necessary in order to guard against malfeasance or other untoward activity that might threaten the economic viability of the repository.

Examples for Meeting the Requirement

Demonstrated dissemination requirements for business planning and practices; citations to and/or examples of accounting and audit requirements, standards, and practice; audited annual financial statements.

Discussion

The repository cannot simply claim transparency, but should show that it adjusts its business practices to keep them transparent, compliant, and auditable. Confidentiality requirements may prohibit making information about the repository’s finances public, but the repository should be able to demonstrate that it is satisfying the needs of its Designated Community.

Evidence Provided

APTrust is quite transparent with its business practices and budgeting.

Financial Sustainability Document

Financial Sustainability and Business Planning outlines the business, financial, and service principles for APTrust, including a commitment to diversity and openness. Link to the Budget Process are included, and finally an overview of all Financial Practices and Procedures. This includes audits, in which "the University Library’s financial procedures are subject to audit review on multi-year cycles by the University of Virginia’s auditors and periodically by the Commonwealth of Virginia’s Auditor of Public Accounts."

Article IX of Active Draft of APTrust Governance Manual:

ARTICLE IX: Budget and Finance

The budget of APTrust is a separately maintained budget held within the University of Virginia Library and university systems. The University Library’s financial procedures are subject to audits by the University of Virginia’s auditors.

Section 1: Checks, drafts, etc.
All checks, drafts, or other orders for the payment of money, notes, or other evidences of indebtedness issued in the name of APTrust shall be handled consistent with the financial policies and practices of the University of Virginia.
Section 2: Deposits of Funds
All funds of APTrust shall be deposited from time to time to the credit of APTrust in such banks, trust companies, or other depositories as the Board may elect and that conform to the University of Virginia practice.
Section 3: Gifts
The Board may accept, on behalf of APTrust, any contributions, gifts, or bequests for the general purposes or for any special purpose of APTrust.
Section 4: Fiscal Year
The fiscal year for APTrust shall begin on the first day of July of each year and end on the thirtieth day of June next succeeding.

APTrust Sustaining Member Deposit Agreement:[1]

  • Costs, Storage Allocations and Termination of Service
    • For a specific listing of current costs and services see APTrust Services and Fees List (2).
    • Depositor agrees to purchase storage services based on its current storage allocation and relevant APTrust rates. If Depositor's storage exceeds currently allocated and/or specifically purchased space within a single month of usage, Depositor must obtain additional space at the then-current pricing unless Depositor chooses to reduce the storage space used to the allocated/purchased level by the following month. The APTrust will inform Depositor of the excess storage use and provide an invoice with choices of additional levels of storage at costs for the remainder of the current annual billing cycle (normally from July 1 to June 30).
    • The APTrust will submit an invoice to Depositor for the first amount owed (to cover whatever remains of the July 1 to June 30 annual billing cycle) upon execution of this Agreement. The invoice will include specific information about the basis for any charges. The APTrust will bill Depositor by May 1 for an annual billing cycle that starts on July1, with payment due by August 1. The APTrust will inform Depositor of any changes in fee structure with 60 days notice before the changes are applied to any accounts. If the change applies to a period during which a previous invoice had been issued and paid, a supplemental invoice will be issued seeking payment for the incremental amount owed.
      • If Depositor fails to pay any invoice when due, Depositor's account will be classified as "unpaid," and the APTrust staff will contact Depositor using information recorded on the deposit agreement or otherwise updated by Depositor.
        • If the APTrust has not received payment or established other billing/payment arrangements with Depositor within 30 days of Depositor’s account being marked "unpaid", services to Depositor pursuant to this Agreement will terminate in 60 days and the Deposit will be deleted from the APTrust storage environment.
      • Depositor may terminate service pursuant to this Agreement by notifying the APTrust in writing by May 1 (in advance of the July 1 start date of a new cycle). In the event of such notice, service pursuant to this Agreement will continue until July 1. Depositor will have until June 15 to retrieve the Deposit from the APTrust storage environment, unless both parties have previously agreed in writing to other arrangements.
        • On the termination date (July 1) and in the absence of other agreed upon arrangements, Depositor's Deposit will be deleted from the APTrust's storage environment.
      • In the event of either Depositor’s failure to pay or Depositor’s election to terminate service as described above, Depositor will have the option to establish a direct contractual relationship with the third-party storage
      • provider with whom the APTrust stored Depositor’s data. Details of how Depositor can establish the direct relationship and take over responsibility for the deposited data appear in How a Depositor Converts to Direct Relationship with Third-Party Storage Provider (7).

APTrust Services and Fees List

September 2015

Updated February 2016

DEFINITIONS:

Sustaining Member: An APTrust Sustaining Member is an institution of higher education or other entity so designated by the APTrust Governing Board that pays an annual Sustaining-Member fee, receives an allocation of preservation storage space at no additional charge, and plays an active role in the development of the APTrust. Allocations of blocks of storage in excess of the initial allocation are available for an additional cost. The fee schedule below provides details about costs, but Sustaining Members receive at the outset a quota of 10 terabytes at no additional charge and will be able to acquire additional storage in 5 terabyte blocks at the current fee noted below.

Other membership types: The APTrust Governing Board may from time to time establish other means by which APTrust’s services can be acquired by entities other than the consortium’s Subscribing Members, and those means will be defined in this document at that time.

APTrust Core Service: APTrust core service uses a robust, redundant cloud-based design to safely store data files deposited to it by Depositors and to be able to return identical data files to the Depositor when requested, with high-assurance proof provided by widely accepted verification methods that the files are indeed identical. In its core service, APTrust does NOT perform specific file-changing "preservation actions" on the files during or after ingest. This includes actions such as file format migration, file normalization, creation of descriptive metadata and rights management. Services other than APTrust's core service may be available through APTrust now or in the future. In its core service, the APTrust does not provide access to deposited data files to any party other than the depositor and APTrust staff. Additional details of the Core Service are available in the Preservation Service Policy.

Additional APTrust Services: Services beyond the Core Service of the APTrust are proposed by APTrust members to the APTrust Program Director, evaluated for consistency with APTrust financial planning, and then submitted with an associated fee structure for approval by majority vote of the APTrust Governing Board.

Fee Setting process: Fees for all services are proposed by the APTrust Program Director, commented upon by advisory/work groups, and approved by majority vote of the APTrust Governing Board. Whenever possible, changes in fees are made with sufficient notice to allow members and subscribers to incorporate them into their regular annual cycles of financial planning. This document is maintained by APTrust staff with all current services and fees.

Deposit to the Digital Preservation Network (DPN): As a part of a national strategy for digital preservation, the APTrust environment is both an ingest node and a replicating node of the Digital Preservation Network. Entities that deposit data files to APTrust may also designate the files for deposit to DPN under the terms of DPN's own agreements. Deposit to DPN requires execution of an agreement between DPN and the Depositor that is appropriate to that purpose.

SERVICE AND FEE TABLE:

Service Description Fee Details
Sustaining Member Annual Fee $20,000/yr Includes 10 TB of Core-Service storage
Additional Core-Service Storage for Sustaining Members $2,750/yr For each additional block of 5 TB

Note: there is a proposal in March 2017 to decrease fees for additional core-service storage per 5 TB block.)

APTrust Answers to Cost Questions

APTrust Answers to Cost Questions were suggested by the MetaArchive Cooperative in Spring 2015 [(https://www.metaarchive.org/cost-questions)]

Original draft date: November 5, 2015

Updated: April 18, 2016; March 17, 2017


APTrust Note: The questions involved appear focused on uncovering hidden costs and other surprises that might be part of commercial solutions for digital preservation. APTrust is a collaboration between institutions of higher education founded on principles of complete transparency, and so some of the questions are not precisely tailored for our type of organization. If you’d like any further detail on any answer or on any other aspect of APTrust, please contact us at info@aptrust.org.

  1. What are the solution provider’s licensing, subscription or membership fees?
    ANSWER: $20,000 per year for each member institution (includes participation in governance activities, two no-registration-fee consortial in-person meetings per year, requires participation in consortial activities, also includes 10 TB of content preserved for the year).
    • Have these fees increased or decreased over the past three years, and why?
      ANSWER: No
    • How often is the fee structure reviewed? And how are fees set?
      ANSWER: Continuously. Governing Board (comprised of members) sets fees.
    • How are customers/subscribers/members consulted during such reviews?
      ANSWER: Through the Governing Board, they review and set them.
  2. Are additional memberships required to participate in the solution?
    ANSWER: No.
    • If so, what are the fees associated with those memberships?
  3. Is there a minimum licensing/subscription/membership term?
    ANSWER: Minimum and maximum are currently the same: one year.
  4. What are the solution provider’s storage fees?
    ANSWER: First 10 TB of content to be preserved (which actually results in 60 TB of storage through replication) is included in membership fee. Additional 5 TB blocks of content are currently charged at $2,750 (translates to $550 per TB). The APTrust Governing Board will hear a proposal from the staff to reduce that fee by 24 percent in March-April 2017. If approved, that change will take effect immediately. To reiterate: we quote costs by quantity of content to be preserved—the actual storage associated is six times that amount.
    • Have those fees increased or decreased over the past three years, and why?
      ANSWER: The costs for “extra” 5 TB blocks was reduced from $4,250 to $2,750 early in 2016 because our experience with greater volumes of content justified the reduction in rates.
    How often is the fee structure reviewed? And how are fees set
    • ANSWER: Same as 1, above.
    • How are customers/subscribers/members consulted during such reviews?
      ANSWER: Same as 1, above.
  5. Are there limits on the numbers or size of collections that can be deposited?
    ANSWER: No limit on collection size or numbers.
    • Is there a maximum amount of storage that can be utilized?
      ANSWER: Our storage environment is Amazon Web Services, and we do not have a limit.
  6. How does the solution provide for increases in storage capacity?
    ANSWER: As noted in 5, we can flex storage as needed by any depositor.
    • And how do these increases affect fees, if at all?
      ANSWER: If we receive reduced per-volume pricing for Amazon as a result of increased total storage, that reduction will be passed to the depositors via reduction in rates.
  7. Do any fees paid (licensing/subscription/membership/storage) include geographically distributed copies of content?
    ANSWER: Yes
    • If so, how many copies and in what geographic locations?
      ANSWER: We store three copies in AWS’s S3 service in Virginia and three more in Glacier in Oregon. We conduct APTrust fixity checks on the content in the S3 service every 90 days (in addition to the AWS built-in fixity checking on both services).
    • If not, what’s the additional cost for this option?
      ANSWER: Included in the base cost.
  8. Am I responsible for obtaining any additional hardware or software at my own expense to work with the solution?
    ANSWER: No
    • If Yes, what are the average hardware/software costs?
    • Does the solution provider publish specifications or requirements?
    • What is the recommended replacement cycle?
    • Are there any additional costs for security (e.g. encrypted storage)?
  9. What are a few specific examples of tasks, services, or resources that my fees for this solution are supporting (e.g., staff salaries, infrastructure upgrades, research and development, etc.)?
    ANSWER: APTrust is a consortium of higher education institutions, governed by those institutions. All costs are publicly reported in categories (such as revenues from memberships and any other sources (including the beyond-allocation storage fees noted above)), AWS costs, staff compensation, staff travel, event costs (for the two face-to-face meetings held per year), and all others.
  10. On what schedule are customers/subscribers/members billed?
    ANSWER: Standard membership fees are billed in late spring; storage beyond the allocated amount is tracked on a monthly basis—if it persists, billing for the extra-storage fees commences.
  11. Does the solution charge a one-time setup, implementation, or initial ingest fee, above and beyond any ongoing fees?
    ANSWER: No.
  12. On average, how long does it take to begin using the solution once a contract or service license agreement (SLA) has been signed?
    ANSWER: In our experience, APTrust has been ready to accept deposits long before the institutions have completed their processes of selection and technical preparation of the content for deposit. But because technical preparation for ingest is a depositor responsibility in our environment (and because we can scale the AWS components to the demand rapidly), deposit can commence as soon as the institution has accounts created (that takes place within one or two business days after the institution provides identity information on appropriate staff).
    • What steps are involved?
      ANSWER: Provisioning accounts as noted above, along with discussion between staff actually doing the deposits to ensure good understanding of the technical specifications of the ingest format (Bagit) and the accompanying data that APTrust needs with the deposit (minimal).
  13. Does the solution provide basic documentation and instructions on getting started?
    ANSWER: Yes, although we have a member-team working for better clarity of that documentation/instruction set.
  14. Does the solution provider prepare content for ingest?
    ANSWER: No
    • If so, do any fees being paid cover tasks like verifying inventories, performing fixity checks, and/or repairing any files that may get damaged in the process of sending content to the solution provider?
      ANSWER: As worded, this question is a little difficult to answer. Certainly no additional fees are charged for any functions that APTrust does in this regard. We have automated processes that detect failures in various steps of the deposit and that verify checksums on packages deposited, etc. If deposit mechanisms fail, the system detects the failure and automatically cues the material for re-deposit. Early in our process, our system checks the deposit for conformity with requirements, and notifies the depositor if the deposit was rejected because it doesn’t conform.
    • If not, does the solution provider cover/defer any costs to train or outsource?
      ANSWER: APTrust, as a consortium of institutions collaborating on preservation solutions, is founded on the notion that all participants help each other. Peer sharing of information is common and very effective, and it is cited often as one of the reasons that members value their participation in APTrust. We have a provision that we will assemble a combined team of staff and member-specialists to provide help to an institution in the early stages, but that depends on availability of the resources, most of whom would be volunteers. In any case, there is no cost to the depositor for these support activities.
  15. To what degree are the steps related to ingest, description, preservation, etc., automated?
    ANSWER: In APTrust, many of these steps are automated (although the term “description” in the question needs clear definition to ensure we’re addressing that question). We are happy to provide much more detail on this to any interested parties.
  16. If the solution is a non-profit (or run by one), are copies of the annual operating budget and financial statement shared with the members.
    ANSWER: We already do this, and we’re planning to do so at greater frequency than annual (so members can see budget updates through the year.
    • If not, are there plans to?
      ANSWER: See above.
  17. In terms of sustainability, does the solution provider have a strategic plan, succession plan, or disaster recovery plan?
    ANSWER: Yes, and we’re working toward trusted digital repository certification.
    • If so, how up to date are such plans?
      ANSWER: Most documents containing these components were adopted in the May to October 2015 range.
    • Has the solution provider engaged in any audits, or risk assessments?
      ANSWER: We have a member workgroup developing an approach for APTrust to achieve trusted digital repository status, and in addition to that team’s reviews and assessments, we’ll soon undertake a security assessment of APTrust with the help of the security specialists at one of our member institutions.
    • Are any of the plans or audit/assessments publicly available?
      ANSWER: We will make all such results available to the public, with the exception of any detail that, if published, would represent a risk to depositor content.
  18. Is there a charge for retrieving content from the solution?
    ANSWER: Not anticipated at present because we don’t anticipate that this will be a frequent request. If it becomes a frequent activity that generates significant unanticipated cost, we will reconsider this stance.
    • If yes, how much is it?
      ANSWER: No charge at this time.
    • How is this charge calculated and what does it cover?
      ANSWER: If a fee is ever considered in the future, it will be designed to cover the actual costs of providing that function, proposed by staff for review by the member Advisory Committee, which will forward its recommendation to the member Governing Board for approval.
    • Under what terms? Are there any restrictions and limitations?
      ANSWER: See above.
  19. Is there any charge for deleting content from the solution?
    ANSWER: No. Any authorized depositing-institution official can inform the staff of the request for deletion.
    • If yes, how much is it?
    • How is this charge calculated and what does it cover?
    • Under what terms? Are there any restrictions or limitations?
  20. [Question 20 is for depositors, not the repository provider.]