Does Reasonable Steps support both FOI and GIPA?

Yes. The Act, the statutory clock, the fee schedule, the decision model and the review path are configuration held in a jurisdiction pack. One deployment serves a Commonwealth agency and a New South Wales agency at the same time, each in its own statutory vocabulary.

Does content have to be migrated?

No. EncompaaS discovers and classifies in place across Content Manager, SharePoint, Exchange and corporate file shares. The systems of record stay the systems of record and nothing is copied out of them.

How is the search evidenced?

An append-only search ledger records every system, every query and every hit count as the search runs, including systems deliberately excluded and the reason for each. It ends in a certificate of search that is signed, countersigned and hashed, and can be attached to the decision or produced on review.

How is Reasonable Steps licensed?

Reasonable Steps is licensed through Microsoft Marketplace and runs inside your own Microsoft tenant, reaching your own systems of record under your own permissions.

Access to information, answered with evidence.

FOI, GIPA and RTI casework, built on Microsoft Power Platform and EncompaaS. It searches the whole records estate, and writes down every system, every query and every hit count as it goes.

Talk to us How it works

Full overview, 3 minutes 36. Recorded from the working application.

Specialists in governed information for over 20 years. This product searches the same kind of records estate we have spent that time building and governing.

200+: Content Manager projects delivered
100+: client organisations
5: Microsoft Solutions Partner designations, and two Microsoft MVPs on staff
2026: recognised in two ISG Microsoft Partner Ecosystem quadrants: Azure Data Transformation and AI Services, and Productivity and Business Process Services

Four numbers explain why this exists.

Australian agencies handle more than 130,000 statutory access requests a year. Freedom of information, GIPA, right to information. Volume is up 25 per cent, cost is up 14, and 27 per cent of decisions land outside the statutory clock.

43,456: Commonwealth FOI requests in 2024-25. Up 25 per cent, and the highest on record. OAIC Annual Report 2024-25, Volume 2
$97.99M: Reported cost of FOI to Commonwealth agencies, up 14 per cent in a single year. OAIC Annual Report 2024-25, Volume 2
27%: Of decisions made outside the statutory timeframe, with a deemed refusal at the end of it. OAIC Annual Report 2024-25, Volume 2

79%

of audited requests could not evidence a reasonable search.

The Auditor-General examined a sample of Commonwealth FOI requests and found that four in five could not show what was searched, what was found, or what was deliberately left out. Reasonable Steps writes that evidence as the search runs and hands it over as a signed certificate.

Australian National Audit Office, 20 May 2026

Add Victoria at 58,181 requests and New South Wales at 27,485 GIPA applications, before counting Queensland, Western Australia, South Australia, Tasmania, the Northern Territory and the Australian Capital Territory, and the national figure is comfortably past 130,000 a year. 63 per cent of agencies run this on a spreadsheet, and only 26 per cent use a case management system at all (OAIC FOI Practitioners' Survey 2024).

It starts where the records actually are.

Reasonable Steps covers the whole path: the estate, the search, the candidate documents, the review, the decision and the release. Finding the records and evidencing the search are part of the product, so an officer never has to assemble either by hand.

The estateEverything the agency holds

DiscoverySearch, and the record of it

Candidate documentsDeduplicated and grouped

ReviewGrounds and redaction

DecisionSchedule and reasons

ReleaseDelivery and disclosure log

Reasonable Steps, end to end. One product, one audit trail.

Searching the estate and evidencing that search is the control the Auditor-General found four in five audited requests could not demonstrate. Here it happens as part of the work, and it produces an artefact you can attach to the decision.

Estate-wide search, built in

One search strategy reaches the enterprise records estate through EncompaaS, and the ledger and the certificate of search come out the other side. The evidence is a by-product of doing the work rather than a separate exercise at the end of it.

Built for the Australian regimes

The Act, the clock, the fee schedule, the decision model and the review path are configuration. One deployment serves a Commonwealth agency and a New South Wales agency at the same time, each in its own statutory vocabulary.

Suggestions you can defend on review

EncompaaS classifies across the estate with sensitivity tagging and entity extraction, and writes labels back to Microsoft Purview. Every exemption suggestion traces to a governed classification, so an officer can always show where it came from.

Search it. Prove it. Release it.

Lodgement through to release on one data model, with the statutory clock running from receipt and the evidence assembling underneath as the officer works.

The Reasonable Steps portfolio screen: thirteen open access applications, three overdue and four due within a week, above a deemed refusal horizon plotting days remaining against the share of documents decided, with the at-risk quadrant shaded.

Every open application against its own clock. Days remaining across the bottom, share of documents decided up the side, circle size by document count. Anything drifting into the shaded corner will breach before it is finished, and it shows a fortnight out rather than the night before.

One

Search it

One search strategy runs across the whole records estate through EncompaaS. Content Manager, SharePoint, Exchange and the corporate file shares, under the officer's own permissions. Nothing is copied out of any of them.

Estate-wide discovery across cloud and on-premises sources
A custodian questionnaire catches material held outside a governed system
Deciding not to search a system is a decision, with a reason, on the file

OpenText Content ManagerOn premises, record types in scope Searched

Microsoft SharePointSites and libraries in scope Searched

Microsoft ExchangeCustodian mailboxes identified by the business area Searched

Corporate file sharesIndexed in place, with OCR on scanned documents Searched

Microsoft TeamsOut of scope by agreement with the applicant Reason recorded

Legacy records archiveDecommissioned and fully migrated, migration certificate on the record Reason recorded

Content never moves. EncompaaS discovers and classifies in place, and the systems of record stay the systems of record.

Two

Prove it

The Search Ledger writes itself while the search runs. Every system, every query, every hit count, timestamped and attributed. It is append only: one entry per query, never edited. The two systems that were not searched sit in the same ledger, each with its reason.

Append only, and exportable in full
Ends in a certificate of search, signed, countersigned and hashed
Attach it to the decision, or produce it on review

The complete Search Ledger for one access application: thirteen entries, each with a timestamp, the system searched, the query run, the hit count and an included or excluded status. The final two entries are exclusions, each carrying the recorded reason. — The ledger, mid-search. Included and excluded systems in one append-only record.

Certificate of search Evidence artefact

Statute: GIPA Act 2009 (NSW)
Systems searched: 4
Queries run: 11
Systems excluded: 2, each with a recorded reason
Results before deduplication: 6,128
Candidate documents: 12 after thread collapse and near-duplicate grouping
Certified by: Senior Information Access Officer
Countersigned: Manager, Information Access
Ledger hash: 981F492004FC1158

The hash is computed over the whole ledger, so altering any entry changes it.

Three

Release it

Review is keyboard first, and every suggestion traces to a governed classification rather than a pattern match. The schedule of documents builds underneath as the officer works, and the statement of reasons drafts itself from the decisions already on file, each ground traced back to the document that produced it.

The officer decides, and the log records whether the suggestion was followed
The delegation is checked before the decision can issue
Published to the disclosure log, where it deflects the next matching application

The delegation check in the Reasonable Steps decision screen: a decision maker selected from a list, five authorisation conditions each ticked, and the issue button unlocked because the check passes. — The delegation check. Until it passes, the decision cannot issue.

One product, every jurisdiction.

New South Wales runs GIPA and the Commonwealth runs FOI. These are not the same statute with different numbers. New South Wales has no exemptions at all and applies a presumption in favour of disclosure against a statutory table of considerations; the Commonwealth applies exemptions in two divisions with a public interest test on the conditional ones. The same screen serves both.

The two statutory packs, side by side.
Provision	New South WalesGIPA	CommonwealthFOI
Act	Government Information (Public Access) Act 2009	Freedom of Information Act 1982
Statutory clock	20 working days, with the New South Wales public holiday set applied	30 calendar days
Application fee	$30	None. Abolished in 2010.
Own personal information	First 20 hours free, then $30 per hour	No charges at all
Decision model	No exemptions. A section 12 presumption in favour of disclosure, the section 14 table of public interest considerations against, and the Schedule 1 conclusive presumptions.	Exemptions. Division 2 unconditional, Division 3 conditional and subject to the public interest test in section 11A(5).
A request is called	An access application	An FOI request
Review path	Internal review, then IPC review, then NCAT	Internal review, then IC review, then the ART

Switching is one control

The clock moves from 20 working days to 30 calendar days. The vocabulary moves from access application to FOI request, and from IPC to OAIC. The decision rail changes from a public interest table to two divisions of exemptions, and the same classification finding carries a different citation. Same product, no rebuild.

Adding a jurisdiction is configuration

A jurisdiction pack is a data record: the Act and its citation, the clock basis, the public holiday set, permitted extensions and their triggers, clock-pause events, the decision model with its section numbers, the fee and charge schedule, the review pathway and the disclosure log rules. Changing jurisdiction changes labels, clocks, decision lists and letters. It never changes code.

Microsoft Power Platform on top, EncompaaS underneath.

A public portal on Microsoft Power Pages. The casework interface is a Microsoft Power Apps code app, with Microsoft Dataverse holding every request, every decision and every line of the search ledger. Underneath, EncompaaS on Microsoft Azure discovers and classifies across the estate, on premises and in the cloud, through connectors rather than a migration.

Public

What the applicant sees

Microsoft Power PagesAnonymous lodgement, status tracking, secure delivery, disclosure log

Interface

Where the casework happens

Reasonable Steps on Microsoft Power AppsPortfolio, triage, discovery, review, decision and release

Case state

What is held

Microsoft DataverseRequests, documents, decisions, the search ledger, clocks and audit

Discovery

How it reaches the estate

EncompaaS on Microsoft AzureAuto classification, entity extraction, summary, table cognition and image OCR, with connectors to every source below The differentiator

Sources

Where the content stays

OpenText Content ManagerUnchanged, unmigrated

Microsoft SharePointSites and libraries

Exchange

OneDrive

Content never moves

EncompaaS discovers, classifies and enriches in place. Reasonable Steps holds the case, the decisions and the evidence. There is no migration and no second copy to govern.

EncompaaS does the discovery and the classification.

It connects to every system your organisation already runs, works out what is in them, and governs the result in place. It is worth understanding on its own terms.

What is EncompaaS?

Assessed to PROTECTED

Microsoft Azure and Microsoft 365 are independently IRAP assessed for workloads up to and including PROTECTED, most recently in March 2026. Power Apps and Power Automate are named in scope of the ASD Blueprint for Secure Cloud.

Runs as the signed-in officer

Microsoft Entra ID carries the identity from the front end down to the record. A search returns what that officer could already open, and nothing else.

Reaches beyond Microsoft

EncompaaS connects to Content Manager, file shares, relational databases and line of business systems over REST, cloud or on premises, wherever the records sit.