Skip to main content

Federal Records: National Archives and Selected Agencies Need to Strengthen E-Mail Management

GAO-08-742 Published: Jun 13, 2008. Publicly Released: Jul 08, 2008.
Jump To:
Skip to Highlights

Highlights

Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked, among other things, to review the extent to which NARA provides oversight of federal records management, describe selected agencies' processes for managing e-mail records, and assess these agencies' e-mail policies and key practices. To do so, GAO examined NARA guidance, regulations, and oversight activities, as well as e-mail policies at four agencies (of contrasting sizes and structures) and the practices of selected officials.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
National Archives and Records Administration To better ensure that federal records, including those that originated as e-mail messages, are appropriately identified, retained, and archived, the Archivist of the United States should develop and implement an approach to oversight of agency records management programs that provides adequate assurance that agencies are following NARA guidance, including: (1) developing various types of inspections, surveys, and other means to evaluate the state of agency records and records management programs; (2) developing criteria for using these means of assessment that ensure that they are regularly performed; and (3) regularly report to the Congress and OMB on the findings, recommendations, and agency responses to its oversight activities, as required by law.
Closed – Implemented
In June 2008, we reported that federal agencies were increasingly using electronic mail (e-mail) for essential communication, and in doing so, they were potentially creating messages that have the status of federal records which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. Further, according to NARA's regulation on e-mail policy and guidance, it requires agencies to instruct their staff on the management and preservation of e-mail records sent or received from nongovernmental e-mail systems. We found among other things that: 1) NARA no longer performs inspections of agency records management plans; 2) NARA has conducted six records management studies, however issues existed due to limitations in scope; and 3) NARA has not reported on its oversight activities as required by the Federal Records Act. As a result, we recommended that NARA develop and implement an approach to oversight of agency records management programs that provides adequate assurance that agencies are following NARA guidance, including: 1) developing various types of inspections, surveys, and other means to evaluate the state of agency records and records management programs; 2) developing criteria for using these means of assessment that ensure that they are regularly performed; and 3) regularly report to the Congress and OMB on the findings, recommendations, and agency responses to its oversight activities, as required by law. In response to our recommendation, NARA has taken the following actions: 1) approved a plan which includes a methodology for conducting annual records management program self-assessments and agency inspections; 2) included guidance for NARA to conduct annual records management program self-assessments and inspections of all federal agencies beginning in fiscal year 2010; and 3) NARA began reporting to the Congress and the Office of Management and Budget (OMB) on its records management activities in the annual Performance and Accountability Report (PAR) as well as issuing memoranda to notify agencies of expanded agency reporting requirements included in the PAR reported to the Congress and OMB. As a result, NARA has increased assurance that records are adequately managed and that important records are not being lost.
Environmental Protection Agency The Administrator of the Environmental Protection Agency should revise the agency's policies to ensure that they appropriately reflect NARA's requirement on instructing staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems.
Closed – Not Implemented
We recommended in June 2008 that the Administrator of the Environmental Protection Agency (EPA) revise agency policies to ensure that they appropriately reflect NARA requirements on instructing staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems. In response, EPA officials advised that they had revised their records management policy regarding e-mail but that the policy was not officially approved. We asked for evidence of this approval in 2011 and in early and late August, 2012. As of September 2012, EPA had not provided evidence of this approval. Therefore this recommendation is closed as not implemented.
Environmental Protection Agency The Administrator of the Environmental Protection Agency should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.
Closed – Implemented
EPA addressed this recommendation in two ways by: 1) Issuing on-line agency wide training on basic records management requirements and e-mail record capture in 2009 and 2) Issuing a baseline Records Management Survey in 2010 to assess EPA's records policy, to be used by records officers to assess their records programs. This survey included questions on the nature of records management training which can be used to assess training adequacy. As a result of issuing the agency-wide on-line records management training and the survey, EPA better assured that e-mail records are appropriately identified, stored, and preserved.
Federal Trade Commission The Chairman of the Federal Trade Commission should revise the commission's policies to ensure that they appropriately reflect NARA's requirement to instruct staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems.
Closed – Implemented
In response to the draft report, the FTC sent a notice to FTC staff about the internal policies and procedures that apply to the management and disposition of electronic mail messages, dated May 28, 2008. According to the notice, non-FTC e-mail accounts are not to be used to conduct FTC business due to privacy, security, and records management reasons. Further, the notice states that in the event that staff send or receive work-related e-mail records from nongovernmental systems, staff must forward such e-mails, including any attachments, to their FTC account and handle the records in accordance with FTC?s e-mail policies and procedures. By taking this action, FTC met this recommendation.
Department of Homeland Security The Secretary of Homeland Security should revise the department's policies to ensure that they appropriately reflect NARA's requirement to state that draft documents circulated on e-mail systems are potential federal records.
Closed – Not Implemented
In response to our recommendation, a DHS official stated that DHS was addressing this recommendation by updating a policy (Directive 141-01, Records Management) on employee and contractor responsibilities to include preserving and protecting records regardless of format or media. Subsequently, a DHS official advised of updates to the Directive/instructions to identify e-mail records. However, as of the September 2012, this guidance was still in draft. Therefore this recommendation is closed as not implemented.
Department of Homeland Security The Secretary of Homeland Security should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.
Closed – Not Implemented
In response to this recommendation the DHS Under Secretary for Management issued a memo in September, 2012, requiring all DHS employees to complete records management training, as well as the tracking and reporting of training completion. However this policy does not address how DHS is ensuring that records management policies are effective or properly implemented In addition, the records management policy that is one of the sources for the policy has not been finalized and DHS has not provided evidence that it address the electronic records weaknesses identified in our report.
Department of Housing and Urban Development The Secretary of Housing and Urban Development should revise the department's policies to ensure that they appropriately reflect NARA's requirements to ensure that staff is capable of identifying federal records and to state that e-mail systems must not be used to store recordkeeping copies of e-mail records (other than those exceptions provided in the regulation) and that e-mail system backup tapes should not be used for recordkeeping purposes.
Closed – Implemented
Housing and Urban Development (HUD) met this recommendation by posting guidance on email record retention. A HUD official provided a copy of this guidance to us in 2012. The guidance described how staff using e-mail systems should determine whether e-mail is a record, and if so, how to retain that e-mail as a record. Retention steps included creating and properly labeling and storing a hard copy of the e-mail. E-mail system back up tapes were not described as a record retention option.
Department of Housing and Urban Development The Secretary of Housing and Urban Development should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.
Closed – Implemented
HUD met this requirement as follows. In July 2009, HUD advised that it had met this requirement by requiring Records staff to train program staff every quarter, as specified in HUD?s Employee Performance Planning and Evaluation System. HUD provided a document from the system stating this requirement, and a document showing that monthly records management training has been conducted with a set of named staff.

Full Report

Office of Public Affairs

Topics

Agency proceedingsData transmissionE-mailElectronic recordsElectronic records managementEvaluation criteriaFederal agenciesFederal records managementFederal regulationsGovernment informationInformation managementInformation resources managementInformation storage and retrievalInformation systemsInspectionInternal controlsPolicy evaluationProgram evaluationProgram managementRecordsRecords managementRecords retentionReporting requirementsStrategic planning