This is the accessible text file for GAO report number GAO-08-742
entitled 'Federal Records: National Archives and Selected Agencies Need
to Strengthen E-Mail Management' which was released on July 8, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
[This report was revised July 28, 2008, to correct figure 1, page 13. This figure initially and inadvertently contained incorrect or repetitious information and was replaced.]
Report to Congressional Requesters:
United States Government Accountability Office:
GAO:
June 2008:
Federal Records:
National Archives and Selected Agencies Need to Strengthen E-Mail
Management:
GAO-08-742:
GAO Highlights:
Highlights of GAO-08-742, a report to congressional requesters.
Why GAO Did This Study:
Federal agencies are increasingly using electronic mail (e-mail) for
essential communication. In doing so, they are potentially creating
messages that have the status of federal records, which must be managed
and preserved in accordance with the Federal Records Act. Under the
act, both the National Archives and Records Administration (NARA) and
federal agencies have responsibilities for managing federal records,
including e-mail records.
In view of the importance that e-mail plays in documenting government
activities, GAO was asked, among other things, to review the extent to
which NARA provides oversight of federal records management, describe
selected agencies’ processes for managing e-mail records, and assess
these agencies’ e-mail policies and key practices. To do so, GAO
examined NARA guidance, regulations, and oversight activities, as well
as e-mail policies at four agencies (of contrasting sizes and
structures) and the practices of selected officials.
What GAO Found:
Although NARA has responsibilities for oversight of agencies’ records
and records management programs and practices, including conducting
inspections or surveys, performing studies, and reporting results to
the Congress and the Office of Management and Budget (OMB), in recent
years NARA’s oversight activities have been primarily limited to
performing studies. NARA has conducted no inspections of agency records
management programs since 2000, because it uses inspections only to
address cases of the highest risk, and no recent cases have met its
criteria. In addition, NARA has not consistently reported details on
records management problems or recommended practices that were
discovered as a result of its studies. Without more comprehensive
evaluations of agency records management, NARA has limited assurance
that agencies are appropriately managing the records in their custody
and that important records are not lost.
The four agencies reviewed generally managed e-mail records through
paper-based processes, rather than using electronic recordkeeping. A
transition to electronic recordkeeping was under way at one of the four
agencies, and two had long-term plans to use electronic recordkeeping.
(The fourth agency had no current plans to make such a transition.)
Each of the business units that GAO reviewed (one at each agency)
maintained “case” files to fulfill its mission and used these for
recordkeeping. The practice at the units was to include e-mail
printouts in the case files if the e-mail contained information
necessary to document the case—that is, record material. These
printouts included transmission data and distribution lists, as
required.
All four agencies had e-mail records management policies that
addressed, with a few exceptions, the requirements in NARA’s
regulations. However, the practices of senior officials at those
agencies did not always conform to requirements. Of the 15 senior
officials whose practices were reviewed, the e-mail records for 7
(including all 4 at one agency) were managed in compliance with
requirements. (One additional official was selected for review but did
not use e-mail.) The other 8 officials generally kept e-mail messages,
record or nonrecord, in e-mail systems that were not recordkeeping
systems. (Among other things, recordkeeping systems allow related
records to be categorized according to their business purposes.) If e-
mail records are not kept in recordkeeping systems, they may be harder
to find and use, as well as being at increased risk of loss from
inadvertent or automatic deletion. Factors contributing to
noncompliance included insufficient training and oversight as well as
the difficulties of managing large volumes of e-mail. Without periodic
evaluations of recordkeeping practices or other controls to ensure that
staff are trained and carry out their responsibilities, agencies have
little assurance that e-mail records are properly identified, stored,
and preserved.
What GAO Recommends:
GAO is recommending that NARA develop and implement a comprehensive
oversight mechanism and that the four agencies address weaknesses in
records management oversight, policies, and practices. Officials from
the five agencies indicated, in comments on a draft of this report,
that they were implementing or intended to implement GAO’s
recommendations.
To view the full product, including the scope and methodology, click on
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-742]. For more
information, contact Linda Koontz at (202) 512-6240 or koontzl@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
NARA's Oversight Activities Have Been Limited:
Agencies Reviewed Generally Used Paper Processes for E-Mail Records
Management, but Three Are Moving Toward Electronic Recordkeeping:
E-mail Record Policies at Three of the Four Agencies Generally
Addressed NARA Guidance:
E-Mail Records Management Practices of Senior Officials Did Not Fully
Comply with Key Requirements:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Comments from the National Archives and Records
Administration:
Appendix III: Comments from the Environmental Protection Agency:
GAO Comments:
Appendix IV: Comments from the Department of Housing and Urban
Development:
GAO Comments:
Appendix V: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: Required Features of Electronic Recordkeeping Systems That
Include E-Mail Records:
Table 2: NARA Studies Performed in the Last 5 Years:
Table 3: E-Mail Policy and Guidance Required by Regulation:
Table 4: Agencies' Conformance to Required Policy and Guidance on
Managing E-Mail Records:
Table 5: Assessed Business Units:
Table 6: Assessed Senior Officials:
Table 7: Topics of E-Mail Records Management Data Collection
Instruments and Their Associated Respondents:
Figure:
Figure 1: Example Decision Tree for Determining Whether an E-Mail
Message Is a Record:
Abbreviations:
CIO: Chief Information Officer:
DHS: Department of Homeland Security:
ECMS: Enterprise Content Management System:
e-mail: electronic mail:
EPA: Environmental Protection Agency:
FTC: Federal Trade Commission:
HERS: HUD Electronic Record System:
HUD: Department of Housing and Urban Development:
NARA: National Archives and Records Administration:
OMB: Office of Management and Budget:
R&D: research and development:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
June 13, 2008:
The Honorable Henry A. Waxman:
Chairman:
Committee on Oversight and Government Reform:
House of Representatives:
The Honorable William Lacy Clay:
Chairman:
Subcommittee on Information Policy, Census, and National Archives:
Committee on Oversight and Government Reform:
House of Representatives:
Federal agencies are increasingly using electronic mail (e-mail) for
essential communication, and in doing so, they are potentially creating
messages that have the status of federal records. According to the
Federal Records Act,[Footnote 1] federal records are materials in
whatever form that document government functions, activities,
decisions, and other important transactions, and such records must be
managed and preserved in accordance with the act.[Footnote 2] As the
volume of federal e-mail grows, so does the challenge of managing
electronic records.
Under the act, the National Archives and Records Administration (NARA
or the Archives) has responsibilities for oversight and guidance of
federal records management, including management of e-mail records.
Agencies also have records management responsibilities, including the
responsibility to develop e-mail management policies and practices that
include specific requirements, such as defining staff responsibilities
for determining whether an e-mail (including any associated
attachments) is a federal record and, further, requiring preservation
of record e-mail.
In view of the importance that e-mail plays in documenting government
activities, you asked that we review federal e-mail records management.
Specifically, our objectives were to:
* assess to what extent NARA provides oversight of federal records
management programs and practices, particularly with regard to e-mail;
* describe processes followed by selected federal agencies to manage e-
mail records;
* assess to what extent the selected agencies' e-mail records
management policies comply with federal requirements; and:
* assess compliance of selected senior officials with key e-mail
recordkeeping requirements.
To determine the extent to which NARA provided oversight of federal
agencies' programs for managing and preserving federal e-mail records,
we analyzed applicable laws, regulations, and guidance; reviewed NARA's
oversight activities from 2003 to 2007, including its 2003 to 2007
reports to the Office of Management and Budget (OMB) and the Congress
on records management activities; analyzed NARA reports and documents;
and interviewed NARA officials.
To describe e-mail recordkeeping processes at selected federal
agencies, we selected four federal agencies (the Environmental
Protection Agency, the Federal Trade Commission, and the Departments of
Homeland Security and of Housing and Urban Development), based on
contrasting sizes and structures and on the significance of their
records to protecting rights and documenting accountability. We
reviewed agency documents, analyzed agency responses to a series of
data collection instruments, interviewed agency officials, reviewed the
e-mail management practices at one business unit at each agency, and
inspected a limited number of sample e-mail records identified by the
agencies to corroborate their statements.
To determine the extent to which the four agencies' policies comply
with requirements, we analyzed applicable laws, regulations, and
guidance to identify e-mail records management requirements, and we
assessed the agencies' e-mail management policies against these
requirements.
To assess compliance of selected senior officials with key
recordkeeping requirements at each agency, we reviewed the e-mail
management practices of four senior officials (including the agency
head at each selected agency), based on agency responses to our data
collection instruments, interviews with agency officials, and
inspection of a limited number of sample e-mail records identified by
the agencies to corroborate their statements. We did not attempt to
assess the extent to which the agencies' staff correctly identified e-
mail as federal records or the extent to which the agencies' records
appropriately included e-mail. Additional detail on the objectives,
scope, and methodology of this audit can be found in appendix I.
We conducted this performance audit from April 2007 to May 2008 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Results in Brief:
To fulfill its responsibility under the Federal Records Act for
oversight of agency records management programs, NARA planned to
conduct activities including inspections, studies, and reporting.
However, despite its plans, in recent years its oversight activities
have been primarily limited to performing studies. Although it has
performed or sponsored six records management studies since 2003, it
has not conducted any inspections since 2000. In addition, although
NARA's reporting to the Congress and OMB has generally described
progress in improving records management at individual agencies and
provided an overview of some of its major records management
activities, it has not consistently provided evaluations of responses
by federal agencies to its recommendations, as required, or details on
records management problems or recommended practices that were
discovered as a result of inspections, studies, or targeted assistance
projects. Without a consistent oversight program that provides it with
a governmentwide perspective, NARA has limited assurance that agencies
are appropriately managing the records in their custody, increasing the
risk that important records will be lost.
The four agencies reviewed generally managed e-mail records through
paper-based processes, rather than using electronic recordkeeping. A
transition to electronic recordkeeping was under way at one of the four
agencies, and two had long-term plans to use electronic recordkeeping.
(The fourth agency had no current plans to make such a transition.)
Each of the business units that we reviewed (one at each agency)
maintained "case" files to fulfill its mission and used these for
recordkeeping. The practice at the units was to include e-mail
printouts in the case files if the e-mails contained information
necessary to document the case--that is, record material. These
printouts included transmission data and distribution lists, as
required.
Three of the four agencies we reviewed had policies in place that
generally complied with key aspects of NARA's regulations on e-mail
records management. At these agencies, the policies were each missing
one of nine key elements. For example, one agency's policy did not
specify, as required, that draft documents circulated via e-mail may be
federal records; agency officials indicated that they planned to
address the omission in updated guidance. At the fourth agency, the
policy was missing three of eight applicable requirements.[Footnote 3]
One element of the policy was inconsistent with regulations, requiring
only the sender of an e-mail message to determine record status; the
regulation states that both sent and received messages could be e-mail
records. According to agency officials, the policy was incomplete
because the department's stated practice is not to use e-mail to create
official records. However, this practice does not remove the
requirement for employees to assess e-mail received for its record
status, because the agency cannot know that employees will not receive
e-mail with record status; the determination of record status depends
on content, not medium. The agency's policy and guidance were silent on
two other requirements. Agency officials stated that these were
included in the policy by a reference to the NARA regulations in which
they appear. However, this reference was too general to make the
requirements clear.
For the senior officials whose practices we reviewed, recordkeeping
requirements for e-mail were not always met. Of 15 senior officials,
[Footnote 4] the e-mail for 7 (including all 4 at the Federal Trade
Commission) was managed in compliance with requirements[Footnote 5].
The remaining 8 officials (at three agencies), did not consistently
conform to key requirements in NARA's regulations for e-mail records,
such as filing them in appropriate record-keeping systems. Instead, e-
mail for these officials, whether record or nonrecord, was generally
being retained in e-mail systems that lacked recordkeeping
capabilities. (Among other things, a recordkeeping system allows
related records to be grouped into classifications according to their
business purposes.) If e-mail records are not kept in recordkeeping
systems, they may be harder to find and use, as well as being at
increased risk of loss from inadvertent or automatic deletion. Factors
contributing to this noncompliance included inadequate training and
oversight, as well as the difficulties of managing large volumes of e-
mail. Without periodic evaluations or other controls to ensure that
staff receive training and are carrying out their responsibilities,
agencies have little assurance that e-mail records are appropriately
identified, stored, and preserved.
To address weaknesses in records management policies and practices, we
are making recommendations to the Archivist that address improvements
to oversight of governmentwide records management and to the agencies
that address improvements to e-mail records management policies,
training, and oversight.
In comments on a draft of our report, officials from NARA, the
Environmental Protection Agency, the Federal Trade Commission, and the
Departments of Homeland Security and of Housing and Urban Development
indicated that they were implementing or intended to implement our
recommendations. NARA, the Environmental Protection Agency, and the
Department of Housing and Urban Development provided written comments
(which are reproduced in apps. II to IV), and the Federal Trade
Commission and the Department of Homeland Security provided comments
via e-mail. We also received technical comments from NARA and the
Federal Trade Commission, which we incorporated into our report as
appropriate.
Although the Department of Housing and Urban Development agreed to
implement our recommendations, it disagreed with certain details of our
draft, particularly our conclusion regarding the department's
compliance with the requirements we reviewed. According to the
department's comments, its e-mail records policies should be considered
to comply because they incorporate NARA's regulations by reference. Our
draft recognized the reference to NARA regulations in HUD's policy, but
we concluded that such a reference was not adequate to comply with NARA
regulations. As we stated, the reference in HUD's policy is too general
to make clear to HUD staff which practices are prohibited. In addition,
HUD did not establish procedures to implement the requirements in
question, as the regulations require.
Background:
Advances in information technology and the explosion in computer
interconnectivity have had far-reaching effects, including the
transformation from a paper-based to an electronic business environment
and the capability for rapid communication through e-mail. Although
these developments have led to improvements in speed and productivity,
they also pose challenges, including the need to manage those e-mail
messages that may be federal records.
NARA and Federal Agencies Have Responsibilities for Federal Records
Management:
Under the Federal Records Act, NARA is given general oversight
responsibilities for records management as well as general
responsibilities for archiving. This includes the preservation in the
National Archives of the United States of permanent records documenting
the activities of the government. NARA thus oversees agency management
of temporary and permanent records used in everyday operations and
ultimately takes control of permanent agency records judged to be of
historic value.[Footnote 6] (Of the total number of federal records,
less than 3 percent are designated permanent.)
In particular, NARA is responsible for issuing records management
guidance; working with agencies to implement effective controls over
the creation, maintenance, and use of records in the conduct of agency
business; providing oversight of agencies' records management programs;
approving the disposition (destruction or preservation) of records, and
providing storage facilities for agency records. The act also gives
NARA the responsibility for conducting inspections or surveys of agency
records and records management programs.
The act[Footnote 7] requires each federal agency to make and preserve
records that (1) document the organization, functions, policies,
decisions, procedures, and essential transactions of the agency and (2)
provide the information necessary to protect the legal and financial
rights of the government and of persons directly affected by the
agency's activities. These records, which include e-mail records, must
be effectively managed.
Records Management Includes a Range of Activities:
To understand the requirements for managing e-mail records, it is
useful to consider the broader context of government records
management. First, the term record, as mentioned earlier, has a
specific meaning in this context (not just the everyday sense of
anything written down or otherwise fixed in some medium). The Federal
Records Act includes an extensive definition of a record:[Footnote 8]
As used in this chapter, "records" includes all books, papers, maps,
photographs, machine readable materials, or other documentary
materials, regardless of physical form or characteristics, made or
received by an agency of the United States Government under Federal law
or in connection with the transaction of public business and preserved
or appropriate for preservation by that agency or its legitimate
successor as evidence of the organization, functions, policies,
decisions, procedures, operations, or other activities of the
Government or because of the informational value of data in them.
Library and museum material made or acquired and preserved solely for
reference or exhibition purposes, extra copies of documents preserved
only for convenience of reference, and stocks of publications and of
processed documents are not included.
As the definition shows, although government documentary materials
(including e-mails) may be "records" in this sense, many are not. For
example, not all e-mails document government "organization, functions,
policies, decisions, procedures, operations, or other activities" or
contain data of informational value.
According to NARA, the activities of an agency records management
program include, briefly, the following:
* identifying records and sources of records;
* developing a file plan for organizing records, including identifying
the classes of records that the agency produces;
* developing records schedules--that is, proposing for each type of
content where and how long records need to be retained and their final
disposition (destruction or preservation) based on time, or event, or a
combination of time and event; and:
* providing records management guidance to agency staff, including
agency-specific recordkeeping practices that establish what records
need to be created in order to conduct agency business.
Developing record schedules is a cornerstone of the records management
process. Scheduling involves not individual documents or file folders,
but rather broad categories of records. Traditionally, these were
record series: that is, "records arranged according to a filing system
or kept together because they relate to a particular subject or
function, result from the same activity, document a specific kind of
transaction, take a particular physical form, or have some other
relationship arising out of their creation, receipt, or use, such as
restrictions on access and use." More recently, NARA introduced
flexible scheduling, which allows so-called "big bucket" or large
aggregation schedules for temporary and permanent records.[Footnote 9]
Under this approach, the schedule applies not necessarily to records
series, but to all records relating to a work process, group of work
processes, or a broad program area to which the same retention time
would be applied.
To develop records schedules, agencies identify and inventory records,
and NARA's appraisal archivists work with agencies to appraise their
value (which includes informational, evidential, and historical value),
determine whether they are temporary or permanent, and determine how
long the temporary records should be kept. NARA then approves the
necessary records schedules. No record may be destroyed unless it has
been scheduled, and for temporary records the schedule is of critical
importance because it provides the authority to dispose of the record
after a specified time period.
Records schedules may be of two kinds: an agency-specific schedule or a
general records schedule, which covers records common to several or all
agencies. According to NARA, general records schedules cover about a
third of all federal records.[Footnote 10] For the other two-thirds,
NARA and the agencies must agree upon specific records schedules. Once
a schedule has been approved, the agency is to issue it as a management
directive, train employees in its use, apply its provisions to
temporary and permanent records, and ensure proper implementation.
Records Management Must Address Electronic Records, Including E-Mail:
The Federal Records Act covers documentary material regardless of
physical form or media, but until the advent of computers, records
management and archiving had been largely focused on handling paper
documents. As information is increasingly created and stored
electronically, records management has had to take into account the
creation of records in varieties of electronic formats, including e-
mail messages.
NARA has promulgated regulations at 36 C.F.R. Part 1234 that provide
guidance to agencies about the management of electronic records. This
guidance is supplemented by the issuance of periodic NARA bulletins and
other forms of guidance to agencies. To ensure that the management of
agency electronic records is consistent with the Federal Records Act,
NARA requires each agency to maintain an inventory of all agency
information systems that identifies basic facts about each system and
the information it contains, and it requires that agencies schedule the
electronic records in its systems. Like other records, electronic
records must be scheduled either under agency-specific schedules or
pursuant to a general records schedule.
According to the regulation,[Footnote 11] agencies are required to
establish policies and procedures that provide for appropriate
retention and disposition of electronic records. In addition to
including general provisions on electronic records,[Footnote 12] agency
procedures must specifically address e-mail records: that is, the
creation, maintenance and use, and disposition of federal records
created by individuals using electronic mail systems.[Footnote 13]
The regulation defines an electronic mail message as:
"a document created or received on an electronic mail system including
brief notes, more formal or substantive narrative documents, and any
attachments, such as word processing and other electronic documents,
which may be transmitted with the message."
The regulation requires e-mail records to be managed as are other
potential federal records with regard to adequacy of documentation,
recordkeeping requirements, agency records management responsibilities,
and records disposition. This entails, in particular, ensuring that
staff are aware that e-mails are potential records and training them in
identifying which e-mails are records.[Footnote 14]
Specific requirements for e-mail records include, for example, that for
each e-mail record, agencies must preserve transmission data, including
names of sender and addressees and message date, because these provide
context that may be needed for the message to be understood. Further,
except for a limited category of "transitory" e-mail records,[Footnote
15] agencies are not permitted to store the recordkeeping copy of e-
mail records in the e-mail system, unless that system has all the
features of a recordkeeping system; table 1 lists these required
features.
Table 1: Required Features of Electronic Recordkeeping Systems That
Include E-Mail Records:
Features:
* Allow related records to be grouped into classifications according to
the business purposes they serve.
* Permit easy and timely retrieval of both individual records and
groupings of related records.
* Retain records in a usable format for their required retention period
as specified by a NARA-approved records schedule.
* Be accessible by individuals who have a business need for information
in the system.
* Preserve the transmission and receipt data specified in agency
instructions.
* Permit transfer of permanent records to NARA.
Source: 36 C.F.R. § 1234.24(b)(1).
[End of table]
If agency e-mail systems do not have the required recordkeeping
features, either agencies must copy e-mail records to a separate
electronic recordkeeping system, or they must print e-mail messages
(including associated transmission information that is needed for
purposes of context) and file the copies in traditional paper
recordkeeping files. NARA's guidance allows agencies to use either
paper or electronic recordkeeping systems for record copies of e-mail
messages, depending on the agencies' business needs.
Each of the required features listed in table 1 is important because it
helps ensure that e-mail records remain both accessible and usable
during their useful lives. For example, it is essential to be able to
classify records according to their business purpose so that they can
be retrieved in case of mission need. Further, if records cannot be
retrieved easily and quickly, or they are not retained in a usable
format, they do not serve the mission or historical purpose that led to
their being preserved. In many cases, e-mail systems do not have the
features in the table. If e-mail records are retained in such systems
and not in recordkeeping systems, they may be harder to find and use,
as well as being at increased risk of loss from inadvertent or
automatic deletion.
Agencies must also have procedures that specifically address the
destruction of e-mail records. In particular, e-mail records may not be
deleted or otherwise disposed of without prior authority from NARA.
[Footnote 16] (Recall that not all e-mail is record material. Agencies
may destroy nonrecord e-mail.)
Agencies can dispose of e-mail records in three situations: First,
agencies are authorized to dispose of e-mail records with very short-
term (transitory) value that are stored in e-mail systems at the end of
their retention periods (as mentioned earlier). Second, for other
records in e-mail systems, NARA authorizes agencies to delete the
version in the e-mail system after the record has been preserved in a
recordkeeping system along with all appropriate transmission data.
Finally, agencies are authorized to dispose of e-mail records in the
recordkeeping system in accordance with the appropriate records
schedule. If the records in the recordkeeping system are not scheduled,
the agency must schedule them before they can be disposed of.
Management of E-Mail Records Poses Challenges:
Because of its nature, e-mail can present particular challenges to
records management. First, the information contained in e-mail records
is not uniform. This is in contrast to many information systems,
particularly those in computer centers engaged in large-scale data
processing, which contain structured data that generally can be
categorized into a relatively limited set of logical groupings. The
information in e-mail systems, on the other hand, is not structured in
this way: it may concern any subject or function and document various
types of transactions. As a result, in many cases, decisions on which e-
mail messages are records must be made individually.
The kinds of considerations that may go into determining the record
status of an e-mail message are illustrated in figure 1. As shown by
the decision tree in the figure (developed at Sandia National
Laboratories), agency staff have to be aware of the defining features
of a record in order to make these decisions.
Figure 1: Example Decision Tree for Determining Whether an E-Mail
Message Is a Record:
[See PDF for image]
This figure is a decision tree for determining whether an e-mail
message is a record. The following information is depicted:
E-mail message: Is it a record?
(1) Are you or your organization the creator of the record? Did you
generate or receive the message to use for your
technical/administrative work in conducting agency business?
Yes: It is a record;
No: proceed to next step.
(2) Does it contain informational value as evidence of your
organization’s functions, policies, decisions, procedures,operations,
mission, programs, projects, or activities?
Yes: It is a record;
No: proceed to next step.
(3) Is it material that originated in another office or outside your
agency, but you commented or took action on the material?
Yes: It is a record;
No: proceed to next step.
(4) Does it document business actions, such as what happened, what was
decided, what advice was given, who was involved, when it happened, the
order of events and decisions?
Yes: It is a record;
No: proceed to next step.
(5) Is it an original message/document related to agency business that
does not exist elsewhere?
Yes: It is a record;
No: proceed to next step.
(6) Are you or your organization the creator of the record? Did you
generate or receive the message to use for your
technical/administrative work in conducting agency business?
Yes: It is not a record;
No: proceed to the next step.
(7) Is it published or processed information that you received and use
as reference?
Yes: It is not a record;
No: proceed to the next step.
(8) Was the message sent to you “for information only?” Is it a copy of
a document or correspondence kept only for convenience of reference on
which no action is taken?
Yes: It is not a record;
No: proceed to the next step.
(9) Is it information accumulated and kept at the workplace, but does
not affect or reflect agency program business?
Yes: It is not a record;
No: proceed to the next step.
(10) Is it spam or documentation that has no work-related informational
or evidentiary value? Is it routine chit-chat?
Yes: It is not a record;
No: proceed to the next step.
(11) When in doubt, treat it as a record. Call your Records Officer for
information.
Source: Courtesy of Anna W. Nusbaum, CRM Sandia National Laboratories.
[End of figure]
Second, the transmission data associated with an e-mail record--
including information about the senders and receivers of messages, the
date the message was sent, and any attachments to the messages--provide
context that may be crucial to understanding the message. Thus, as
NARA's e-mail regulations and guidance reflect, transmission data must
be retained, and attachments are defined as part of the e-mail record.
Third, a given message may be part of an exchange of messages between
two or more people within or outside an agency, or even of a string
(sometimes branching) of many messages sent and received on a given
topic. In such cases, agency staff need to decide which message or
messages should be considered records and who is responsible for
storing them in a recordkeeping system.
Finally, the large number of federal e-mail users and high volume of e-
mails increase the management challenge. According to NARA, the use of
e-mail results in more records being created than in the past, as it
often replaces phone conversations and face-to-face meetings that might
not have been otherwise recorded. E-mail may also replace other types
of written communications, such as letters and memorandums.
Whether agencies use paper-based or electronic recordkeeping systems,
individual users generally make decisions (based on considerations such
as those in the figure) on what messages they judge to be records. In
paper-based systems, users then print and file e-mail records--with
appropriate transmission data--in the appropriate file structure
(generally corresponding to record series or schedule). In electronic
systems, the particular steps to file the record would vary depending
on the particular type of system and its degree of integration with the
agency's other information systems.[Footnote 17] Although details vary,
an electronic recordkeeping system, like a paper-based system, requires
that a filing structure has been established by which records can be
associated with the appropriate series.
The advantages of using a paper-based system for record copies of e-
mails are that this approach takes advantage of the recordkeeping
system already in place for the agency's paper files and requires
little or no technological investment. The disadvantages are that a
paper-based approach depends on manual processes and requires
electronic material to be converted to paper, potentially losing some
features of the electronic original; these processes may be especially
burdensome if the volume of e-mail records is large.
The advantage of using an electronic recordkeeping system, besides
avoiding the need to manage paper, is that it can be designed to
capture certain required data (such as e-mail transmission data)
automatically. Electronic recordkeeping systems also make searches for
records on particular topics much more efficient. In addition,
electronic systems that are integrated with other applications may have
features that make it easier for the user to identify records and that
potentially could provide automatic or partially automatic
classification functions.[Footnote 18] However, as with other
information technology investments, acquiring an electronic
recordkeeping system requires careful planning and analysis of agency
requirements and business processes; in addition, electronic
recordkeeping raises the issue of maintaining electronic information in
an accessible form throughout its useful life.[Footnote 19] Finally,
like paper-based systems, electronic recordkeeping systems must be used
properly by employees to be effective.
These challenges have been recognized by NARA and the records
management community in numerous studies and articles.[Footnote 20] A
2001 survey of federal recordkeeping practices conducted by a
contractor--SRA International--for NARA concluded, among other things,
that managing e-mail was a major records management problem and that
the quality of recordkeeping varied considerably across agencies.
[Footnote 21] The authors also commented on features of agency missions
that lead to strong recordkeeping practices: "When agencies have a
strong business need for good recordkeeping, such as the threat of
litigation or an agency mission that revolves around maintaining 'case'
files, then recordkeeping practices tend to be relatively strong with
regard to the records involved." In addition, the study concluded that
for many federal employees, the concept of a "record" and what should
be scheduled and preserved was not clear.
A 2005 survey of federal agencies' policy and practices for electronic
records management, funded in part by NARA, concluded that procedures
for managing e-mail were underdeveloped.[Footnote 22] The study found
that most of the surveyed offices had not developed electronic
recordkeeping systems, but were instead maintaining recordkeeping
copies of e-mail and other electronic documents in paper format.
However, all of the offices also maintained electronic records
(frequently electronic duplicates of paper records). According to the
study team, agencies did not establish electronic recordkeeping systems
partly because of a lack of support and resources, and the complexity
of implementing such systems increased with the size of the agency. As
a result, organizations were maintaining unsynchronized parallel paper
and electronic systems, resulting in extra work, confusion regarding
which is the recordkeeping copy, and retention of many records beyond
their disposition date. The study team also concluded that disposition
of electronic records was too cumbersome and uncertain. According to
the report, employees delete electronic records, such as e-mails, one
at a time, a cumbersome process which may result in retention of too
many records for too long or premature disposition that is inconsistent
with approved retention schedules. (This is in contrast to records
disposition in a recordkeeping system, in which categories of temporary
records may be disposed of at the end of their retention periods.) The
report also discussed NARA's role in promoting agencies' adoption of
electronic recordkeeping systems.
Commenting on these points, NARA expressed the view that for agencies
that maintain paper as the record copy, the early destruction of
electronic copies was not a significant problem because such copies
generally have very short term retentions, and no information is lost.
[Footnote 23] It considered that the overly long retention of
electronic copies did raise concerns regarding legal discovery and
compliance with requests under the Freedom of Information Act or the
Privacy Act. In these circumstances, agencies are required to search
for all information, not just information in recordkeeping systems;
thus, maintaining large volumes of nonrecord material increases this
burden.
Most recently, a NARA study team examined in 2007 the experiences of
five federal agencies (including itself) with electronic records
management applications, with a particular emphasis on how these
organizations used these applications to manage e-mail.[Footnote 24]
The purpose of the study was to gather information on the strategies
that organizations are using that may be useful to others. Among the
major conclusions from the survey was that implementing an electronic
records management application requires considerable effort in
planning, testing, and implementation, and that although the
functionality of the software product itself is important, other
factors are also crucial, such as agency culture and the quality of the
records management system in place. With regard to e-mail in
particular, the survey concluded that for some agencies, the volume of
e-mail messages created and received may be too overwhelming to be
managed at the desktop by thousands of employees across many sites
using a records management application alone, and that e-mail messages
can constitute the most voluminous type of record that is filed into
these applications. Finally, further study was recommended of
technologies that are being used to manage e-mail and what federal
agencies are doing with their record e-mail messages.
NARA is planning to perform such a study in 2008. According to NARA,
the study will take a close look at how selected agencies are
implementing electronic recordkeeping for their program records,
including those e-mail messages that need to be retained and managed as
federal records. The study will look at electronic recordkeeping
projects that have a records management application in place as well as
other solutions that provide recordkeeping functionality. In both
cases, NARA plans to explore how e-mail messages in particular are
identified and managed as records. According to NARA officials, they
have begun planning for the study and identifying agencies to be
included; they expect to have the report completed by the end of
September 2008.
Such a study could provide useful information to help NARA develop
additional guidance to agencies looking for electronic solutions for
records management of e-mail and other electronic records. As the
earlier studies suggest, implementing such solutions is not a simple or
easy process. Although NARA has referred to the decision to move to
electronic recordkeeping as inevitable, it emphasizes that the timing
of the decision depends on an agency's specific mission and
circumstances. [Footnote 25]
NARA Has Taken Action to Address Management of Electronic Records,
Including E-Mail:
For the last several years, NARA's records management program has
increasingly reflected the importance of electronic records and
recordkeeping. For example, NARA has undertaken a redesign of its
records management activities,[Footnote 26] including (among other
things) the following three activities, which are significant for
management of electronic records, including e-mail:
* NARA established flexible scheduling (the so-called "big bucket"
approach described earlier), under which agencies can schedule records
at any level of aggregation that meets their business needs. By
simplifying disposition instructions, "big bucket" schedules have
advantages for electronic records management; filing e-mail records
under a "big bucket" system, for example, is simplified because users
can be presented with fewer filing categories.[Footnote 27]
* NARA developed e-mail regulations that eliminated the previous
requirement to file transitory e-mail dealing with routine matters in a
formal agency recordkeeping system. According to NARA, this change
would allow agencies to focus their resources on managing e-mail that
is important for long-term documentation of agency business.[Footnote
28] The change was reflected in a revision to General Records Schedule
23 that explicitly included very short-term temporary e-mail
messages.[Footnote 29] The final rule became effective on March 23,
2006.
* NARA developed regulations and guidance to make retention schedules
media neutral. According to NARA, its objective was to eliminate
routine rescheduling work[Footnote 30] so that agencies and NARA could
focus their resources on high records management priorities. Under its
revised regulations, in effect as of December 2007, new records
schedules would be media neutral unless otherwise specified. At the
same time, NARA revised General Records Schedule 20 (which provides
disposition authorities for electronic records) to expand agencies'
authority to apply previously approved schedules to electronic records
and to dispose of hard copy records that have been converted to an
electronic format, among other things.[Footnote 31]
Our Prior Work Has Addressed Electronic Records Management:
In July 1999, we reported that NARA and federal agencies were facing
the substantial challenge of managing and preserving electronic records
in an era of rapidly changing technology.[Footnote 32] In that report,
we stated that in addition to handling the burgeoning volume of
electronic records, NARA and the agencies would have to address several
hardware and software issues to ensure that electronic records were
properly created, maintained, secured, and retrievable in the future.
We also noted that NARA did not have governmentwide data on the records
management capabilities and programs of all federal agencies. As a
result, we recommended that NARA conduct a governmentwide survey of
agencies' electronic records management programs and use the
information as input to its efforts to reengineer its business
processes.
NARA subsequently undertook efforts to assess governmentwide records
management practices and study the redesign of its business processes.
As mentioned earlier, in 2001 NARA completed an assessment of
governmentwide records management practices, as we had recommended.
NARA's assessment of the federal recordkeeping environment concluded
that although agencies were creating and maintaining records
appropriately, most electronic records remained unscheduled, and
records of historical value were not being identified and provided to
NARA for archiving.
In 2002, we reported that factors contributing to the problems of
managing and preserving electronic records included records management
guidance that was inadequate in the current technological environment,
the low priority often given to records management programs, and the
lack of technology tools to manage electronic records.[Footnote 33] In
addition, NARA did not perform systematic inspections of agency records
management, so that it did not have comprehensive information on
implementation issues and areas where guidance needed strengthening.
Although NARA had plans to improve its guidance and address technology
issues, these did not address the low priority generally given to
records management programs nor the inspection issue.
With regard to inspections, we noted that in 2000, NARA had replaced
agency evaluations (inspections) with a new approach--targeted
assistance--because it considered that its previous approach to
evaluations had been flawed: it reached only a few agencies, it was
often perceived negatively, and it resulted in a list of records
management problems that agencies then had to resolve on their own.
Under targeted assistance, NARA entered into partnerships with federal
agencies to provide them with guidance, assistance, or training in any
area of records management.[Footnote 34] Despite the possible benefits
of such assistance to the targeted agencies, however, we concluded that
it was not a substitute for systematic inspections. Only agencies
requesting assistance were evaluated, and the scope and focus of the
assistance were determined not by NARA but by the requesting agency.
Thus, it did not provide systematic and comprehensive information for
assessing progress over time.
To address the low priority generally given to records management
programs, we recommended that NARA develop a strategy for raising
agency senior management awareness of and commitment to records
management. To address the inspection issue, we recommended that NARA
develop a strategy for conducting systematic inspections of agency
records management programs to (1) periodically assess agency progress
in improving records management programs and (2) evaluate the efficacy
of NARA's governmentwide guidance.
In response to our recommendations, NARA devised a strategy for raising
awareness among senior agency management of the importance of good
federal records management, as well as a comprehensive approach to
improving agency records management that included inspections and
identification of risks and priorities. NARA also took steps to improve
federal records management programs by updating its guidance to reflect
new types of electronic records. In 2003, we testified that the plan
for improving agency records management did not include provisions for
using inspections to evaluate the efficacy of its governmentwide
guidance, and an implementation plan for the approach had not yet been
established.[Footnote 35] NARA later addressed these shortcomings by
developing an implementation plan that included using agency
inspections to evaluate the efficacy of its guidance, with such
inspections to be undertaken based on a risk-based model, government
studies, or media reports.[Footnote 36] Such an approach, if
appropriately implemented, had the potential to help avoid the
weaknesses in records management programs that led to the scheduling
and disposition problems that we and NARA had described in earlier
work.
NARA's Oversight Activities Have Been Limited:
To fulfill its responsibility under the Federal Records Act for
oversight of agency records management programs, NARA planned to
conduct activities including inspections, studies, and reporting.
However, despite NARA's plans, in recent years its oversight activities
have been primarily limited to performing studies. Although it has
performed or sponsored six records management studies since 2003, it
has not conducted any inspections since 2000. In addition, although
NARA's reporting to the Congress and OMB has generally described
progress in improving records management at individual agencies and
provided an overview of some of its major records management
activities, it has not consistently provided evaluations of responses
by federal agencies to its recommendations, as required, or details on
records management problems or recommended practices that were
discovered as a result of inspections, studies, or targeted assistance
projects. Without a consistent oversight program that provides it with
a governmentwide perspective, NARA has limited assurance that agencies
are appropriately managing the records in their custody, thus
increasing the risk that important records will be lost.
NARA Has Oversight Responsibilities Regarding Federal Records
Management:
Oversight is a key activity in governance that addresses whether
organizations are carrying out their responsibilities and serves to
detect other shortcomings. Our reports emphasize the importance of
effective oversight of government operations by individual agency
management, by agencies having governmentwide oversight
responsibilities, and by the Congress. Various functions and activities
may be part of oversight, including monitoring, evaluating, and
reporting on the performance of organizations and their management and
holding them accountable for results.
The Federal Records Act gave NARA responsibility for oversight of
agency records management programs by, among other functions, making it
responsible for conducting inspections or surveys of agencies' records
and records management programs and practices; conducting records
management studies; and reporting the results of these activities to
the Congress and OMB. In particular, the reports are to include
evaluations of responses by agencies to any recommendations resulting
from inspections or studies that NARA conducts and, to the extent
practicable, estimates of costs to the government if agencies do not
implement such recommendations.
According to NARA, it planned to carry out its oversight
responsibilities using inspections, studies, and reporting.
Specifically, in 2003,[Footnote 37] NARA stated that it would:
* perform inspections of agency records and records management
programs;
* conduct studies that focus on cross-government issues, analyze and
identify best practices, and use the results to develop governmentwide
recommendations and guidance; and:
* report to the Congress and OMB on problems and recommended practices
discovered as part of inspections, studies, and targeted assistance
projects.
NARA No Longer Performs Inspections of Agency Records Management
Programs:
Although inspections were included in NARA's oversight plans in 2003,
NARA has not conducted any since 2000.[Footnote 38] NARA laid out a
strategy for performing inspections and studies in 2003 as part of its
records management redesign efforts.[Footnote 39] According to this
strategy, NARA anticipated undertaking inspections only under what it
termed exceptional circumstances: that is, if (1) agencies have high-
level records management problems that put at risk federal records that
protect rights, assure accountability, or document the national
experience, and (2) agencies refuse targeted assistance from NARA and
fail to mitigate or otherwise effectively deal with such risks. In
other words, NARA considered inspections its tool of last resort: to be
used when the risk to records was deemed high and other tools (such as
targeted assistance and training) failed to mitigate the risk to
records.
Under this strategy, NARA planned to determine when to undertake
inspections based on its risk-based resource allocation model (or when
it learned through other means of a clear and egregious records
management problem in an agency or line of business). Using this model,
developed in 2003, NARA's Resource Allocation Project performed a
governmentwide assessment in 2004 of high-priority federal records and
records programs. After reviewing program areas and work processes of
the government (as opposed to organizational units),[Footnote 40] the
project identified the business processes, subfunctions, and agency
activities that were likely to generate the majority of high-priority
records. Based on input and assessments from NARA staff with expertise
in the subfunctions and associated agencies, the project then rated the
subfunctions according to three criteria for establishing resource
priorities:
* the risk to records (based on such factors as whether the
subfunctions or associated agencies had experienced major scheduling
issues or known problems, such as allegations of unauthorized
destruction of records[Footnote 41]),
* the level of significance of the records to rights and
accountability, and:
* the likelihood that the subfunction would generate permanent records
(and if so, their volume and significance).
According to the final report on the project,[Footnote 42] this
assessment showed that the risks to records were being addressed and
managed by the Archives' own records management activities and those of
the agencies. As a result, the Resource Allocation Project did not lead
to the identification of records management risks that met the new
inspection criteria.[Footnote 43] Instead, NARA applied its resources
to other activities that it considered more effective and less resource-
intensive than the inspections it undertook in the past. These include
regular contacts between appraisal archivists and agencies, updated
guidance information, and training.
However, the Resource Allocation Project was primarily based on NARA's
in-house information sources and expertise. Although this information
and expertise may be considerable and collecting and assessing it
potentially valuable, it is not a substitute for examinations of agency
programs, surveys of practices, agency self-assessments, or other
external sources of information. Further, although the final report on
the 2004 project included important lessons learned for improving
future assessments, NARA did not set up a process for continuing the
effort and applying the lessons learned to updating the assessment or
validating its results.
Officials had also stated that targeted assistance was a tool that NARA
would use in preference to inspections to solve urgent records
management problems and that the results of the Resource Allocation
Project were also to be used in determining where to use this tool.
However, NARA's use of targeted assistance has declined significantly
over the past 5 years. (NARA reported that in 2002, 77 projects were
opened and 76 completed;[Footnote 44] in contrast, 4 were opened and
none completed in 2007.) Officials ascribed the reduced emphasis on
targeted assistance projects to various factors, including competing
demands (such as work on the development of its advanced electronic
records archive[Footnote 45] and on helping agencies to schedule
electronic records[Footnote 46]), the difficulty of getting agencies to
devote resources to the projects, and the removal of numerical targets
for targeted assistance projects, which occurred when NARA revised
performance metrics to emphasize results rather than quantity.[Footnote
47] According to NARA, it also works with agencies to address critical
records management issues outside formal targeted assistance
arrangements. In addition, it identifies and investigates allegations
of unauthorized destruction of federal records.
Thus, neither inspections nor targeted assistance have made significant
contributions to NARA's oversight of agency records management. Without
a more comprehensive method of evaluating agency records management
programs, NARA lacks assurance that agencies are effectively managing
records throughout their life cycle.
NARA Has Performed Several Records Management Studies:
NARA has performed records management studies in accordance with its
2003 plan. According to the plan, it was to conduct records management
studies to focus on cross-government issues, to identify and analyze
best practices, and to develop governmentwide recommendations and
guidance.[Footnote 48] In addition, NARA planned to undertake records
management studies when it believed an agency or agencies in a specific
line of business were using records management practices that could
benefit the rest of a specific line of business or the federal
government as a whole.[Footnote 49]
Since developing its 2003 plan, NARA has conducted or sponsored six
records management studies (see table 2).[Footnote 50]
Table 2: NARA Studies Performed in the Last 5 Years:
Title: Research and Development Records: Maintenance, Use and
Disposition in Federal Agencies;
Date: September 30, 2004;
Comments: Report prepared to assist in developing and incorporating
guidance on the appraisal of research and development (R&D) records.
Title: Records Maintenance and Disposition in Headquarters Air Force
Offices;
Date: January 2005;
Comments: Study focused on Air Force Headquarters recordkeeping
practices; included recommendations to the agency.
Title: Environmental Health and Safety Records: Maintenance, Use, and
Disposition in Federal Agencies;
Date: November 4, 2005;
Comments: Report prepared to provide the basis for updating and
expanding the existing guidance on the appraisal of environmental
health and safety records.
Title: Best Practices in Electronic Records Management: A Survey and
Report on Federal Government Agencies' Recordkeeping Policy and
Practices;
Date: December 19, 2005;
Comments: Results of survey data collected from federal and state
agencies and one private sector organization regarding their individual
policies and practices for electronic records management (study
conducted by the University of Maryland Center for Information Policy).
Title: NARA Review of the Department of Energy R&D Schedule and Its
Implementation by DOE Laboratories;
Date: August 2006;
Comments: Examination of Energy laboratories' implementation of R&D
records schedule, particularly in regard to project records, and to
suggest any needed improvements in the schedule; included
recommendations to the agency.
Title: A Survey of Federal Agency Records Management Applications 2007;
Date: January 22, 2008;
Comments: Results of a survey of five federal agencies that were
implementing records management application (software) products to
manage their electronic records, with particular attention on e-mail.
Source: GAO analysis of NARA information.
[End of table]
Most of these studies were focused on records management issues with
wide application.[Footnote 51] For example, two were related to helping
NARA improve its guidance on particular types of records--health and
safety records, and research and development (R&D) records. Another two
were limited in scope to components of a single agency, but they
addressed issues with potentially broad application and included
conclusions regarding factors that needed to be considered in the
appraisal of given types of records.
NARA Has Not Reported on Its Oversight Activities as Required:
Under the Federal Records Act, NARA is responsible for reporting the
results of its records management activities to the Congress and OMB,
including evaluations of responses by agencies to any recommendations
resulting from its inspections or studies and (where practicable)
estimates of costs if its recommendations are not implemented. Further,
NARA's plan for carrying out its oversight responsibilities states that
it will report to the Congress and OMB on problems and recommended
practices discovered as part of inspections, studies, and targeted
assistance projects.[Footnote 52] According to NARA, it fulfills its
statutory reporting requirement through annual Performance and
Accountability Reports,[Footnote 53] which include sections on "Federal
Records Management Evaluations."
However, although NARA has issued reports on its records management
studies, the Federal Records Management Evaluations sections of the
Performance and Accountability Reports have not included the studies'
results or evaluations of responses by agencies to its recommendations.
Instead, the reports have generally provided an overview of NARA's
major records management activities, as well as describing noteworthy
records management progress at individual agencies. For example, the
report for fiscal year 2007 provided statistics on the appraisal and
scheduling of electronic records systems and listed agencies that had
scheduled electronic records or transferred permanent electronic
records to NARA during the fiscal year.
Elsewhere in the reports, NARA mentioned four of the six records
management studies as part of its reporting on records management
goals. However, it included few details on the results of these studies
regarding the records management problems or recommended practices that
they uncovered. For example, in the fiscal year 2005 Performance and
Accountability Report, NARA reported that it had completed a January
2005 study on Air Force Headquarters offices (see table 2), but NARA
did not discuss the results, and later reports did not discuss actions
taken in response to its recommendations. Similarly, the fiscal year
2007 Performance and Accountability Report did not describe any actions
that the Department of Energy had taken in response to an August 2006
study.[Footnote 54]
Also, in 2007, NARA stopped reporting on its targeted assistance
projects. In prior years, its Performance and Accountability Reports
generally provided statistics on targeted assistance projects and
described their general goals, although the reports did not generally
discuss problems or recommended practices resulting from them. In the
fiscal year 2007 report, NARA stated that the strategies described in
its Strategic Directions, including targeted assistance, had become
part of its standard business practices and would no longer be
highlighted individually. However, as mentioned earlier, the number of
targeted assistance projects had declined significantly by that time.
The Director and senior officials from NARA's Modern Records Program
agreed that the annual reports did not specify the problems and
recommended practices discovered as part of inspections, studies, and
targeted assistance projects. According to these officials, the annual
Performance and Accountability Reports have been focused on positive
news, and NARA has struggled with developing an objective way to report
negative news about agencies' records management. The officials
attributed this difficulty to the agency's conservatism in this regard.
NARA's limited use of oversight tools and incomplete reporting on the
specific results of its oversight activities can be attributed to an
organizational preference for using persuasion and cooperation when
working with agencies. This preferred approach is consistent with
NARA's reasons (as we noted in 2003) for replacing agency evaluations
(inspections) with targeted assistance: among these reasons was that
inspections were perceived negatively by agencies. NARA officials have
said that they prefer to use "carrots, rather than sticks." NARA
officials added that full-scale inspections were resource intensive and
took several years to complete, and that agencies took years to address
NARA's recommendations.
Although, as described earlier, NARA regularly works with agencies on
scheduling and disposition of records (activities related to the end of
the records life cycle), officials agreed that these activities provide
limited insight into records management at earlier stages--that is,
creation, maintenance, and use. The officials also agreed that their
work with agencies on scheduling records does not fulfill the
Archivist's responsibility under the Federal Records Act to conduct
inspections or surveys of agency records and records management
programs and practices. Further, by giving the Archivist the
responsibility to report to the Congress and OMB on records management
issues, the Federal Records Act provides NARA with a tool for holding
agencies accountable, a key aspect of oversight. However, NARA has been
reluctant to use this tool, limiting its ability to determine whether
federal agencies are carrying out their records management
responsibilities. Without more specific and comprehensive information
about how agencies are managing their records and without the means to
hold agencies accountable for shortcomings, NARA's ability to identify
and address common records management problems is impaired. As a
result, there is reduced assurance that records are adequately managed
and that important records are not being lost.
Agencies Reviewed Generally Used Paper Processes for E-Mail Records
Management, but Three Are Moving Toward Electronic Recordkeeping:
The four agencies reviewed--the Department of Homeland Security (DHS);
the Environmental Protection Agency (EPA); the Federal Trade Commission
(FTC); and the Department of Housing and Urban Development (HUD)--
generally preserved e-mail records through paper-based processes,
although one agency--EPA--is in the process of deploying an electronic
content management system that is to be used for managing e-mail
messages that are agency records;[Footnote 55] two others have long-
term plans to develop electronic recordkeeping. Three of the four
agencies also used electronic systems to manage documents,
correspondence, and so on,[Footnote 56] but these systems generally did
not have recordkeeping features. Each of the business units that we
reviewed (one at each agency) maintained "case" files to fulfill its
mission that were used for recordkeeping. The practice at the units was
to include e-mail printouts in the case files if they contained
information necessary to document the case--that is, record material.
These printouts included transmission data and distribution lists, as
required.
DHS: DHS primarily uses "print and file" recordkeeping for all records.
None of the department's e-mail systems is a recordkeeping system;
accordingly, they may be used to store only transitory e-mail records.
Officials from the Office of the DHS Chief Information Officer (CIO)
told us that DHS e-mail systems house transitory e-mails and retain
them for at least 90 days. In addition, according to the CIO office,
although employees can currently access Web-based and Internet-
accessible private e-mail systems, the department is taking steps to
restrict or remove this access.
Although its current recordkeeping is generally paper-based, DHS has
begun planning for an enterprisewide Electronic Records Management
System. According to the business case submitted by DHS to OMB to
justify the proposed investment, the proposed system is to allow
electronic storage and retrieval of records by authorized staff
throughout DHS and permit the elimination of paper file copies.
According to the department's senior records officer, DHS's current
records schedules are now media neutral. DHS's records management
handbook also provides instructions for both electronic and paper e-
mail recordkeeping.
In addition, DHS CIO officials told us that the department has
implemented several electronic knowledge and document management
systems, at least two of which have recordkeeping features but are not
used for e-mail recordkeeping.
E-mail records were maintained in paper at the DHS business unit
reviewed, the Washington Regional Office of Detention and Removal
Operations under Immigration and Customs Enforcement (ICE). The primary
responsibility of the Office of Detention and Removal Operations is to
identify, apprehend, and remove illegal aliens from the United States.
To fulfill its mission, the business unit maintained paper-based case
files, and these files were used for recordkeeping.
To store deportation case information, the unit uses the so-called
"alien files" or "A-files." These files are created by DHS's
Citizenship and Immigration Services for certain noncitizens, such as
immigrants, to serve as the one central file for all of the
noncitizen's immigration-related applications and related documents
that pertain to that person's activities.[Footnote 57] The A-files are
managed by Citizenship and Immigration Services and shared among DHS
components as necessary. Because A-files are paper-based, they require
physical transfer from one location to another. To track these files,
DHS uses the National File Tracking System, an automated file-tracking
system developed to enable all DHS staff at numerous DHS locations
around the country to locate, request, receive, and transfer A-files.
Each A-file has a National File Tracking System number.[Footnote 58]
According to business unit officials, e-mails would not usually be
found in the A-files because the primary use of e-mail was to share
information within the business unit, and so it would rarely rise to
the level of a record. The A-files mainly contain other kinds of
information, including forms from agency information systems,
investigation results, charging documents, conviction documents,
photos, fingerprints, and memos. A deportation officer provided 10
active open case files for inspection (each officer is usually
responsible for 40 to 60 active open immigration cases). The 10 case
files contained a total of 18 e-mail records, which included
transmittal data and distribution lists.
EPA: EPA's current recordkeeping is largely print and file, but the
agency is undergoing a transition to electronic recordkeeping,
beginning with e-mail records. According to EPA officials, the
commitment to establish its Enterprise Content Management System
(ECMS), which has recordkeeping features, was a result of an agency
decision to develop a long-term solution to manage hurricane records
electronically in the wake of Hurricanes Katrina and Rita. According to
a memorandum sent to all EPA employees, the goal was to ensure that
these records be placed in a recordkeeping system that met both EPA and
NARA requirements, while allowing easy access to the records when
needed. At the same time, the agency ordered that the automatic delete
function in the agency's e-mail system be deactivated so that no
hurricane records could be deleted accidentally.
According to agency officials, the e-mail capability of ECMS was
available in fiscal year 2007, and the agency expects that by the end
of fiscal year 2009, 50 percent of EPA staff and contractors will be
using the system. The ECMS repository is an electronic recordkeeping
system that uses commercial software that complies with a standard
endorsed by NARA. According to officials, as part of its preparations
for the transition, EPA recently updated its record schedules so that
its treatment of records would be media neutral; this is to facilitate
uploading records into ECMS.[Footnote 59] It has also developed
materials, such as a brochure and a user guide, to support its
transition.
The agency's e-mail systems are not currently used as recordkeeping
systems and will not be under ECMS. Accordingly, they can be used to
store only transitory e-mail records. Officials also told us that
employees could access Web-based e-mail systems for limited personal
use, but that they were not permitted to use these for official
business.
E-mail records were maintained in paper at the EPA business unit
reviewed, the Assessment and Remediation Division of the Office of
Superfund Remediation and Technology Innovation (part of EPA's Office
of Solid Waste and Emergency Response). Among other things, this
division processes claims related to Superfund cleanup settlements.
Officials from the Office of Superfund Remediation and Technology
Innovation told us that recordkeeping for this office was print and
file, but that employees were also directed to include all records
(including e-mail records) into the office's electronic Superfund
Document Management System. This was not a recordkeeping system, but
the plan was to integrate it with ECMS for long-term stewardship of
Superfund files. According to these officials, they expect to be able
to capture Superfund e-mail records in ECMS by fall 2008.
Officials of the Assessment and Remediation Division stated that few e-
mail messages would be considered records, because most official
business regarding claims was conducted through correspondence on
letterhead with an original signature. Although copies of these might
be sent as e-mail attachments, these officials said, they would not be
the official recordkeeping copy. However, division officials stated
that e-mail records were more likely to be included in case files
regarding "mixed funding" claims related to Superfund cleanup
settlements, because these involved communication between regional
offices and parties involved in the claims. (Mixed funding refers to
the government assuming some proportion of cleanup expenses, with other
parties assuming the rest.)[Footnote 60] According to officials, mixed
funding documentation could include e-mail records documenting
information to justify claims and facilitate payment. Officials
provided a mixed funding case file for inspection, in which they had
identified 10 e-mail records. All these records included transmission
data and distribution lists, as required.
FTC: FTC recordkeeping for e-mail and other records is print and file.
The commission's e-mail system is not a recordkeeping system, and the
commission has not implemented the option allowed by NARA's guidance to
use the e-mail system for storing transitory e-mail records. The agency
has no current plans to institute electronic recordkeeping. According
to FTC officials, the commission's processes are largely paper based.
The commission's records management guidance states that few e-mails
are expected to rise to the level of a record. For example, agency
officials explained that official decisions of the commission are
generally reached jointly by the commissioners and recorded in
documents such as memorandums, letters, and meeting minutes. According
to officials, FTC uses a case management system to track work products
(such as depositions, filings, and briefs), but this is not a document
management or recordkeeping system. According to officials, about 80
percent of all FTC files are case files.
The records manager said that the records schedules for FTC programs
currently include instructions for e-mail disposition, but that the
office is in the process of conducting a records inventory and
reassessing records scheduling, with the next step being to do "big
bucket" media-neutral scheduling. According to this official, this
approach will provide flexibility in the event that FTC adopts
electronic business processes in the future. According to FTC
officials, the commission is currently assessing its needs for
electronic document management tools, including an electronic
recordkeeping system.
The CIO told us that agency staff cannot directly access external Web-
based e-mail through the agency's Web browsers, and agency employees
have been instructed not to use such systems for official FTC business.
However, this official said that agency employees may use the
commission's remote application delivery environment[Footnote 61] to
obtain limited access to external Web-based e-mail as a convenience.
The business unit reviewed at FTC was the Division of Marketing
Practices within the Consumer Protection Bureau, which responds to
problems of consumer fraud in the marketplace, such as deceptive
marketing schemes that use false and misleading information. The
division enforces federal consumer protection laws by, among other
things, developing rules to protect consumers and filing actions in
federal district court for immediate and permanent orders to stop scams
and get compensation for scam victims.
The business unit follows the FTC's print and file approach to
recordkeeping, saving e-mails and other communications if they are
related to a case. At this unit, cases are investigations of Internet
fraud and marketing practices, each of which is assigned to a lead
attorney. Officials provided one closed case file for inspection,
consisting of four boxes of records. The case file provided contained
about 65 e-mails, all of which included transmittal data and
distribution lists.
HUD: HUD currently uses a print and file approach to e-mail
recordkeeping. The department's e-mail system is not a recordkeeping
system, and according to officials, they have not implemented the
option allowed by NARA's guidance to use the e-mail system for storing
transitory e-mail records. However, as part of an overall modernization
plan, HUD is undertaking an enterprise office system modernization
project for its records and document management. According to the
business case submitted by HUD to OMB to justify the modernization
investment, the HUD Electronic Record System (HERS) will replace eight
legacy systems and support the full life cycle of document management
activities and correspondence management, including the creation and
processing of records, record disposition, and retrieval of historical
archived information. HUD plans to implement HERS by the fourth quarter
of 2010. In the first phase of the plan, HUD is implementing modernized
systems for tracking correspondence and Freedom of Information Act
requests. Although the correspondence system is used for tracking e-
mail correspondence, it is not a recordkeeping system for e-mail.
The business unit reviewed at HUD was the Office of Healthy Homes and
Lead Hazard Control. Among other things, this office manages grants
related to lead hazard and conducts investigations to determine
compliance with HUD's Lead Disclosure Rule.[Footnote 62] HUD records
management officials stated that each program area has a file plan, and
that the Office of Healthy Homes and Lead Hazard Control has its own
records schedule.
According to officials from the office, most of their business is
transacted via certified mail, so that relatively few e-mail messages
would be record material. Two units provided active open files for
inspection: nine grant files from six Government Technical
Representatives in the Program Management and Assurance Division, and
four lead hazard investigation case files from one inspector in the
Compliance Assistance and Enforcement Division. The nine grant files
included 120 e-mail messages, and the four investigation files included
5 e-mail messages, all in the same case file. All 125 of the e-mail
records included transmittal data and distribution lists, as required.
E-mail Record Policies at Three of the Four Agencies Generally
Addressed NARA Guidance:
At three of the four agencies reviewed, the policies in place generally
addressed the requirements for e-mail records management that we
identified, but each was missing one of the nine requirements. At the
fourth agency (HUD), the policies in place did not cover three of eight
applicable requirements.[Footnote 63]
According to NARA's regulations on records management, agencies are
required to establish policies and procedures that provide for
appropriate retention and disposition of electronic records. In
addition to including general provisions on electronic records, agency
procedures must address specific requirements for e-mail
records.[Footnote 64] The regulations provide minimum requirements,
which allow agencies flexibility to establish processes for managing e-
mail records that are appropriate to their business, size, and
resources.
According to the regulations, certain aspects of e-mail must be
addressed in the instructions that agencies provide staff on
identifying and preserving electronic mail messages, such as the need
to preserve transmission data. Agencies are also required to address
the use of external e-mail systems that are not controlled by the
agency (such as private e-mail accounts on commercial systems such as
Gmail, Hotmail, .Mac, etc.). Where agency staff have access to external
systems, agencies must ensure that federal records sent or received on
such systems are preserved in the appropriate recordkeeping system and
that reasonable steps are taken to capture available transmission and
receipt data needed by the agency for recordkeeping purposes. One of
the four agencies (HUD) had its systems configured so that staff could
not access external e-mail applications; thus, this requirement was not
applicable for HUD.
In summary, we extracted nine key requirements from the regulation.
Agency records management policy and guidance with regard to e-mail
must address these requirements, which are shown in table 3.
Table 3: E-Mail Policy and Guidance Required by Regulation:
Requirements: Agency policies and guidance must:
* inform staff that e-mails are potential records;
* ensure that staff is capable of identifying federal records;
* require the preservation of e-mail transmission data and distribution
lists;
* state that draft documents circulated on e-mail systems are potential
federal records;
* require that e-mail records are stored in an appropriate
recordkeeping system and instruct staff on how these records are
maintained in that recordkeeping system regardless of format;
* provide instructions on how to copy e-mails identified as federal
records from an e-mail system not identified as a recordkeeping system
to a recordkeeping system;
* state that e-mail systems must not be used to store recordkeeping
copies of e-mail messages identified as federal records[A];
* prohibit the use of e-mail system backup tapes for recordkeeping
purposes;
* instruct staff on the management and preservation of e-mail records
sent or received from nongovernmental e-mail systems.
Source: GAO analysis of NARA Regulations.
[A] Unless the e-mail system has the features of a recordkeeping system
described in table 1. An exception to the prohibition against storage
in the e-mail system may be made for transitory records with NARA-
approved short term retention periods of 180 days or less.
[End of table]
The policies and guidance at three of the four agencies (DHS, FTC, and
EPA) each omitted one applicable requirement.
* At DHS, the policies and guidance did not state that draft documents
circulated on e-mail systems are potential federal records. Department
officials told us that they recognized that their policies did not
specifically address the need to assess the records status of draft
documents, and said they planned to address the omission during an
ongoing effort to revise the policies.
* At EPA and FTC, the e-mail management policy did not instruct staff
on the management and preservation of e-mail messages sent or received
from nongovernmental e-mail systems. According to officials at both
agencies, such instructions were not included because agency employees
were instructed not to use such accounts for agency business. However,
whenever access to such external systems is available at an agency, the
agency should provide these instructions.[Footnote 65]
If agency records management policies and guidance are not complete,
agency e-mail records may be at increased risk of loss. If agencies do
not state that draft documents circulated on e-mail systems are
potential records, agency officials may not preserve such record
materials. If agencies do not instruct staff on the management and
preservation of e-mail messages sent or received from nongovernmental e-
mail systems, officials may create or receive e-mail records in
external systems that may not be preserved in recordkeeping systems.
In the course of our review at EPA, officials told us that this
situation may have arisen: they had discovered that certain e-mail
messages for a previous Administrator, possibly including records, had
not been saved. According to these officials, they had discovered an e-
mail message from a former Acting Administrator instructing a private
consultant not to use the Administrator's EPA e-mail account to discuss
a sensitive government issue (World Trade Center issues) but to use a
personal e-mail account. EPA officials reported this incident to NARA
on April 11, 2008, in a letter that also described the agency's
response to the incident and planned safeguards to avoid such incidents
in the future; these safeguards included the release of a policy
statement prohibiting the use of non-EPA messaging systems for the
conduct of agency business and a review of e-mail account auto-delete
settings. NARA replied on April 30 that the safeguards EPA planned
appeared appropriate.
Finally, HUD's policies and guidance did not include, or did not
implement, three of eight applicable e-mail records management
requirements. For one requirement, HUD's policy was inconsistent with
NARA's regulations, and it was silent on two of the requirements.
HUD did not fully implement the requirement to ensure that staff are
capable of identifying federal records because its e-mail policy states
that only the sender is responsible for reviewing the record status of
an e-mail. However, NARA's regulation defines e-mail messages as
material either created or received on electronic mail
systems.[Footnote 66] HUD officials acknowledged that the department's
policy omits the recipient's responsibility for determining the record
status of e-mail messages and stated that the e-mail policy fell short
of fully implementing NARA regulations in this regard because the
department's practice is not to use e-mail for business matters in
which official records would need to be created. However, this practice
does not remove the requirement for agency employees to assess e-mail
received for its record status, because the agency cannot know that
employees will not receive e-mail with record status; the determination
of record status depends on the content of the information, not its
medium.
In addition, two other requirements were missing from HUD's policy: it
did not state, as required, that recordkeeping copies of e-mail should
not be stored in e-mail systems or that backup tapes should not be used
for recordkeeping purposes. HUD officials stated that they considered
that these requirements were met by a reference in their policy to the
NARA regulations in which these requirements appear. However, this
reference is too general to make clear to staff that e-mail systems and
backup tapes are not to be used for recordkeeping.
Table 4 summarizes the results for the four agencies.
Table 4: Agencies' Conformance to Required Policy and Guidance on
Managing E-Mail Records:
Requirement: Inform staff that e-mails are potential records;
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy covered requirement.
Requirement: Ensure that staff is capable of identifying federal
records;
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy omitted or was inconsistent with requirement.
Requirement: Preserve e-mail transmission data and distribution lists;
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy covered requirement.
Requirement: State that draft documents circulated on e-mail systems
are potential federal records;
Agency: DHS: policy omitted or was inconsistent with requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy covered requirement.
Requirement: Require that e-mail records are stored in an appropriate
recordkeeping system and instruct staff on how these records are
maintained in that recordkeeping system regardless of format;
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy covered requirement.
Requirement: Provide instructions on how to copy e-mails identified as
federal records from e-mail system not identified as recordkeeping
system to a recordkeeping system;
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy covered requirement.
Requirement: State that e-mail systems must not be used to store
recordkeeping copies of e-mail messages identified as federal
records[A];
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy omitted or was inconsistent with requirement.
Requirement: State that e-mail system backup tapes should not be used
for recordkeeping purposes;
Agency: DHS: policy covered requirement;
Agency: EPA: policy covered requirement;
Agency: FTC: policy covered requirement;
Agency: HUD: policy omitted or was inconsistent with requirement.
Requirement: Instruct staff on the management and preservation of e-
mail messages sent or received from nongovernmental e-mail systems;
Agency: DHS: policy covered requirement;
Agency: EPA: policy omitted or was inconsistent with requirement;
Agency: FTC: policy omitted or was inconsistent with requirement;
Agency: HUD: NA[B].
Source: GAO analysis.
[A] Unless the system has the features described in table 1. An
exception to the prohibition against storage in the e-mail system may
be made for transitory records with NARA-approved short term retention
periods of 180 days or less.
[B] One requirement was not applicable because of the configuration of
the agency's network.
[End of table]
If requirements for e-mail management are not included in agency
records management policies and guidance, agency e-mail records may be
at increased risk of loss. The loss of records that are important for
documenting government functions, activities, decisions, and other
important transactions could potentially impair agencies' ability to
carry out their missions.
E-Mail Records Management Practices of Senior Officials Did Not Fully
Comply with Key Requirements:
E-mail messages that qualified as records were not being appropriately
identified and preserved for 8 of the 15 senior officials we reviewed.
Senior officials at three agencies did not consistently conform to key
requirements in NARA's regulations for e-mail records; only at FTC did
the four senior officials fully follow these requirements. The other
three agencies showed varying compliance: three officials at DHS, two
officials at EPA, and three officials at HUD were not following
required e-mail recordkeeping practices. Factors contributing to the
inconsistent e-mail recordkeeping practices include inadequate training
and oversight. Other factors included the difficulty of managing large
volumes of e-mail in paper-based recordkeeping systems and the stated
practice at one agency that e-mail would not be used for record
material.
As described, the four agencies primarily used "print and file"
recordkeeping systems, which require agency staff to print out e-mail
messages for filing as the official recordkeeping copies in designated
filing systems. Each agency's policy also required the preservation of
e-mail transmission data, distribution lists, and acknowledgments.
DHS. At DHS, our review covered three senior officials because,
according to DHS officials, the Secretary of Homeland Security did not
use e-mail: these officials told us that the Secretary did not have a
DHS e-mail account, and that he did not conduct any official
communications using external nongovernmental e-mail systems.
For the remaining three officials, the e-mail management practices did
not fully comply with the requirements. None of the e-mails of the
senior officials were reviewed for their status as a record or filed in
an appropriate recordkeeping system. Instead, the officials were using
their e-mail accounts to store all e-mails.[Footnote 67] Two of the
three officials personally managed their e-mail accounts; the third
shared this responsibility with a member of his staff. The staff of one
of the officials who managed his own e-mail had access to the
official's e-mail account, but the staff reviewed or accessed these
only if instructed to do so by the official. The department said that
the third official's office administrator had access to calendar
functions only.
According to one of these senior officials, storing e-mails on the
computer is convenient for searching and retrieving. It was this
official's opinion that this approach was safe from a legal standpoint
because no e-mails were deleted. Nonetheless, using an e-mail system to
retain all e-mails indefinitely increases the difficulty of performing
searches based on categories of records; in contrast, such searches are
facilitated by a true recordkeeping system. Further, if e-mail records
are not stored in an appropriate recordkeeping system (paper or
electronic), there is reduced assurance that they are useful and
accessible to the agency as needed, or that they will be retained for
the appropriate period.
EPA: At EPA, the e-mail records of two of the four senior officials
were being managed in accordance with key requirements reviewed. For
these two senior officials, one of whom was the agency head, e-mail
records were stored in paper-based recordkeeping systems.
The EPA Administrator had two EPA e-mail accounts, one intended for
messages from the public and one for communicating with select senior
EPA officials (not intended for use by the public). In the paper-based
recordkeeping system, of 25 e-mail records inspected, all included
transmission data and distribution lists, as required. For the
nonpublic account, staff provided eight e-mail records for inspection,
all of which also included transmission data and distribution lists.
According to EPA officials, the nonpublic account generated few records
because the Administrator receives most of his information from other
sources, including face-to-face briefings and meetings.
For the second senior official, administrative staff told us that the
official reviewed e-mail personally and forwarded records to the staff
for printing and filing in a paper-based recordkeeping system that
followed the agency's records schedules. We selected 20 e-mails from
the official's files for examination. These files were associated with
four EPA records schedules. All of the e-mails included transmission
data and distribution lists as required.
The e-mail records of two other senior officials were not being managed
in compliance with requirements, because e-mail records were not being
stored in appropriate recordkeeping systems, but rather in the e-mail
system:
* One of these officials was in the process of migrating e-mail records
from the e-mail system to ECMS. This official had been storing e-mail
records in e-mail system folders since January 2006, in anticipation of
the rollout of the ECMS, and had not been using a paper-based
recordkeeping system in the interim. The e-mail system's folders were
organized according to the agency's records schedules to facilitate the
transfer, which was ongoing. Because this senior official did not store
e-mail records in a paper-based recordkeeping system during this
transition, the official's e-mail account was being used as a
recordkeeping system, which is contrary to regulation. However, when
the transition to the electronic recordkeeping system is complete, the
new system should provide the opportunity for this official's
recordkeeping practices to be brought into compliance with
requirements.
* The second official was also saving all e-mail in the e-mail system.
EPA officials stated that most of the senior official's e-mail was sent
to an administrative assistant, who was responsible for identifying and
maintaining the records received and filing them accordingly. However,
the administrative assistant for this official stated that although she
had been briefed on maintaining and preserving the senior official's
calendar in a recordkeeping system, she had not received guidance or
training in how to preserve or categorize the official's e-mail for
recordkeeping purposes. In addition, the assistant stated that all e-
mails remained stored in the e-mail system where they could be
retrieved if necessary.
FTC: The four senior officials at FTC were managing e-mail in
compliance with key requirements reviewed. These officials were the
Chairman[Footnote 68] and three Commissioners.[Footnote 69] According
to an FTC official, the Commissioners do not discuss substantive issues
in e-mails to one another because of the possibility that such group e-
mails could be construed as meetings subject to the Sunshine Act,
[Footnote 70] which must be open to the public. FTC staff told us that
the then-Chairman and two Commissioners delegated part or all of the
responsibility for e-mail management; the remaining Commissioner
personally managed e-mails. E-mails with record status were to be
printed and filed in the commission's paper-based recordkeeping
systems. The FTC recordkeeping systems contained e-mail records of the
four officials; of the 155 e-mail records inspected, all included the
required distribution lists and transmission data.
HUD: One of the four senior officials at HUD was managing e-mail in
compliance with key requirements, but for the other three officials, e-
mail records were not stored in appropriate recordkeeping systems.
The e-mail records for the agency head were being managed in accordance
with key requirements. According to HUD officials, management of e-
mails for the agency head was delegated to staff: that is, the agency
head's e-mails were forwarded by his administrative assistant to the
Office of the Executive Secretariat, where they were reviewed for
record status and preserved as necessary in paper files. Staff from the
Office of the Executive Secretariat flagged 10 e-mail records using the
department's correspondence tracking system, which were then retrieved
from the paper-based recordkeeping system for inspection; all of these
files included the required distribution lists and transmission data.
The practices of the three other senior officials varied, except that
for all three, they or their staff stated that the officials retained e-
mail messages in the e-mail system.[Footnote 71] One senior official
told us that he read his own e-mail and forwarded messages to staff to
determine record status. Another official's staff stated that the staff
was responsible for managing e-mail, but that the official would
determine what should be printed and filed. The third official's staff
stated that the official did not review e-mails for record status but
forwarded all program-related e-mails to staff, who would decide which
e-mails should be included in the program files as records. Neither the
three senior officials nor several of their staff had received records
management training.
HUD provided copies of e-mail messages from one senior official for
review, but there was no evidence that the messages were stored in an
appropriate recordkeeping system, and HUD officials stated that the
provided e-mails were not records. They offered to provide similar
nonrecord messages for the two other officials, but we declined to
review them because the messages would not have addressed the question
of whether the officials were storing e-mail records in appropriate
recordkeeping systems. Thus, for these three officials the department
did not provide examples of printed e-mail records that had been stored
in appropriate recordkeeping files.
According to department officials, this situation is explained by HUD's
practice of not using e-mail for business matters that would produce
records. According to department officials, official business is
conducted through paper processes, some electronic processes (such as
Web-based systems), but rarely through e-mail.
Nonetheless, although e-mail may rarely rise to the level of a record
under paper-based processes, it does not follow that no e-mail records
are ever created or received, as shown by the e-mail records maintained
by the department's Executive Secretariat and the Office of Healthy
Homes and Lead Hazard Control. The weakness in HUD's policy regarding
responsibility for determining which e-mails are records, combined with
the lack of training in e-mail records management, reduces the
department's assurance that those e-mail messages that are records are
being appropriately identified.
Factors contributing to the inconsistent practices at the three
agencies include inadequate training and oversight, as well as the
difficulties of managing large volumes of e-mail with the tools and
resources available, which in most cases do not include electronic
recordkeeping systems.
* The regulations require agencies to develop adequate training to
ensure that staff implement agency policies. All four agencies have
issued guidance and developed training materials, and all state that
they performed records management training. For example, according to
DHS officials, all three senior officials and staff had received
records management training as new employees. However, DHS and HUD had
no documentation to indicate that employees had received such training,
[Footnote 72] and our review of practices found instances in which
staff did not understand their recordkeeping responsibilities for e-
mail and stated that they had not been informed of them or received
training. For example, three senior HUD officials had not received
training on records management. Staff explained that formal briefings
had last taken place at that time.
* Agencies must also periodically evaluate their records management
programs, including periodic monitoring of staff determinations of the
record status of materials. However, the three agencies have not fully
developed and implemented oversight mechanisms, and do not determine
the extent to which senior officials or other staff are following
applicable requirements for e-mail records.[Footnote 73] According to
DHS, it has initiated oversight and review activities, but these are
not yet at the pilot stage because of other demands on records
management staff, such as completion of records scheduling. EPA has
developed an oversight plan and has pilot-tested a records management
survey tool, but it has not yet begun agencywide reviews. It plans to
fully deploy this tool when ECMS is fully implemented. HUD had not
initiated oversight and review activities, according to officials,
because of its practice of not using e-mail for matters that would
necessitate the creation of official records. These officials stated
that when the department's modernized system for records and document
management is in place, the department's e-mail policies will be
updated and appropriate oversight and review activities put in place.
Unless agencies train staff adequately in records management and
perform periodic evaluations or establish other controls to ensure that
staff receive training and are carrying out their responsibilities,
agencies have little assurance that e-mail records are appropriately
identified, stored, and preserved. Further, keeping large numbers of
record and nonrecord messages in e-mail systems potentially increases
the time and effort needed to search for information in response to a
business need or an outside inquiry, such as a Freedom of Information
Act request.
The volume of e-mail is also described as contributing to e-mail
records management shortcomings. Agency officials and staff referred to
the difficulty of managing large volumes of e-mail, suggesting that
limited resources contributed to their inability to fully comply with
records management and preservation policies. To help ensure that e-
mail records are managed appropriately, it is helpful to incorporate
recordkeeping into the process by which agency staff create and respond
to mission-related e-mail. Because this process is electronic, the most
straightforward approach is to perform e-mail recordkeeping
electronically. All four agencies, however, still rely either entirely
or primarily on paper for their recordkeeping systems, even for "born
digital" records like e-mail.
Weaknesses in the processes in place at three of the four agencies
reviewed raise questions about the appropriateness of paper
recordkeeping processes for their e-mail records. Simply devoting more
resources to paper records management may be neither efficient nor cost-
effective, and the agencies have recognized that this is not a tenable
long-term solution. EPA is beginning a transition to electronic
recordkeeping, and HUD and DHS have plans focused on future
enterprisewide transitions.
Managing electronic documents, including e-mail, in electronic
recordkeeping systems would potentially provide the efficiencies of
automation and avoid the expenditure of resources on duplicative manual
processes and storage. It is important to recognize, however, that
moving to electronic recordkeeping has proved not to be a simple or
easy process and that projects at large agencies have presented the
most significant challenges. For projects of all sizes, agencies must
balance the potential benefits of electronic recordkeeping against the
costs of redesigning business processes and investing in technology.
NARA has called the decision to move to electronic recordkeeping
inevitable.[Footnote 74] Nonetheless, like other information technology
investments, such a move requires careful planning in the context of
the specific agency's circumstances, in addition to well-managed
implementation.
Conclusions:
NARA's limited performance of its oversight responsibilities leaves it
with little assurance that agencies are effectively managing records,
including e-mail records, throughout their life cycle. NARA has an
organizational preference for partnering with and supporting agencies'
records management activities, which is appropriate for many of its
guidance and assistance responsibilities. However, this preference has
led NARA to avoid performing oversight activities that it judged to be
perceived negatively--the full-scale inspections/evaluations that it
performed in previous years. Although it has performed studies that
provide it with insights into records management issues and it has
taken action in response to the findings, it has not developed means to
evaluate the state of federal records management programs and
practices. As a result, NARA's oversight of federal records management
programs, including management of e-mail, has been limited. Further,
NARA's limited reporting on problems and solutions identified at
individual agencies reduces its own ability to hold agencies
accountable for addressing identified problems, as well as reducing the
ability of agencies to learn from the experience of others.
At the four agencies reviewed, e-mail records management policies were
generally compliant with NARA regulations, with some exceptions. If
policies do not fully conform to regulatory requirements, it increases
the likelihood that those requirements will not be met in practice.
Senior officials at three of the four agencies stored e-mail records in
e-mail systems, rather than in recordkeeping systems, which is not in
accordance with NARA's regulations. Factors contributing to this
noncompliance generally included insufficient training and oversight
regarding recordkeeping practices, as well as the onerousness of
handling large volumes of e-mail. Providing adequate training and
oversight is a prerequisite for improvement, but real improvements in e-
mail recordkeeping may require replacing the paper-based recordkeeping
processes currently in place. Properly implemented, the transition to
electronic recordkeeping of e-mail has the potential not only to reduce
the burden of e-mail management but also to provide positive benefits
in improving the usefulness and accessibility of records.
Recommendations for Executive Action:
To better ensure that federal records, including those that originated
as e-mail messages, are appropriately identified, retained, and
archived, we recommend that the Archivist of the United States:
* develop and implement an approach to oversight of agency records
management programs that provides adequate assurance that agencies are
following NARA guidance, including:
* developing various types of inspections, surveys, and other means to
evaluate the state of agency records and records management programs;
* developing criteria for using these means of assessment that ensure
that they are regularly performed; and:
* regularly report to the Congress and OMB on the findings,
recommendations, and agency responses to its oversight activities, as
required by law.
In addition, we recommend that the Administrator of the Environmental
Protection Agency:
* revise the agency's policies to ensure that they appropriately
reflect NARA's requirement on instructing staff on the management and
preservation of e-mail messages sent or received from nongovernmental e-
mail systems and:
* develop and apply oversight practices, such as reviews and monitoring
of records management training and practices, that are adequate to
ensure that policies are effective and that staff are adequately
trained and are implementing policies appropriately.
* We further recommend that the Chairman of the Federal Trade
Commission revise the commission's policies to ensure that they
appropriately reflect NARA's requirement to instruct staff on the
management and preservation of e-mail messages sent or received from
nongovernmental e-mail systems.
We further recommend that the Secretary of Homeland Security:
* revise the department's policies to ensure that they appropriately
reflect NARA's requirement to state that draft documents circulated on
e-mail systems are potential federal records and:
* develop and apply oversight practices, such as reviews and monitoring
of records management training and practices, that are adequate to
ensure that policies are effective and that staff are adequately
trained and are implementing policies appropriately.
Finally, we recommend that the Secretary of Housing and Urban
Development:
* revise the department's policies to ensure that they appropriately
reflect NARA's requirements to ensure that staff is capable of
identifying federal records and to state that e-mail systems must not
be used to store recordkeeping copies of e-mail records (other than
those exceptions provided in the regulation) and that e-mail system
backup tapes should not be used for recordkeeping purposes, and:
* develop and apply oversight practices, such as reviews and monitoring
of records management training and practices, that are adequate to
ensure that policies are effective and that staff are adequately
trained and are implementing policies appropriately.
Agency Comments and Our Evaluation:
We provided a draft of this report to NARA, DHS, EPA, FTC, and HUD for
review and comment. Three agencies provided written comments (which are
reproduced in apps. II to IV), and two provided comments via e-mail.
All five agencies indicated that they were implementing or intended to
implement our recommendations. Three of the five agencies generally
agreed with our findings and recommendations. One agency provided
information about its use of outside e-mail accounts, and one agency
agreed to implement our recommendations but questioned aspects of our
report.
In written comments, the Archivist of the United States stated that
NARA generally agreed with our draft report and would develop an action
plan to implement our recommendation. The Archivist also provided
technical comments, and we clarified our report to address each of
them. (see app. II).
In e-mail comments, the Director, Records, Publications, and Mail
Management at DHS, stated that the department agreed with our draft
report and that it correctly represented the condition at the time of
the review. The Director also said that future DHS records management
policy documents would be revised to reflect our recommendations.
In written comments, the Chief Information Officer of EPA stated that
the agency accepted our two recommendations. In addition, she provided
additional information on the EPA records management program. Finally,
this official provided technical comments, which we addressed as
appropriate; our assessment of these comments is contained in appendix
III.
In e-mail comments, an official from FTC's Office of the General
Counsel stated that FTC had instructed staff not to use outside e-mail
accounts for official business, but it was nonetheless taking action to
implement our recommendation by issuing a notice to staff regarding
policies and procedures for e-mail records, which included a statement
that work-related e-mails inadvertently sent or received from non-FTC
accounts must be handled in accordance with the agency's records
preservation policies and procedures. Our draft recognized FTC's
instruction not to use outside accounts for official business, but also
noted that that FTC did not totally prohibit access to such accounts.
Because access to outside accounts was available, FTC was required by
NARA regulations to provide staff with guidance on the proper handling
of e-mail records sent or received through such accounts. FTC also
provided technical comments, which we incorporated as appropriate.
In written comments, HUD's Acting Chief Information Officer stated that
HUD planned to implement our recommendations, but also stated that our
draft was inaccurate in three areas:
* The Acting CIO questioned the clarity of a figure we included to
illustrate a decision process that could be used to decide if an e-mail
message is a record. As noted in our draft, the illustration is
provided as an example to illustrate the kinds of factors that may be
considered when deciding whether an e-mail message is a record.
* The Acting CIO disagreed with our conclusions regarding HUD's
compliance with the requirements we reviewed, stating that the
department's records policies comply with all these requirements
because they incorporate NARA's regulations by reference. While our
draft recognized the reference to NARA regulations in HUD's policy, we
concluded that such a reference was not adequate to comply with NARA
regulations. As we stated in our draft, the reference in HUD's policy
is too general to make clear to HUD staff which practices are
prohibited. In addition, HUD did not establish procedures to implement
the requirements in question, as the regulations require.
* The Acting CIO questioned the accuracy of a statement on the number
of senior officials whose files were reviewed. Our evidence shows that
our statement was accurate, but we revised it to include further
clarifying detail.
We provide more detailed responses to these points in appendix IV.
As agreed with your offices, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
from the date of this report. At that time, we will send copies of this
report to the Archivist of the United States, the Administrator of the
Environmental Protection Agency, the Chairman of the Federal Trade
Commission, the Secretary of Homeland Security, and the Secretary of
Housing and Urban Development. Copies will be made available to others
on request. In addition, this report will be available at no charge on
our Web site at [hyperlink, http://www.gao.gov].
If you have questions about this report, please contact me at (202) 512-
6240 or koontzl@gao.gov. Contact points for our Offices of
Congressional Relations and Public Affairs may be found on the last
page of this report. GAO staff who made major contributions to this
report are listed in appendix V.
Signed by:
Linda D. Koontz:
Director, Information Management Issues:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
Our objectives were to:
* assess to what extent the National Archives and Records
Administration (NARA) provides oversight of federal records management
programs and practices, particularly with regard to e-mail,
* describe processes followed by selected federal agencies to manage e-
mail records,
* assess to what extent the selected agencies' e-mail records
management policies comply with federal requirements, and:
* assess compliance of selected senior officials with key e-mail
recordkeeping requirements.
To determine the extent to which NARA provides oversight of federal
agencies for managing and preserving federal e-mail records, we
analyzed applicable laws, regulations, and guidance; reviewed NARA's
oversight activities from 2003 to 2007, including its reports to OMB
and the Congress on records management activities; reviewed recent
NARA's records management reports; and interviewed NARA officials.
To address our other objectives, we judgmentally selected four agencies
for review based upon several factors. First, we identified four
general government functions from those functions that NARA identified
in a 2004 resource allocation study as having records that had a direct
and significant impact on the rights, welfare, and/or well-being of
American citizens or foreign nationals: homeland security, health,
economic development, and environmental management. (NARA classified
these functions as high risk for rights/accountability.) Next, using
NARA's analysis, we compiled a list of the federal agencies and their
components that performed those high-risk functions. For each
identified agency, we further classified it according to agency
structure (a department with component bureaus or agencies, a
department with an office structure, an independent agency, or an
independent commission) and size (a large department over 150,000
employees, a small department less than 11,000 employees, a small
independent agency less than 1,100 employees, or a large independent
agency over 18,000 employees).
We then judgmentally selected four agencies from the high-risk list
that presented various combinations of structure and size. These were
as follows:
Department of Homeland Security (U.S. Immigration and Customs
Enforcement):
* Rated by NARA as high on rights and accountability for records in the
Homeland Security: Immigrant and Non-Citizen Services function:
* Department with component agencies:
* Over 162,000 employees:
Department of Housing and Urban Development (Office of Healthy Homes
and Lead Hazard Control):
* Rated by NARA as high on rights and accountability for records in the
Health: Illness Prevention function:
* Department with offices:
* Less than 11,000 employees:
Environmental Protection Agency:
* Rated by NARA as high on rights and accountability for records in the
Environmental Management: Environmental Remediation function:
* Independent agency:
* Over 18,000 employees:
Federal Trade Commission:
* Rated by NARA as high on rights and accountability for records in the
Economic Development: Business, Trade, Trust, and Financial Oversight:
* Independent commission:
* Less than 1,100 employees:
At each of the four selected agencies, we:
* assessed e-mail records management policies of the agency;
* described processes followed by agencies to manage e-mail records,
specifically reviewing e-mail records management practices of a
business unit associated with the high-risk function; and:
* assessed compliance of four senior officials with key e-mail
recordkeeping requirements.
We selected a business unit from each organization that (1) performed
the particular line of business we identified in our agency selection
process and (2) had permanent records that NARA rated high on risk to
accountability and citizen rights. Table 5 identifies the business unit
we selected at each agency.
Table 5: Assessed Business Units:
Department: DHS;
Component: Immigration and Customs Enforcement;
Business unit: Detention and Removal Operation.
Department: EPA;
Component: Office of Solid Waste and Emergency Response, Office of
Superfund Remediation and Technology Innovation;
Business unit: Assessment and Remediation Division.
Department: FTC;
Component: Bureau of Consumer Protection;
Business unit: Division of Marketing Practices.
Department: HUD; Component: [Empty];
Business unit: Office of Healthy Homes and Lead Hazard Control.
Source: GAO analysis of agency data.
[End of table]
We also selected four senior officials at each agency. At DHS, EPA, and
HUD, we selected the head of the agency, the head of the office
responsible for policy, a randomly selected senior official, and the
most senior agency official associated with the business unit we
inspected. At FTC, we selected the Chairman and three Commissioners.
The selected senior officials are listed in table 6.
Table 6: Assessed Senior Officials:
Department: DHS;
Title of official: Secretary.
Title of official: Assistant Secretary for Policy.
Title of official: Acting Assistant Secretary for Health Affairs &
Chief Medical Officer.
Title of official: Assistant Secretary for Immigration and Customs
Enforcement.
Department: EPA;
Title of official: Administrator.
Title of official: Assistant Administrator for Enforcement and
Compliance Assurance.
Title of official: Assistant Administrator for Environmental
Information/Chief Information Officer.
Title of official: Assistant Administrator for Solid Waste and
Emergency Response.
Department: FTC;
Title of official: Chairman.
Title of official: Commissioner.
Title of official: Commissioner.
Title of official: Commissioner.
Department: HUD;
Title of official: Secretary.
Title of official: Assistant Secretary for Policy.
Title of official: Assistant Secretary for Housing--Federal Housing
Commissioner.
Title of official: Director, Office of Healthy Homes and Lead Hazard
Control.
Source: GAO analysis.
[End of table]
To describe the agencies' e-mail records management practices, we
analyzed documents, interviewed appropriate officials at the agency
(including business unit officials and staff), and performed limited
inspections of selected e-mail records.
To assess each agency's e-mail records management policies, we reviewed
the agency's published policy documents, including formal policies and
operational manuals, as well as agency-provided responses to a data
collection instrument on e-mail management, and compared their contents
to the e-mail related requirements in NARA's records management
regulations.
To assess compliance of senior officials with key e-mail recordkeeping
requirements, we analyzed documents, used data collection instruments
to gather information from the senior officials, their staffs, or other
appropriate officials, and inspected selected e-mail records. We asked
each agency to provide examples of senior officials' e-mail messages
stored as records to corroborate their responses. We then analyzed the
information provided by the agencies and assessed it against the e-mail
requirements in NARA's regulations on federal records.
We did not attempt to assess the extent to which the agencies' staff
correctly identified e-mail records or the extent to which the
agencies' records appropriately included e-mail.
The four data collection instruments we used are briefly described in
table 7.
Table 7: Topics of E-Mail Records Management Data Collection
Instruments and Their Associated Respondents:
Topic: E-mail records management;
Respondents: Agency's senior records manager.
Topic: E-mail systems management;
Respondents: Representative from Office of the Chief Information
Officer.
Topic: E-mail management practices of agency business units;
Respondents: Staff familiar with the business process of the agency's
program.
Topic: E-mail management practices of agency senior officials;
Respondents: Four senior officials, their staff, or both; other agency
officials.
Source: GAO analysis.
[End of table]
We performed our work at agency offices in the Washington, D.C.,
metropolitan area.
We conducted this performance audit from April 2007 to May 2008 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
[End of section]
Appendix II: Comments from the National Archives and Records
Administration:
National Archives and Records Administration:
8601 Adelphi Road:
College Park, Maryland 20740-6001:
NARA 's web site is [hyperlink, http://www.archives.gov]:
May 27, 2008:
Ms. Linda Koontz:
Director of Information Issues:
Government Accountability Office:
441 G Street NW:
Washington, DC 20548:
Dear Ms. Koontz:
We thank you for the opportunity to review and comment on the draft
report entitled National Archives and Selected Agencies Need to
Strengthen E-Mail Management before the report is issued in final form.
NARA accepts the recommendation for action by the Archivist of the
United States and will construct an action plan to satisfy that
recommendation. We generally agree with the contents of the draft
report and offer some suggestions below for your consideration.
The second full paragraph on page 8 is confusing. It could be stated
more clearly by splitting it into two sentences. Please consider the
following: "Under the Federal Records Act, NARA is given oversight
responsibilities for records management as well as general
responsibilities for archiving. This includes the preservation in the
National Archives of the United States of permanent records documenting
the activities of the government."
The following paragraph on page 8 lists several NARA responsibilities.
As it is a major NARA responsibility, we suggest that "approval of the
disposition for all Federal records" be included in this list.
The first full paragraph on page 17 describes many of the advantages of
electronic recordkeeping (ERK). It is important to note that user
adoption is critical to enjoying the benefits of ERK. If an employee
inconsistently follows the "print and file" policy, he/she may also not
follow the steps necessary to put the e-mail or other e-record in the
ERK system. Also, auto-classification remains only a potential approach
at this time.
The section on NARA' s oversight activities beginning on page 24
focuses only on inspections. The report should note that NARA also
conducts oversight when it identifies and investigates allegations of
unauthorized disposition of Federal records. We discussed this activity
and provided documentation to the GAO team during its site work.
Descriptions of our reluctance to engage in full-scale inspections and
evaluations are incomplete. While our preference is to guide and
support agencies' records management activities, as we discussed
extensively with the GAO team, we also had another overarching reason
for discontinuing the evaluation program. In practice, those full-scale
inspections were extremely resource intensive and took several years to
complete. Once a NARA evaluation report was issued, the need for
extensive resources shifted to the agency. Agencies often took years to
satisfy recommendations made in NARA evaluations, and records
management practices in the agencies did not necessarily improve.
Finally, the final paragraph on page 36 states that the (EPA)
Enterprise Content Management System (ECMS) repository is approved by
NARA. NARA does not approve electronic record keeping systems. The ECMS
repository uses DoD 5015.2-certified software which NARA has endorsed.
Again, thank you for the opportunity to review and comment on this
draft report. We look forward to continuing work with you as we
strengthen e-mail management processes across the Federal government.
Sincerely,
Signed by:
Michael J. Kurtz, for:
Allen Weinstein:
Archivist of the United States:
[End of section]
Appendix III: Comments from the Environmental Protection Agency:
Note: GAO comments supplementing those in the report text appear at the
end of this appendix.
United States Environmental Protection Agency:
Office Of Environmental Information:
Washington, D.C. 20460:
Internet Address (URL): [hyperlink, http://www.epa.gov]:
May 29, 2008
Mr. James Sweetman, Assistant Director:
United States Government Accountability Office:
Washington, DC:
Dear Mr. Sweetman:
Thank you for selecting the Environment Protection Agency (EPA) as one
of the four agencies reviewed by the Government Accountability Office
(GAO) audit to assess the adequacy of the National Archives and Records
Administration's (NARA's) records management guidance and Agencies'
compliance with the federal requirements for managing e-mail records.
The Agency appreciates the opportunity to provide comments on the draft
report, National Archives and Selected Agencies Need to Strengthen E-
Mail Management. We are directing our comments to your attention as
requested in Linda Koontz's memo of May 8, 2008.
EPA accepts GAO's two recommendations to: (1) revise the Agency's
policies to ensure that they appropriately reflect NARA's requirement
on instructing staff on the management and preservation of e-mail
messages sent or received from nongovernmental e-mail systems and (2)
develop and apply oversight practices, such as reviews and monitoring
of records management training and practices, that are adequate to
ensure that policies are effective and that staff are adequately
trained and are implementing policies appropriately.
EPA would like to request that the final Report be updated with the
following edits and/or comments:
Page: Page 34, first paragraph; [See comment 1]
GAO Stated: EPA is in the process of deploying an electronic content
management system that is to be used for managing e-mail.
EPA Comment: ECMS will not be replacing our larger email system, Lotus
Notes. Therefore, this sentence should state: EPA is in the process of
deploying an electronic content management system that is to be used
for managing e-mail that are Agency records.
Page: Page 36, last paragraph; [See comment 2]
GAO Stated: The ECMS repository is a NARA-approved electronic
recordkeeping system.
EPA Comment: NARA does not approve systems. The ECMS uses a Commercial-
Off-the-Shelf (COTS) product that is DoD 5015.2 STD certified, which is
endorsed by NARA.
Page: Page 37, first full paragraph; [See comment 3]
GAO Stated: According to the EPA CIO office, transitory e-mail is
stored on e-mail systems for a maximum of 180 days.
EPA Comment: This statement is incorrect. EPA asked that the statement
be replaced with the language on page 36, second paragraph, which
states that the Agency ordered that all automatic delete functions be
deactivated (disabled).
Page: Page 42, second bullet and Page 45 table; [See comment 4]
GAO Stated: At EPA, the e-mail management policy did not instruct staff
on the management and preservation of e-mail messages sent or received
from nongovernmental e-mail systems.
EPA Comment: EPA will develop an Agency-wide policy to instruct staff
about the use of non-EPA e-mail systems and the management and
preservation of e-mail messages sent or received from nongovernmental e-
mail systems.
Page: Page 42, second bullet; [See comment 5]
GAO Stated: At EPA and FTC, the e-mail management policy did not
instruct staff on the management and preservation of e-mail messages
sent or received from nongovernmental e-mail systems. According to
officials at both agencies, such instructions were not included because
agency employees were instructed not to use such accounts for agency
business.
EPA Comment: EPA has not provided formal instructions to staff on the
use of secondary accounts to conduct Agency business, rather, EPA has a
clear and consistent policy framework against the use of
nongovernmental e-mail systems for official EPA business.
Page: Page 43, first full paragraph; [See comment 6]
GAO Stated: NARA official stated that they would communicate with EPA
to determine the sufficiency of the steps taken to respond to the
incident and to prevent such incidents from recurring.
EPA Comment: EPA received NARA's response dated April 30, 2008,
enclosed. NARA agreed that the safeguards that EPA is implementing to
mitigate the risk of any further loss of such e-mail, and the
forthcoming policy statement prohibiting the use of non-EPA e-mail
accounts to conduct agency business, are appropriate and adequate. NARA
further states that they consider this case closed and no further
reporting is needed.
Page: Page 47 first full paragraph; [See comment 7]
GAO Stated: The EPA Administrator had two EPA e-mail accounts, one
public and one for communicating with select senior EPA officials.
EPA Comment: The EPA Administrator has two email accounts, a primary
one for communicating with the public and a secondary account for
communicating with select EPA officials. EPA does not refer to theses
accounts as public and non-public but rather primary and secondary
email accounts.
Page: Page 47, first full paragraph; [See comment 8]
GAO Stated: According to EPA officials, the nonpublic account generated
few records because the Administrator did not use e-mail to conduct
agency business, receiving most of his information from other sources,
including face-to-face briefings and meetings.
EPA Comment: EPA did not say that the secondary email account was not
used to conduct Agency business, but rather, it was not the primary
tool the EPA Administrator used to exchange information. Therefore this
sentence should read: According to EPA officials, the secondary account
generated few records because the Administrator receives most of his
information from other sources, including face-to-face briefings and
meetings.
Page: Page 47, third full paragraph; [See comment 9]
GAO Stated: The e-mail records of two other senior officials were not
managed in compliance with requirements, because e-mail records were
not being stored in appropriate recordkeeping systems, but rather in
the e-mail system.
EPA Comment: The Agency Records Officer will follow-up with these
senior officials and their administrative staffs to ensure that e-mail
records are properly identified and saved in an appropriate
recordkeeping system.
Page: Page 51, middle of first paragraph; [See comment 10]
GAO Stated: EPA has developed an oversight plan and has pilot-tested a
records management program review but not yet begun Agency-wide
reviews.
EPA Comment: EPA developed a comprehensive records management survey
tool that will be used to serve the following three purposes: obtain an
Agency-wide records management baseline, conduct self-assessments by
each program office and region, and conduct program reviews by the
National Records Management Program. The survey tool will be
implemented after the full implementation of ECMS.
[End of table]
Efficient and effective document and records management has been a
priority focus at EPA in recent years and we are proud of the proactive
steps we are taking to ensure the Agency's records management program
remains among the best in the federal government. Highlights of the
steps that the Agency has recently taken include:
* Implementing phase one of an Agency-wide Enterprise Content
Management System (ECMS) deployment;
* Commissioning a senior level Task Force to make recommendations for
improving document and records management Agency-wide, and
commissioning an Agency-wide workgroup to implement the Task Force's
recommendations;
* Developing mandatory on-line records management training, taken by
18,000 employees and contractors;
* Resubmitting paper based records schedules to NARA for media neutral
approval (approximately 270 schedules);
* Developing four on-line training modules for Agency records contacts,
along with other training tools such a "Tip of the Week" and enhancing
our award-winning records management Website;
* Developing a mandatory requirement for all Records Liaison Officers
(RLOs) to received NARA's certification in federal records management;
* Requiring the inclusion of records management responsibilities in the
Performance Appraisal and Recognition System (PARS) plans for all
employees with specific records responsibilities; and;
* Including a session on records management responsibilities in new
employee orientations.
Again, the Agency appreciates the opportunity to obtain an independent
perspective of our records management program and receive feedback on
areas where improvements can be realized. Should you have any question
regarding EPA's response, please contact John Ellis, EPA's Agency
Records Officer at 202-566-1643 or ellis.john@epa.gov.
Sincerely,
Signed by:
Molly A. O'Neill:
Assistant Administrator and Chief Information Officer:
Enclosure:
The following are GAO's comments on the on the EPA's written response
dated May 29, 2008, to our draft report.
GAO Comments:
1. We clarified our discussion of this topic.
2. We clarified our discussion of this topic.
3. We removed the reference to the 180 day limit.
4. In our discussion of the exchange between EPA and NARA on the
incident involving possible loss of e-mail records, we included
information on EPA's plan to promulgate a policy on the use on non-EPA
e-mail systems.
5. See comment 4. EPA plans to promulgate a policy prohibiting the use
of non-EPA e-mail systems for EPA business.
6. We updated our discussion of this topic to reflect NARA's response.
7. We do not use EPA's terminology because we do not find "primary" and
"secondary" to be useful descriptions. However, we revised our
discussion to clarify the references.
8. See note 7.
9. If EPA implements the oversight mechanism we recommend, it will help
ensure that e-mail records are properly identified and protected.
10.We updated our discussion to indicate when EPA plans to deploy its
survey tool.
[End of section]
Appendix IV: Comments from the Department of Housing and Urban
Development:
Note: GAO comments supplementing those in the report text appear at the
end of this appendix.
U.S. Department Of Housing And Urban Development:
Chief Information Officer:
Washington, DC 20410-3000:
May 28, 2008:
Ms. Linda Koontz:
Director, Information Management Issues:
Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Ms Koontz:
Thank you for the opportunity to comment on the Government
Accountability Office (GAO) draft report entitled "National Archives
and Selected Agencies Need to Strengthen E-Mail Management."
The focus of this audit was to determine whether e-mail documents that
constitute federal records are preserved in accordance with the record
preservation policies and requirements of the National Archives and
Records Administration (NARA). The Department of Housing and Urban
Development (HUD) agrees that effective e-mail records management
policies need to be in place at HUD and all federal agencies, and that
such policies must be diligently followed. The draft report recommends
that HUD revise its e-mail record management policies to ensure such
policies appropriately reflect NARA requirements and that HUD staff are
capable of identifying federal records. The draft report also
recommends that HUD develop and apply oversight practices, including
reviews of records, and monitoring of records management training and
practices. HUD is in agreement that its e-mail policies, training and
oversight can be strengthened and HUD plans to take steps to strengthen
these areas. While HUD agrees with these recommendations, HUD has
identified statements in the draft report about HUD policies and
practices that are inaccurate.
The following identifies areas in the draft report which HUD found to
be inaccurate or ambiguous:
Page 14 - HUD concurs with GAO's point that, in determining whether an
e-mail message is a record, the Department should go through a process
like that described in the example. Unfortunately, the arrangement and
contents of the flowchart should be corrected if it is to be considered
by "agency staff [who] have to be aware of the defining features of a
record in order to make these decisions," other than as simply an
example of a determination process, and not one that should be followed
as shown. [See comment 1]
Page 15 - Figure 1, Example Decision Tree for Determining Whether an E-
Mail Message Is a Record, includes circular logic, multiple questions
improperly co-located within a single flow chart question block, and
improperly late placement of question blocks identifying exceptions to
the retention requirements. [See comment 2] Most notably, the first
question block circularly assumes that the e-mail is a "record" as part
of the overall matter of "determining whether an e-mail message is a
record," thereby pre-empting those portions of the rest of the
flowchart that indicate that the e-mail may not be a record. The block
also improperly asks two questions, and does not identify whether an
overall "yes" answer is obtained when both questions are answered
"yes," or when either question is answered "yes." Finally, the
relationship between the two apparently unrelated questions
(paraphrasing, did "you" create the e-mail? is it for business use?) is
unclear. Similar problems arise in many other question blocks and in
the arrangement of the blocks. [See comment 3]
Page 40 - The section header (on draft page 40) is incorrectly titled,
"Three of the Four Agencies Comply with Most Policy Requirements for E-
Mail Management" and begins with an incorrectly low number of agencies
with generally conforming policies, "At three of the four agencies
reviewed, the policies in place generally addressed the requirements
for e-mail records management..."; in both cases, "three" should be
"four," as described below, and the wording revised accordingly ("The
Four Agencies Comply..." and "At the four agencies reviewed..."), as
should the corresponding part of the Table of Contents on draft page 1
("The Four Agencies Comply..."), the Results in Brief on draft page 6
("Three agencies we reviewed..."), and the HUD column of table 4 on
draft page 44 (the "X"s should be check marks. [See comment 4]
Page 41 - states, incorrectly that, HUD's "policies in place did not
cover three of eight applicable requirements." That sentence should be
deleted for the reasons provided in the discussion of statements on
page 44.
Page 44 - correctly states that, "HUD officials stated that they
considered that these requirements were met by a reference in their
policy to the NARA regulations in which these requirements appear." In
particular, HUD's Electronic Mail Policy (Handbook 2400.1, chapter 7,
paragraph 7-4.b, Record Retention Responsibilities) says that, "Records
created or received on electronic mail systems must be managed in
accordance with the provision of 36 CFR 1220, 1222 and 1228," which are
NARA regulations. (Note that this HUD policy text has been quoted by
GAO in its draft footnote 66.) NARA has incorporated its Electronic
Records Management regulation, 36 CFR 1234, as a whole into other NARA
regulations. (See 36 CFR §§ 1222.50(b)(7), 1228.154(a), 1228.232(d),
and 1228.270(a). Incorporation by reference is a widely used and well-
accepted legal device. The text of the referenced document, once
incorporated by reference, becomes fully and legally a part of the
document into which it is incorporated. It is also sufficient to
reference only incorporation of an entire document to incorporate its
portions; that is, after incorporating a part of the Code of Federal
Regulations (CFR), there is no need to reference each subpart, section,
and paragraph. The subcomponents of the part are automatically
incorporated as part of the incorporation of the entire CFR part. [See
comment 5]
Note: HUD and NARA are not unique in using regulatory incorporation by
reference to CFR Parts as a whole; the Office of Management and Budget
has also incorporated into its regulations entire CFR Parts issued by
NARA and other agencies by reference. See, e.g., 2 CFR 215.5.)
Page 44 states that, "However, this reference is too general to make
clear to staff that e-mail systems and backup tapes are not to be used
for recordkeeping." As described above, this is incorrect, and should
be deleted. [See comment 6]
Page 49, the report incorrectly states that, "For these three officials
the Department did not provide examples of printed e-mail records that
had been stored in appropriate recordkeeping files." On the day GAO
staff visited HUD to obtain these examples, the staff visited the
office of only one of the three officials. The two other HUD offices
for which GAO had made appointments that day were not visited. The
sentence should be corrected to read, "The one official's office which
was requested to provide examples of printed e-mail records that had
been stored in appropriate recordkeeping files provided files of e-
mails but the files did not reflect an accepted recordkeeping system."
[See comment 7]
Page 54 and 55 - Recommendations to HUD: - The Department's policies
already "appropriately reflect NARA's requirements" on these matters.
As described in the discussion above, regarding statements made on
pages 41 and 44, HUD has incorporated NARA's e-mail management
requirements into its own policies by reference. However, as also noted
earlier, HUD will enhance its policies and its implementation as
recommended in order to increase their usability by all HUD officials
and staff, including HUD's political leadership. [See comment 8]
In conclusion, HUD reiterates that its e-mail policy already
incorporates the NARA regulations and requirements. Accordingly, HUD's
policy does not require, revision but HUD acknowledges that
implementation of this policy can be and will be enhanced.
Additionally, it is not the case that every e-mail is an official
record. HUD uses e-mail as a communication tool. HUD's practice is not
to use e-mail for official record purposes. [See comment 9]
However, as also noted earlier, HUD will enhance its policies and its
implementation as recommended in order to increase their usability by
all HUD officials and staff, including HUD's senior officials. More
definitive information with timelines will be provided in HUD's action
plan to be developed once the final report has been issued.
If you have any questions or require additional information, please
contact Shelia Fitzgerald, Acting Director, Office of Investment,
Strategy, Policy and Management at (202)-402-2432.
Sincerely,
Signed by: [Illegible], for:
Joseph M. Milazzo:
Acting Chief Information Officer:
The following are GAO's comments on the on the HUD's written response
dated May 28, 2008, to our draft report.
GAO Comments:
1. As noted in our report, the described decision process is an example
of one that could be used to determine whether an e-mail message is a
record. We did not state that the process is a requirement that must be
followed by any particular agency.
2. See comment 1.
3. See comment 5.
4. See comment 5.
5. Our draft noted that HUD incorporated Parts 1220, 1222, and 1228 of
NARA's regulations by reference. However, the policy requirements at
issue are contained in Part 1234 of NARA's regulations. In its
comments, HUD argues that the Parts it cites incorporate Part 1234 by
reference. We do not agree with HUD that this type of indirect
reference is a sufficient or effective way of informing HUD staff of
their e-mail recordkeeping responsibilities as well as of prohibited
practices. In addition, HUD did not fully implement the applicable e-
mail management requirements because it did not establish procedures to
implement appropriate procedures that protect e-mail records.
6. See comment 5.
7. The text suggested by HUD is incorrect in that we requested copies
of e-mail records from all three selected officials. We revised our
report to provide additional detail on this.
8. We agree that enhancing HUD's policies on e-mail records as we
recommend could increase their usability by all HUD officials and
staff; among other things, this could clarify for HUD staff which
practices are prohibited.
9. We agree that not every e-mail is an official record, and we
emphasized this point in our report. However, we also emphasized that
the content of a communication, not its form, determines its record
status.
[End of section]
Appendix V: GAO Contact and Staff Acknowledgments:
GAO Contact:
Linda Koontz, (202) 512-6240, koontzl@gao.gov:
Staff Acknowledgments:
In addition to the individual named above, Mirko Dolak and James R.
Sweetman, Jr. (Assistant Directors); Monica Anatalio; Timothy Case;
Barbara Collier; Pamlutricia Greenleaf; Jennifer Franks; Tarunkant N.
Mithani; Sushmita Srikanth; and Jennifer Stavros-Turner made key
contributions to this report.
[End of section]
Footnotes:
[1] The relevant provisions of the Federal Records Act of 1950 and
subsequent records management statutes are largely codified in Chapters
21, 29, 31, and 33 of Title 44 of the U.S. Code.
[2] The definition of a record is given at 44 U.S.C. 3301.
[3] One requirement was not applicable because of the configuration of
the agency's network.
[4] One senior official did not use e-mail, according to agency staff.
[5] In addition, one official was using the e-mail system to store
records in anticipation of a transition to an electronic recordkeeping
system; when the ongoing transition is complete, the new system should
allow this official's recordkeeping practices to be brought into
compliance with requirements.
[6] Relevant NARA regulations implementing the Federal Records Act are
found at 36 C.F.R. 1220-1238.
[7] As relevant here, 44 U.S.C. chapters 21, 29, 31, and 33.
[8] 44 U.S.C. 3301.
[9] National Archives and Records Administration, Guidance for Flexible
Scheduling, Bulletin 2005-05 (Apr. 20, 2005), [hyperlink,
http://www.archives.gov/records-mgmt/bulletins/2005/2005-05.html].
[10] General records schedules are posted at NARA's Web site:
[hyperlink, http://www.archives.gov/records-mgmt/ardor/records-
schedules.html].
[11] 36 C.F.R. Part 1234.
[12] For example, the regulation states that all information in
electronic systems (including those operated by contractors) is to be
scheduled (either through general or agency-specific records schedules)
and that such scheduling shall take place no later than 1 year after
the implementation of the system.
[13] 36 C.F.R. §1234.24.
[14] The requirements for informing and training staff on identifying
records are given in 36 C.F.R. § 1222.20.
[15] These are e-mail records with very short-term (180 days or less)
NARA-approved retention periods (under the authority of General Record
Schedule 23, Item 7, or a NARA-approved agency records schedule).
Agencies may elect to manage such records on the e-mail system itself,
without the need to copy the record to a recordkeeping system, provided
that (1) users do not delete the messages before the expiration of the
NARA-approved retention period, and (2) the system's automatic deletion
rules ensure preservation of the records until the expiration of the
NARA-approved retention period.
[16] 44 U.S.C. § 3303a.
[17] For example, the recordkeeping system might be a stand-alone
system, it might be integrated into an e-mail application, it might be
a component of a more general electronic document management system, or
it might be a function of an enterprisewide electronic information
management system. NARA, What is Electronic Recordkeeping? [hyperlin,
http://www.archives.gov/records-mgmt/policy/prod1b.html].
[18] According to Gartner Research, "What enterprises really need (and
want), is a mechanism that automatically classifies messages by records
management type... without user intervention." However, such technology
is "in its infancy," as of August 2007, although Gartner expected it to
mature rapidly because of high demand. Gartner Research, Best Practices
in Records Management: FAQs, G00149526 (Aug. 17, 2007).
[19] That is, if the hardware, software, or media required to access
the information become obsolete or deteriorate, the information must be
migrated to hardware, software, or media that continue to be
accessible.
[20] For example, Robert F. Williams and Lori J. Ashley, Cohasset
Associates Inc., 2005 Electronic Records Management Survey--A Renewed
Call to Action, Cohasset/ARMA/AIIM White Paper (2005); Giovanna
Patterson and J. Timothy Sprehe, "Principal Challenges Facing
Electronic Records Management in Federal Agencies Today," Government
Information Quarterly, Vol. 19 (2002), pp 307-315; available at
[hyperlink, http://www.sciencedirect.com]; The Sedona Conference®
Working Group on Best Practices for Electronic Document Retention &
Production, The Sedona Guidelines: Best Practice Guidelines &
Commentary for Managing Information & Records in the Electronic Age
(2005), [hyperlink,
http://www.thesedonaconference.org/content/miscFiles/TSG9_05.pdf].
[21] SRA International, Inc., Report on Current Recordkeeping Practices
with the Federal Government, a report sponsored by NARA (Dec. 10, 2001)
[hyperlink, http://www.archives.gov/records-mgmt/pdf/report-on-
recordkeeping-practices.pdf].
[22] Center for Information Policy/College of Information Studies/
University of Maryland, Best Practices in Electronic Records
Management: A Survey and Report on Federal Government Agency's
Recordkeeping Policies and Practices, a report sponsored by NARA (Dec.
19, 2005) [hyperlink, http://www.archives.gov/records-
mgmt/initiatives/umd-survey.html].
[23] NARA, NARA Review of UMD CIP Report "Best Practices in Electronic
Records Management," [hyperlink, http://www.archives.gov/records-
mgmt/initiatives/umd-survey-nara-review.pdf].
[24] NARA, A Survey of Federal Agency Records Management Applications
2007 (Jan. 22, 2008).
[25] NARA, "Why Federal Agencies Need to Move Towards Electronic
Recordkeeping," [hyperlink, http://www.archives.gov/records-
mgmt/policy/prod1afn.html].
[26] The Archives' redesign framework is presented in NARA's Strategic
Directions for Federal Records Management (July 31, 2003), [hyperlink,
http://www.archives.gov/records-mgmt/initiatives/strategic-
directions.html] (accessed Feb. 7, 2008).
[27] Other advantages are that big bucket schedules simplify managing
agency records by synchronizing retentions and dispositions of records
in the context of their work processes or business functions rather
than by individual records series or electronic systems, and they may
reduce the need to resubmit schedules for new and unscheduled records
as long as these are included in a previously scheduled business
process.
[28] NARA, NARA's Strategic Directions for Federal Records Management:
Status Report (Sept. 20, 2004) [hyperlink,
http://www.archives.gov/records-mgmt/initiatives/strategic-directions-
status-sept2004.html].
[29] NARA, GRS Transmittal No. 15 (Sept. 14, 2005) [hyperlink,
http://www.archives.gov/records-mgmt/ardor/grs-trs15.html].
[30] For example, when switching from a paper recordkeeping system to
an electronic system, it had generally been necessary to reschedule
records; under media neutrality, this requirement would be reduced.
Instead, NARA would specify when it would be necessary for agencies to
reschedule records when switching from a paper recordkeeping system to
an electronic system.
[31] NARA, GRS Transmittal No. 18 (Dec. 14, 2007) [hyperlink,
http://www.archives.gov/records-mgmt/ardor/grs-trs18.html].
[32] GAO, National Archives: Preserving Electronic Records in an Era of
Rapidly Changing Technology, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GGD-99-94] (Washington, D.C.: July 19, 1999).
[33] GAO, Information Management: Challenges in Managing and Preserving
Electronic Records, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-
02-586] (Washington, D.C.: June 17, 2002).
[34] Services offered include expedited review of critical schedules,
tailored training, and help in records disposition and transfer.
[35] GAO, Electronic Records: Management and Preservation Pose
Challenges, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-936T]
(Washington, D.C.: July 8, 2003).
[36] GAO, Electronic Records Archives: The National Archives and
Records Administration's Fiscal Year 2006 Expenditure Plan, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-06-906] (Washington, D.C.: Aug.
18, 2006).
[37] NARA, NARA's Strategic Directions for Federal Records Management
(July 31, 2003).
[38] One inspection, initiated in 1995, remains officially open. An
evaluation report on this inspection, which examined the Central
Intelligence Agency's records management program, was completed in
March 2000. However, not all recommendations from the evaluation have
been closed. According to NARA, the agency has addressed all the policy
and guidance recommendations, and the open recommendations mainly
concern the transfer of the agency's records to NARA. NARA told us that
it is working with the agency to close these recommendations.
[39] NARA, Strategic Directions: Inspections and Studies of Records
Management in Federal Agencies (October 2003).
[40] NARA used as a starting point the Business Reference Model of
governmental activity developed by OMB as part of the Federal
Enterprise Architecture. The Federal Enterprise Architecture is a
comprehensive business-driven blueprint of the entire federal
government. It consists of a set of interrelated "reference models"
designed to facilitate cross-agency analysis and the identification of
duplicative investments, gaps, and opportunities for collaboration
within and across agencies.
[41] Under 44 U.S.C. Part 3106, federal agencies are required to notify
the Archivist of any alleged unauthorized disposition of records. NARA
establishes a case to track each allegation and communicates with the
agency until the issue is resolved.
[42] NARA, Federal Government-wide Resource Allocation Project Core
Team Final Project Report (Sept. 17, 2004).
[43] According to NARA, the results of the Resource Allocation Project
have been used for planning where to focus its scheduling efforts and
other records management activities.
[44] NARA, Ready Access to Essential Evidence, 2004 Performance and
Accountability Report (2004).
[45] We have issued several reports on ERA and its development since
2002: GAO, Information Management: Challenges in Managing and
Preserving Electronic Records, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-02-586] (Washington, D.C.: June 17, 2002); Records
Management: National Archives and Records Administration's Acquisition
of Major System Faces Risks, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-03-880] (Washington, D.C.: Aug. 22, 2003); Records
Management: Planning for the Electronic Records Archives Has Improved,
GAO-04-927 (Washington, D.C.: September 23, 2004); Information
Management: Acquisition of the Electronic Records Archives Is
Progressing, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-802]
(Washington, D.C.; July 15, 2005); Electronic Records Archives: The
National Archives and Records Administration's Fiscal Year 2006
Expenditure Plan, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-
906] (Washington, D.C.: Aug. 18, 2006); Information Management: The
National Archives and Records Administration's Fiscal Year 2007
Expenditure Plan, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-
987] (Washington, D.C.: July 27, 2007).
[46] NARA Bulletin 2006-02 set deadlines, as required by the E-
Government Act of 2002, for agencies to schedule electronic records.
Specifically, by September 30, 2009, agencies must have NARA-approved
records schedules for all records in existing information systems, and
they must ensure that records management and archival functionality are
incorporated into the design, development, and implementation of new
electronic systems.
[47] An additional factor, according to officials, was the challenge of
developing memorandums of understanding with agencies (on each
project's requirements and the resources that the agency and NARA would
undertake to apply to it), because NARA generally worked with agency
records officers, who often did not have the authority to sign such
agreements. According to NARA, in 2006, it eased this requirement so
that instead of a signed memorandum of understanding, it would suffice
that a project have some form of documentation (such as an e-mail)
indicating that both sides agreed to the project goals, requirements,
and resources.
[48] NARA, NARA's Strategic Directions for Federal Records Management
(July 31, 2003).
[49] NARA, Strategic Directions: Inspections and Studies of Records
Management in Federal Agencies (October 2003).
[50] The table does not include the 2001 SRA study described earlier,
which was conducted before NARA developed its 2003 plan. NARA did not
perform records management studies in 2002 and 2003.
[51] Although two were limited in scope to components of a single
agency, they addressed issues with potentially broad application and
included conclusions regarding factors that needed to be considered in
the appraisal of given types of records.
[52] NARA, NARA's Strategic Directions for Federal Records Management
(July 31, 2003).
[53] Since fiscal year 2004, NARA has prepared annual Performance and
Accountability Reports. In fiscal year 2003 and earlier, it produced
separate Performance Reports and Annual Reports.
[54] NARA, Preserving the Past to Protect the Future: 2007 Performance
and Accountability Report (2007).
[55] At the time of our review, use of the electronic system was
voluntary and not yet widespread.
[56] Various types of nonrecordkeeping electronic systems offer
computerized management of electronic and paper-based documents. For
example, electronic document management systems may be used to track
and store electronic documents and/or images of paper documents. Such
systems may include a system to convert paper documents to electronic
form, a mechanism to capture documents from authoring tools, a database
to organize storage, and a search mechanism to locate the documents.
[57] Over 55 million A-files are managed by Citizenship and Immigration
Services, which relies on an alien's historical A-file to determine
eligibility for immigration benefits. Other DHS components, including
Immigration and Customs Enforcement, use A-files during criminal
investigations and to determine, for example, whether an alien should
be removed from or allowed to stay in the United States. Information
and documents from A-files may also be shared with other law
enforcement agencies, such as the Federal Bureau of Investigation, to
investigate individuals suspected of being involved in terrorist
activities.
[58] We have previously reported on difficulties finding A-files: GAO,
Immigration Benefits Additional Efforts Needed to Help Ensure Alien
Files Are Located when Needed, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-85] (Washington, D.C.: Oct. 27, 2006).
[59] ECMS allows the user to access the recordkeeping system to save a
record and associate it with the appropriate records schedule, as well
as to search through records within the user's organization.
[60] Generally, the term refers to "pre-authorized" mixed funding, in
which the settling parties agree to do the cleanup and EPA agrees to
finance a portion of the costs.
[61] FTC uses the Citrix remote application delivery environment.
[62] 24 C.F.R. 35, subpart A. This rule requires homeowners to disclose
all known lead paint and lead paint hazards when selling or leasing a
residential property built before 1978.
[63] One of the requirements was not applicable because of the
configuration of HUD's network.
[64] 36 C.F.R. § 1234.24.
[65] In comments on a draft of this report, an FTC official indicated
that on May 28, 2008, the commission's Records and Filing Office sent a
notice to FTC staff reminding them of the existing policy on limited
use of outside e-mail accounts and instructing them on how to handle e-
mail records received through such accounts.
[66] HUD's Electronic Mail Policy also states that "Records created or
received on electronic mail systems must be managed in accordance with
the provision of 36 C.F.R. 1220, 1222 and 1228." Thus, HUD's guidance
is contradictory on this point. (The statement appears in the policy
under Electronic Mail Database Management, Record Retention
Responsibilities.)
[67] The inboxes of the three officials contained 583, 8,097, and
30,745 e-mail messages, respectively, and their sent folders contained
6,565, 5,236, and 4,498 e-mails.
[68] The Chairman whose records were reviewed resigned effective March
28, 2008. A new Chairman was designated effective March 31, 2008. The
new Chairman is one of the three Commissioners covered in this
assessment.
[69] At the time there were five Commissioners in all, including the
Chairman. Currently, there are four.
[70] 5 U.S.C. § 552b.
[71] According to CIO officials, e-mail more than 60 days old is
automatically archived, with archives maintained for 3 years and
sometimes longer; employees are not allowed to delete anything from the
archive.
[72] EPA did track records management training, which agency officials
stated was mandatory. However, not all employees had been trained.
[73] FTC officials state that the commission's records management
program is currently conducting an agencywide records inventory that
includes assessing the adequacy of documentation of official actions
(including e-mail records) through a review of file samples. According
to these officials, they expect to implement more comprehensive
oversight and review as this and other activities are completed, which
would include questionnaires, interviews, and selected file reviews.
[74] NARA, "Why Federal Agencies Need to Move Towards Electronic
Recordkeeping," [hyperlink, http://www.archives.gov/records-
mgmt/policy/prod1afn.html].
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548: