NARA and Federal Agencies Have Responsibilities for Federal Records Management

Under the Federal Records Act, NARA is given general oversight  responsibilities for records management as well as general responsibilities  for archiving. If e-mail records are retained  in such systems and not in recordkeeping systems, they may be harder to  find and use, as well as being at increased risk of loss from inadvertent or  automatic deletion. However, despite  NARA’s plans, in recent years its oversight activities have been primarily  limited to performing studies. In addition, although NARA’s reporting to the  Congress and OMB has generally described progress in improving records  management at individual agencies and provided an overview of some of  its major records management activities, it has not consistently provided  evaluations of responses by federal agencies to its recommendations, as  required, or details on records management problems or recommended  practices that were discovered as a result of inspections, studies, or  targeted assistance projects. Without a consistent oversight program that  provides it with a governmentwide perspective, NARA has limited  assurance that agencies are appropriately managing the records in their  custody, thus increasing the risk that important records will be lost. According to NARA, it planned to carry out its oversight responsibilities  using inspections, studies, and reporting. Agencies Reviewed Generally Used Paper Processes for E-Mail Records Management, but Three Are Moving Toward Electronic Recordkeeping

The four agencies reviewed—the Department of Homeland Security  (DHS); the Environmental Protection Agency (EPA); the Federal Trade  Commission (FTC); and the Department of Housing and Urban  Development (HUD)—generally preserved e-mail records through paper- based processes, although one agency—EPA—is in the process of  deploying an electronic content management system that is to be used for  managing e-mail messages that are agency records; two others have long- term plans to develop electronic recordkeeping. Each of the business units that we reviewed (one at each agency)  maintained “case” files to fulfill its mission that were used for  recordkeeping. The practice at the units was to include e-mail printouts in  the case files if they contained information necessary to document the  case—that is, record material. These printouts included transmission data  and distribution lists, as required. The e-mail records of two other senior officials were not being managed in  compliance with requirements, because e-mail records were not being  stored in appropriate recordkeeping systems, but rather in the e-mail  system:    One of these officials was in the process of migrating e-mail records from  the e-mail system to ECMS. Factors contributing to the inconsistent practices at the three agencies  include inadequate training and oversight, as well as the difficulties of  managing large volumes of e-mail with the tools and resources available,  which in most cases do not include electronic recordkeeping systems. Unless agencies train staff adequately in records management and perform  periodic evaluations or establish other controls to ensure that staff receive  training and are carrying out their responsibilities, agencies have little  assurance that e-mail records are appropriately identified, stored, and  preserved. Senior officials at three of the four agencies stored e-mail records in e-mail  systems, rather than in recordkeeping systems, which is not in accordance  with NARA’s regulations. Recommendations for Executive Action

To better ensure that federal records, including those that originated as e- mail messages, are appropriately identified, retained, and archived, we  recommend that the Archivist of the United States    develop and implement an approach to oversight of agency records  management programs that provides adequate assurance that agencies  are following NARA guidance, including    developing various types of inspections, surveys, and other means  to evaluate the state of agency records and records management  programs;    developing criteria for using these means of assessment that ensure  that they are regularly performed; and  regularly report to the Congress and OMB on the findings,  recommendations, and agency responses to its oversight activities,  as required by law. GAO staff who made major contributions to this report are listed in  appendix V.

Appendix I: Objectives, Scope, and Methodology

assess to what extent the National Archives and Records  Administration (NARA) provides oversight of federal records  management programs and practices, particularly with regard to e-mail,    describe processes followed by selected federal agencies to manage     assess to what extent the selected agencies’ e-mail records  management policies comply with federal requirements, and    assess compliance of selected senior officials with key e-mail  recordkeeping requirements. 4. 7. 8.
Why GAO Did This Study

Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked, among other things, to review the extent to which NARA provides oversight of federal records management, describe selected agencies' processes for managing e-mail records, and assess these agencies' e-mail policies and key practices. To do so, GAO examined NARA guidance, regulations, and oversight activities, as well as e-mail policies at four agencies (of contrasting sizes and structures) and the practices of selected officials.

What GAO Found

Although NARA has responsibilities for oversight of agencies' records and records management programs and practices, including conducting inspections or surveys, performing studies, and reporting results to the Congress and the Office of Management and Budget (OMB), in recent years NARA's oversight activities have been primarily limited to performing studies. NARA has conducted no inspections of agency records management programs since 2000, because it uses inspections only to address cases of the highest risk, and no recent cases have met its criteria. In addition, NARA has not consistently reported details on records management problems or recommended practices that were discovered as a result of its studies. Without more comprehensive evaluations of agency records management, NARA has limited assurance that agencies are appropriately managing the records in their custody and that important records are not lost. The four agencies reviewed generally managed e-mail records through paper-based processes, rather than using electronic recordkeeping. A transition to electronic recordkeeping was under way at one of the four agencies, and two had long-term plans to use electronic recordkeeping. (The fourth agency had no current plans to make such a transition.) Each of the business units that GAO reviewed (one at each agency) maintained "case" files to fulfill its mission and used these for recordkeeping. The practice at the units was to include e-mail printouts in the case files if the e-mail contained information necessary to document the case--that is, record material. These printouts included transmission data and distribution lists, as required. All four agencies had e-mail records management policies that addressed, with a few exceptions, the requirements in NARA's regulations. However, the practices of senior officials at those agencies did not always conform to requirements. Of the 15 senior officials whose practices were reviewed, the e-mail records for 7 (including all 4 at one agency) were managed in compliance with requirements. (One additional official was selected for review but did not use e-mail.) The other 8 officials generally kept e-mail messages, record or nonrecord, in e-mail systems that were not recordkeeping systems. (Among other things, recordkeeping systems allow related records to be categorized according to their business purposes.) If e-mail records are not kept in recordkeeping systems, they may be harder to find and use, as well as being at increased risk of loss from inadvertent or automatic deletion. Factors contributing to noncompliance included insufficient training and oversight as well as the difficulties of managing large volumes of e-mail. Without periodic evaluations of recordkeeping practices or other controls to ensure that staff are trained and carry out their responsibilities, agencies have little assurance that e-mail records are properly identified, stored, and preserved.