Federal Records:

National Archives and Selected Agencies Need to Strengthen E-Mail Management

GAO-08-742: Published: Jun 13, 2008. Publicly Released: Jul 8, 2008.

Additional Materials:

Contact:

Linda D. Koontz
(202) 512-3000
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked, among other things, to review the extent to which NARA provides oversight of federal records management, describe selected agencies' processes for managing e-mail records, and assess these agencies' e-mail policies and key practices. To do so, GAO examined NARA guidance, regulations, and oversight activities, as well as e-mail policies at four agencies (of contrasting sizes and structures) and the practices of selected officials.

Although NARA has responsibilities for oversight of agencies' records and records management programs and practices, including conducting inspections or surveys, performing studies, and reporting results to the Congress and the Office of Management and Budget (OMB), in recent years NARA's oversight activities have been primarily limited to performing studies. NARA has conducted no inspections of agency records management programs since 2000, because it uses inspections only to address cases of the highest risk, and no recent cases have met its criteria. In addition, NARA has not consistently reported details on records management problems or recommended practices that were discovered as a result of its studies. Without more comprehensive evaluations of agency records management, NARA has limited assurance that agencies are appropriately managing the records in their custody and that important records are not lost. The four agencies reviewed generally managed e-mail records through paper-based processes, rather than using electronic recordkeeping. A transition to electronic recordkeeping was under way at one of the four agencies, and two had long-term plans to use electronic recordkeeping. (The fourth agency had no current plans to make such a transition.) Each of the business units that GAO reviewed (one at each agency) maintained "case" files to fulfill its mission and used these for recordkeeping. The practice at the units was to include e-mail printouts in the case files if the e-mail contained information necessary to document the case--that is, record material. These printouts included transmission data and distribution lists, as required. All four agencies had e-mail records management policies that addressed, with a few exceptions, the requirements in NARA's regulations. However, the practices of senior officials at those agencies did not always conform to requirements. Of the 15 senior officials whose practices were reviewed, the e-mail records for 7 (including all 4 at one agency) were managed in compliance with requirements. (One additional official was selected for review but did not use e-mail.) The other 8 officials generally kept e-mail messages, record or nonrecord, in e-mail systems that were not recordkeeping systems. (Among other things, recordkeeping systems allow related records to be categorized according to their business purposes.) If e-mail records are not kept in recordkeeping systems, they may be harder to find and use, as well as being at increased risk of loss from inadvertent or automatic deletion. Factors contributing to noncompliance included insufficient training and oversight as well as the difficulties of managing large volumes of e-mail. Without periodic evaluations of recordkeeping practices or other controls to ensure that staff are trained and carry out their responsibilities, agencies have little assurance that e-mail records are properly identified, stored, and preserved.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: The Secretary of Housing and Urban Development should revise the department's policies to ensure that they appropriately reflect NARA's requirements to ensure that staff is capable of identifying federal records and to state that e-mail systems must not be used to store recordkeeping copies of e-mail records (other than those exceptions provided in the regulation) and that e-mail system backup tapes should not be used for recordkeeping purposes.

    Agency Affected: Department of Housing and Urban Development

    Status: Closed - Implemented

    Comments: Housing and Urban Development (HUD) met this recommendation by posting guidance on email record retention. A HUD official provided a copy of this guidance to us in 2012. The guidance described how staff using e-mail systems should determine whether e-mail is a record, and if so, how to retain that e-mail as a record. Retention steps included creating and properly labeling and storing a hard copy of the e-mail. E-mail system back up tapes were not described as a record retention option.

    Recommendation: The Secretary of Homeland Security should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.

    Agency Affected: Department of Homeland Security

    Status: Closed - Not Implemented

    Comments: In response to this recommendation the DHS Under Secretary for Management issued a memo in September, 2012, requiring all DHS employees to complete records management training, as well as the tracking and reporting of training completion. However this policy does not address how DHS is ensuring that records management policies are effective or properly implemented In addition, the records management policy that is one of the sources for the policy has not been finalized and DHS has not provided evidence that it address the electronic records weaknesses identified in our report.

    Recommendation: The Secretary of Homeland Security should revise the department's policies to ensure that they appropriately reflect NARA's requirement to state that draft documents circulated on e-mail systems are potential federal records.

    Agency Affected: Department of Homeland Security

    Status: Closed - Not Implemented

    Comments: In response to our recommendation, a DHS official stated that DHS was addressing this recommendation by updating a policy (Directive 141-01, Records Management) on employee and contractor responsibilities to include preserving and protecting records regardless of format or media. Subsequently, a DHS official advised of updates to the Directive/instructions to identify e-mail records. However, as of the September 2012, this guidance was still in draft. Therefore this recommendation is closed as not implemented.

    Recommendation: The Chairman of the Federal Trade Commission should revise the commission's policies to ensure that they appropriately reflect NARA's requirement to instruct staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems.

    Agency Affected: Federal Trade Commission

    Status: Closed - Implemented

    Comments: In response to the draft report, the FTC sent a notice to FTC staff about the internal policies and procedures that apply to the management and disposition of electronic mail messages, dated May 28, 2008. According to the notice, non-FTC e-mail accounts are not to be used to conduct FTC business due to privacy, security, and records management reasons. Further, the notice states that in the event that staff send or receive work-related e-mail records from nongovernmental systems, staff must forward such e-mails, including any attachments, to their FTC account and handle the records in accordance with FTC?s e-mail policies and procedures. By taking this action, FTC met this recommendation.

    Recommendation: The Administrator of the Environmental Protection Agency should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.

    Agency Affected: Environmental Protection Agency

    Status: Closed - Implemented

    Comments: EPA addressed this recommendation in two ways by: 1) Issuing on-line agency wide training on basic records management requirements and e-mail record capture in 2009 and 2) Issuing a baseline Records Management Survey in 2010 to assess EPA's records policy, to be used by records officers to assess their records programs. This survey included questions on the nature of records management training which can be used to assess training adequacy. As a result of issuing the agency-wide on-line records management training and the survey, EPA better assured that e-mail records are appropriately identified, stored, and preserved.

    Recommendation: The Administrator of the Environmental Protection Agency should revise the agency's policies to ensure that they appropriately reflect NARA's requirement on instructing staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems.

    Agency Affected: Environmental Protection Agency

    Status: Closed - Not Implemented

    Comments: We recommended in June 2008 that the Administrator of the Environmental Protection Agency (EPA) revise agency policies to ensure that they appropriately reflect NARA requirements on instructing staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems. In response, EPA officials advised that they had revised their records management policy regarding e-mail but that the policy was not officially approved. We asked for evidence of this approval in 2011 and in early and late August, 2012. As of September 2012, EPA had not provided evidence of this approval. Therefore this recommendation is closed as not implemented.

    Recommendation: To better ensure that federal records, including those that originated as e-mail messages, are appropriately identified, retained, and archived, the Archivist of the United States should develop and implement an approach to oversight of agency records management programs that provides adequate assurance that agencies are following NARA guidance, including: (1) developing various types of inspections, surveys, and other means to evaluate the state of agency records and records management programs; (2) developing criteria for using these means of assessment that ensure that they are regularly performed; and (3) regularly report to the Congress and OMB on the findings, recommendations, and agency responses to its oversight activities, as required by law.

    Agency Affected: General Services Administration: National Archives and Records Administration

    Status: Closed - Implemented

    Comments: In June 2008, we reported that federal agencies were increasingly using electronic mail (e-mail) for essential communication, and in doing so, they were potentially creating messages that have the status of federal records which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. Further, according to NARA's regulation on e-mail policy and guidance, it requires agencies to instruct their staff on the management and preservation of e-mail records sent or received from nongovernmental e-mail systems. We found among other things that: 1) NARA no longer performs inspections of agency records management plans; 2) NARA has conducted six records management studies, however issues existed due to limitations in scope; and 3) NARA has not reported on its oversight activities as required by the Federal Records Act. As a result, we recommended that NARA develop and implement an approach to oversight of agency records management programs that provides adequate assurance that agencies are following NARA guidance, including: 1) developing various types of inspections, surveys, and other means to evaluate the state of agency records and records management programs; 2) developing criteria for using these means of assessment that ensure that they are regularly performed; and 3) regularly report to the Congress and OMB on the findings, recommendations, and agency responses to its oversight activities, as required by law. In response to our recommendation, NARA has taken the following actions: 1) approved a plan which includes a methodology for conducting annual records management program self-assessments and agency inspections; 2) included guidance for NARA to conduct annual records management program self-assessments and inspections of all federal agencies beginning in fiscal year 2010; and 3) NARA began reporting to the Congress and the Office of Management and Budget (OMB) on its records management activities in the annual Performance and Accountability Report (PAR) as well as issuing memoranda to notify agencies of expanded agency reporting requirements included in the PAR reported to the Congress and OMB. As a result, NARA has increased assurance that records are adequately managed and that important records are not being lost.

    Recommendation: The Secretary of Housing and Urban Development should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.

    Agency Affected: Department of Housing and Urban Development

    Status: Closed - Implemented

    Comments: HUD met this requirement as follows. In July 2009, HUD advised that it had met this requirement by requiring Records staff to train program staff every quarter, as specified in HUD?s Employee Performance Planning and Evaluation System. HUD provided a document from the system stating this requirement, and a document showing that monthly records management training has been conducted with a set of named staff.

    Dec 5, 2013

    Sep 10, 2013

    Aug 22, 2013

    Jun 20, 2013

    May 9, 2013

    Apr 4, 2013

    Mar 13, 2013

    Feb 27, 2013

    Feb 21, 2013

    Looking for more? Browse all our products here