Fast Facts

Federal recordkeeping requirements seek to ensure transparency and efficiency in federal agency records, including electronic records.

Most of the 17 agencies we reviewed had records management programs, and many of those included electronic records requirements. Some agencies’ programs hadn’t fully addressed electronic records requirements, e.g., they didn’t ensure that appropriate emails are preserved.

The National Archives and Records Administration hasn’t ensured that smaller agencies at higher risk of improper records management have improvement plans. We recommended doing so and also made recommendations to 15 other agencies.

National archives

National archives

Skip to Highlights
Highlights

What GAO Found

Seventeen agencies GAO selected for review varied in the extent to which their policies and procedures addressed the electronic recordkeeping requirements in the Managing Government Records Directive and the Federal Records Act ( FRA ) and its amendments. More specifically, 14 of the 17 agencies established records management programs, while three agencies did not. Of those 14 agencies with established records management programs, almost all addressed requirements related to incorporating electronic records into their existing programs, but many did not have policies and procedures to fully incorporate recordkeeping functionalities into electronic systems, establish controls and preservation considerations for systems, and issue instructions on email requirements (see table).

Assessment of Selected Agencies' Policies and Procedures Addressing Key Electronic Records Requirements

NARA provided guidance and assistance to the selected agencies, including guidance on electronic records management and training. All of the agencies stated that the assistance was generally helpful and that they relied on it to some extent for implementing the key requirements discussed in this report. Further, NARA oversaw the selected agencies' implementation of federal records management regulations through their self-assessment progam. However, NARA had not ensured that the selected small or micro agencies that self-assessed to be at high risk of improper records management in calendar year 2017 were taking appropriate actions to make improvements to their records management programs. NARA officials stated they conduct follow-up with the agencies that report poor scores, but they do not proactively require the agencies to address their weaknesses. Until NARA requires these agencies to develop plans to make necessary improvements, these agencies will likely miss important opportunities to improve their record management practices.

Why GAO Did This Study

The Federal Records Act , a subsequent directive, and NARA regulations establish requirements for agencies to ensure the transparency, efficiency, and accountability of federal records, including those in electronic form. In addition, NARA plays an important role in overseeing and assisting agencies' records management efforts.

GAO was asked to evaluate federal agencies' implementation of the aforementioned requirements related to electronic records. The objectives were to determine the extent to which (1) selected agencies' policies and procedures address the electronic recordkeeping requirements in the Managing Government Records Directive and the Presidential and FRA Amendments of 2014 and (2) NARA assisted selected agencies in managing their electronic records. To do so, GAO selected 17 agencies and reviewed their records management policies and procedures. GAO also reviewed laws and requirements pertaining to NARA's roles and responsibilities for assisting agencies in managing their electronic records. Further, GAO analyzed NARA guidance and other documents that discussed NARA's efforts in carrying out these responsibilities.

Skip to Recommendations

Recommendations

GAO is making 40 recommendations to 14 of the 17 selected agencies to improve their management of electronic records. GAO is also recommending that NARA (1) require high-risk smaller agencies to create improvement plans and (2) monitor progress on a regular basis. Six agencies, including NARA, agreed with the recommendations, while 11 did not state whether they agreed or disagreed, or had no comments.

Recommendations for Executive Action

Agency Affected Recommendation Status
Office of the Archivist 1. The Archivist of the United States should require small and micro agencies that were determined to be at high risk of not complying with statutory and regulatory records management requirements to develop plans and timelines to address their records management weaknesses (Recommendation 1)
Open
The National Archives and Records Administration concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Archivist 2. The Archivist of the United States should monitor the agencies' progress towards these efforts on a regular basis. (Recommendation 2)
Open
The National Archives and Records Administration concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Armed Forces Retirement Home 3. The Chief Executive Officer of the Armed Forces Retirement Home should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 3)
Open
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Armed Forces Retirement Home 4. The Chief Executive Officer of the Armed Forces Retirement Home establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 4)
Open
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Armed Forces Retirement Home 5. The Chief Executive Officer of the Armed Forces Retirement Home should establish a time frame to update the agency's policies and procedures to include the (1) following records management controls required for electronic information systems: usability, content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 5)
Open
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Armed Forces Retirement Home 6. The Chief Executive Officer of the Armed Forces Retirement Home should ensure existing policies and procedures describe the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 6)
Open
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Secretary 7. The Secretary of Commerce should establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 7)
Closed - Implemented
In response to our recommendation, in May 2021, we reviewed evidence showing Commerce's newly established timeframes to ensure all records schedules are up-to-date and submitted to NARA by December 2022. By establishing a time frame to submit all records schedules to NARA, Commerce decreases the risk of maintaining records that are no longer relevant or needed.
Office of the Secretary 8. The Secretary of Commerce should ensure the electronic system that manages email provides the capabilities to manage permanent and temporary email records and to identify, retrieve, and retain records. (Recommendation 8)
Closed - Implemented
In response to our recommendation, in May 2021, Commerce provided evidence that it now uses an email solution to manage its permanent and temporary email records that meet NARA's requirements. Commerce stated that through the collaboration of the new Records Manager and email operations team, the department will continue to ensure that their email solution meets NARA's requirements of having the capability to identify, retrieve, and retain records. By taking these actions, Commerce is decreasing its risk that its emails are not able to be preserved or accessed when needed.
Consumer Financial Protection Bureau 9. The Director of the Consumer Financial Protection Bureau should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 9)
Open
The Consumer Financial Protection Bureau concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the bureau states that it has taken action, we plan to verify whether implementation has occurred.
Election Assistance Commission 10. The Executive Director of the Election Assistance Commission should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 10)
Open
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
Election Assistance Commission 11. The Executive Director of the Election Assistance Commission should establish a time frame to develop a plan on how the agency intends to manage permanent electronic records. (Recommendation 11)
Open
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
Election Assistance Commission 12. The Executive Director of the Election Assistance Commission should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 12)
Open
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
Election Assistance Commission 13. The Executive Director of the Election Assistance Commission should establish a time frame to update its policies and procedures to include the (1) following records management controls required for electronic information systems: content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 13)
Open
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
Election Assistance Commission 14. The Executive Director of the Election Assistance Commission should develop a written policy that describes the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 14)
Open
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
Federal Trade Commission 15. The Chairman of the Federal Trade Commission should establish a time frame to update the agency's electronic information system inventory to include the following characteristics: reading and processing the records contained in the system, inputs and outputs, contents of the files and records, and cycle updates. (Recommendation 15)
Open
The Federal Trade Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
Marine Mammal Commission 16. The Chairman of the Marine Mammal Commission should use recently developed policies and procedures to implement and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 16)
Open
The Marine Mammal Commission did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
National Aeronautics and Space Administration 17. The Administrator of the National Aeronautics and Space Administration should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 17)
Open
The National Aeronautics and Space Administration concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
National Science Foundation 18. The Director of the National Science Foundation should establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 18)
Open
The National Science Foundation concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.
National Science Foundation 19. The Director of the National Science Foundation should establish a time frame to update the agency's electronic information system inventory to include the following characteristics: technical characteristics of the systems, identify inputs and outputs, and describe update cycles. (Recommendation 19)
Open
The National Science Foundation concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.
National Science Foundation 20. The Director of the National Science Foundation should establish a time frame to update the agency's policies and procedures to include all of the records management controls required for electronic information systems and the required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 20)
Open
The National Science Foundation concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.
National Science Foundation 21. The Director of the National Science Foundation should develop policies and procedures for the required retention and management requirements for email, including instructions to staff to ensure that the names and addresses of the sender, date of message, attachments, calendars, and draft documents will be retained. (Recommendation 21)
Open
The National Science Foundation concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 22. The Director of the Office of Management and Budget should ensure, in conjunction with the Executive Office of the President's Office of Administration, that existing policies and procedures incorporate the management of electronic records into its overall records management program. (Recommendation 22)
Open
The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 23. The Director of the Office of Management and Budget should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 23)
Open
The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 24. The Director of the Office of Management and Budget should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 24)
Open
The Office of Management and Budget concurred with our recommendation. In April 2021, OMB stated that it is taking appropriate steps to implement the recommendation and will update GAO with additional information as it becomes available.
Office of the Director 25. The Director of the Office of Management and Budget should establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 25)
Open
The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 26. The Director of the Office of Management and Budget should ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 26)
Open
The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of National Drug Control Policy 27. The Director of the Office of National Drug Control Policy should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 27)
Open
The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of National Drug Control Policy 28. The Director of the Office of National Drug Control Policy should establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 28)
Open
The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of National Drug Control Policy 29. The Director of the Office of National Drug Control Policy should ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 29)
Open
The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 30. The Director of the Office of Personnel Management should establish a time frame to ensure that all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 30)
Open
In May 2021, OPM stated that that the agency is planning to modify their efforts towards addressing this recommendation and will update GAO on the progress towards closure.
Office of the Director 31. The Director of the Office of Personnel Management should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 31)
Open
The Office of Personnel Management concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 32. The Director of the Office of Personnel Management should establish a time frame to develop a plan to manage permanent electronic records. (Recommendation 32)
Open
In May 2021, OPM stated that that the agency is planning to modify their efforts towards addressing this recommendations and will update GAO on the progress towards closure.
Office of the Director 33. The Director of the Office of Personnel Management should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 33)
Open
The Office of Personnel Management concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Office of the Director 34. The Director of the Office of Personnel Management should establish a time frame to update the agency's policies and procedures on retention and management for email to include retaining electronic calendars and draft documents. (Recommendation 34)
Open
The Office of Personnel Management concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Overseas Private Investment Corporation 35. The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 35)
Open
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Overseas Private Investment Corporation 36. The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to develop policies and procedures that define required electronic information system functionalities for recordkeeping systems including declaring records and assigning unique identifiers, capturing records, maintaining security, and preserving records. (Recommendation 36)
Open
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Overseas Private Investment Corporation 37. The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to update the agency's policies and procedures to include the (1) following records management controls required for electronic information systems: reliability, content, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 37)
Open
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Overseas Private Investment Corporation 38. The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to update the agency's policies and procedures on retention and management for email to include policies for retaining electronic calendars. (Recommendation 38)
Open
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Peace Corps 39. The Director of the Peace Corps should establish a time frame to update the agency's electronic information systems inventory to (1) specify technical characteristics necessary for reading and processing the records contained in the system, (2) identify system inputs and outputs, (3) define the contents of the files and records, (4) determine restrictions on access and use, and (5) specify how the agency ensures the timely disposition of records. (Recommendation 39)
Open
The Peace Corps did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Peace Corps 40. The Director of the Peace Corps should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 40)
Open
The Peace Corps did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Peace Corps 41. The Director of the Peace Corps should establish a time frame to update the agency's policies and procedures to include (1) following records management controls required for electronic information systems: usability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 41)
Open
The Peace Corps did not state whether or not it concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
Morris K. Udall and Stewart L. Udall Foundation 42. The Executive Director of Udall Foundation should establish a time frame to develop and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 42)
Open
The Udall Foundation concurred with this recommendation. As of May 2021, we had not received information pertaining to planned actions for this recommendation. Once the foundation states that it has taken action, we plan to verify whether implementation has occurred.

Full Report

GAO Contacts