# [Appendix A]{.smallcaps} INSPECTOR GENERAL'S ASSESSMENT OF MANAGEMENT CHALLENGES FACING NARA {#appendix-a-inspector-generals-assessment-of-management-challenges-facing-nara .AR-Part-Title}

Under the authority of the Inspector General Act, the NARA OIG conducts
and super­vises independent audits, investigations, and other reviews to
promote economy, efficiency, and effectiveness and prevent and detect
fraud, waste, and mismanagement. To fulfill that mission and help NARA
achieve its strategic goals, we have aligned our programs to focus on
areas that we believe represent the agency's most significant
challenges. We have identified those areas as NARA's top 10 management
challenges. Under these are the related audits, investigations, and
reviews that were performed in FY 2005.

1.  **Electronic Records Archives (ERA)**

NARA and the Lockheed-Martin Corporation, is building an Electronic
Records Archives (ERA) with the goal of ensuring the preservation of,
and access to, Government electronic records. The pace of technological
progress makes formats in which the records are stored obsolete within a
few years, threatening to make them inaccessible even if they are
preserved intact.

ERA is to be a comprehensive, systematic, and dynamic means of
preserving virtually any kind of electronic record, free from dependence
on any specific hardware or soft­ware. The ERA system is targeted to make
it possible for Federal agencies to transfer any type or format of
electronic record to the National Archives so that citizens can locate
records of interest and the National Archives can deliver these
materials in a usable format.

NARA's challenge is to build a system that will accommodate past,
present, and future formats of electronic records. To mitigate the risks
associated with development and acqui­sition of an advanced electronic
archival system, Congress directed NARA to re­assess the ERA project
schedule based on estimates of the amount of work and re­sources required
to complete each task. Beginning on October 1, 2002, NARA was required
to submit to Congress a quarterly report on the status of the project's
schedule, budget, and expenditures as measured against a reported
baseline; a prioritization of project risks and their mitigation
efforts; and corrective actions taken to manage identi­fied schedule
slip­page, cost overruns, or quality problems that might occur. By
Septem­ber 2007, NARA plans to have initial operating capability for ERA
with incre­mental improve­ments that will eventually result in full system
capability. The challenge will be to deliver and main­tain a functional
ERA system that will preserve electronic records for as long as needed.

**2. Electronic Records Management (ERM)**

NARA directs one of 24 Government-wide initiatives, the Electronic
Records Manage­ment (ERM) initiative. The ERM initiative will provide
guidance to agencies in managing and transferring to NARA, in an
increasing variety of data types and formats, their permanent electronic
records. For many years, Federal records were created on paper and
stored in files and boxes with NARA. Now, electronic records are created
by Gov­ern­ment agencies at an astounding rate, challenging NARA to find
ways to manage and preserve them. NARA is a key player in e-Government
and managing partner for the e-Government ERM initiative. E-Government
is part of President Bush's management agenda aimed at making it easier
for citizens to obtain high-quality service from the Federal Government
while reducing the cost of delivering those services. NARA enlisted
partner agencies, developed a detailed plan for accom­plishing its
objectives, and issued the first guidance on transferring e-mail records
to NARA.

NARA and its Government partners are challenged with trying to figure
out how to manage electronic records in an electronic manner, to make
ERM and e-Government work more effectively.

**3. Improving Records Management**

NARA's mission is to ensure that Federal officials and the American
public have ready access to essential evidence. One way NARA addresses
its mission is by assisting agencies with the management of their
records from the time that those records are created. Without effective
records management, records needed to document citizens' rights, actions
for which Federal officials are responsible, and the historical
experience of our nation will be at risk of loss, deterioration, or
destruction. According to NARA's Strategic Plan, to minimize these
risks, NARA will work in active partnership with the Administration,
Federal officials, the Congress, and Federal courts to help them create,
identify, appropriately schedule, and manage record material. This will
enable the Govern­ment to preserve records as long as they are needed to
protect rights, ensure accountability, document the national experience,
and to destroy records as soon as it is practical to do so when they are
no longer needed.

NARA must work with Federal agencies to make scheduling, appraisal, and
accessioning processes more effective and timely. The challenge is how
best to accomplish this com­ponent of our overall mission and identify
and react to agencies with critical records management needs.

***4.* Information Technology Security**

The authenticity and reliability of our electronic records and
information technology systems are only as good as our IT security
infrastructure. Each year, the risks and challenges to IT security
continue to evolve. NARA must ensure the security of its data and
systems or risk undermining the agency's credibility and ability to
carry out its mission.

IT security becomes even more critical as NARA increases its visibility
through the implementation of e-Government initiatives that expand
online services to the public. The more NARA increases electronic access
to its services and records, the more vulnerable the agency is to
intrusions, viruses, privacy violations, fraud, and other abuses of its
systems. The risk related to IT security is endemic to all Federal
agencies and has been identified by the GAO as one of its top 10
high-risk challenges.

+-----------------------------------------------------------------------+
| > *Audits, investigations, and reviews performed in FY 2005:*         |
+-----------------------------------------------------------------------+
| -   Audit of NARA's Intrusion Detection System                        |
+-----------------------------------------------------------------------+
| -   Review of NARA's Information Technology Investment Management     |
|     Decide Process Accomplished for the Novell Software Upgrade       |
|     Project                                                           |
+-----------------------------------------------------------------------+
| -   NARA's Investment Management Decide Process                       |
+-----------------------------------------------------------------------+
| -   Review of Proposed Modification of the Information Technology     |
|     Support Services Task Order Security Program Requirements         |
+-----------------------------------------------------------------------+
| -   Server Vulnerability                                              |
+-----------------------------------------------------------------------+
| -   Review of the Management and Operations of NARA's Help Desk       |
+-----------------------------------------------------------------------+
| -   Review of NARA's Acquisition of Storage Management Software       |
+-----------------------------------------------------------------------+

**5. Expanding Public Access to Records**

In a democracy, the records of its archives belong to its citizens.
NARA's challenge is to more aggressively inform and educate our
customers about the services we offer and the essential evidence to
which we can provide access. NARA envisions expanding oppor­tunities for
individual citizens, educational institutions, and Federal agencies to
make use of those records. New technologies are making it easier to
reach all users in their homes, schools, and workplaces. NARA must
increase partnerships with Government agencies at all levels and with
universities and corporate communities to take advantage of new means to
bring the holdings of the National Archives to people no matter where
they are located.

Mastering this challenge requires that NARA listen to its customers and
improves access to records in ways that meet customer needs and customer
service standards. This will require NARA to enhance activities such as
creating comprehensive catalogs and indexes for our holdings so that
users can find the records they need; make documentary mate­rial
available through the Internet; improve reference service; and help
Presidents at the beginning of their administrations plan for public
access to their records in Presidential libraries.

+-----------------------------------------------------------------------+
| > *Audits, investigations, and reviews performed in FY 2005:*         |
+-----------------------------------------------------------------------+
| -   Evaluation of NARA's Processes for Handling Personal Information  |
|     Collected from the Public                                         |
+-----------------------------------------------------------------------+

**6. Meeting Storage Needs of Growing Quantities of Records**

NARA-promulgated regulation, 33CFR, Part 1228, "Disposition of Federal
Records," Subpart K, "Facility Standards for Records Storage
Facilities," requires all facilities that house Federal records to meet
defined physical and environmental requirements by FY 2009.

Specifically, in January 2000, NARA revised the regulations for public
and private facilities that store Federal records to (1) improve the
environment and safeguards for Federal records by incorporating stricter
facility standards and advances in sprinkler technology, (2) reflect
building design measures that may prevent or minimize fire and water
damage to records, and (3) ensure uniform facility standards for all
records cen­ters, both public and private, that store and protect Federal
records. NARA's chal­lenge is to ensure compliance with these regulations
internally as well as by other agencies that house Federal records.

**7. Preservation Needs of Records**

The Archivist has identified preservation as a material weakness under
the FMFIA reporting process. NARA cannot provide public access to
records to support researchers' needs unless it can preserve them for as
long as needed. Providing public access to records for future
gener­a­tions requires that NARA assess the preservation needs of the
records, provide storage that retards deterioration and treat or
duplicate and reformat records at high risk for deterioration. NARA must
preserve paper records and motion pictures, audio record­ings,
videotapes, still photography, aerial photography, microfilm and other
microforms, and maps and charts in a variety of formats in our holdings.
NARA must ensure that its risk management program adequately identifies
and addresses all records needing preservation in a timely manner.

NARA holdings grow older daily and are deteriorating. NARA is challenged
to address the following questions: Are we effectively identifying those
holdings that are both most at risk and most important in terms of
priority? Who makes this determination, upon what criteria is it based,
and is it being soundly and properly applied? Are resources and the
technology available and sufficient to meet the preservation needs of
these records?

+-----------------------------------------------------------------------+
| > *Audits, investigations, and reviews performed in FY 2005:*         |
+-----------------------------------------------------------------------+
| -   Evaluation of NARA's Preservation Program                         |
+-----------------------------------------------------------------------+

**8. Improving Financial Management**

By inclusion under the Accountability of Tax Dollars Act of 2002, NARA
is required to prepare audited financial statements in compliance with
prescribed standards, subject to independent audit.

The Federal Government has a stewardship obligation to prevent fraud,
waste, and abuse; to use tax dollars appropriately; and to ensure
financial accountability to the President, the Congress, and the
American people. Timely, accurate, and useful financial information is
essential for making day-to-day operating decisions; managing the
Gov­ernment's operations more efficiently, effectively, and economically;
meeting the goals of the Federal financial management reform legislation
(Chief Financial Officers Act); supporting results-oriented management
approaches; and ensuring accountability on an ongoing basis.

In identifying improved financial performance as one of its five
Government-wide initiatives, the President's Management Agenda (PMA)
stated that a clean financial audit is a basic prescription for any
well-managed organization and recognized that "most federal agencies
that obtain clean audits only do so after making extraordinary,
labor-intensive assaults on financial records." Further, the PMA stated
that without sound internal controls and accurate and timely financial
information, it is not possible to ac­com­plish the President's agenda to
secure the best performance and highest measure of accountability for
the American people.

+-----------------------------------------------------------------------+
| > *Audits, investigations, and reviews performed in FY 2005:*         |
+-----------------------------------------------------------------------+
| -   Audit of the National Archives Records Center Revolving Fund FY   |
|     2003 Financial Statements                                         |
+-----------------------------------------------------------------------+
| -   Audit of the National Archives Trust Fund FY 2003 Financial       |
|     Statements                                                        |
+-----------------------------------------------------------------------+
| -   Audit of the National Archives Gift Fund FY 2003 Financial        |
|     Statements                                                        |
+-----------------------------------------------------------------------+
| -   Evaluation of NARA's FY 2004 Management Control Program           |
+-----------------------------------------------------------------------+
| -   Audit of the National Archives and Records Administration         |
|     Consolidated Financial Statements FY 2004                         |
+-----------------------------------------------------------------------+
| -   Audit of the Travel Card Program                                  |
+-----------------------------------------------------------------------+
| -   Prompt Payment Audit                                              |
+-----------------------------------------------------------------------+
| -   Review of NHPRC Grants                                            |
+-----------------------------------------------------------------------+
| -   Audit of the National Archives Trust Representational Fund        |
+-----------------------------------------------------------------------+

**9. Physical Security**

NARA must maintain adequate levels of physical security over our
facilities and hold­ings to ensure the safety and integrity of persons
and holdings within our facilities. This is especially critical in light
of the new realities that face this nation, post--September 11, and the
risks that our holdings may be pilfered by persons for a variety of
motivations, defaced, or destroyed by fire or other natural disasters.

The Archivist has identified security of collections as a material
weakness under the Financial Manager's Financial Integrity Act (FMFIA)
reporting process. Our facilities hold records that serve to document
the rights of citizens, the actions of Government officials, and the
national experience. They also hold a new class of records identified as
"Records of Concern" (ROC). These are records that could be useful to
individuals or entities in the planning and conduct of hostile acts
against this nation.

Three primary challenges facing NARA are to (1) provide quality service
to our custo­mers while instituting reasonable internal controls to
prevent theft and to maintain documentation for supporting recovery of
disenfranchised holdings and subsequent prosecution of those who would
steal from NARA; (2) take every reasonable, appropriate measure possible
to limit access to ROC and act expeditiously in coordinating efforts
with appropriate law enforcement entities as warranted and appropriate;
and (3) protect and safeguard our facilities and the employees who work
in them and to mitigate the potential for damage and destruction through
both natural and deliberately precipitated acts.

+-----------------------------------------------------------------------+
| > *Audits, investigations, and reviews performed in FY 2005:*         |
+-----------------------------------------------------------------------+
| -   NARA's Ability to Inspect Employee's Personal Property            |
+-----------------------------------------------------------------------+

> **10. Strengthening Human Capital**

The GAO has identified human capital as a Government-wide high risk.
Strategic human capital management should be the centerpiece of any
serious change management initia­tive or any effort to transform the
cultures of Government agencies. Serious human capital shortfalls,
however, continue to erode the ability of many agencies, and threaten
the ability of others, to economically, efficiently, and effectively
perform their missions. According to GAO, the major problem is the lack
of a consistent strategic approach to marshaling, managing, and
maintaining the human capital needed to maximize Govern­ment performance
and ensure its accountability. People are an agency's most important
organizational asset. An organization's people define its character,
affect its capacity to perform, and represent the knowledge base of the
organization. Agencies can improve their performance by the way that
they treat and manage their people and building commitment and
accountability through involving and empowering employees.

NARA's challenge is to adequately assess its human capital needs in
order to effectively recruit, retain, and train people with the
technological understanding and content knowledge that NARA needs for
future success. According to NARA's Strategic Plan, NARA must include
preparation for training the leaders of tomorrow in its plans. Further,
NARA must help those current staff members possessing traditional
archival training to add skills necessary for working with new
technologies. In addition, NARA must replace valuable staff members lost
to retirement with others able to deal with records in the electronic
information age. Moreover, NARA must partner with univer­sities and
professional associations to determine educational requirements for the
21st century.

# ![](media/image1.wmf){width="0.8in" height="0.8in"}[Appendix B]{.smallcaps} FEDERAL MANAGERS' FINANCIAL INTEGRITY ACT REPORT {#appendix-b-federal-managers-financial-integrity-act-report .AR-Part-Title}

[Appendix C\
]{.smallcaps}**PROGRESS ON 2004 AUDIT RECOMMENDATIONS**

## The NARA Inspector General (OIG) contracted with Clifton Gunderson, LLP (CG) to audit financial statements as well as internal controls and operations. CG performed an audit of the consolidated financial statements of the National Archives and Records Administration as of September 30, 2004. In its final report dated November 1, 2004, CG reported certain matters involving the internal control and its operation that were considered to be reportable conditions, four of these were considered to be material weaknesses. CG made 39 recommendations to correct these conditions. (The 2004 Internal Auditor's Report may be found on page 97 of NARA's 2004 Performance and Accountability Report.) {#the-nara-inspector-general-oig-contracted-with-clifton-gunderson-llp-cg-to-audit-financial-statements-as-well-as-internal-controls-and-operations.-cg-performed-an-audit-of-the-consolidated-financial-statements-of-the-national-archives-and-records-administration-as-of-september-30-2004.-in-its-final-report-dated-november-1-2004-cg-reported-certain-matters-involving-the-internal-control-and-its-operation-that-were-considered-to-be-reportable-conditions-four-of-these-were-considered-to-be-material-weaknesses.-cg-made-39-recommendations-to-correct-these-conditions.-the-2004-internal-auditors-report-may-be-found-on-page-97-of-naras-2004-performance-and-accountability-report. .AR-2004-Head-2}

## Area 1: Financial Reporting {#area-1-financial-reporting .AR-2004-Head-2}

CG noted this area a material weakness and made six recommendations
related to financial statement preparation; timely recording,
reconciliation, and analysis; general ledger system setup and posting
model definitions; and integrated financial management system. They are:

1.  Ensure that adequate controls such as protecting cells on
    spreadsheets, limiting access to spreadsheets to prevent inadvertent
    changes, and control of the changes made to the spreadsheets are
    implemented while a spreadsheet-based system is used in gathering
    and analyzing financial statements data.

2.  Establish written policies and procedures to formalize plans,
    methods, and procedures to guide the financial statement preparation
    and reporting process.

3.  Prepare and analyze monthly reconciliations of subsidiary and
    summary account balances and external reports. Consider a "formal
    closing" of all accounts at an interim date(s), which will reduce
    the level of accounting activity and analysis required at year-end.
    This "formal closing" entails ensuring that all transactions are
    recorded in the proper period through the month-end.

4.  Ensure that upgrades to the financial management systems comply with
    the posting model definitions in the U.S. Standard General Ledger
    (USSGL).

5.  Develop standard procedures to identify Federal and non-Federal
    transactions if the general ledger (GL) system does not have this
    capability. Also, correcting the vendor files may enable NARA to
    automate this process. Lastly, if NARA continues to per­form the
    identification manually, an audit trail needs to be maintained and a
    supervisory review will need to be performed.

6.  Evaluate the functional requirements to integrate the financial
    reporting, billing systems, property and equipment, and a cost
    system with the GL system and assess the degree of integration
    necessary to have a single, unified financial system.

Through September 30, 2005, NARA has provided documentation to the OIG
and CG to satisfy numbers 1 through 5 above.

## Area 2: Property, Plant, and Equipment (PPE) {#area-2-property-plant-and-equipment-ppe .AR-2004-Head-2}

CG noted this area a material weakness and made six recommendations
related to accounting for PPE and deferred maintenance. They are:

7.  Continue to identify assets that need to be capitalized rather than
    expensed.

8.  Develop standard report formats for all project mangers of software
    development projects and construction projects that track monthly
    payments, monitor progress, and report completion.

9.  Ensure adequate supporting documentation is maintained for
    acquisitions and dispositions.

10. Develop and implement monthly reconciliation procedures for all
    assets including heritage assets.

11. Record all assets in the property management system.

Through September 30, 2005, NARA has provided documentation to the OIG
and CG to satisfy all of the above.

## Area 3: Investment in Non-Federal Securities {#area-3-investment-in-non-federal-securities .AR-2004-Head-2}

CG noted this area a material weakness and made two recommendations.
They are:

12. Record investments that are held to maturity at amortized costs and
    investments that are for sale at fair market value.

13. Record the budgetary entry related to the purchase of investments in
    non-Federal securities.

Through September 30, 2005, NARA has provided documentation to the OIG
and CG to satisfy number 12 above.

## Area 4: Information Technology (IT)  {#area-4-information-technology-it .AR-2004-Head-2}

CG noted this area a material weakness and made 21 recommendations
related to software development and change controls, entity-wide
security program, controls to protect its information; and contingency
planning. They are:

14. Implement controls to ensure that the "Project/Task Validation and
    Approval" is completed for modifications and maintenance changes
    according to the NARA-Wide Configuration Management Template.

15. Obtain proper approvals before moving NARANET into the production
    environment.

16. Follow required NARANET rollout processes and procedures prior to
    movement to production.

17. Conduct certification evaluations on all IT resources owned or
    operated on behalf of NARA, in accordance with NARA policy,
    including externally hosted applications.

18. Formally define, communicate, and document data ownership
    responsibilities and procedures for all major business and general
    support systems, including its financial data hosted at the service
    provider.

19. Revise Plan of Actions and Milestones (POA&M) process to comply with
    OMB guidance, including the incorporation of all IT findings from
    all sources.

20. Develop inter-connection security agreements with all external
    vendors (including Federal agencies) hosting financial systems used
    by NARA.

21. Review password configurations on all servers used for network
    authentication and ensure that temporary passwords cannot be used
    more than once, and only issue unique temporary passwords to users.
    Ensure that NARA has imple­men­ted specifications for password usage
    established by NIST in Federal Information Processing Standards
    Publication 112, *Password Usage.*

22. Review all NARANET user accounts to identify all inactive or unused
    accounts and remove as necessary. This procedure should also be
    incorporated within the user recertification process. Also, all
    NARANET user accounts should be supported by documented approved
    access requests.

23. Enforce Directive 804, and ensure that users are recertified. In
    addition, NARA should comply with its standard operating procedures
    and ensure that NARA­NET user accounts are disabled after 24 hours of
    the user's separation and are deleted after 10 days of the
    disabling.

24. Use network address translation (NAT) to hide all internal IP
    addresses and to filter traffic entering NARA's internal network for
    improved security. Written justifications should be provided for the
    exclusion of those machines from the requirement of NAT. Ensure all
    internal IP addresses pass through internal DNS servers.

25. Update the NARA network topology to include all external connections
    and network devices. Ensure that all access points are securely
    configured to prevent unauthorized network access.

26. Install cameras outside of the computer room to monitor access to
    and from all entry points. Security guards should investigate all
    unusual access activity. The use of a key to override badge reader
    access should result in alarms at the guard station and be
    immediately investigated.

27. Review all individuals with access to the computer room, determine
    if access in needed to perform their job responsibilities, and
    remove any unnecessary access. Also, management should develop
    policies and procedures to recertify access granted.

28. Establish and enforce policies and procedures regarding server
    configuration, operation, and maintenance. Develop and compare
    server baseline config­u­ra­tions (for each operating system platform).
    These policies and procedures allow administrators to have a strict
    set of requirements to follow in place no matter who administers the
    servers. NARA Internet--connected server's systems logs should be
    reviewed to determine if unauthorized access has occurred as a
    result of the weaknesses in the server configurations.

29. On a regular basis, as part of the user recertification process,
    management should review all Comprehensive Human Resources
    Information System (CHRIS) users to ensure that they still require
    access to CHRIS, their permissions are reasonable based upon their
    position responsibilities, and poten­tially conflicting roles within
    other applications (i.e., ETAMS) are removed.

30. Formally identify and prioritize all critical data and operations on
    its major applications and the resources needed to recover them if
    there is a major interruption or disaster. Ensure that emergency
    processing priorities are established to assist in managing disaster
    situations more effectively for the network. In addition, establish
    emergency processing priorities that will help manage disaster
    situations more effectively for the network.

31. Address the disaster recovery plan at other NARA locations.

32. Conduct regular disaster recovery testing of all major applications
    and general support systems (including interconnectivity with
    external service providers) that consider varying scenario types.
    Develop a *lessons learned* document from each test with corrective
    actions to prevent a reoccurrence in future tests.

33. The memorandum of understanding (MOU) should be revised to
    incorporate measures to be taken by NARA and the service provider
    \[Pegasys\] to recover any lost connectivity between the two
    entities.

34. Replace the "wet pipe" sprinkler system with a "dry pipe" sprinkler
    or single-interlock pre-action sprinkler system that does not store
    liquids directly above computer equipment.

Through September 30, 2005, NARA has provided documentation to the OIG
and CG to satisfy numbers 14 through 20, 22 through 25, 27, 29, and 30
through 34 above. Partial documentation has also been provided for
recommendations 26 and 30.

## Area 5: Payroll {#area-5-payroll .AR-2004-Head-2}

CG noted this area a reportable condition and made four recommendations.
They are:

35. Performing a monthly reconciliation of leave balances reported in
    the time and attendance (T&A) report and the leave and earnings
    statement (LES).

36. Enforce the policy of signing and dating the Supervisor Time and
    Attendance Certification Report.

37. Record credit time earned on Electronic Time and Attendance
    Management System (ETAMS).

38. Enforce the policy of signing or initialing of the time and
    attendance log by the employee and the supervisor.

Through September 30, 2005, NARA has provided documentation to the OIG
and CG to satisfy numbers 35 through 38 above.

## Area 6: Cost Allocation Methodology {#area-6-cost-allocation-methodology .AR-2004-Head-2}

CG noted this area a reportable condition and made one recommendation.
It is:

39. Establish a formal and comprehensive cost-allocation methodology and
    ensure that related policies and procedures such as the
    semiautomated allocation pro­cess policy are updated.

Through September 30, 2005, NARA has provided documentation to the OIG
and CG to satisfy this recommendation.