SEC’s Records Management 

Practices 

September 30, 2012

 Report No. 505 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page ii
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page iii

SEC’s Records Management Practices 

Executive Summary

Background. SEC’s records include confidential treatment requests files, 

correspondence, investigation records, matters under inquiry records, transcripts, 

working papers, consumer complaint files, Congressional and Chairman files, 

administrative proceedings files, self-regulatory files, bankruptcy files, effective 

orders, etc. 

On November 28, 2011, a presidential memorandum was issued on managing 

government records. This memorandum emphasized the importance of having 

well-managed records management program that includes reducing redundant 

efforts, minimizing costs and sharing institutional knowledge within and across 

organizations. Further, the memorandum states that “proper records 

management is the backbone of open Government.”1

The Office of Records Management Services (ORMS) is responsible for 

coordinating, overseeing and implementing the U.S. Securities and Exchange 

Commission’s (SEC or Commission) records management program at its 

Headquarters, Operations Center, and 11 Regional Office locations.2 ORMS and 

the Office of Security Services (OSS) are direct reporting units to the Office of 

Support Operations (OSO). OSS has oversight of the SEC’s vital records 

program. 

ORMS oversees the SEC’s overall records management program through pointsof-contacts (POC) in most offices and divisions. The POCs provide oversight of 

their individual records management program and practices.3 ORMS’

responsibilities include “providing reference services for Commission staffers, 

other Federal, state and local entities and members of the public that are 

essential in assisting the SEC in achieving its mission.”4 Additionally, the office 

“coordinates with the Commission’s Office of Investor Education and Advocacy 

and Public Reference Room for records reference requests from the public.”5

 

Further, ORMS assists the Office of Freedom of Information Act (FOIA) Services, 

in responding to requests for nonpublic records under FOIA. SEC staff can find 

answers to questions on “How to Request Records” and “Frequently Asked 

Questions About Records” on the SEC Intranet. 

 

1

 Presidential Memorandum – Managing Government Records, (Nov. 28, 2011), p.1.

2

SEC’s headquarters and regional offices are comprised of 36 offices and divisions that are headed by 

Directors. SEC also has the Chairman’s office and 4 Commissioners’ offices.

3

 POCs are mainly comprised of administrative officers and business managers. Other serving in this role 

include assistant directors and personnel with various other titles. 

4

 ORMS, Standard Operating Policy 2.1, Requestors, p.1. 

5

Id. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page iv

Objectives. The objectives of our audit were to examine whether ORMS: 

 established a viable records management program that ensures 

permanent SEC records are appropriately maintained and 

preserved in accordance with applicable Federal statutes and 

regulations; and 

 adhered to applicable Federal statutes and regulations regarding 

the retention, disposal, transfer, and recovery of SEC records. 

Where appropriate OIG identified best practices. 

Results. The SEC does not have an active staff assistance program and 

periodic agency-wide staff assistance visits were not conducted by ORMS or its 

predecessors. Although ORMS provided assistance to SEC offices and divisions 

to identify their records and has scheduled records for disposition, it has not 

conducted staff assistance visits of all 36 SEC offices and divisions. Therefore, 

confusion exists among POCs regarding their records management 

responsibilities. 

In addition, our audit revealed that although ORMS readily answered agency 

staff questions about records matters, provided basic records management 

training during SEC’s new employee orientation, and provided training to staff in 

the Regional Offices, the office did not provide records management training to 

staff agency-wide. OIG determined that this has caused confusion among 

employees. 

Our review of a sample number of records requests found that some staff in 

ORMS did not follow the office’s standard operating policy in processing requests 

and several requests were not completed in ORMS’ goal of seven business days 

goal for non-urgent records requests. 

We also identified offices that did not have records retention schedules and other 

offices whose records retention schedules were outdated. Additionally, we found 

offices ORMS had not met with to determine if they had records. 

OIG determined that many offices and divisions do not have proper records 

management procedures and ensure that active records are properly and 

economically maintained, and used on a regular basis. Further, we found that 

inactive records are not regularly disposed. 

Several POCs informed OIG they do not know when their records should be 

disposed of and they do not dispose of records annually. Additionally, until 

recently, ORMS had not reviewed the contents of 256 boxes their contractor 

identified in a report that was issued to ORMS in November 2010. ORMS 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page v

informed OIG that it has now reviewed 98 of the boxes and they are coordinating 

with the Federal Records Center (FRC) to review the remaining boxes. 

Our audit also found that ORMS has not performed a timely review of

Commission records that are eligible for destruction. Thus, a backlog exists that 

represents approximately 10 years of records that are eligible for destruction, but 

have not been destroyed. Although ORMS maintains hard copies of disposal 

forms the FRC provides for their review, approval, and destruction for records, 

the office does not maintain a list of the Commission records the FRC has 

identified as eligible for destruction. 

Further, we determined that some offices and divisions do not have records 

management POCs. We also found that SEC’s records management directives 

do not require offices or divisions to have records management POCs. As a 

result, some SEC employees do not understand their records management 

responsibilities. Also, the Federal regulations and SEC policies covering records 

management are not being followed properly. 

OSS has oversight of the SEC’s vital records program and is working with ORMS 

to evaluate the program. Thus, OSS has not defined the SEC’s vital records and 

did not review or update the agency’s vital records at least annually. As a result, 

SEC’s listing of vital records is incomplete and outdated. Further, the SEC has 

not definitively established how it will protect and retrieve vital records in an 

emergency situation. Due to changes in responsibilities for vital records 

management, confusion exists regarding the SEC’s compliance with the National 

Archives and Records Administration’s (NARA) guidance on vital records. 

Consequently, the SEC did not comply with certain vital records management 

regulations. 

Lastly, our audit found that the SEC’s records management administrative 

regulations and vital records handbook are outdated. The administrative 

regulations contain terminology, processes and forms that are no longer current 

and the Vital Records Handbook includes a form the SEC has never used. 

Summary of Recommendations. This report contains 12 recommendations to 

aid in ensuring SEC’s records are properly managed and to strengthen the 

SEC’s records management program. Based on the results of our audit, we 

recommended that ORMS periodically conduct agency-wide staff assistance 

visits of the SEC’s records management programs in accordance with SECR 7-1, 

Securities and Exchange Commission’s Records Management Program. ORMS 

should also develop a records management training program and offer training 

sessions on records management to all SEC employees. We also recommended

that ORMS develop more robust internal controls to provide oversight to its 

employees in processing records requests. Further, we recommended that 

ORMS work with offices and divisions agency-wide to ensure they have current 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page vi

and complete records retention schedules. ORMS should also establish records 

management procedures that enable SEC offices and divisions to properly 

manage their records in accordance with applicable Federal regulations and the 

SEC’s administrative regulations. 

Additionally, ORMS should develop a definitive plan and milestones to review the 

backlog of records that are maintained at the FRC and determine how the 

records will be treated. We also recommended that ORMS develop an action 

plan to address the 10-year backlog of records the FRC has identified as being 

eligible for destruction. ORMS should also require all offices and divisions to 

designate a POC for records management matters, then periodically verify the 

listing. We further recommended that OSS, in coordination with ORMS, develop 

a vital records program that includes processes and procedures, and establish 

and maintain the SEC’s vital records in accordance with applicable Federal 

regulations and NARA’s guidance on vital records management. 

We also recommended ORMS update its administrative regulations covering 

records management and train SEC employees on the new regulations. Lastly, 

OSS and ORMS should coordinate reviewing SEC’s Vital Records Handbook

and determine if it will be revised or rescinded. 

Management’s Response to the Report’s Recommendations. OIG provided 

OSO with the formal draft report on September 21, 2012. OSO concurred with 

all 12 of the report’s recommendations. OIG considers the report’s 

recommendations resolved. However, each recommendation will remain open 

until documentation is provided to us that supports the recommendation has 

been fully implemented. 

OSO’s responses to each recommendation and OIG’s analysis of the responses 

are presented after each recommendation in the body of this report. OIG’s 

response to OSO’s overall comments to the report is included in Appendix VIII. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page vii

TABLE OF CONTENTS 

Executive Summary....................................................................................................iii 

.... vii 

..... 1 

..... 1 

..... 4 

..... 5 

.....5 

.....7 

.....7 

..... 9 

..... 9 

... 12 

... 13 

... 15 

... 16 

.

.

.

.. 18 

.. 18 

..19

...19

... 20 

... 21 

... 23 

Table of Contents ..................................................................................................

Background and Objectives .............................................................................

Background ..................................................................................................

Objectives .....................................................................................................

Findings and Recommendations ....................................................................

Finding 1: Agency-Wide Staff Assistance Visits of SEC Records 

Management Programs Were Not Periodically Conducted ...........................

Recommendation 1..................................................................

Finding 2: Records Management Training Was Not Provided to All SEC 

Staff on Their Responsibilities.......................................................................

Recommendation 2..................................................................

Finding 3: Some Records Requests Processing Did Not Align with ORMS’

Established Business Goals and Records Requests Were Not Completed 

in Accordance with the SOP..........................................................................

Recommendation 3..................................................................

Finding 4: Some SEC Offices or Divisions Do Not Have Records 

Retention Schedules and Others Should Be Updated ..................................

Recommendation 4..................................................................

Finding 5: Some SEC Offices and Divisions Did Not Review Their Records 

Retention Schedules and Dispose of Records in Accordance with Their 

Schedules .....................................................................................................

Recommendation 5..................................................................

..................................................................

..................................................................

Recommendation 6

Recommendation 7

Finding 6: The Backlog of Records Being Maintained at FRC Were Not 

Reviewed ......................................................................................................

Recommendation 8..................................................................

Finding 7: Records Management Points-of-Contact Have Not Been 

Identified for All SEC Offices and Divisions...................................................

Recommendation 9..................................................................
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page viii

Finding 8: SEC’s Vital Records Management Program Needs 

Improvement .................................................................................................... 23 

Recommendation 10..........................................................

..........................................................

......... 28 

Recommendation 11 ......... 28 

Finding 9: SEC’s Records Management Administrative Regulations, 

Retention Schedule, and Handbook Are Outdated .........................................29

Recommendation 12......................................................... ......... . 31 

Appendices 

Appendix I: Federal Agencies Records Management Responsibilities. ........... 32 

Appendix II: Abbreviations................................................................................ 35 

Appendix III: Scope and Methodology.............................................................. 36 

Appendix IV: Criteria ........................................................................................39

Appendix V: List of Recommendations ............................................................ 41 

Appendix VI: Definitions .................................................................................. 44 

Appendix VII: Management Comments............................................................ 46 

Appendix VIII: OIG’s Response to Management’s Comments ......................... 50 

Tables 

Table 1: ORMS Approved Action Codes for Records Requests. ..................... 11

Table 2: Survey Results of SEC Offices and Divisions Vital Records 

Listings............................................................................................................. 24 

Table 3: Survey Results of SEC Offices and Divisions Vital Records 

Listings as Compared to the Vital Records in 2010 COOP Plan and the 

Draft 2011 Listing. ............................................................................................ 26 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 1 

Background and Objectives

Background 

Agency records management programs must have effective controls over the 

creation, maintenance, and use of records in the conduct of current business. 

Further, agencies must cooperate with the Archivist and the Administrator of

General Services Administration in applying standards, procedures, and 

techniques that are designed to improve the management of records, promote 

the maintenance and security of records deemed appropriate for preservation, 

and facilitate the segregation and destruction of records of temporary value.6

On November 28, 2011, a presidential memorandum was issued on managing 

government records. The memorandum emphasizes the importance of having 

well-managed records management program such as reducing redundant efforts, 

minimizing costs and sharing institutional knowledge within and across 

organizations. Further, the memorandum states that “proper records 

management is the backbone of open Government.”7

The Office of Records Management Services (ORMS) and the Office of Security 

Services (OSS) are direct reporting units to the Office of Support Operations 

(OSO). Previously, ORMS was part of the Office of FOIA, Records Management 

and Security. OSS has oversight of the SEC’s vital records program.

Since May 2007, ORMS has been led by an Archivist who is responsible for 

coordinating, overseeing and implementing the U.S. Securities and Exchange 

Commission’s (SEC or Commission) records management program at its 

Headquarters, Operations Center, and 11 Regional Office locations.8 The office 

is comprised of two branches and has a records officer who provides assistance 

to ORMS’ Archivist. Over the past few years ORMS has taken the following 

measures to improve the Commission’s records management program:

 Developed relationships with records management points-ofcontact (POC) and/or employees in SEC offices and divisions; 

 Adopted standard operating policy (SOP); 

 Improved its records request completion time; 

 

6

 36 C.F.R. § 1220.30. 

7

 Presidential Memorandum – Managing Government Records, (Nov. 28, 2011), p.1.

8

SEC’s headquarters and regional offices are comprised of 36 offices and divisions that are headed by 

Directors. SEC also has the Chairman’s office and 4 Commissioners’ offices.
SEC’s Records Management Practices September 30, 2012

Report No. 505

Page 2

 Annually sends staff to National Archives and Records 

Administration (NARA) records management training, as well as 

other records management training; 

 Provided basic records management training during SEC’s new 

employee orientation; and

 Since January 2012, ORMS has conducted assessments of five 

Regional Offices’ records management programs and provided

training to the staff.

SEC’s records include confidential treatment requests files, correspondence, 

investigation records, matters under inquiry records, transcripts, working papers, 

consumer complaint files, Congressional and Chairman files, administrative 

proceedings files, self-regulatory files, bankruptcy files, effective orders, etc. 

Though ORMS oversees the SEC’s overall records management program, most 

offices and divisions have POCs who provide oversight of their individual records 

management program and practices.

9 ORMS works with POCs to develop and 

obtain NARA’s approval of records retention schedules for records they either 

create or receive from internal and external sources. With few exceptions the 

offices and divisions have records retention schedules that ORMS has reviewed 

and NARA has approved. ORMS maintains the Commission’s overall records

retention schedule that identifies each office’s and division’s individual records

retention schedules.

ORMS’ other responsibilities include “providing reference services for 

Commission staffers, other Federal, state and local entities and members of the 

public that are essential in assisting the SEC in achieving its mission.”10

Additionally, the office “coordinates with the Commission’s Office of Investor 

Education and Advocacy and Public Reference Room for records reference 

requests from the public.”11 Further, ORMS assists the Office of Freedom of 

Information Act (FOIA) Services, in responding to requests for nonpublic records 

under FOIA. SEC staff can find answers to questions on “How to Request 

Records” and “Frequently Asked Questions About Records” on the SEC Intranet,

the Commission’s internal website. 

In September 2010, ORMS hired a contractor to assess its requirements for an 

automated Records Management System. As part of this process the contractor 

conducted an assessment of the SEC’s overall records management program

and identified areas of improvement. In November 2010, the contractor issued 

the office a report that among other things, recommended ORMS establish 

working groups or have meetings with record management POCs to enable the

 

9

POCs are mainly comprised of administrative officers and business managers. Others serving in this role 

include assistant directors and personnel with various other titles.

10 ORMS, Standard Operating Policy 2.1, Requestors, p.1.

11 Id.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 3 

SEC to deliver timely and current records management guidance to its offices 

and divisions. Further, the report recommended ORMS provide training to SEC 

staff and develop a communication plan that would “provide a consistent means 

of information-sharing and ensure that all offices and staff members are receiving 

current direction on records management issues.” Additionally, the report 

recommended ORMS develop “a 3 to 5 year records management strategic and 

program operation plan.” Further, the report recommended ORMS “update its 

records management policies and directives.”12 

National Archives and Records Administration. NARA defines records as “all 

books, papers, maps, photographs, machine readable materials, or other 

documentary materials, regardless of physical form or characteristics, made or 

received by an agency of the United States government under Federal law or in 

connection with the transaction of public business and preserved or appropriate 

for preservation by that agency or its legitimate successor as evidence of the 

organization, functions, policies, decisions, procedures, operations, or other 

activities of the government or because of the informational value of data in 

them.”13

From the Federal government’s perspective, records management is the 

“planning, controlling, directing, organizing, training, promoting, and other 

managerial activities involved in creating, maintaining, using and disposing of 

records, to achieve adequate and proper documentation of the policies and 

transactions of the government, and effective and economical management of 

the agency’s operations.”

14

 The main tool to manage the disposition of records is

records retention schedules. 

Scheduled records represent Federal records whose final disposition has been 

approved by NARA. Scheduled records are identified in a records retention 

schedule and include both permanent and temporary records.15 Unscheduled 

records represent Federal records whose final disposition have not been 

approved by NARA, and are not based on the Standard Form (SF) 115, Request 

for Records Disposition Authority. NARA requires that unscheduled records 

must be treated as permanent records until it approves their final disposition. 

NARA’s 2010 and 2011 Records Management Self-Assessment reports16 on the 

Federal government’s records management programs found the SEC’s records 

management program scored a 38 in 2010 and a 93 in 2011. ORMS stated that 

 

12 T-White Parker Strategy & Management Consulting, SEC Records Management Policies and Business 

Process Assessment, (Nov. 2010), pp. 23-25.

13 44 U.S.C. § 3301. 

14 44 U.S.C. § 2901(2). 

15 Not all records are destroyed. 

16 The self-assessment reports scored federal agencies on their compliance with federal statue, including 

NARA guidance, on records management.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 4 

the SEC was considered a high risk agency in 2010, but is now considered a low 

risk agency. 

OIG Survey. In December 2011, we administered a survey to designated POCs 

in offices and divisions regarding their records management program, 

coordination with ORMS, training, etc. The purpose of the survey was to obtain 

an understanding of the offices and divisions records management practices and 

procedures. The overall response rate to the survey was over 60 percent. 

 

Objectives. The objectives of our audit were to examine whether ORMS: 

 established a viable records management program that ensures 

permanent SEC records are appropriately maintained and 

preserved in accordance with applicable Federal statutes and 

regulations; and 

 adhered to applicable Federal statutes and regulations regarding 

the retention, disposal, transfer, and recovery of SEC records. 

Where appropriate OIG also identified best practices. 

Specific Federal agencies records management responsibilities are described in 

Appendix I of this report. Definitions for “records” terminology are included in 

Appendix VI of this report. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 5 

Findings and Recommendations

Finding 1: Agency-Wide Staff Assistance Visits of 

SEC Records Management Programs Were Not 

Periodically Conducted 

ORMS and its predecessors did not periodically conduct 

agency-wide staff assistance visits of SEC offices’ and 

divisions’ records management programs. 

The SEC does not have an active staff assistance program and there is no 

evidence that periodic staff assistance visits were conducted by ORMS or its 

predecessors on all SEC offices and divisions. Not carrying out these 

responsibilities is inconsistent with the requirements in SECR 7-1, Securities and 

Exchange Commission’s Records Management Program, September 29, 1996 

(SECR 7-1). 

SECR 7-1 indicates the records officer should schedule and make staff 

assistance visits to each SEC office of record at least every 18 months. It further 

says to ensure the efficient and economical creation, management and 

disposition of records SEC-wide, the Records Officer will establish and operate 

an active and continuing staff assistance program. Also, SECR 7-1 states that 

staff assistance visits should cover the records management program, electronic 

records and micrographic records, among other records management disciplines 

such as directives, forms, mail, etc. 

 

Assistance ORMS Provided to Offices and Divisions. Over the years ORMS 

has continually provided assistance to SEC offices and divisions in identifying 

their records and scheduling records for disposition. NARA’s guidance does not 

specifically define formal evaluations and thus, ORMS’ management considers 

the assistance it provides to offices and divisions as formal evaluations. ORMS

Archivist informed OIG that prior to January 2012, he was unable to regularly 

conduct the visits as required in SECR 7-1, due to staff shortages. He further

stated there were other urgent issues the office’s limited resources were focused 

on when he assumed the position in May 2007, such as addressing the backlog 

of records that was in storage. He further told OIG that ORMS is generally aware 

of unique records management matters applicable to each SEC office and 

division. Since January 2012, ORMS has evaluated five Regional Offices’

records management programs and has plans to evaluate the remaining offices.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 6 

Feedback From SEC Records Management POCs. In addition to issuing a 

survey to the records management POCs, OIG met and conducted phone 

interviews with them to garner information about their office’s or division’s 

records management program and responsibilities. When asked when was the 

last time they reviewed their records retention schedules and disposed of 

records, 13 percent of POCs indicated they had not disposed of any records 

because they did not have a records retention schedule; did not have staffing 

resources to do so; or were not knowledgeable about their schedule. Forty 

percent stated their office had never disposed of any records. Another 40 

percent indicated they had worked at the SEC for two years or less and had not 

disposed of any records. The latter POCs further indicated they did not know 

when their office had last disposed of records. 

In interviews, two POCs informed OIG they had received new documents from 

external sources and had created new documents in late 2011. However, neither 

knew if documents were considered records and they had not consulted with 

ORMS. As discussed in Finding 2 of this report, some POCs are unaware 

ORMS is available to provide assistance with determining the disposition of 

records. 

Not disposing of records in accordance with the approved records retention 

schedule is inconsistent with 36 C.F.R. § 1228.156 (f), which states that Federal 

agencies “must ensure that disposable records, including restricted records 

(security classified or exempted from disclosure by statute, including the Privacy 

Act, or regulation), are destroyed in accordance with the requirements specified 

in 36 C.F.R. §1228.58.”

17

 

Conclusion. An inactive agency-wide staff assistance program can cause 

confusion among POCs. Misunderstanding of records management 

responsibilities prevents organizations from achieving the benefits of a wellmanaged program, such as maintaining institutional knowledge and preserving 

pertinent information. 

ORMS should periodically conduct agency-wide staff assistance visits of SEC’s 

records management programs in accordance with SECR 7-1, so they are aware 

of newly created records and they can provide assurance the SEC is properly 

retaining and scheduling records for disposition. Further, ORMS should inform 

SEC staff they can find answers to questions on the hyperlinks “How to Request 

Records” and “Frequently Asked Questions About Records,” that are located on

the SEC’s Intranet. Useful answers to questions that can be found in the 

hyperlinks include “what I need to know about records management, recycling 

and destroying records, record retentions schedules, clearance from records 

management for departing SEC employees,” etc. 

 

17 36 C.F.R. § 1228.156 (f). 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 7 

Recommendation 1: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) periodically conducts agency-wide staff 

assistance visits of the Securities and Exchange Commission offices’ and 

divisions’ records management programs in accordance with SECR 7-1, 

Securities and Exchange Commission’s Records Management Program. 

To assist in this process, ORMS should develop a plan that identifies a 

timeline for the conduct and scope of the staff assistance visits. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Finding 2: Records Management Training Was Not 

Provided to All SEC Staff on Their 

Responsibilities

ORMS did not provide training on records management to 

employees and POCs agency-wide on their responsibilities, 

which is inconsistent with a requirement in 36 C.F.R. § 

1220.34(f). 

During the scope of our audit, we determined that ORMS readily answered

questions from agency staff that inquired about records matters and provided 

them assistance. ORMS also conducts a 10-minute informative session on 

records management during SEC’s New Employee Orientation for new 

employees, contractors and interns. Additionally, ORMS conducted a training 

session on records management at the Office of the Chief Operating Officer’s 

(OCOO) Mission Support Conference that was held in February 2012. 

Nonetheless, ORMS has not provided agency-wide records management training 

to all staff on a general basis regarding their records management 

responsibilities, in accordance with 36 C.F.R. § 1220.34(f). According to 36 

C.F.R. § 1220.34(f), Federal agencies should “provide guidance and training to 

all agency personnel on their records management responsibilities, including the 

identification of Federal records, in all formats and media.”18 It should be noted 

that 36 C.F.R. § 1220.34 does not address the frequency training should be 

offered to staff. 

 

18 36 C.F.R. §1220.34 (f).
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 8 

In the survey OIG administered to records management POCs, 82 percent of the 

respondents indicated they had not received any records management training 

from ORMS. Our audit found that this lack of training has caused confusion 

among employees who do not understand their records management 

responsibilities or ORMS’ role and responsibilities. The following examples 

illustrate the confusion regarding records management that POCs shared with 

OIG: 

 A POC stated that based on her understanding of the 

Federal regulations related to records management, she 

thought it was ORMS’ responsibility to review their records 

retention schedule and to dispose of records. 

 

 A senior level staff member who no longer works at the SEC, 

left documents in her office and staff did not know who had 

the responsibility to review them and if the documents 

should be retained or disposed. 

ORMS Records Management Program and Training. Since January 2012, 

ORMS has provided records management training to five Regional Offices. 

Feedback from the Regional Offices indicates the training has been helpful. In 

early May 2012, ORMS hired two branch chiefs to assist with records operations 

and policy, training and compliance. ORMS’ management says the branch 

chiefs will prepare a branch specific strategic plan and establish a program that 

offers periodic records management training to SEC employees. 

The lack of systematic records management training has resulted in POCs 

retaining records that probably should have been disposed. 

Other Agencies’ Records Management Programs and Training. NARA 

provided OIG with the names of three Federal agencies they believe have wellmanaged records program. Two agencies responded to our request for 

feedback on their programs. Both agencies told us they provide ongoing training 

through web-based, on-line, and in-person avenues. They further offer training 

on a variety of records management subjects and the training varies depending 

on the audience. For instance, different training courses are available for agency 

employees needing basic records management knowledge and for records 

management POCs who are more familiar with records management regulations. 

Conclusion. ORMS did not provide records management training to staff 

agency-wide on their records management responsibilities. As a result, 

confusion exists regarding their responsibilities and ORMS’ records management 

role and responsibilities. ORMS should develop a systematic records 

management training program that is geared towards all SEC staff and then 

provide training to all. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 9 

Recommendation 2: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) develops a records management training 

program that covers training sessions for all Securities and Exchange 

Commission employees. ORMS should determine the audience, scope, 

material, and training schedule. Training factors ORMS should consider 

include defining records, how to treat records in accordance with Federal 

regulations and records retention schedule, records management 

responsibilities for employees and designated points-of-contact. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Finding 3: Some Records Requests Processing 

Did Not Align With ORMS’ Established Business 

Goals and Records Requests Were Not 

Completed in Accordance with the SOP 

ORMS did not process records requests within their 

established internal business goals. In most cases ORMS 

staff did not inform its management about the delays in 

writing, as required per the office’s SOP. Further, ORMS 

staff did not follow their SOP when processing records

requests the office received. 

ORMS Services and Processes 

ORMS provides reference services to staff, as well as “other Federal, state and 

local entities and members of the public that are essential in assisting the SEC in 

achieving its mission.”19 Additionally, ORMS “coordinates with the Commission’s 

Office of Investor Education and Advocacy and Public Reference Room to 

service records reference requests from the public”20 and assists the Office of 

FOIA Services with responding to FOIA requests from the public for nonpublic 

records. 

 

19 ORMS, Standard Operating Policy for Properly Servicing and Completing a Request for Records – the 

Lifecycle of a Request, p.1. 

20 Id.
SEC’s Records Management Practices September 30, 2012

Report No. 505

Page 10

ORMS only accepts records requests from SEC employees. SEC employees 

can request records by completing the “Request For Records Template” that is 

available on SEC’s Intranet. Completed templates are emailed to ORMS’ 

records requests inbox. ORMS maintains a log of record requests to track when 

records are received and processed. Among other items, the template includes 

a box that can be checked covering areas such as confidential treatment 

requests files, correspondence, investigation records, matters under inquiry 

records, transcripts, workpapers, consumer complaint files, Congressional and 

Chairman files, administrative proceedings files, self-regulatory files, bankruptcy 

files, and effective orders, etc. Based on fiscal years 2010 and 2011 data we

reviewed, OIG determined that ORMS receives approximately 210 records

requests each month from SEC employees and FOIA.

21

ORMS’ SOP indicates the office’s goal is to process requested records within 

three business days for urgent requests and seven business days for non-urgent 

requests.

22

Records Requests. To assess the average length of time ORMS spent 

processing records requests, OIG obtained and reviewed a sample of 105

records requests23 the office had received. Thirty-eight (38) of 105 records in our 

sample were for non-urgent requests. Our analysis revealed they were not 

processed within ORMS’ seven business days goal for non-urgent requests. In 

some cases it took ORMS up to eight months to process requests. ORMS

informed OIG that the delays occurred because some of their staff lacked the 

skills and aptitude needed to properly process requests in a timely fashion. 

ORMS data on its records requests turnaround time revealed that 80 percent of 

records requested in fiscal year 2012 were processed within eight business days.

Requests and ORMS’ SOP. Our audit determined that ORMS staff did not 

follow its SOP that requires them to notify management regarding delays that 

occur when they processed records that took more than 20 days. ORMS

informed us this requirement became effective August 24, 2009. OIG found that 

it took more than 20 days to process 10 of 38 non-urgent records requests in our 

sample. Only 1 of the 10 requests indicated the reason for the delay was

communicated to management. ORMS informed us that although the delay was 

not properly identified on the records request document, it is possible staff 

verbally communicated the reasons for the delay to management; however it was 

not documented according to the office’s SOP. 

 

21 The public submits FOIA requests for SEC records to the Office of FOIA Services.

22 ORMS, Standard Operating Policy for Properly Servicing and Completing a Request for Records – the 

Lifecycle of a Request, p.1.

23 Our sample included urgent and non-urgent requests dating from January 2008 to September 2011.
SEC’s Records Management Practices September 30, 2012

Report No. 505

Page 11

ORMS’ SOP further requires its employees to “place copies of all documents

(emails, notes or any other information) pertaining to requests in the dossier and 

return the assigned request for records in the dossier to ORMS staff members 

who are responsible for managing the request for records mailbox and log, the 

ORMS Chief, or his (her) designee.”

24 For 18 of 105 records in our sample,

sufficient information was not identified in the dossier such as the request form, 

status of the request, and completion date. This lack of information prevented 

OIG from determining what the requests were and whether the requests were 

completed.

ORMS’ SOP also requires the “staffer who processed the records request returns 

the assigned request for records dossier to the ORMS staffer responsible for 

managing the request for records mailbox and log, the ORMS Chief or designee. 

The ORMS employee responsible for managing the records requests mailbox 

and log uses the supporting documentation to code the requested service. [The]

ORMS staff [who completed the records request] does not code the serviced 

request.”25 ORMS uses a system of “approved codes” as shown in Table 1 

below, to assess the status of records requests the office receives.

 Table 1: ORMS Approved Action Codes for Records Requests

ORMS 

Code 

Action Taken for the Request

0 Requestor cancelled the records request.

1 ORMS closed the records request by referring the requestor to 

other sources such as SEC subscription database.

2 ORMS completed the records request.

R ORMS reassigned the records request to another staff 

member.

 Source: OIG generated

There were 2 of 105 records in our sample coded as “2-completed requests,” but 

ORMS could not locate these records. To aid in resolving this problem, ORMS 

should develop a new code to categorize requested records that cannot be 

located. ORMS management agreed a new code is needed. ORMS further 

stated its staff had previously made this suggestion, but due to other priorities it 

was not pursued further. 

Another record in our sample was coded as “8.” ORMS management told us the 

code had not been approved and staff had developed it to describe actions they 

had taken. 

When asked whether ORMS reviews a sample number of processed records 

requests, we were told the office had done so in the past, but not consistently.

 

24 ORMS, Standard Operating Policy for Properly Servicing and Completing a Request for Records – the 

Lifecycle of a Request, p. 7.

25 Id.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 12

ORMS believes the office can best monitor records requests and other items if 

the process is automated. 

Best Practices. In identifying best practices, OIG consulted with a records 

officer from another Federal agency who told us their automated records 

management system contributes to the office’s efficiency. She further relayed 

that the records management system “has outstanding features such as tracking 

records, when the records are due back to the records office, what records are 

up for destruction, etc. It has allowed the records office to locate where records 

are and better track them and identify where permanent assets are.” Having an 

automated system for records management may contribute to ORMS efficiently 

overseeing the SEC’s records management program. 

Conclusion. As evidenced by OIG’s review of a sample number of records 

requests, some ORMS staff did not follow the office’s SOP records requests 

procedures and requests were not completed within ORMS’ goal. ORMS should 

implement additional internal controls such as a more robust management review 

of records requests to ensure staff complete requests within its goal and they 

comply with their SOP (e.g., including required information in a dossier and 

notifying management of delays in processing records that take more than 20 

days). 

The Office of Management and Budget Circular A-123 “Management’s 

Responsibility for Internal Control” establishes that management has a 

fundamental responsibility to develop and maintain effective internal controls. 

Ineffective internal controls have prevented ORMS from timely processing 

records requests and it has led to confusion on whether records were completed. 

Further, “effective controls over the creation, maintenance, and use of records in 

its current business”

26 will aid ORMS improve the management and maintenance 

of the SEC’s records management program. 

Recommendation 3: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) develops internal controls that assure 

ORMS staff are provided oversight and adhere to the office’s standard 

operating policy. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

 

26 36 C.F.R. § 1220.30. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 13

Finding 4: Some SEC Offices or Divisions Do Not 

Have Records Retention Schedules and Others 

Should Be Updated 

SEC has newly created offices that do not have records 

retention schedules and there are other offices that ORMS 

has not met with to create their records retention schedules. 

According to NARA, Federal agencies are to “develop records schedules for all 

records created and received by the agency and obtain NARA approval of the 

schedules prior to implementation, in accordance with 36 C.F.R. parts 1225 and 

1226.”27 Federal agencies have common records such as personnel, payroll, 

and training records that NARA has classified and are included in General 

Records Schedules (GRS). GRS are “issued by the management of the United 

States to provide disposition authorization for records common to several or all 

agencies of the Federal Government. They include records relating to civilian 

personnel, fiscal accounting, procurement, communications, printing, and other 

common functions, and certain non-textual records. They also include records 

relating to temporary commissions, boards, councils and committees. Because 

these schedules are designed to cover records common to several agencies, 

many record descriptions are general. Agency records officers may either use 

the schedules as an appendix to an agency printed schedule or tailor the general 

schedules to the agency’s own particular needs and incorporate them into 

agency schedules.”28

 The SEC has five offices that are covered by GRS:29

1. Office of Equal Employment Opportunity 

2. Office of Financial Management 

3. Office of Human Resources (OHR) 

4. Office of Information Technology (OIT) 

5. Office of Support Operations 

According to SECR 7-1, Section B. 8, division directors, office heads, regional 

directors and district administrators should “make sure that active records are 

properly and economically maintained and used, and systematic disposition of 

inactive records are made on a regularly scheduled basis.” 

Records Retention Schedules 

SEC offices and divisions are responsible for maintaining their records in 

accordance with their approved retention schedules. As previously discussed, 

 

27 36 C.F.R. § 1220.34. 

28 GRS is the retention schedule for these offices. See NARA’s website (http://www.archives.gov), 

Introduction to the General Records Schedules. 

29 OCOO and OSS also have records that are on GRS, as well as records that are not on GRS. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 14

most offices and divisions have records retention schedules that have been filed 

with ORMS. However, the SEC’s comprehensive records schedule is dated 

September 1997. Since then the SEC has added new offices and combined, 

abolished and/or renamed others. Some offices and divisions that are not 

covered by GRS either do not have records retention schedules or are in the 

process of revising their current retention schedules.30 Additionally, the offices 

which fall under GRS do not have records retention schedules, other than GRS, 

which is the retention schedule for these offices. 

Our review of records retention schedules and records management processes 

found that a particular division identified several risks for the division’s records 

management program such as identifying records owners and outdated records 

management policies. Another office was in the process of redefining the 

documents it created and received from internal and external sources during our 

audit. Subsequently, the office conducted a full inventory to identify 

“scheduled”

31 records and has been working with ORMS to get its 

“unscheduled”32 records appropriately scheduled. 

OIG further identified POCs from two offices who had not met with ORMS 

regarding documents the office generated that met the records definition or to 

determine if a retention schedule was needed. One of the offices indicated that 

in late 2011, staff turned over in its records management function. The office 

recently hired a managing executive and a business manager to enhance its 

operational functions which includes records management. The POC indicated 

the office’s prior records management practice was to work with ORMS as issues 

arose and they had no continuous or consistent contact with ORMS. The office 

subsequently met with ORMS to identify its records and modify its records 

retention schedule. 

A POC from the second office in our example informed OIG he did not think his 

office had created any records. The POC stated the records the office “create[s] 

would be typically managed in systems or files external to [their] office.” He also 

said they would “rely on the email retention mechanisms to manage those 

external records to their office. [Hence], the office does not have any specific 

practices and procedures defined [for records management] and [they] do not 

have retention schedules beyond those of the Commission’s policies as a whole.”

 

30 While the retention schedules are being revised, SEC offices and divisions are expected to follow their 

current records retention schedules. 

31 Scheduled records represent federal records whose final disposition is approved by NARA. Scheduled 

records are identified in a records retention schedule when the records will be destroyed. 

32 Unscheduled records represent federal records whose final dispositions have not been approved by 

NARA, and are based on the Form SF 115, Request for Records Disposition Authority. NARA requires that 

unscheduled records must be treated as permanent records until it approves a final disposition for the 

records.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 15

Forty-two percent of personnel in our survey indicated their office or division did 

not have a records retention schedule. This indicates there is a lack of 

understanding of records retention schedules. For example, a records 

management POC initially thought his office had not finalized its records 

retention schedule. However, our review of ORMS’ comprehensive records 

schedule and inquiries revealed the office did in fact have a schedule. 

ORMS should ensure the SEC’s records retention schedules are current. Not 

having records retention schedules for all offices and divisions could cause 

POCs to misunderstand their roles and responsibilities. In addition, it could 

potentially result in retaining unnecessary records or discard records that should 

have been preserved. ORMS’ management informed us that while they want to 

actively interact with SEC offices and divisions on a continuous basis, it does not 

have sufficient resources to do so. A few POCs informed us that ORMS should 

actively engage with Commission’s offices and divisions to ensure that robust 

records management processes and procedures are in place and are being 

carried out by Commission staff. 

Recommendation 4: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) works with the Securities and Exchange 

Commission (SEC) offices and divisions to ensure they all have current 

records retention schedules that encompass the office’s or division’s

records. Accordingly, ORMS should determine whether it should update 

the SEC’s comprehensive records retention schedule to ensure it is 

reflective of current SEC offices’ and divisions’ records. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments.

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 16

Finding 5: Some SEC Offices and Divisions Did 

Not Review Their Records Retention Schedules 

and Dispose of Records in Accordance with Their 

Schedules 

Some offices and divisions kept all the records they 

created and received and did not periodically review 

their records retention schedules and dispose of 

records in accordance with their schedules. 

Some offices keep all the records they create and receive. This could potentially 

lead to inefficient utilization of office space in the future. An office that was 

established in 2009 indicated they maintained the records the office created. 

They are in the process of creating a records retention schedule. ORMS 

indicated that as of late July 2012, NARA was reviewing this office’s records 

retention schedule. 

A POC informed OIG that it does not have a records retention schedule, but has 

met with ORMS to discuss what type of records it has and to determine if a 

records retention schedule is necessary. The POC believes that from a risk 

perspective, because the office has approximately 50 employees and generally 

does not generate or receive many original records, a records retention schedule 

may not be needed. He further said many of their employees work in a field that 

encourages the preservation of documents. The office maintains a file room that 

has historical documents dating back to the 1940s. ORMS was unaware the 

office had not disposed of any records. OIG confirmed that the office does have 

a records retention schedule. Subsequently, ORMS met with the POC to discuss 

the office’s records and scheduling processes. 

OIG met with two POCs whose records are covered by GRS. The first POC 

informed us they had not reviewed records management regulations regarding 

disposing and managing the office’s records, due to a lack of resources. She 

further indicated the office needed training on records management. ORMS’ 

management told OIG that because its office follows GRS their records should 

be disposed of in accordance with GRS, which requires that most records have a 

two-year retention period. The second POC stated since her arrival at the SEC 

in November 2009, the office had not reviewed their records to determine how 

and what should be disposed of, and had contacted NARA for guidance. The 

office plans to review the disposition of its records in the near future. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 17

Backlog of Records at FRC Need to Be Reviewed. Additionally, our audit 

found that ORMS had not reviewed the content of 256 boxes their contractor 

identified in its November 2010 report. The boxes contained records ORMS 

received from various sources and ORMS needs to review the content of the 

boxes to determine the disposition and dates of the records.33 In September 

2012, ORMS informed OIG that it has now reviewed 98 boxes and they are 

coordinating with the FRC to review the content of the remaining boxes. 

Proper Records Management Procedures. We determined that many offices 

and divisions do not have proper records management procedures and do not 

ensure active records are properly and economically maintained and used on a 

regular basis. Further, the systematic disposition of inactive records is not 

regularly performed. Many POCs indicated they are unsure when the offices’

and divisions’ records should be disposed of and do not do so annually. 

When a FOIA request for a record is received and the record is available, 

Federal agencies are expected to provide the record after a reasonable research 

has been conducted. Whether the record should be disposed of in accordance 

with the retention schedule is irrelevant. If the record exists, even though it 

should have been disposed of in accordance with the retention schedule, the 

SEC is required to provide it in a FOIA request. As such, there is a risk the SEC 

could provide information that should have been disposed. The FOIA office 

informed OIG that during the litigation discovery period for records, Federal 

agencies are expected to perform extensive searches and provide the record if 

the agency has it, regardless of the record’s retention period. 

Not having a records management program or procedures that enable offices 

and divisions to review records retention schedule and to properly dispose of 

records violates 36 C.F.R. § 1220.34(d) which states that agencies must “assign 

records management responsibilities in each program (mission) and 

administrative area to ensure the incorporation of recordkeeping requirements 

and records maintenance, storage, and disposition practices into agency 

programs, processes, system and procedures. Moreover, it violates 36 C.F.R. § 

1220.34 (g) which states that agencies must “develop records schedules for all 

records created and received by the agency and obtain NARA approval of the 

schedules prior to implementation, in accordance with 36 C.F.R. § 1225 and 

1226.”34

ORMS has not periodically contacted all records management POCs and 

provided them with guidance regarding their responsibility to identify records for 

disposal. By not disposing of records in a timely manner and taking full action to 

 

33 The report ORMS’ contractor issued in November 2010 identified the 256 boxes. ORMS stated the initial 

size of the backlog was approximately 1,000 boxes. 

34 36 C.F.R. § 1220.34 (d) and (g). 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 18

preserve records having no administrative, legal, or other value, could cause the 

SEC to inefficiently use office space and increase the cost to preserve records. 

Conclusion. Several offices did not dispose of their records in accordance with 

the records retention schedules. Additionally, our audit revealed that ORMS has 

a backlog of records that was identified in 2010 that still needs to be reviewed to 

determine the proper treatment of the records. ORMS’ actions has led noncompliance with Federal regulations that requires records be properly disposed 

of based on the records retention schedules. Further, not disposing of records in 

accordance with the records retention schedules poses a risk the SEC is 

providing information when a FOIA request is made. 

Recommendation 5: 

The Office of Support Operations should ensure the Office of Records 

Management Services establishes records management procedures that 

enable the offices and divisions to properly manage their records in 

accordance with applicable federal regulations and Securities and 

Exchange Commission’s administrative regulations. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Recommendation 6: 

The Office of Support Operations should ensure the Office of Records 

Management Services establishes a definitive plan and milestones to

review the remaining backlog of boxes that are being maintained at the 

Federal Records Center and ensures proper disposition of the records that 

are contained in the boxes. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 19

Recommendation 7: 

The Office of Support Operations should ensure the Office of Records 

Management Services provides guidance to records management pointsof-contact and requires, at least annually, they determine whether there 

are any records requiring disposal for their individual offices and divisions. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

 

Finding 6: The Backlog of Records Being 

Maintained at FRC Were Not Reviewed 

ORMS has 10-year backlog of SEC records at the FRC that 

are eligible for destruction and they did not review and 

approve the records for destruction.

ORMS has not timely reviewed Commission records that are eligible for 

destruction. ORMS Archivist inherited a substantial backlog of records upon his 

arrival to the SEC in May 2007. The backlog represents approximately 10 years 

of records that are eligible for destruction. ORMS must review and approve 

these records before they can be destroyed. 

ORMS Records Disposal Cycle. At the end of each fiscal year FRC sends a 

records disposal form to ORMS that lists all the SEC’s records in their 

possession that are eligible for permanent destruction. The disposition form 

includes a job number and the year the record is due to be destroyed. The form 

also identifies if the records are temporary. FRC submits a request to ORMS for 

its approval before it destroys the records.35 

FRC informed ORMS they had 29,345 cubic feet of records eligible for 

destruction at the end of fiscal year 2011. ORMS approved the destruction of 

2,306 cubic feet of these records. We concluded that had ORMS timely 

reviewed the records in prior years, the backlog would not exist. 

 

35 44 U.S.C., Disposal of Records, § 3303a(e), requires an examination by Archivist of lists and schedules of 

records lacking preservation value. Further, it states “[The Archivist of the United States] may approve and 

effect the disposal of records that are in his legal custody, provided that records that had been in the custody 

of another existing agency may not be disposed of without the written consent of the head of the agency.”
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 20

As part of our sampling, OIG requested the following information from ORMS: 

 The number of records ORMS disposed of each year; 

 The number of records that remains to be destroyed by year; and 

 The total number of records the SEC created from 1999 to 2011. 

ORMS was unable to provide the information we requested because it does not 

have a viable method to track the information. 

Further, OIG found that ORMS does not maintain a list of the Commission 

records that are eligible for destruction identified by FRC. However, the office 

does maintain hard copies of the disposal forms the FRC provides to ORMS. 

OIG’s review of the approved disposal forms for fiscal year 2011 found that a 

form was completed for all disposals and the disposals were properly approved. 

OIG could not perform a walkthrough of ORMS’ record disposal process because 

our observation of their records indexing36 was problematic.37 For example, 

based on ORMS’ record indexing we requested records for our review. 

However, none of the records were found because the index was incorrect. 

ORMS says the indexing problem only exists for records that were created 

before 2008. Further, ORMS stated until they can do a full inventory of the 

Commission’s records that are located at the FRC and verify the records, none of 

them can be destroyed. 

Conclusion. ORMS did not dispose of SEC records in accordance with the 

retention schedules, which is inconsistent with 44 U.S.C. § 3102, Establishment 

of Program of Management, that requires Federal agencies establish and 

maintain an active, continuing program for the economical and efficient 

management of the agency records.38 

Recommendation 8: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) develops an action plan to address the 

10-year backlog of records that the Federal Records Center (FRC) 

identified as eligible for destruction. In developing an action plan, ORMS 

should determine a timeline to address the backlog of records, a timeline 

to conduct a full inventory of the Security and Exchange Commission’s

records, and how ORMS will address the indexing system for archived 

records. 

 

36 ORMS indexes records by maintaining a log that states where the records are located. 

37 In September 2012, ORMS management informed OIG that the records have been reviewed and legacy 

issues were identified that must now be resolved before the records can be approved for destruction. 

38 44 U.S.C. § 3102. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 21

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Finding 7: Records Management Points-ofContact Have Not Been Identified for All SEC 

Offices and Divisions 

While most offices and divisions have appointed POCs for 

records management matters, some have not; therefore, 

ORMS cannot clearly identify POCs for each office or 

division. OIG could not determine who all the designated 

records management POCs were for individual offices or 

divisions based on ORMS’ listing of meetings held with SEC 

offices and divisions for records management matters. 

NARA, 36 C.F.R., Section 1220.34(d) requires Federal agencies to “assign 

records management responsibilities in each program (mission) and 

administrative area to ensure incorporation of recordkeeping requirements and 

records maintenance, storage, and disposition practices into agency programs, 

processes, systems, and procedures.”39

 

OIG requested a list of SEC’s records management POCs and learned that 

although ORMS does not maintain an official listing, it has a list of offices and the 

names of people they worked with on records management matters. At the SEC, 

business managers and administrative officers typically serve as records 

management POCs, but other employees such as assistant directors, legal 

counsel, etc., also serve in this role. ORMS has established relationships with 

offices and divisions and they address any questions and concerns the may have 

regarding records matters. ORMS provided us with a list of employees they met 

with over the past few years regarding records matters, and employees they 

consider to be POCs. 

We determined that ORMS’ list needs to be updated to include all POCs. While 

most offices and divisions have appointed POCs for records management 

matters, some have not. Moreover, our audit found some offices and divisions 

did not have designated POCs until 2011 or 2012. Furthermore, there appears 

to be confusion between ORMS and offices and divisions pertaining to who is 

 

39 36 C.F.R. § 1220.34(d). 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 22

designated as the records management POC. For example, OIG was informed 

of a particular employee who had been the office’s records management POC 

since the 1990s, but he was not on ORMS’ list. In another instance, ORMS’ list 

identified an employee from an office as the records management POC. 

However, the employee said he only worked with ORMS on records matters for 

his branch and not for the entire office. We later found that the office director had 

assigned its assistant directors as records management POCs. However, the 

names of the assistant directors were not on ORMS’ records management list. 

Moreover, an employee ORMS identified as a POC for another office told OIG 

she was not the records management POC. OIG was later informed that the 

head of the office, along with two employees, were responsible for the office’s 

records; however, they were not identified as POCs on ORMS’ list. Further, an 

office told us they did not have a POC due to staff turnover. Subsequently, the 

office appointed a records management POC. Lastly, one office just designated 

a records management POC in January 2012. 

Additionally, our audit found that ORMS has not reviewed the records 

management program of two headquarters offices. ORMS stated that one of the 

office directors started at the SEC in November 2011, and due to other priorities 

they had not contacted the office but planned to do so. ORMS told us that not all 

offices and divisions consider records management a priority and it has been 

difficult for certain offices and divisions to focus on records management 

practices. This is consistent with NARA officials’ observations. NARA officials 

told us that the lack of priority for records management is common in Federal 

agencies. However, because of a records destruction matter that occurred at the 

SEC, it appears offices and divisions are now more supportive of ORMS’ 

initiatives. 

A management official informed us she thought ORMS was responsible for 

reviewing the office’s retention schedule, when in fact this responsibility resides 

with each office or division. Further, an administrative officer who serves as the 

records management POC stated she has not worked with ORMS since 2008 

and was unfamiliar with record rules and ORMS’ responsibilities. 

Based on a recommendation from NARA, OIG contacted two Federal agencies 

and an independent Federal agency from the financial industry, and asked them 

how they communicated with offices in their agencies regarding records 

management matters. The agencies told us they have records management 

POCs in each office at their respective agency. 

Conclusion. SEC’s records management directives do not require offices or 

divisions to have records management POCs. ORMS management agrees that 

establishing records management POCs for all offices and divisions is important, 

but say they need the support and assistance of SEC offices and divisions to do 

so. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 23

Not having records management POCs has contributed to ineffective 

communication between ORMS and SEC offices and divisions on records 

management matters, such as misunderstandings regarding responsibilities and 

staff not properly following Federal regulations and SEC policies on records 

management. 

Recommendation 9: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) issues a directive, requiring all Securities 

and Exchange Commission offices and divisions to designate a point-ofcontact (POC) for records management matters and inform ORMS of their 

designated POC. ORMS should maintain a list of POCs that is verified 

annually. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Finding 8: SEC’s Vital Records Management 

Program Needs Improvement 

Offices and divisions are not reviewing their vital records 

listing annually in compliance with Federal regulations. 

Further, we determined the SEC’s vital records are not 

current and complete based on our review of vital records in

12 offices and divisions. 

Designated staff in SEC offices and divisions are not annually reviewing and/or 

updating their vital records in accordance with Federal Continuity Directive 1 

(FCD 1), Federal Executive Branch National Continuity Program and 

Requirements, which states that “at a minimum, vital records should be annually 

reviewed, rotated, or cycled so that the latest version will be available.”40

 

Further, the SEC is not in compliance with 36 C.F.R. § 1223.14(c) which states 

that agencies must “ensure that the designation of vital records is current and 

complete.”

 

40 Federal Continuity Directive 1 (FCD 1), Federal Executive Branch National Continuity Program and 

Requirements, (Feb. 2008), Annex I, p. I-3.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 24

OSS is responsible for SEC’s vital records management. OSS provided OIG 

with the SEC’s Continuity of Operations (COOP) Plan (2010 COOP Plan), dated 

April 2010, which included a listing of vital records for SEC offices and divisions. 

OIG also obtained and reviewed SEC’s draft 2011 vital records listing. We found 

that the 2010 COOP Plan and the draft 2011 vital records listing include vital 

records of an office that no longer exists and whose function was merged into 

another office that was created in September 2009. 

Vital Records at the SEC. According to SEC’s 2010 COOP plan, vital records 

are “electronic and hardcopy documents, references, and records needed to 

support essential functions during a continuity of operations situation. The two 

basic categories of records are emergency operating records and legal and 

financial records.” SEC defines emergency operating records as “records that 

support the execution of an agency’s essential functions.” In addition, SEC 

defines legal and financial records as “records that are needed to protect the 

legal and financial rights of the Government and of the persons affected by its 

actions.”

SEC Offices and Divisions Are Not Reviewing Their Vital Records Listing 

Annually. OIG interviewed staff from 12 offices and divisions that were on 

SEC’s Continuity Task Force, and had responsibility for maintaining their office or 

division’s vital records listing.

41

 Staff was asked “When was the last time you 

reviewed and/or updated your vital records listing?” Our audit found the answers 

shown in Table 2.

 Table 2: Survey Results of SEC Offices and 

 Divisions Vital Records Listings

Number of 

Offices

Category Results

2 Reviewed their vital records listing 

annually

2 Reviewed their vital records listing 

continuously

2 Did not review their vital records 

listing annually

2 Reviewed their vital records listing a 

year or more ago

3 Did not know when they last 

reviewed or updated their vital 

records listing 

1 Other

Total 12

 Source: OIG Generated.

 

41 SEC’s Continuity Task Force was made up of agency-wide personal designees who have oversight of 

their offices’ or divisions’ vital records and periodically met with the defunct Office of the Executive Director 

to discuss COOP matters and their vital records responsibilities. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 25

One designee in the “reviewed their vital records listing continuously” category 

was unable to provide the vital records listing due to staff turnover. One 

designee in the “reviewed their vital records listing annually” category admitted 

the last time they updated its vital records listing was in May 2010 in preparation 

for the May 2010 exercise. The designee further stated the office reviews its vital 

records listing prior to the national COOP government exercise that occurs every 

two years. A second designee in this category stated that the last time they 

reviewed and updated its vital records listing was in June 2006. A designee in 

the “did not know when they last reviewed or updated their vital records listing” 

category stated that OSS recommended the office not rely on old vital records 

listing and to disregard it because the list may contain items that are not vital 

records. Further, the designee stated OSS informed them that the way SEC 

previously identified and maintained vital records may change. A designee in the 

“reviewed their vital records listing a year or more ago” category stated that it 

currently updates the vital records listing as changes occur and they will review it 

quarterly. Finally, the designee in the “other” category stated that December 

2011 was the first time the office had formally reviewed and updated its vital 

records listing and the office has kept a catalog of its vital records from its 

inception in 2009.

Vital Records Listing. We obtained the 12 offices and divisions vital records 

listings and compared them to the vital records that were included in the 2010 

COOP Plan and the draft 2011 listing. Our testing revealed the following results 

as illustrated in Table 3.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 26 

Table 3: Survey Results of SEC Offices and Divisions Vital Records 

Listings, as Compared to the Vital Records in 2010 COOP Plan and

the Draft 2011 Listing

Office/ 

Division

Vital 

Records 

Agreed

Agreed 

to

2010 

COOP 

Plan

Did Not 

Agree 

to 2010

COOP 

Plan

Did Not 

Agree to 

Draft 2011 

Vital 

Records

Listing

New Office-No 

Vital Records in 

2010 COOP 

Plan/No Draft

2011 Vital 

Records Listing

No Vital 

Records 

Received 

From Office/

Division

1 

2 

3 

4  

5  

6  

7  

8 

9 

10 

11 

12 

 Source: OIG Generated.

Specifically, we found that only three offices and divisions records agreed to the 

draft 2011 vital records list. OIG’s findings demonstrate that although SEC 

offices and divisions are responsible for reviewing their vital records listing 

annually and updating the vital records as necessary, oversight is needed to 

ensure all offices and divisions monitor their vital records listing at least annually

and verify their compliance with Federal regulations.

Defunct Office of the Executive Director. Prior to OSO the defunct Office of 

the Executive Director was responsible for coordinating SEC’s continuity efforts, 

continuity of operations,42 and vital records management which is a component 

of the COOP. The defunct Office of the Executive Director, with OIT’s 

assistance, created the Continuity Support Center (CSC), which is a computer 

system that designated vital records staff in SEC offices and divisions could 

access and post key documents and vital records electronically. Though OSS’

Chief of Security Services says he has accessed the CSC, OSS has not 

determined if it will be used to maintain the SEC’s vital records until a full 

assessment of the vital records program has been performed. 

 

42 Vital records management is a component of continuity of operations according to FEMA. See Elements 

of Viable Continuity Capability at http://www.fema.gov/about/org/ncp/coop/index.shtm. According to FEMA, 

continuity of operations, as defined in the National Security Presidential Directive-51/Homeland Security 

Presidential Directive-20 (NSPD-51/HSPD-20) and the National Continuity Policy Implementation Plan 

(NCPIP), is an effort within individual executive departments and agencies to ensure that Primary Mission 

Essential Functions (PMEF) continue to be performed during a wide range of emergencies, including 

localized acts of nature, accidents and technological or attack-related emergencies. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 27

In prior years the defunct Office of the Executive Director oversaw Continuity 

Task Force meetings that were held to keep vital records personnel abreast of 

COOP matters and remind them to update their vital records. OIG reviewed a 

copy of a Continuity Task Force meeting that was held on January 25, 2011.43 

The agenda reminded staff that vital records listing should be updated 

continuously and kept available electronically and in hard-copy. 

OSS and ORMS Vital Records Roles. OSS’ Chief of Security Services and 

ORMS management are working together to evaluate the SEC’s vital records 

program. OSS’ Chief of Security Services informed us that his office had not yet 

determined what constitutes a SEC vital record and a contractor the office hired 

in June 2012, will assist them not only with COOP management, but will also 

assess the SEC’s vital records management program. OIG determined that 

without defining what vital records are, the SEC cannot ensure its vital records 

are adequately protected, accessible and immediately usable. 

Required Annual Review of SEC’s Vital Records Program. OIG’s review of 

NARA’s 2010 Records Management Self-Assessment Report44 found that 

Federal agencies are required to perform an annual review of their vital records 

program,

45 consistent with FCD 1, which states vital records program “must 

include an annual review of the program to address new security issues, identify

problem areas, update information, and incorporate any additional vital records 

generated by new agency programs or functions or by organization changes to 

existing programs or function...”46 OSS could not provide us with support to 

show that annual reviews of SEC’s vital records program were previously 

performed.

Compliance with NARA Guidance and Federal Regulations. When OIG 

asked OSS how it ensures the SEC complies with NARA guidance and Federal 

regulations for vital records program, we were told that based on its initial review 

of existing vital records program, “the SEC might not have vital records in 

accordance with NARA guidance.” 

36 C.F.R. § 1223.14 states that agencies must “appropriately inform all staff 

about vital records.” Except for a training session SEC employees took on vital 

records in 2010, OSS officials were unsure how SEC previously informed its staff 

 

43 In the past Continuity Task Force meetings were held to inform SEC offices and divisions about COOP 

matters and to remind them of their responsibility to update their vital records listing. 

44 According to the report’s executive summary, “the goal of the self-assessment is to determine whether 

federal agencies are compliant with statutory and regulatory records management requirements.” NARA,

2010 Records Management Self-Assessment Report, An Assessment of Records Management Programs in 

the Federal Government, (Feb. 22, 2011), p.2. 

45 NARA, 2010 Records Management Self-Assessment Report, An Assessment of Records Management 

Programs in the Federal Government, (Feb. 22, 2011), p.30. 

46 Federal Continuity Directive 1 (FCD 1), Federal Executive Branch National Continuity Program and 

Requirements, (Feb. 2008), Annex I, p. I-3. 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 28

about vital records. We were also informed that the SEC has not established 

retrieval procedures for vital records. 

OSS will work with their contractor to validate COOP and vital records 

requirements, establish retrieval procedures for vital records and ensure the vital 

records and COOP program complies with NARA and Federal regulations. 

Conclusion. SEC has not defined its vital records and does not review or 

update vital records annually. As a result, SEC’s listing of vital records are not 

complete or current. Further, the SEC has not definitively established how it will 

protect and retrieve vital records in emergency situations. The SEC must ensure 

it develops and fully supports a vital records management program that is 

adequately tested, protected, accessible and available to support its mission.

Non-compliance with NARA’s guidance on vital records occurred because this 

responsibility was transferred to OSS and ORMS and the predecessor (defunct 

Office of the Executive Director) did not retain adequate records or 

documentation regarding the SEC’s vital records program. As a result, there has 

been confusion regarding who is responsible for reviewing NARA guidance and 

ensuring the SEC’s vital records program complies with NARA guidance. If not 

corrected, the conditions outlined in this finding could potentially prevent the SEC 

from performing mission essential functions in emergency or other situations that 

could cause disruptions in its normal operations.

Recommendation 10: 

The Office of Support Operations should ensure the Office of Security 

Services, in coordination with the Office of Records Management 

Services, develops a vital records program that includes processes and 

procedures to establish and maintain the Securities and Exchange 

Commission’s vital records in accordance with applicable Federal 

regulations and the National Archives and Records Administration’s 

guidance on vital records management. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Recommendation 11: 

The Office of Support Operations should ensure the Securities and 

Exchange Commission’s (SEC) procedures and processes for vital 

records management include, but are not limited to: 
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 29

1) Designating points-of-contact (POC) for offices or division that 

have vital records; 

2) Ensuring appropriate hardware, software and system 

documentation are adequate to operate the systems and can 

access SEC’s vital records in cases of emergencies; 

3) Ensuring vital records information is updated throughout the 

year and reviewed annually; and

4) Providing designated POCs with vital records requirements or 

new information at least once a year. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 

Finding 9: SEC’s Records Management 

Administrative Regulations, Retention Schedule, 

and Handbook Are Outdated 

SEC’s records management administrative regulations, 

records retention schedule, and the Vital Records Handbook 

have not been revised in a number of years. Additionally, 

the administrative regulations refer to sample forms and 

processes that are no longer available or are no longer 

followed, respectively. 

Specifically, SEC’s administrative regulations (SECR-7 series) related to records 

management have not been revised dating as far back as May 1991.47 Further, 

SEC’s records retention schedule has not been revised or updated since 

September 1997. ORMS informed OIG that they are in the process of updating 

the administrative regulations. We were also told that ORMS conducted a high 

level review of the regulations and did not find any grossly incorrect information. 

Moreover, regarding the SECR-7 series covering electronic records 

management, OIT informed us that they are working with ORMS to update the 

policies and procedures on electronic records. 

 

47 The SEC administrative regulations in the SECR-7 series that are discussed in this report are comprised 

of the following five SECRs that are related to records management: SECR 7-1, Records Management 

Program (September 29, 1996); SECR 7-2, Records Management, Creation, Maintenance and Use of 

Records, Including Files (August 5, 1993); SECR 7-3, Disposition of Securities and Exchange Commission 

Records (July 21, 1993); SECR 7-6, Electronic Records (May 23, 1991); and SECR 7-7, Records 

Management, Vital Records (July 21, 1993). 
SEC’s Records Management Practices September 30, 2012

Report No. 505

Page 30

NARA does not provide specific guidance on when or how often Federal 

agencies should update their administrative regulations, procedures, and policies 

on records management. However, according to NARA’s 2010 Records 

Management Self-Assessment Report “a third of the respondents...have not 

updated their directive(s) in a number of years.” NARA further asserts that “this 

is a deficiency in their records management programs. They are not accounting 

for new records series, and they are not keeping up with records management 

best practices.” Additionally, NARA stated that bulletins and related guidance on 

records management are issued on an ongoing basis. NARA believes that 

agencies need to incorporate pertinent portions of such guidance into their 

directives and other issuances. 48 NARA’s 2011 Records Management SelfAssessment Report described updating directives continues to be a problematic 

area as it stated that there was “little change in the data....30 percent [of 

respondents] said they have not updated their directive since FY 2006 or 

earlier.”49

ORMS stated that while it agrees with NARA’s assessment, NARA should 

provide clear guidance on how often or when directives should be updated. 

OIG determined that ORMS’ outdated administrative records management 

regulations and records retention schedule have caused confusion among SEC 

staff. One management official stated that when she reviewed the SECR 7-2,

“Creation, Maintenance and Use of Records, Including Files,” August 5, 1993, 

located on the SEC’s Intranet and clicked the hyperlinks for Figures 3-1 and 3-2, 

the figures were not available. ORMS was unaware of this matter and said they 

would look into it. Further, ORMS stated by the end of September 2012, the 

office will issue updated administrative regulations on records management.

SEC’s Vital Records Handbook. OIG’s review of SEC’s Vital Records

Handbook (Handbook), dated August 30, 1996, revealed that much of the 

information and procedures outlined in the Handbook are outdated. For example 

the Handbook indicates that individuals responsible for their offices’ records 

management must prepare the SEC Form 2883, as of September 30 each year 

and submit it to the SEC records officer before November 1 of that year. It 

further explains that Form 2883 is an annual status report of the vital records 

program and discusses “the status of each individual office or region’s progress 

in implementing the vital records management program or if implemented, that 

inventories of records selected have been examined and are still valid.” 

However, we found that the SEC Form 2883 is no longer in use and is not 

available in SEC’s internal forms listing. In addition, our inquiry with ORMS’ 

 

48 NARA, 2010 Records Management Self-Assessment Report, An Assessment of Records Management 

Programs in the Federal Government, (Feb.22, 2011), p.15.

49 Id., p.8.
SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 31

former records officer who has been with the office since 1999 revealed that to 

his recollection, no SEC office or division has sent a Form 2883 to ORMS. 

OSS informed OIG they have not reviewed the Handbook. OSS’ and ORMS’

management indicated the Handbook will be reviewed as part of OSS’ 

contractor’s requirements to assess the vital records program. 

Conclusion. To lessen confusion and ensure current and updated information is 

provided to SEC staff, the records management SECR-7 series and the 

Handbook should either be revised or rescinded. These items contain 

terminology, processes, and assign responsibilities that are outdated and thus 

need to be revisited. For example, terms such as automatic data processing, 

automatic data processing equipment, electronic, information processing center 

or mainframe are outdated, but can be found in some SECR-7 series and the 

Handbook.

As discussed in the Presidential Memorandum – Managing Government 

Records, (Nov. 28, 2011), current and relevant records management information 

is needed to ensure the SEC’s records are properly managed. Outdated records 

management and vital records information has resulted in SEC staff not 

effectively managing records and has resulted in staff not fully complying with 

governing Federal records management statutes and the requirements that are

established in the SECR-7 series.

Recommendation 12: 

The Office of Support Operations should ensure the Office of 

Records Management Services (ORMS) revises the Securities and 

Exchange Commission’s (SEC) administrative regulations on 

records management and determines whether it will rescind the 

Vital Records Handbook. Once ORMS updates the SEC 

administrative regulations it should inform and train SEC 

employees on the updated records management administrative 

regulations. 

Management Comments. OSO concurred with this recommendation. 

See Appendix VII for management’s full comments. 

OIG Analysis. We are pleased that OSO concurred with this 

recommendation. 
Appendix I 

SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 32

Federal Agencies 

Records Management Responsibilities 

Agency heads have specific legal requirements for records management which 

include: 

 

 Making and preserving records that contain adequate and proper 

documentation of the organization’s functions, policies, decisions, 

procedures, and essential transactions. The records must be 

designed to furnish the information needed to protect the legal and 

financial rights of the government and persons directly affected by 

the agency's activities;50 

 Establishing and maintaining an active, continuous program for the 

economical and efficient management of the agency’s records 51; 

 Establishing safeguards against the removal or loss of records and 

making requirements and penalties known to agency officials and 

employees; and 52 

 Notifying the Archivist of any actual, impending, or threatened unlawful 

destruction of records and assisting in their recovery.53

36 C.F.R. § 1220.32, dictates that federal agencies must create and maintain 

authentic, reliable, and usable records and ensure that they remain so for the 

length of their authorized retention period. A comprehensive records 

management program provides policies and procedures for ensuring that: 

(a) Records documenting agency business are created or 

captured; 

(b) Records are organized and maintained to facilitate 

their use and ensure integrity throughout their 

authorized retention periods; 

(c) Records are available when needed, where needed, 

and in a usable format to conduct agency business; 

(d) Legal and regulatory requirements, relevant 

standards, and agency policies are followed; 

(e) Records, regardless of format, are protected in a safe 

and secure environment and removal or destruction is 

carried out only as authorized in records schedules; 

and

 

50 44 U.S.C. § 3101. 

51 44 U.S.C. § 3102. 

52 44 U.S.C. § 3105. 

53 44 U.S.C. § 3106. 
Appendix I

SEC’s Records Management Practices September 30, 2012

Report No. 505

Page 33

(f) Continuity of operations is supported by a vital 

records program (see part 1223 of this subchapter).54

Further, 36 C.F.R. § 1220.34, discusses the following activities federal agencies 

must perform for records management:

(a) Assign records management responsibility to a person and 

office with appropriate authority within the agency to 

coordinate and oversee implementation of the agency 

comprehensive records management program principles in § 

1220.32;

(b) Advise NARA and agency managers of the name(s) of the 

individual(s) assigned operational responsibility for the 

agency records management program;

(c) Issue a directive(s) establishing program objectives, 

responsibilities, and authorities for the creation, 

maintenance, and disposition of agency records. Copies of 

the directive(s) (including subsequent amendments or 

supplements) must be disseminated throughout the agency, 

as appropriate, and a copy must be sent to NARA;

(d) Assign records management responsibilities in each 

program (mission) and administrative area to ensure 

incorporation of recordkeeping requirements and records 

maintenance, storage, and disposition practices into agency 

programs, processes, systems, and procedures;

(e) Integrate records management and archival requirements 

into the design, development, and implementation of 

electronic information systems as specified in § 1236.12 of 

this subchapter;

(f) Provide guidance and training to all agency personnel on 

their records management responsibilities, including 

identification of Federal records, in all formats and media;

(g) Develop records schedules for all records created and 

received by the agency and obtain NARA approval of the 

schedules prior to implementation, in accordance with 36 

C.F.R. parts 1225 and 1226 of this subchapter;

(h) Comply with applicable policies, procedures, and standards 

relating to records management and recordkeeping 

requirements issued by the Office of Management and 

Budget, NARA, General Services Administration, or other 

agencies, as appropriate;

(i) Institute controls ensuring that all records, regardless of 

format or medium, are properly organized, classified or 

 

54 36 C.F.R. § 1220.32.
Appendix I 

SEC’s Records Management Practices September 30, 2012 

Report No. 505

Page 34

indexed, and described, and made available for use by all 

appropriate agency staff; and

(j) Conduct evaluations to measure the effectiveness of records 

management programs and practices, and to ensure that 

they comply with NARA regulations in this subchapter.
Appendix II

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 35

Abbreviations

CFR Code of Federal Regulations

COOP Continuity of Operations 

CSC Continuity Services Center

FCD Federal Continuity Directive

FEMA Federal Emergency Management 

Agency

FOIA Freedom of Information Act

FRC Federal Records Center

GRS General Records Schedules

NARA National Archives and Records 

Administration

NFC Department of Agriculture’s National 

Finance Center

OCOO Office of the Chief Operating Officer

OFIS Office of Filings and Information 

Services

OHR Office of Human Resources

OIG Office of Inspector General

OIT Office of Information Technology

ORMS Office of Records Management 

Services

OSO Office of Support Operations

OSS Office of Security Services

POC Point-of-Contact

SEC or 

Commission

U.S. Securities and Exchange 

Commission

SECR SEC Administrative Regulation

SF Standard Form

SOP Standard Operating Policy
Appendix III 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 36

Scope and Methodology

As part of our annual audit plan the OIG conducted an audit of the SEC’s records 

management program. 

We conducted this performance audit in accordance with generally accepted 

government auditing standards. Those standards require that we plan and 

perform the audit to obtain sufficient, appropriate evidence to provide a 

reasonable basis for our findings and conclusions based on our audit objectives. 

We determined that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives. 

Scope. The scope of our audit covered calendar years 2008 to 2010 and 

January 2011 to September 2011. Our initial fieldwork was conducted from late 

October 2011 to February 2012. Our audit focused on SEC’s records 

management program and practices and determining whether its records 

management program enables the agency to properly handle records in 

accordance with applicable federal statute and guidance. In addition, we 

reviewed records management procedures and practices that SEC offices and 

divisions follow to assess whether they are in compliance with the SEC’s 

administrative regulations and federal laws on records management. 

Due to a staffing shortage, the audit was temporarily suspended from March to 

early July 2012. The report’s findings, conclusions and recommendations for this 

report were reconfirmed from mid-July to August 2012. 

Methodology. To meet the objectives of assessing whether ORMS established a 

viable records management program that ensures permanent SEC records are 

appropriately maintained and preserved in accordance with applicable federal 

statutes and regulations, we obtained and reviewed applicable records 

management federal regulations and examined SEC’s records management 

program and practices to determine whether the Commission complies with the 

federal statue and regulations. OIG met with ORMS management and its staff to 

discuss SEC’s records management program and compliance with federal laws 

on records management. We inquired NARA officials about their assessment of 

SEC’s records management program. Further, we reviewed NARA’s 2010 and 

2011 records management self-assessment reports on records management 

programs in the federal government. The self-assessment reports scored federal 

agencies on their compliance with federal statue, including NARA guidance, on 

records management. We reviewed the results of SEC’s records management 

program that were included in the self-assessment reports. We also met with 

records management POCs as well as other management officials who are 

responsible for records management program in SEC offices and divisions to 
Appendix III 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 37

assess whether their practices and procedures complied with federal statute on 

records management. Also, we contacted three federal agencies to learn about 

their records management program and to determine how they comply with 

records management federal regulations. We also developed and administered 

a survey to directors, business managers, administrative officers in SEC offices 

and divisions regarding their records management program and knowledge 

about federal statue on records management. OIG reviewed and analyzed the 

results of the survey.

To achieve the objective of examining whether ORMS adheres to applicable 

federal statutes and regulations regarding the retention, disposal, transfer, and 

recovery of SEC records, we reviewed a sample of records requests that were 

processed by ORMS. We examined SEC offices and divisions records 

management practices for retaining and disposing of records and their process 

for reviewing their records retention schedule. We also inquired ORMS 

management, its staff, and SEC offices and divisions about the procedures in 

place to ensure SEC complies with federal statutes and regulations regarding the 

retention, disposal, transfer and recovery of SEC records. Further, we also 

examined SEC’s records management practices to determine if they are in 

compliance with SEC’s administrative regulations on records management. 

Some of the questions in the survey we administered to directors, business 

managers, and administrative officers addressed matters related to their handling 

of records they created or received from external sources. 

Finally, we identified areas which improvement could be made, documented the 

results of our audit work and facilitated implementation of recommendations 

noted in the report.

Internal Controls. For this audit, we based our assessment of ORMS’ internal 

controls that were significant to the audit objectives on the Committee of 

Sponsoring Organizations of the Treadway Commission framework, such as 

control environment, control activities, information and communication, and 

monitoring. Among the internal controls that we assessed were ORMS’ controls 

related to processing records requests, management’s monitoring process over 

records requests that could not be processed within 20 days, and ORMS’ policies 

and procedures to meet its objectives. 

Judgmental and Statistical Sampling. ORMS provided us with a list of all 

records requests it received from January 1, 2008 to September 30, 2011. 

ORMS’ universe of records requests totaled 8,015. We used the EZ Quant 

Statistical Analysis Audit tool to generate a statistical sample of 89 records 

requests. The sample was designed to project rates of occurrence with 90 

percent confidence that the point estimate is within ± 5 percent of the audit 

universe. 
Appendix III 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 38

We also judgmentally selected additional 16 records requests from the list to 

ensure that our sample included the various types of records requests such as 

records requested by external parties. Because we used both judgmental and 

statistical sampling techniques, we did not try to project the results of records 

requests reviewed in our sample to the entire population. 

Prior Audit Coverage. In 1997, the OIG performed an audit of the SEC’s 

automation of records management to determine if the Commission has 

established sufficient policies and procedures for electronic records and to 

identify possible improvements to electronic records management.

 Automated Records Management, Report No. 262, September 29, 

1997. 

The report included six recommendations. Three recommendations were issued 

to the former Office of Filings and Information Services (OFIS) which included 

records management function and the remaining three recommendations were 

issued to OIT. Both OFIS and OIT concurred with the recommendations that 

were issued to them. For the recommendations that were issued to OFIS, OIG 

asked ORMS management on the status of the recommendations. ORMS 

management stated that since ORMS Archivist’s arrival at the SEC, they enacted 

processes that were responsive to all of the recommendations directed to OFIS. 

Based on supporting documents ORMS management provided, OIG determined 

that the recommendations issued to OFIS were addressed and closed. Further, 

OIG determined that OIT addressed the recommendations issued to them, and 

these recommendations were also closed. 
Appendix IV 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 39

Criteria 

36 C.F.R. § 1220 Federal Records: General, Subpart A, General Provisions 

and Subpart B, Agency Records Management Program Responsibilities. 

Discusses, among other things, who is responsible for records management, 

NARA’s responsibilities for records management such as issuing regulations on 

records management, establishing standards for the retention of records having 

continuing value, etc., and federal agencies’ records management 

responsibilities and what federal agencies must do to carry out their records 

management responsibilities. 

44 U.S.C. § 2901 - Definitions. Provides definitions for terms used for records 

management, including records disposition.

44 U.S.C. § 31- Records Management by Federal Agencies. States general 

duties of records management by agency heads, establishment of program of 

records management, and transfer of records to records center, etc. 

44 U.S.C. § 33 - Disposal of Records. Discusses, among other things,

definition of records, regulations covering lists of records for disposal and 

procedure for disposal. 

Federal Continuity Directive 1 (FCD 1), Federal Executive Branch National 

Continuity Program and Requirements. Discusses a requirement for federal 

agencies to have a vital records program that must include an annual review of 

the program to address new security issues, identify problem areas, update 

information, and incorporate any additional vital records generated by new 

agency programs or functions or by organization changes to existing programs or 

function. 

SECR 7-1, SEC Administrative Regulation, Records Management Program 

(September 29, 1996). Lists SEC’s records management program requirements 

and objectives and assigns responsibilities for records management. 

SECR 7-2, SEC Administrative Regulation, Records Management, Creation, 

Maintenance and Use of Records, Including Files (August 5, 1993). 

Discusses SEC’s procedures and policies for records management. 

SECR7-3, SEC Administrative Regulation, Disposition of Securities and 

Exchange Commission Records (July 21, 1993). Prescribes policies, 

responsibilities, program objectives, and procedures for disposing, retiring or 

transferring records. Applies to personnel who create or accumulate records 

agency-wide. 
Appendix IV 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 40

SECR7-6, SEC Administrative Regulation, Electronic Records 

(May 23, 1991). Prescribes policies, responsibilities, and procedures for 

establishing, testing, and implementing electronic recordkeeping as alternatives 

to or in conjunction with paper records subject to SECR 7-2. Provides guidance 

to ensure permanent preservation of archival information which is in machinereadable form. 

SECR7-7, SEC Administrative Regulation, Records Management, Vital 

Records (July 21, 1993). Establishes SEC’s vital records program and provides 

guidance and instructions for implementing the program. Applies to agency-wide 

staff and activities. 

ORMS’ Standard Operating Policy. The SOP identifies ORMS’ policies and 

procedures for processing records requests and it identifies the offices’ 

responsibilities. 

OMB Circular A-123, Management’s Responsibility for Internal Control, 

(December 21, 2004) (Revised). Establishes that management has a 

fundamental responsibility to develop and maintain effective internal control. 
Appendix V 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 41

List of Recommendations 

Recommendation 1: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) periodically conducts agency-wide staff 

assistance visits of the Securities and Exchange Commission offices’ and 

divisions’ records management programs in accordance with SECR 7-1, 

Securities and Exchange Commission’s Records Management Program. To 

assist in this process, ORMS should develop a plan that identifies the timeline for 

the conduct and scope of the staff assistance visits. 

Recommendation 2: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) develops a records management training 

program that covers training sessions for all Securities and Exchange 

Commission employees. ORMS should determine the audience, scope, 

material, and training schedule. Training factors ORMS should consider include 

defining records, how to treat records in accordance with Federal regulations and 

records retention schedule, records management responsibilities for employees 

and designated points-of-contact. 

Recommendation 3: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) develops internal controls that assure ORMS 

staff are provided oversight and adhere to the office’s standard operating policy. 

Recommendation 4: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) works with the Securities and Exchange 

Commission (SEC) offices and divisions to ensure they all have current records 

retention schedules that encompass the office’s or division’s records. 

Accordingly, ORMS should determine whether it should update the SEC’s 

comprehensive records retention schedule to ensure it is reflective of current 

SEC offices’ and divisions’ records.
Appendix V 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 42

Recommendation 5: 

The Office of Support Operations should ensure the Office of Records 

Management Services establishes records management procedures that enable 

the offices and divisions to properly manage their records in accordance with 

applicable federal regulations and Securities and Exchange Commission’s 

administrative regulations. 

Recommendation 6: 

The Office of Support Operations should ensure the Office of Records 

Management Services establishes a definitive plan and milestones to review the 

remaining backlog of boxes that are being maintained at the Federal Records 

Center and ensures proper disposition of the records that are contained in the 

boxes. 

Recommendation 7: 

The Office of Support Operations should ensure the Office of Records 

Management Services provides guidance to records management points-ofcontact and requires, at least annually, they determine whether there are any 

records requiring disposal for their individual offices and divisions. 

Recommendation 8: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) develops an action plan to address the 10-year 

backlog of records that the Federal Records Center (FRC) identified as eligible 

for destruction. In developing an action plan, ORMS should determine a timeline 

to address the backlog of records, a timeline to conduct a full inventory of the 

Security and Exchange Commission’s records, and how ORMS will address the 

indexing system for archived records. 

Recommendation 9: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) issues a directive, requiring all Securities and 

Exchange Commission offices and divisions to designate a point-of-contact 

(POC) for records management matters and inform ORMS of their designated 

POC. ORMS should maintain a list of POCs that is verified annually. 
Appendix V 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 43

Recommendation 10: 

The Office of Support Operations should ensure the Office of Security Services, 

in coordination with the Office of Records Management Services, develops a vital 

records program that includes processes and procedures to establish and 

maintain the Securities and Exchange Commission’s vital records in accordance 

with applicable Federal regulations and the National Archives and Records 

Administration’s guidance on vital records management. 

Recommendation 11: 

The Office of Support Operations should ensure the Securities and Exchange 

Commission’s (SEC) procedures and processes for vital records management 

include, but are not limited to: 

1) Designating points-of-contact (POC) for offices or division that have 

vital records; 

2) Ensuring appropriate hardware, software and system documentation 

are adequate to operate the systems and can access SEC’s vital 

records in cases of emergencies; 

3) Ensuring vital records information is updated throughout the year and 

reviewed annually; and 

4) Providing designated POCs with vital records requirements or new 

information at least once a year. 

Recommendation 12: 

The Office of Support Operations should ensure the Office of Records 

Management Services (ORMS) revises the Securities and Exchange 

Commission’s (SEC) administrative regulations on records management 

and determines whether it will rescind the Vital Records Handbook. Once 

ORMS updates the SEC administrative regulations it should inform and 

train SEC employees on the updated records management administrative 

regulations. 
Appendix VI 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 44

Definitions

1. Disposing of Records - 44 U.S.C. § 2901, defines disposing of records as 

any activity related to: (a) the destruction of temporary records that are no 

longer necessary for the conduct of business; (b) transferring records to the 

Federal agency storage facility such as FRC or a third-party storage; (c) 

transferring records determined to have sufficient historical or other value 

warranting continued preservation to NARA; or (d) the transfer of records 

from one Federal agency to any other Federal agency. 

2. General Records Schedule - According to NARA, general records schedule 

is issued by the Archivist of the United States to provide disposition 

authorization for records common to several or all agencies of the Federal 

Government. They include records relating to civilian personnel, fiscal 

accounting, procurement, communications, printing, and other common 

functions, and certain non-textual records. They also include records relating 

to temporary commissions, boards, councils and committees. Because these 

schedules are designed to cover records common to several agencies, many 

record descriptions are general. 

3. Records - 44 U.S.C. § 3301 defines records as all books, papers, maps, 

photographs, machine readable materials, or other documentary materials, 

regardless of physical form or characteristics, made or received by an agency 

of the United States government under federal law or in connection with the 

transaction of public business and preserved or appropriate for preservation 

by that agency or its legitimate successor as evidence of the organization, 

functions, policies, decisions, procedures, operations, or other activities of the 

government or because of the informational value of data in them. 

4. Records Retention Schedule - 36 C.F.R. § 1220.18 defines records 

schedule as any of the following:

(1) SF 115, Request for Records Disposition Authority, which were

approved by NARA to authorize the disposition of Federal records;

(2) GRS issued by NARA; or

(3) A published agency manual or directive containing the records 

descriptions and disposition instructions approved by NARA on one or 

more SF 115s or issued by NARA in the GRS. 

5. Scheduled Records - Federal records whose final disposition has been 

approved by NARA on a SF 115, Request for Records Disposition Authority, 

GRS, or in a federal agency’s manual or directive containing the records 

descriptions and disposition instructions approved by NARA.
Appendix VI 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 45

6. Temporary Records - 36 C.F.R. § 1220.18 defines temporary records as any 

Federal record that has been determined by the Archivist of the United States 

to have insufficient value (on the basis of current standards) to warrant its 

preservation by [NARA]. This determination may take the form of: (1) records 

designated as disposable in an agency records disposition schedule 

approved by NARA (SF 115, Request for Records Disposition Authority); or 

(2) records designated as disposable in GRS. 

7. Unscheduled Records - Federal records whose final disposition has not 

been approved by NARA on a SF 115, Request for Records Disposition 

Authority or records designated as disposable in GRS. Such records must be 

treated as permanent until a final disposition is approved.

8. Vital Records - According to NARA, vital records are “essential agency 

records that are needed to meet operational responsibilities under national 

security emergencies or other emergency conditions (emergency operating 

records) or to protect the legal and financial rights of the Government and 

those affected by Government activities (legal and financial rights records).” 

Additionally NARA defines vital records program as “the policies, plans, and 

procedures developed and implemented and the resources needed to 

identify, use, and protect the essential records needed to meet operational 

responsibilities under national security emergencies or other emergency 

conditions or to protect the Government’s rights or those of its citizens.”
Appendix VII 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 46

Management Comments 
Appendix VII 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 47
Appendix VII 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 48
Appendix VII 

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 49
Appendix VIII

SEC’s Records Management Practices September 30, 2012 

Report No. 505 

Page 50

OIG’s Response to Management’s Comments

We are pleased OSO concurred with all 12 recommendations in our report and 

are encouraged that the office will take the steps needed to fully implement the 

recommendations. We believe that the full implementation of these

recommendations will serve to strengthen the SEC’s records management 

practices. 

However, OIG disagrees with certain statements in OSO’s overall response to 

this report. In particular, OSO’s statement that the scope of our audit and 

recommendations highlight issues that existed prior to 2008 is not factual. The 

scope of our audit was from January 1, 2008 to September 30, 2011, and our 

audit results are based on appropriate, factual evidence and OIG observations 

that were made during the scope of the audit. The administrative regulations that 

OIG applied to some of our findings and recommendations are based on the five 

SECRs that are specific to records management, and were issued by the SEC 

from May 1991 to September 1996. Consequently, OIG recommended and OSO 

agreed to revise these SECRs. 

 

Further, while OSO’s statement the office conducted 383 records management 

related meetings encompassing staff of 5 SEC divisions and 17 offices may be 

true, OSO did not provide OIG with any evidence the office conducted staff 

assistance visits from 2008 to 2011 of the SEC’s 36 offices, divisions, and 

regional offices, in accordance with SECR 7-1, Securities and Exchange 

Commission’s Records Management Program, which states the records officer 

should schedule and make staff assistance visits to each SEC office of record at 

least every 18 months. 

Additionally, though ORMS provided records management training to a large 

number of SEC staff, it has not provided records management training to all SEC 

staff in compliance with 36 C.F.R. § 1220.34(f), which indicates Federal agencies 

must “provide guidance and training to all agency personnel on their records 

management responsibilities, including the identification of Federal records...” 
Audit Requests and Ideas 

The Office of Inspector General welcomes your input. If you would like to 

request an audit in the future or have an audit idea, please contact us at: 

U.S. Securities and Exchange Commission 

Office of Inspector General 

Attn: Assistant Inspector General for Audits (Audit Request/Idea) 

100 F Street, N.E. 

Washington D.C. 20549-2736 

Tel. #: 202-551-6061 

Fax #: 202-772-9265 

Email: oig@sec.gov 

Hotline 

To report fraud, waste, abuse, or mismanagement at the SEC, 

contact the Office of Inspector General at: 

Phone: 877.442.0854 

Web-based Hotline Complaint Form: 

www.reportlineweb.com/sec_oig