AUDIT REPORT

Audit of NRC’s Freedom of Information Act Process

OIG-14-A-17 June 16, 2014

All publicly available OIG reports (including this report) are accessible through

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

June 16, 2014

MEMORANDUM TO: Mark A. Satorius

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S FREEDOM OF INFORMATION ACT 

PROCESS (OIG-14-A-17)

Attached is the Office of the Inspector General’s (OIG) audit report titled Audit of NRC’s 

Freedom of Information Act Process.

The report presents the results of the subject audit. Following the June 11, 2014, exit 

conference, agency staff indicated that they had no formal comments for inclusion in 

this report.

Please provide information on actions taken or planned on each of the 

recommendations within 30 days of the date of this memorandum. Actions taken or 

planned are subject to OIG followup as stated in Management Directive 6.1.

We appreciate the cooperation extended to us by members of your staff during the 

audit. If you have any questions or comments about our report, please contact me at 

415-5915 or Beth Serepca, Team Leader, at 415-5911.

Attachment: As stated 

cc: M. Galloway, OEDO

K. Brock, OEDO

J. Arildsen, OEDO

C. Jaegers, OEDO

RidsEdoMailCenter
Audit of NRC’s Freedom of Information Act of Process

i

EXECUTIVE SUMMARY

BACKGROUND

The Freedom of Information Act (FOIA) is a Federal law that provides any 

person the right to submit a written request for access to records or 

information maintained by the Federal Government. The Nuclear 

Regulatory Commission’s (NRC) FOIA program is managed by the FOIA, 

Privacy, and Information Collections Branch (referred to in this report as 

the FOIA office) within the Office of Information Services, Customer 

Service Division. 

The FOIA process begins when the agency (1) receives – via mail, 

facsimile, or Internet – an incoming FOIA request, (2) assigns it a number, 

and (3) determines which NRC offices need to review their records to 

identify whether they have information pertinent to the request and sends 

a request to those offices. FOIA coordinators in responsive offices 

provide an estimate of the search, review, and duplication effort required 

to produce any documents identified as within the scope of the request. 

The FOIA office then estimates the associated processing fees (for which 

the requester may be responsible), advises the requester as to the 

amount due, and assigns the request to the appropriate offices to identify 

and provide to the FOIA office all relevant documents from their office 

within an assigned timeframe. To facilitate appropriate disclosure of 

records, the FOIA coordinators consult as needed with agency staff in the 

responding offices and/or the Office of the General Counsel to prepare a 

response. The response is reviewed and signed by the FOIA officer, and 

sent to the requester. 

OBJECTIVE

The audit objective was to determine whether the FOIA process is efficient 

and complies with the current laws.

RESULTS IN BRIEF

NRC generally responds to FOIA requests in accordance with Federal 

requirements. The agency meets the timeliness requirements for simple 

FOIA requests and adheres to the vast majority of FOIA regulations; 

however, opportunities exist to improve program efficiency and increase 
Audit of NRC’s Freedom of Information Act of Process

ii

Federal compliance by (A) fully using technology and enhancing training 

requirements and (B) adhering to review and approval regulations.

Operational Efficiency Could Be Improved 

The efficiency of NRC’s FOIA program can be improved by fully using 

available technology and enhancing agency training. Federal agencies 

should have the necessary tools and training to respond promptly and 

efficiently to FOIA requests. However, NRC management has not 

implemented effective internal controls. As a result, FOIA processing 

costs are high and the timeliness requirements are not consistently met.

Management Level Reviews Are Inconsistent 

NRC is not in compliance with FOIA regulations as initial disclosure 

reviews of FOIA records are done at inconsistent management levels. 

Federal regulations state that, during the initial disclosure review, the head 

of the responsible office must review agency records to determine whether 

the agency records are exempt from disclosure; however, there is no 

enforcement of this policy and there is no method to track these reviews. 

Additionally, NRC’s internal guidance differs from the Code of Federal 

Regulations. This may result in (A) a reduced number of discretionary 

releases or (B) the inadvertent release of sensitive information.

RECOMMENDATIONS

This report makes nine recommendations to improve the efficiency of 

NRC’s FOIA process.

AGENCY COMMENTS

An exit conference was held with the agency on June 11, 2014. Prior to 

this meeting, after reviewing a discussion draft, agency management 

provided supplemental information that has been incorporated into this 

report, as appropriate. As a result, agency management stated their 

general agreement with the findings and recommendations in this report 

and opted not to provide formal comments for inclusion in this report.
Audit of NRC’s Freedom of Information Act of Process

iii

ABBREVIATIONS AND ACRONYMS

ADAMS Agencywide Documents Access and Management System

CFR Code of Federal Regulations

DOJ The Department of Justice’s Office of Information Policy 

FOIA The Freedom of Information Act

NRC Nuclear Regulatory Commission

OIG Office of the Inspector General

OIS Office of Information Services

TABS Transforming Assets into Business Solutions
Audit of NRC’s Freedom of Information Act of Process

iv

TABLE OF CONTENTS

EXECUTIVE SUMMARY....................................................................................... i

ABBREVIATIONS AND ACRONYNMS................................................................iii

I. BACKGROUND.................................................................................... 1

II. OBJECTIVE ......................................................................................... 5

III. FINDINGS ........................................................................................... 5

A. Operational Efficiency Could Be Improved ............................ 5

B. Management Level Reviews Are Inconsistent ..................... 16

IV. CHALLENGES ................................................................................... 20

V. CONSOLIDATED LIST OF AGENCY RECOMMENDATIONS .......... 22

VI. AGENCY COMMENTS....................................................................... 23

APPENDIXES

A. OBJECTIVE, SCOPE, AND METHODOLODY........................................ 24

B. FOIA Exemptions..................................................................................... 26
Audit of NRC’s Freedom of Information Act Process

1

I. BACKGROUND 

The Freedom of Information Act (FOIA)1 is a Federal law that provides any 

person the right to submit a written request for access to records or 

information maintained by the Federal Government. In response to such 

written requests, Federal agencies must disclose the requested records, 

unless they are protected from release under one of the nine FOIA 

statutory exemptions.2

 FOIA mandates that all agencies shall readily 

promulgate information, agency rules, opinions, orders, records, and 

proceedings to the public.

Executive Memoranda

In 2009, President Barack Obama and Attorney General Eric Holder 

issued memoranda on the FOIA. These statements of FOIA policy 

emphasized that the FOIA "should be administered with a clear 

presumption: in the face of doubt, openness prevails." The President also 

directed agencies to "take affirmative steps to make information public" 

and not to "wait for specific requests from the public." The Attorney 

General's FOIA Guidelines stressed the need for agencies to: 

• Have efficient and effective systems in place for responding to 

requests. 

• Increase proactive disclosures. 

• Improve the use of technology.

• Reduce backlogs of pending FOIA requests and appeals. 

• Improve timeliness in responding to requests.

Federal FOIA Oversight

The Department of Justice’s Office of Information Policy (hereinafter 

referred to as DOJ) oversees agencies’ FOIA implementation. 

Additionally, DOJ also issues FOIA policy guidance, conducts FOIArelated training programs to Government staff, and is responsible for 

encouraging compliance. 

 1 5 U.S.C. § 552, As Amended

2 See Appendix B for a listing of the nine statutory exemptions.
Audit of NRC’s Freedom of Information Act Process

2

NRC Guidance

The Nuclear Regulatory Commission’s (NRC) FOIA requirements are 

conveyed in the Code of Federal Regulations (CFR) under Title 10, Part 9, 

Subpart A, “Freedom of Information Act Regulations.” NRC Management 

Directive and Handbook 3.1, “Freedom of Information Act,” provides 

guidance on NRC’s FOIA policy and implementation of the FOIA process.3

 

NRC also maintains an internal and public Web site with FOIA information 

available to staff.

FOIA Process

NRC’s FOIA program is managed by the FOIA, Privacy, and Information 

Collections Branch (referred to in this report as the FOIA office4

) within the 

Office of Information Services (OIS), Customer Service Division. The 

FOIA process begins when the agency (1) receives – via mail, facsimile, 

or Internet – an incoming FOIA request, (2) assigns it a number, and (3) 

determines which NRC offices need to review their records to identify 

whether they have information pertinent to the request and sends a 

request to those offices. FOIA coordinators5 in responsive offices provide

an estimate of the search, review, and duplication effort required to 

produce any documents identified as within the scope of the request. 

The FOIA office then estimates the associated processing fees (for which 

the requester may be responsible), advises the requester as to the 

amount due, and assigns the request to the appropriate offices to identify 

and provide to the FOIA office all relevant documents from their office 

within an assigned timeframe. To facilitate appropriate disclosure of 

records, the FOIA coordinators consult as needed with agency staff in the 

responding offices and/or the Office of the General Counsel to prepare a 

response. The response is reviewed and signed by the FOIA officer, and 

 3 Management Directive 3.1 was last revised on June 8, 2011. 

4 The FOIA office consists of a branch chief, FOIA officer, administrative assistant, and Government 

information specialists (also known as FOIA specialists). FOIA specialists consist of NRC employees and 

contractors.

5 Each NRC office has a FOIA coordinator who acts as a central point of contact for his/her respective 

office. The coordinator serves as a liaison between the FOIA office and the subject matter experts who 

are responsible for collecting and redacting, as appropriate, the FOIA records within the program offices.
Audit of NRC’s Freedom of Information Act Process

3

sent to the requester. See Figure 1 for a simplified FOIA process 

flowchart.

Figure 1: FOIA Process Flowchart

Source: Office of the Inspector General (OIG)

Agencies have a statutory responsibility to make a determination on FOIA 

requests within 20 working days. This type of FOIA request is known as a 

“simple” request. The FOIA also gives agencies the right to extend that 

time by 10 working days when a given request requires additional search 

time or consideration. These types of requests are called “complex” 

requests. This may apply when (1) NRC needs to assemble responsive 

records from its regional offices; (2) the request involves a "voluminous" 

amount of records that must be located, compiled, and reviewed; or (3) 

NRC must consult with another NRC office or Federal agency that may 

have originated the information or have a substantial interest in the 

information.

Japan FOIA Team

Also working on FOIA responses since June of 2011 is a temporary 

“Japan team.” The Japan team was created by the Office of Nuclear 

Security and Incident Response and OIS for the sole purpose of 

responding to the numerous requests for agency records related to the 
Audit of NRC’s Freedom of Information Act Process

4

March 2011 Fukushima Daiichi nuclear disaster.6

 Established shortly after 

the Fukushima incident, the Japan team has posted almost 260,000 

pages of responsive records to the agency’s Web site, and has completed 

its review of the last responsive documents. The team anticipates closing 

out all the requests by the end of June 2014. Once the responses are 

completed, the members of the team will either be reassigned or released. 

For these reasons, the Japan team was excluded from the scope of this 

audit.

FOIA Centralization

As part of the NRC Transforming Assets into Business Solutions (TABS)7 

initiative, NRC intends to streamline the FOIA process by eliminating the 

current FOIA coordinator positions within the program offices.8

 

Centralization will move most program office FOIA-related administrative 

functions to the FOIA branch within OIS. Currently, the majority of 

program offices have a FOIA coordinator who is an employee of that office 

and fulfills the coordinator responsibilities as a collateral duty. 

Centralization will transfer these responsibilities to the FOIA office, which 

will add four additional staff to enable it to handle the added workload. 

Centralization is expected to be completed in FY 2015.

 6 On March 11, 2011, a 9.0-magnitude earthquake and an estimated 45-foot-high tsunami struck Japan 

off the Honshu Island coast at the Fukushima Daiichi nuclear power plant, causing a hydrogen explosion 

and release of radioactive material. Radioactive contamination spread over a large area of Japan, 

requiring the relocation of tens of thousands of people.

7 TABS is an agencywide initiative to reduce the duplication of efforts in corporate support and office 

support areas such as human resources, information technology, financial management, and contract 

management. The goal of TABS is to reduce agency overhead by finding solutions for the most effective 

and efficient delivery of business support services. 

8 The Office of Enforcement, Office of the Secretary, Office of Investigations, regional offices, and OIG 

are currently excluded from centralization because of functional and logistical impediments.
Audit of NRC’s Freedom of Information Act Process

5

II. OBJECTIVE

The audit objective was to determine whether the FOIA process is efficient 

and complies with the current laws. Report Appendix A contains 

information on the audit scope and methodology.

III. FINDINGS

NRC generally responds to FOIA requests in accordance with Federal 

requirements. The agency meets the timeliness requirements for simple 

FOIA requests and adheres to the vast majority of FOIA regulations; 

however, opportunities exist to improve program efficiency and increase 

federal compliance by (A) fully using technology and enhancing training 

requirements and (B) adhering to review and approval regulations.

A. Operational Efficiency Could Be Improved 

The efficiency of NRC’s FOIA program can be improved by fully using 

available technology and enhancing agency training. Federal agencies 

should have the necessary tools and training to respond promptly and 

efficiently to FOIA requests. However, NRC management has not 

implemented effective internal controls. As a result, FOIA processing 

costs are high and the timeliness requirements are not consistently met.

Processes Should Be Efficient 

Federal agencies, to include NRC, should have the necessary tools and 

training to respond promptly and efficiently to FOIA requests. FOIA 

professionals deserve the full support of the agency's Chief FOIA Officer 

to ensure that they have the tools they need to respond promptly and 

efficiently to FOIA requests. Additionally, all agencies should use modern 

technology to inform citizens about what is known and done by their 

Government. DOJ guidance and best practices suggest that agencies 

should actively explore using technology to process FOIA requests.
Audit of NRC’s Freedom of Information Act Process

6

The Open Government National Action Plan for the United States of 

America9 recommends that all agency employees, not just FOIA 

personnel, have FOIA training in order to efficiently and effectively 

respond to FOIA requests. DOJ guidance and best practices maintains 

that each agency should require that its personnel, both FOIA and nonFOIA, attend training to understand FOIA guidelines on transparency.

Processes Could Be More Efficient 

Use of Technology Could Be Expanded 

NRC does not use technology to the fullest extent possible in processing 

its FOIA requests. The individuals in the program office responsible for 

searching for the requested information (also known as the subject matter 

experts) must provide the records to the FOIA office which, in turn, 

supplies the records to the requester. In many of these instances, when 

the subject matter experts locate the requested records, they must first 

redact any information that falls under one of the statutory exemptions.10 

For example, any records containing personally identifiable information or 

classified information would either be completely withheld or provided to 

the requester with redactions protecting the sensitive information. 

The entire redaction process is tedious and paper intensive. If subject 

matter experts need to redact any information, they must first make sure 

they print the responsive records as this process is currently done 

manually. They must then manually place “brackets” around the 

information they wish to redact before forwarding the records to the FOIA 

office. The FOIA office staff must then scan the hardcopies into their 

computers before completing the actual redaction using specialized 

software. For a large FOIA request, there could be hundreds or 

thousands of pages to redact. 

 9 This plan, created by the Obama administration in 2011 and updated in 2013, lists a set of commitments 

and actions that have or will be taken by the Federal Government to create a more efficient, effective, and 

accountable Government.

10 The statutory exemptions can be found in Appendix B. Additionally, in order to withhold information in 

agency records, a foreseeable harm statement must be provided for Exemptions 2 and 5. 
Audit of NRC’s Freedom of Information Act Process

7

Several staff expressed frustration with this manual process. For 

example:

• The previous NRC FOIA officer and two FOIA coordinators stated 

that reviewing FOIA records is “very time-consuming.” 

• A contractor hired to process FOIA requests observed that the NRC 

FOIA process was still very “paper-laden” and opined that it should 

move to the electronic world. 

• A FOIA coordinator from a regional office said that he wanted 

electronic processing because his office has so much paperwork 

even though many of their records are already electronic; this is 

due to the need to print their FOIA records for NRC headquarters.

• A FOIA staffer said that rather than dealing with paper and 

microfilm, storing and processing everything electronically would be 

the most efficient way to go. 

A senior manager from DOJ stated that electronic processing really cuts 

down the manual processing time. The manager added that technology is 

the primary way to improve timeliness and that agencies need to go in the 

direction of processing FOIA requests electronically.

FOIAXpress

To process FOIA requests more efficiently, the FOIA office uses a 

commercial software application called FOIAXpress. FOIAXpress is a tool 

used for automating the FOIA request process by managing the entire 

lifecycle of a FOIA request, from initial request to final delivery of 

documents. The purpose of the software is to automate the FOIA request 

process in order to save Federal agencies time and money, while also 

ensuring compliance with DOJ requirements. However, as of March 28, 

2014, NRC’s FOIA office was using a version of FOIAXpress that was 

more than 2 years old (Version 7); the most current version is Version 9. 

This is significant for the following reasons:
Audit of NRC’s Freedom of Information Act Process

8

Working with outdated software decreases efficiency and increases the 

likelihood of errors in processing FOIA requests.

1. Version 9 of FOIAXpress introduced a feature called Advanced 

Document Review. Advanced Document Review is a 

deduplication11 technology that can significantly reduce email and 

document sets by filtering out duplicate and non-responsive emails 

and documents. This, in theory, saves valuable time and effort in 

redacting the FOIA records. 

According to the DOJ Open Government Plan 2.0, one of the most 

common delays in the processing of FOIA requests across the 

Government is the time spent by FOIA personnel searching for, 

deduplicating, and conducting initial responsiveness reviews on records. 

Much of this is done by hand or by using commercial software with limited 

capabilities for advanced document review and redaction. These steps 

must take place before a FOIA professional can even begin to review 

records for the application of FOIA exemptions and for ultimate release to 

FOIA requesters.

2. As a free add-on feature to Version 9 of FOIAXpress, there is an 

additional tool called Public Access Link. Public Access Link is a 

public-facing Web portal that provides electronic communication 

between requesters and Federal agencies. Public Access Link 

allows requesters to electronically submit FOIA requests, 

correspond with NRC, check the status of a request, receive their 

final documents, and access a number of dashboard presentations 

on NRC’s overall FOIA status – such as the number of open 

requests or number of requests received. 

To ensure that additional costs were not the primary deterrent to 

upgrading the software, OIG reviewed the FOIAXpress contract and noted 

that NRC purchased the annual maintenance support package. This 

annual support includes software version upgrades of FOIAXpress at no 

additional cost.

 11 Deduplication eliminates extra copies of data by saving just one copy and replacing the other copies 

with pointers that lead back to the original copy. In its simplest form, deduplication eliminates duplicate 

copies of the same file.
Audit of NRC’s Freedom of Information Act Process

9

Available Technology 

In addition to FOIAXpress, there are other technologies available to assist 

with FOIA processing. According to DOJ FOIA best practices, a key 

aspect of FOIA processing involves searching for records within the 

agency. These searches frequently entail searching through voluminous 

numbers of email messages and disparate records systems throughout 

the organization. Achieving real efficiency in FOIA processing will entail 

agencies maximizing their electronic recordkeeping capacities to facilitate 

identification of the location of records responsive to requests.

Positive Steps

While NRC could improve its use of technology to process FOIA requests, 

the agency is doing several things well and has taken steps to increase its 

electronic presence. For example:

• OIS is in the process of providing regions and certain program 

offices copies of RedactXpress,12 a software program which would 

allow subject matter experts to redact documents electronically 

rather than manually.

• NRC offers an extensive array of informational resources on its 

public Web site, including its FOIA Web page.

• In addition to its Web site, NRC proactively posts thousands of 

records in its publicly available electronic recordkeeping system 

(ADAMS),13 including records regarding the Fukushima disaster, 

investigation and enforcement actions, reactor regulation, nuclear 

material safety, licensing, environmental safety, nuclear security, 

nuclear research, and agency financial accountability.

 12 RedactXpress is a standalone redaction and declassification software tool used to permanently remove 

sensitive information from electronic documents. It eliminates the manual labor of making copies, tracking 

documents, and filing. 

13 Agencywide Documents Access and Management System.
Audit of NRC’s Freedom of Information Act Process

10

FOIA Training Can Be Improved

The FOIA training at NRC could be improved. While there is a basic 

online training course and some occasional agencywide live training 

sessions, there are currently no FOIA training requirements for FOIA 

specialists, FOIA coordinators, or agency staff in general. Many of the 

FOIA specialists and FOIA coordinators claimed that their training was 

essentially “on-the-job.” 

Several NRC staff expressed frustration with the lack of training for some 

of the FOIA specialists. Some of the issues include:

• FOIA requests are often far too broad in scope, requiring FOIA 

coordinators to search for “any and all” related to a FOIA request. 

Several coordinators feel that the FOIA office does not do a 

sufficient job of calling requesters and narrowing the scope of their 

requests. 

• Lack of knowledge regarding NRC’s processes and program 

offices. 

• Lack of knowledge regarding FOIA law.

Further, as a possible indicator of a lack of training for NRC staff and FOIA 

coordinators, two external stakeholders who have frequently submitted 

NRC FOIA requests have also been frustrated with certain aspects of 

NRC’s FOIA process. Particularly, they were troubled by the inconsistent 

redactions produced by NRC. 

For example, one stakeholder claimed that certain information may be

redacted in one document of a FOIA request, but the same information will 

appear unredacted in another document of a separate FOIA request. The 

stakeholder questioned why something would be redacted in one 

document but not in another document. He also claimed that he requests 

certain documents on a regular basis and, most times, the documents 

come back with little or no redactions. Yet, the information is never 

publicly posted and he must go through the FOIA process each time for 

future requests. 
Audit of NRC’s Freedom of Information Act Process

11

Likewise, the other stakeholder had a similar complaint regarding NRC’s 

“nonsensical redactions.” He believes NRC is inconsistent with its use of 

security designations to withhold information. He has submitted FOIA 

requests for information that was not publicly available, yet the information 

was sent to him completely unredacted. In his view, the documents 

should have been redacted or they should have already been publicly 

available. NRC's Chief FOIA Officer confirmed that his biggest challenge 

was ensuring that NRC provides a consistent response to FOIA requests.

The lack of specific training requirements for NRC FOIA personnel is 

noteworthy for several reasons: 

1. The FOIA office has recently experienced a high amount of 

turnover, losing some seasoned personnel with many years of 

experience.

2. With the impending FOIA centralization and FOIA coordinator roles 

moving to OIS, the new point-of-contact for each program office will 

likely be the office technical assistant. In NRC’s current FOIA 

program, technical assistants typically play little or no role in the 

FOIA process. 

3. FOIA coordinators currently service their own office. After 

centralization, coordinators will be servicing multiple offices, some 

of which they will have little familiarity with.

4. According to the FOIA.gov public Web site, approximately 74 

percent of NRC’s FOIA requests are considered to be complex 

requests, compared to 33 percent for all other Federal agencies. 

Complex requests involve more documents and coordination with 

multiple NRC offices and/or other Federal agencies.

Lack of Effective Controls 

NRC has not fully used technology or created a training program because 

NRC management has not implemented effective internal controls. 

Specifically, there has been a lack of oversight and communication with 

regard to technology issues, and there is no clear written guidance or 

policy on training.
Audit of NRC’s Freedom of Information Act Process

12

Lack of Oversight and Communication Regarding FOIAXpress

FOIAXpress has not been upgraded to its current version due to a lack of 

management oversight and communication. The initial upgrade request 

from Version 7 to Version 8 was sent to OIS by the FOIA office on June 

25, 2013, yet the actual upgrade did not occur until March 28, 2014. The 

primary issue that stalled the upgrade was a technical problem in getting 

Version 8 to work with one of NRC’s existing servers. When FOIA office 

staff were questioned about this, the consensus among the FOIA staff was 

that they did not understand the technical aspects of the issue and were 

relying on OIS to fix the problem. 

OIG followed up on this issue in interviews with several staff and 

management in OIS. After interviews with the Deputy Director of OIS and 

the Chief Information Officer, FOIAXpress was upgraded to Version 8 –

approximately 9 months after the FOIA office’s initial request. Still, 

Version 8 is not the most current version of FOIAXpress. 

During the course of these interviews, it became clear that there was no 

ownership of the overall process to upgrade the FOIAXpress software. 

Most of those interviewed could not answer questions about where the 

breakdown was occurring or who was responsible for overseeing it. It was 

readily apparent that there was no communication to or from the FOIA 

office and OIS senior management, while the situation lingered without 

being adequately addressed.

No Written Training Guidance or Program

Currently, there are no formal training requirements for FOIA specialists 

and coordinators because there is no written training guidance or training 

program. With FOIA centralization soon approaching, the FOIA office has 

written a training plan that is currently in draft mode. In the 2014 Chief 

FOIA Officer Report to DOJ, NRC asserts it is “expanding existing 

substantive FOIA training based on best-practice FOIA procedures, scope 

of exemptions and exclusions, and up-to-date legal developments in 

tandem with FOIA centralization. This will be required for all FOIA 

professionals and available to all program office staff.” 
Audit of NRC’s Freedom of Information Act Process

13

Two NRC training officials were interviewed and they stated that requiring 

all agency staff to take FOIA training would likely be difficult to implement. 

There is also the question of cost-benefit as making training mandatory for 

all NRC staff has a significant cost associated with it. While providing 

FOIA training for all NRC staff would be ideal, it is not practical because of 

budgetary constraints and only underscores the importance of having 

proper training for FOIA office personnel so they can properly guide and 

assist NRC staff. 

Higher Costs and Reduced Timeliness 

NRC has encountered high FOIA processing costs and has not been 

meeting the statutory 30-day limit to process complex FOIA requests. As 

mentioned earlier in the report, approximately 74 percent of NRC’s FOIA

requests are considered by the agency to be complex. This also is a 

factor in NRC’s high processing costs and lack of timeliness. See Figure 

2 for a breakdown of requests processed.14 

Figure 2: 

Source: OIG

 14 Expedited requests are FOIA requests placed at the front of the processing queue where the requester 

clearly demonstrates a compelling need because (1) the failure to obtain requested records on an 

expedited basis could reasonably be expected to pose an imminent threat to the life or physical safety of 

an individual or (2) with respect to a person primarily engaged in disseminating information, there is an 

urgency to inform the public concerning actual or alleged Federal Government activity. 

94

275

1

NRC's FY13 FOIA Requests Processed

Simple

Complex

Expedited

74%
Audit of NRC’s Freedom of Information Act Process

14

NRC’s cost per FOIA request processed is significantly higher than other 

agencies. NRC spent approximately $7,225 per FOIA request processed 

in FY 2013.15 The average cost per request processed for the other 98 

Federal agencies was about $615. Other agencies subject to FOIA only 

consider approximately 33 percent of the requests received complex. This 

certainly played a significant factor in the disparity between FOIA 

processing costs, but the fact remains that NRC’s cost per request 

processed still is extremely high.16 

NRC is also not meeting its statutory 30-day timeliness requirement for 

processing complex FOIA requests. (See Figure 3 for NRC average 

processing times.) 

Figure 3: 

Source: OIG

 15 NRC spent approximately $2.67 million in processing 370 FOIA requests. Data for these calculations 

was obtained from the FOIA.gov public Web site. 

16 To help offset the imbalance of NRC’s complex requests compared to other Federal agencies; OIG 

also analyzed the cost per FOIA request by removing the Japan team’s FOIA requests. While only a 

rough estimate, the cost per FOIA request dropped to approximately $5,000 – still a large number in 

relation to all other Federal agencies. 

0

10

20

30

40

50

60

70

80

90

12

37

82

Average Number of Days

NRC's FY13 Average Processing Time

Simple

All Requests

Complex
Audit of NRC’s Freedom of Information Act Process

15

Recommendations:

OIG recommends that the Executive Director for Operations:

1. Implement technology, such as RedactXpress, in the regions and 

larger program offices to more efficiently process FOIA requests.

2. Conduct annual reviews to determine the feasibility of upgrading 

technology within OIS to more efficiently process FOIA requests.

3. Develop a process to ensure that the FOIA office’s information 

technology needs are met in a timely manner, specifically with 

regard to FOIAXpress updates.

4. Develop and implement an OCHCO and DOJ-approved formal 

training and development program for all FOIA office personnel.

5. Obtain DOJ FOIA e-learning training modules and encourage all 

agency staff to pursue completion through annual agency 

communications. 

6. Reintroduce FOIA branch led training for NRC staff on an annual 

basis.

7. Conduct a review of FOIA requests to determine if frequently 

requested non-public documents can be proactively placed into 

public ADAMS for future use.
Audit of NRC’s Freedom of Information Act Process

16

B. Management Level Reviews Are Inconsistent 

NRC is not in compliance with FOIA regulations as initial disclosure 

reviews of FOIA records are done at inconsistent management levels. 

Federal regulations state that, during the initial disclosure review, the head 

of the responsible office must review agency records to determine whether 

the agency records are exempt from disclosure; however, there is no 

enforcement of this policy and there is no method to track these reviews. 

Additionally, NRC’s internal guidance differs from the Code of Federal 

Regulations. This may result in (A) a reduced number of discretionary 

releases17 or (B) the inadvertent release of sensitive information.

Review and Approval Required 

The Code of Federal Regulations requires that, during the initial disclosure 

review, the head of the responsible office shall review agency records to 

determine whether the agency records are exempt from disclosure.18 If 

the head of the office determines that, although exempt, the disclosure of 

the agency records will not be contrary to the public interest and will not 

affect the rights of any person, the head of the office may authorize 

disclosure of the agency records.

Additionally, Attorney General Holder’s memo states:

An agency should not withhold information simply because it may 

do so legally. I strongly encourage agencies to make discretionary 

disclosures of information. An agency should not withhold records 

merely because it can demonstrate, as a technical matter, that the 

records fall within the scope of a FOIA exemption.

 17 A discretionary disclosure, or discretionary release, is the approved release of information that falls 

under one of the FOIA exemptions. This information may be released because it poses no perceived 

harm to the agency or individuals involved.

18 10 CFR 9.25(f). However, the Commission, Office of the Secretary, Office of the Inspector General, 

and Office of General Counsel are subject to unique disclosure review requirements. See 10 CFR 

9.25(g) for specific details.
Audit of NRC’s Freedom of Information Act Process

17

NRC Not in Compliance with FOIA Regulations 

NRC is not in compliance with FOIA regulations as initial disclosure 

reviews are not consistently conducted by office directors. OIG contacted 

19 FOIA coordinators from the program offices and 4 coordinators from 

the regional offices inquiring about office director review of FOIA records. 

While all four of the regions involve senior management at a branch chief 

level or above in FOIA records reviews, approximately half of the program 

offices surveyed revealed that no senior management reviewed their FOIA 

records. 

According to FOIA office staff, a cover memo describing the contents of 

the FOIA records usually accompanied the records submitted to the FOIA 

office. It was common for FOIA coordinators to sign these cover memos 

without a signature from their senior management. The staffer said that 

the FOIA office will sometimes process FOIA records without any 

confirmation that program office senior management reviewed the 

records. Furthermore, if the FOIA records were emailed from a program 

office to the FOIA office, there may be no cover memo at all. Another 

person in the FOIA office stated that, as a practice, office directors rarely 

review FOIA responses coming to the FOIA office.

Lack of Internal Controls 

NRC’s initial disclosure reviews are inconsistent because there is a lack of 

effective controls. For instance: 

• The use of the current cover memo is not enforced and it does not 

contain an area for senior management signoff. 

• There is a disconnect between the Code of Federal Regulations 

and NRC’s primary internal FOIA guidance, Management Directive 

3.1.

Management Directive 3.1 states: 

When information that is believed to be exempt from disclosure has 

been identified and bracketed, the director or a management official 

at the Grade 15 level or higher in the responsible office will review 
Audit of NRC’s Freedom of Information Act Process

18

the records, or portions thereof, proposed to be withheld and further 

determine whether disclosure of the exempt information will 

adversely affect the public interest or the rights of any person. 

However, the Code of Federal Regulations specifies only the office 

director; it does not provide the option of a management official at Grade 

15 level or higher to conduct the initial disclosure review.

While the four regional offices and roughly half of the program offices 

obtained senior management approval of FOIA packages, very few, if any, 

received approvals from the office director. The majority of these offices 

followed the guidance in Management Directive 3.1, not the Code of 

Federal Regulations. Despite the fact that office director review is in the 

Code of Federal Regulations, and a more flexible version is in 

Management Directive 3.1, neither policy is uniformly enforced by NRC 

management.

Potential for Releases 

Without senior management initial disclosure review of FOIA records, 

there is the potential that (A) discretionary releases may not occur or (B) 

sensitive information could be inadvertently released. According to 

regulations, agency staff cannot release exemption-qualified information –

this falls directly on the head of the office. Therefore, if the office director 

is not reviewing the FOIA record, the likelihood of overriding a subject 

matter expert’s withholdings and making a discretionary release would 

significantly decrease.

On the other hand, if an office director or senior management official does 

not review a FOIA record, there is also the potential that sensitive 

information could be released. The FOIA coordinator and FOIA office may 

not have the expertise to sufficiently review the entire FOIA record, while 

the Office of the General Counsel generally reviews only redactions within 

FOIA records. If the subject matter expert elects not to make redactions in 

a FOIA record, then that information may be released without any further 

scrutiny. 
Audit of NRC’s Freedom of Information Act Process

19

Recommendations:

OIG recommends that the Executive Director for Operations:

8. Develop and implement a process to confirm appropriate program 

and regional office management review of FOIA records.

9. Either revise Management Directive 3.1 to comply with the 

disclosure review requirements found in 10 CFR Part 9.25(f) or 

revise 10 CFR Part 9.25(f) to allow office heads the authority to 

delegate the initial disclosure review determination responsibility to 

a designee at a managerial Grade 15 level or above.
Audit of NRC’s Freedom of Information Act Process

20

IV. CHALLENGES

NRC’s upcoming plan to centralize most FOIA coordinator positions into 

OIS presents several challenges for the agency. During interviews with 

staff, OIG found there is resistance to the upcoming centralization. FOIA 

specialists, FOIA coordinators, and an NRC manager all expressed 

concerns. Many staff interviewed believe that centralization will make the 

FOIA process less efficient by adding additional unintended steps and 

removing the expertise from the offices. Some of the concerns expressed 

to OIG by staff regarding centralization are: 

• Centralization will just be “an extra layer to the process.”

• The FOIA process was set up in a decentralized way years ago 

(i.e., a coordinator in each office) because you want expertise in the 

office. 

• There will be additional back and forth between offices and there 

could also be individuals in the program offices that have no 

experience processing FOIA requests. 

Communication

Communication is the most significant challenge associated with 

centralization. Relevant, reliable, and timely communication is required to 

control operations and achieve objectives. Recently, OIG found an overall 

lack of effective communication within OIS during an Audit of NRC’s 

Information Technology Governance.

19 In light of this finding and staff’s 

resistance to centralization, management’s involvement and commitment 

to communication is essential. NRC management must communicate its 

vision of how a centralized FOIA office will function. In order to achieve 

buy-in, management should involve as many people as possible, 

communicate the essentials, and communicate frequently to respond to 

staff's needs.

 19 This report (OIG-14-A-04) is publicly available in ADAMS; see accession number ML13343A244.
Audit of NRC’s Freedom of Information Act Process

21

OIS management confirmed that communication is a challenge and is 

taking steps to address this. Management explained that the information 

technology coordinator centralization (also part of the agencywide initiative 

to reduce duplication of efforts) is going well and that they are applying the 

same model towards the FOIA centralization. Focus groups from program 

offices have been established to discuss issues with the FOIA process. 

Additionally, weekly centralization meetings were held with FOIA staff to 

solicit feedback. 

Guidance

Ensuring that FOIA guidance documents are up to date is another 

challenge associated with centralization. Centralization will cause 

processes and procedures to change. Federal standards require clearly 

documenting processes at an appropriate level of detail to allow 

management to effectively monitor the activity. Guidance must be 

properly managed, maintained, and made available in order to meet its 

intended purpose. Management must plan to update or revise procedures 

with any changes resulting from centralization. Well-designed guidance 

documents, if used properly, can appropriately direct agency employees 

and increase efficiency. 

Monitoring 

Another challenge will be to determine if the centralization of FOIA staff is 

achieving the desired outcomes. Once centralization is complete, 

management should monitor performance measures and indicators to 

determine if the new centralized structure is performing as intended. A 

best practice would also be to conduct a self-assessment of the FOIA 

program after the centralization is complete. Management can then use 

the results of these efforts to modify any processes found to have 

weaknesses.
Audit of NRC’s Freedom of Information Act Process

22

V. CONSOLIDATED LIST OF RECOMMENDATIONS 

OIG recommends that the Executive Director for Operations:

1. Implement technology, such as RedactXpress, in the regions and 

larger program offices to more efficiently process FOIA requests.

2. Conduct annual reviews to determine the feasibility of upgrading 

technology within OIS to more efficiently process FOIA requests.

3. Develop a process to ensure that the FOIA office’s information 

technology needs are met in a timely manner, specifically with 

regard to FOIAXpress updates.

4. Develop and implement an OCHCO and DOJ-approved formal 

training and development program for all FOIA office personnel.

5. Obtain DOJ FOIA e-learning training modules and encourage all 

agency staff to pursue completion through annual agency 

communications. 

6. Reintroduce FOIA branch led training for NRC staff on an annual 

basis.

7. Conduct a review of FOIA requests to determine if frequently 

requested non-public documents can be proactively placed into 

public ADAMS for future use.

8. Develop and implement a process to confirm appropriate program 

and regional office management review of FOIA records.

9. Either revise Management Directive 3.1 to comply with the 

disclosure review requirements found in 10 CFR Part 9.25(f) or 

revise 10 CFR Part 9.25(f) to allow office heads the authority to 

delegate the initial disclosure review determination responsibility to 

a designee at a managerial Grade 15 level or above.
Audit of NRC’s Freedom of Information Act Process

23

VI. AGENCY COMMENTS 

An exit conference was held with the agency on June 11, 2014. Prior to 

this meeting, after reviewing a discussion draft, agency management 

provided supplemental information that has been incorporated into this 

report, as appropriate. As a result, agency management stated their 

general agreement with the findings and recommendations in this report 

and opted not to provide formal comments for inclusion in this report.
Audit of NRC’s Freedom of Information Act Process

24

Appendix A

OBJECTIVE, SCOPE, AND METHODOLOGY

OBJECTIVE

The audit objective was to determine whether the FOIA process is efficient 

and complies with the current laws. 

SCOPE

The audit reviewed NRC’s activities related to FOIA with special emphasis 

on process and compliance with current laws. This audit did not review 

FOIA activities associated with the Japan FOIA efforts. OIG conducted 

this performance audit from November 2013 through April 2014 at NRC 

headquarters in Rockville, Maryland. Internal controls related to the audit 

objective were reviewed and analyzed. Throughout the audit, auditors 

were aware of the possibility or existence of fraud, waste, and abuse in 

the program.

METHODOLOGY

To address the audit objective, OIG auditors interviewed 65 individuals. 

These interviews included NRC management and staff at headquarters 

and staff at each of NRC’s four regional offices. Regional office interviews 

were conducted by telephone. The interviews also included stakeholders 

and management from the Office of Information Policy at the Department 

of Justice. Furthermore, OIG reviewed Federal and internal agency 

guidance, including:

• Freedom of Information Act (5 U.S.C. § 552). 

• 10 CFR Part 9, Subpart A, Freedom of Information Act Regulations.

• NRC Management Directive 3.53, NRC Records and Document 

Management Program.

• Executive Order 13392 of December 14, 2005, Improving Agency 

Disclosure of Information.
Audit of NRC’s Freedom of Information Act Process

25

• 2009 Presidential Memorandum for the Heads of Executive 

Departments and Agencies.

• Attorney General Memorandum for the Heads of Executive 

Departments and Agencies.

• Second Open Government National Action Plan for the United 

States of America.

OIG auditors observed a walkthrough of the FOIA process and assessed 

the technological tools used for FOIA processing. Furthermore, OIG 

conducted a review and analysis of FOIA: 

• Timeliness statistics.

• Training requirements. 

• Processing costs. 

• Approvals. 

• Dispositions. 

• Repetitive requests. 

We conducted this performance audit in accordance with generally 

accepted Government auditing standards. Those standards require that 

we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit 

objectives.

The audit was conducted by Beth Serepca, Team Leader; 

Robert Woodward, Audit Manager; Michael Blair, Senior Analyst; 

Jenny Cheung, Auditor; and Regina Revinzon, Student Analyst.
Audit of NRC’s Freedom of Information Act Process

26

Appendix B

FOIA Exemptions 

Exemption 

number

Matters that are exempt from FOIA 

(1) (A) Specifically authorized under criteria established by an Executive Order to be kept 

secret in the interest of national defense or foreign policy and (B) are in fact properly 

classified pursuant to the Executive Order. 

(2) Related solely to the internal personnel rules and practices of an agency. 

(3) Specifically exempted from disclosure by statute (other than section 552b of this title), 

provided that such statute (A) requires that matters be withheld from the public in such 

a manner as to leave no discretion on the issue or (B) establishes particular criteria for 

withholding or refers to particular types of matters to be withheld. 

(4) Trade secrets and commercial or financial information obtained from a person and 

privileged or confidential. 

(5) Interagency or intra-agency memorandums or letters that would not be available by 

law to a party other than an agency in litigation with the agency. 

(6) Personnel and medical files and similar files the disclosure of which would constitute a 

clearly unwarranted invasion of personal privacy. 

(7) Records or information compiled for law enforcement purposes, but only to the extent 

that the production of such law enforcement records or information: 

(A) could reasonably be expected to interfere with enforcement proceedings; 

(B) would deprive a person of a right to a fair trial or impartial adjudication; 

(C) could reasonably be expected to constitute an unwarranted invasion of personal 

privacy; 

(D) could reasonably be expected to disclose the identity of a confidential source, including 

a state, local, or foreign agency or authority or any private institution which furnished 

information on a confidential basis, and, in the case of a record or information compiled 

by a criminal law enforcement authority in the course of a criminal investigation or by 

an agency conducting a lawful national security intelligence investigation, information 

furnished by confidential source; 

(E) would disclose techniques and procedures for law enforcement investigations or 

prosecutions, or would disclose guidelines for law enforcement investigations or 

prosecutions if such disclosure could reasonably be expected to risk circumvention of 

the law; or 

(F) could reasonably be expected to endanger the life or physical safety of an individual. 

(8) Contained in or related to examination, operating, or condition of reports prepared by, 

on behalf of, or for the use of an agency responsible for the regulation of supervision of 

financial institutions. 

(9) Geological and geophysical information and data, including maps, concerning wells.