Files and folders can be encrypted by setting an attribute in the object's Properties dialog box. This will ensure that the personal folder, where most Office documents are stored, will be encrypted by default. Teach users to never encrypt individual files, but only folders.
Programs work on files in various ways.
Encrypting files consistently at the folder level will ensure that files do not get decrypted unexpectedly. The private keys associated with recovery certificates are extremely sensitive. They should be generated either on a computer that is physically secured, or their certificates should be completely exported to a PFX file, protected under a strong password, and stored on a secure floppy disk. Recovery agent certificates should be assigned to special recovery agent accounts that are not used for any other purpose. Keep all of them, until all files that may have been encrypted with them are updated.