Federal Records: National Archives and Selected Agencies Need to Strengthen E-Mail Management
Published: 2008-06-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked, among other things, to review the extent to which NARA provides oversight of federal records management, describe selected agencies' processes for managing e-mail records, and assess these agencies' e-mail policies and key practices. To do so, GAO examined NARA guidance, regulations, and oversight activities, as well as e-mail policies at four agencies (of contrasting sizes and structures) and the practices of selected officials.
section_title: What GAO Found
paragraphs: Although NARA has responsibilities for oversight of agencies' records and records management programs and practices, including conducting inspections or surveys, performing studies, and reporting results to the Congress and the Office of Management and Budget (OMB), in recent years NARA's oversight activities have been primarily limited to performing studies. NARA has conducted no inspections of agency records management programs since 2000, because it uses inspections only to address cases of the highest risk, and no recent cases have met its criteria. In addition, NARA has not consistently reported details on records management problems or recommended practices that were discovered as a result of its studies. Without more comprehensive evaluations of agency records management, NARA has limited assurance that agencies are appropriately managing the records in their custody and that important records are not lost. The four agencies reviewed generally managed e-mail records through paper-based processes, rather than using electronic recordkeeping. A transition to electronic recordkeeping was under way at one of the four agencies, and two had long-term plans to use electronic recordkeeping. (The fourth agency had no current plans to make such a transition.) Each of the business units that GAO reviewed (one at each agency) maintained "case" files to fulfill its mission and used these for recordkeeping. The practice at the units was to include e-mail printouts in the case files if the e-mail contained information necessary to document the case--that is, record material. These printouts included transmission data and distribution lists, as required. All four agencies had e-mail records management policies that addressed, with a few exceptions, the requirements in NARA's regulations. However, the practices of senior officials at those agencies did not always conform to requirements. Of the 15 senior officials whose practices were reviewed, the e-mail records for 7 (including all 4 at one agency) were managed in compliance with requirements. (One additional official was selected for review but did not use e-mail.) The other 8 officials generally kept e-mail messages, record or nonrecord, in e-mail systems that were not recordkeeping systems. (Among other things, recordkeeping systems allow related records to be categorized according to their business purposes.) If e-mail records are not kept in recordkeeping systems, they may be harder to find and use, as well as being at increased risk of loss from inadvertent or automatic deletion. Factors contributing to noncompliance included insufficient training and oversight as well as the difficulties of managing large volumes of e-mail. Without periodic evaluations of recordkeeping practices or other controls to ensure that staff are trained and carry out their responsibilities, agencies have little assurance that e-mail records are properly identified, stored, and preserved.

section_title: Letter
paragraphs: Federal agencies are increasingly using electronic mail (e-mail) for  essential communication, and in doing so, they are potentially creating  messages that have the status of federal records. According to the Federal  Records Act, federal records are materials in whatever form that  document government functions, activities, decisions, and other important  transactions, and such records must be managed and preserved in  accordance with the act. As the volume of federal e-mail grows, so does  the challenge of managing electronic records.
Under the act, the National Archives and Records Administration (NARA  or the Archives) has responsibilities for oversight and guidance of federal  records management, including management of e-mail records. Agencies  also have records management responsibilities, including the  responsibility to develop e-mail management policies and practices that  include specific requirements, such as defining staff responsibilities for  determining whether an e-mail (including any associated attachments) is a  federal record and, further, requiring preservation of record e-mail.
In view of the importance that e-mail plays in documenting government  activities, you asked that we review federal e-mail records management.  Specifically, our objectives were to    assess to what extent NARA provides oversight of federal records  management programs and practices, particularly with regard to e-mail;    describe processes followed by selected federal agencies to manage e-   assess to what extent the selected agencies’ e-mail records  management policies comply with federal requirements; and    assess compliance of selected senior officials with key e-mail  recordkeeping requirements.
To determine the extent to which NARA provided oversight of federal  agencies’ programs for managing and preserving federal e-mail records, we  analyzed applicable laws, regulations, and guidance; reviewed NARA’s  oversight activities from 2003 to 2007, including its 2003 to 2007 reports to  the Office of Management and Budget (OMB) and the Congress on records  management activities; analyzed NARA reports and documents; and  interviewed NARA officials.
To describe e-mail recordkeeping processes at selected federal agencies,  we selected four federal agencies (the Environmental Protection Agency,  the Federal Trade Commission, and the Departments of Homeland  Security and of Housing and Urban Development), based on contrasting  sizes and structures and on the significance of their records to protecting  rights and documenting accountability. We reviewed agency documents,  analyzed agency responses to a series of data collection instruments,  interviewed agency officials, reviewed the e-mail management practices at  one business unit at each agency, and inspected a limited number of  sample e-mail records identified by the agencies to corroborate their  statements.
To determine the extent to which the four agencies’ policies comply with  requirements, we analyzed applicable laws, regulations, and guidance to  identify e-mail records management requirements, and we assessed the  agencies’ e-mail management policies against these requirements.
To assess compliance of selected senior officials with key recordkeeping  requirements at each agency, we reviewed the e-mail management  practices of four senior officials (including the agency head at each  selected agency), based on agency responses to our data collection  instruments, interviews with agency officials, and inspection of a limited  number of sample e-mail records identified by the agencies to corroborate  their statements. We did not attempt to assess the extent to which the  agencies’ staff correctly identified e-mail as federal records or the extent  to which the agencies’ records appropriately included e-mail. Additional  detail on the objectives, scope, and methodology of this audit can be found  in appendix I.
We conducted this performance audit from April 2007 to May 2008 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: Advances in information technology and the explosion in computer  interconnectivity have had far-reaching effects, including the  transformation from a paper-based to an electronic business environment  and the capability for rapid communication through e-mail. Although these  developments have led to improvements in speed and productivity, they  also pose challenges, including the need to manage those e-mail messages  that may be federal records.
subsections: section_title: NARA and Federal Agencies Have Responsibilities for Federal Records Management
paragraphs: Under the Federal Records Act, NARA is given general oversight  responsibilities for records management as well as general responsibilities  for archiving. This includes the preservation in the National Archives of  the United States of permanent records documenting the activities of the  government. NARA thus oversees agency management of temporary and  permanent records used in everyday operations and ultimately takes  control of permanent agency records judged to be of historic value. (Of  the total number of federal records, less than 3 percent are designated  permanent.)
In particular, NARA is responsible for issuing records management  guidance; working with agencies to implement effective controls over the  creation, maintenance, and use of records in the conduct of agency  business; providing oversight of agencies’ records management programs;  approving the disposition (destruction or preservation) of records, and  providing storage facilities for agency records. The act also gives NARA  the responsibility for conducting inspections or surveys of agency records  and records management programs.
The act requires each federal agency to make and preserve records that  (1) document the organization, functions, policies, decisions, procedures,  and essential transactions of the agency and (2) provide the information  necessary to protect the legal and financial rights of the government and of  persons directly affected by the agency’s activities. These records, which  include e-mail records, must be effectively managed.
subsections: section_title: Records Management Includes a Range of Activities
paragraphs: As used in this chapter, “records” includes all books, papers, maps, photographs, machine  readable materials, or other documentary materials, regardless of physical form or  characteristics, made or received by an agency of the United States Government under  Federal law or in connection with the transaction of public business and preserved or  appropriate for preservation by that agency or its legitimate successor as evidence of the  organization, functions, policies, decisions, procedures, operations, or other activities of  the Government or because of the informational value of data in them. Library and museum  material made or acquired and preserved solely for reference or exhibition purposes, extra  copies of documents preserved only for convenience of reference, and stocks of  publications and of processed documents are not included.
As the definition shows, although government documentary materials  (including e-mails) may be “records” in this sense, many are not. For  example, not all e-mails document government “organization, functions,  policies, decisions, procedures, operations, or other activities” or contain  data of informational value.
According to NARA, the activities of an agency records management  program include, briefly, the following  identifying records and sources of records;    developing a file plan for organizing records, including identifying the  classes of records that the agency produces;    developing records schedules—that is, proposing for each type of  content where and how long records need to be retained and their final  disposition (destruction or preservation) based on time, or event, or a  combination of time and event; and    providing records management guidance to agency staff, including  agency-specific recordkeeping practices that establish what records  need to be created in order to conduct agency business.
Developing record schedules is a cornerstone of the records management  process. Scheduling involves not individual documents or file folders, but  rather broad categories of records. Traditionally, these were record series:  that is, “records arranged according to a filing system or kept together  because they relate to a particular subject or function, result from the  same activity, document a specific kind of transaction, take a particular  physical form, or have some other relationship arising out of their  creation, receipt, or use, such as restrictions on access and use.” More  recently, NARA introduced flexible scheduling, which allows so-called  “big bucket” or large aggregation schedules for temporary and permanent  records. Under this approach, the schedule applies not necessarily to  records series, but to all records relating to a work process, group of work  processes, or a broad program area to which the same retention time  would be applied.
To develop records schedules, agencies identify and inventory records,  and NARA’s appraisal archivists work with agencies to appraise their  value (which includes informational, evidential, and historical value),  determine whether they are temporary or permanent, and determine how  long the temporary records should be kept. NARA then approves the  necessary records schedules. No record may be destroyed unless it has  been scheduled, and for temporary records the schedule is of critical  importance because it provides the authority to dispose of the record after  a specified time period.
Records schedules may be of two kinds: an agency-specific schedule or a  general records schedule, which covers records common to several or all  agencies. According to NARA, general records schedules cover about a  third of all federal records. For the other two-thirds, NARA and the  agencies must agree upon specific records schedules. Once a schedule has  been approved, the agency is to issue it as a management directive, train  employees in its use, apply its provisions to temporary and permanent  records, and ensure proper implementation.
section_title: Records Management Must Address Electronic Records, Including E-Mail
paragraphs: The Federal Records Act covers documentary material regardless of  physical form or media, but until the advent of computers, records  management and archiving had been largely focused on handling paper  documents. As information is increasingly created and stored  electronically, records management has had to take into account the  creation of records in varieties of electronic formats, including e-mail  messages.
NARA has promulgated regulations at 36 C.F.R. Part 1234 that provide  guidance to agencies about the management of electronic records. This  guidance is supplemented by the issuance of periodic NARA bulletins and  other forms of guidance to agencies. To ensure that the management of  agency electronic records is consistent with the Federal Records Act,  NARA requires each agency to maintain an inventory of all agency  information systems that identifies basic facts about each system and the  information it contains, and it requires that agencies schedule the  electronic records in its systems. Like other records, electronic records  must be scheduled either under agency-specific schedules or pursuant to a  general records schedule.
According to the regulation, agencies are required to establish policies  and procedures that provide for appropriate retention and disposition of  electronic records. In addition to including general provisions on  electronic records, agency procedures must specifically address e-mail  records: that is, the creation, maintenance and use, and disposition of  federal records created by individuals using electronic mail systems. “a document created or received on an electronic mail system including brief notes, more  formal or substantive narrative documents, and any attachments, such as word processing  and other electronic documents, which may be transmitted with the message.”
The regulation requires e-mail records to be managed as are other  potential federal records with regard to adequacy of documentation,  recordkeeping requirements, agency records management responsibilities,  and records disposition. This entails, in particular, ensuring that staff are  aware that e-mails are potential records and training them in identifying  which e-mails are records.
Specific requirements for e-mail records include, for example, that for  each e-mail record, agencies must preserve transmission data, including  names of sender and addressees and message date, because these provide  context that may be needed for the message to be understood. Further,  except for a limited category of “transitory” e-mail records, agencies are  not permitted to store the recordkeeping copy of e-mail records in the e- mail system, unless that system has all the features of a recordkeeping  system; table 1 lists these required features.
If agency e-mail systems do not have the required recordkeeping features,  either agencies must copy e-mail records to a separate electronic  recordkeeping system, or they must print e-mail messages (including  associated transmission information that is needed for purposes of  context) and file the copies in traditional paper recordkeeping files.
NARA’s guidance allows agencies to use either paper or electronic  recordkeeping systems for record copies of e-mail messages, depending on  the agencies’ business needs.
Each of the required features listed in table 1 is important because it helps  ensure that e-mail records remain both accessible and usable during their  useful lives. For example, it is essential to be able to classify records  according to their business purpose so that they can be retrieved in case of  mission need. Further, if records cannot be retrieved easily and quickly, or  they are not retained in a usable format, they do not serve the mission or  historical purpose that led to their being preserved. In many cases, e-mail  systems do not have the features in the table. If e-mail records are retained  in such systems and not in recordkeeping systems, they may be harder to  find and use, as well as being at increased risk of loss from inadvertent or  automatic deletion.
Agencies must also have procedures that specifically address the  destruction of e-mail records. In particular, e-mail records may not be  deleted or otherwise disposed of without prior authority from NARA.  (Recall that not all e-mail is record material. Agencies may destroy  nonrecord e-mail.)
Agencies can dispose of e-mail records in three situations: First, agencies  are authorized to dispose of e-mail records with very short-term  (transitory) value that are stored in e-mail systems at the end of their  retention periods (as mentioned earlier). Second, for other records in e- mail systems, NARA authorizes agencies to delete the version in the e-mail  system after the record has been preserved in a recordkeeping system  along with all appropriate transmission data. Finally, agencies are  authorized to dispose of e-mail records in the recordkeeping system in  accordance with the appropriate records schedule. If the records in the  recordkeeping system are not scheduled, the agency must schedule them  before they can be disposed of.
section_title: Management of E-Mail Records Poses Challenges
paragraphs: Because of its nature, e-mail can present particular challenges to records  management. First, the information contained in e-mail records is not  uniform. This is in contrast to many information systems, particularly  those in computer centers engaged in large-scale data processing, which  contain structured data that generally can be categorized into a relatively  limited set of logical groupings. The information in e-mail systems, on the  other hand, is not structured in this way: it may concern any subject or  function and document various types of transactions. As a result, in many  cases, decisions on which e-mail messages are records must be made  individually.
The kinds of considerations that may go into determining the record status  of an e-mail message are illustrated in figure 1. As shown by the decision  tree in the figure (developed at Sandia National Laboratories), agency staff  have to be aware of the defining features of a record in order to make  these decisions.
Second, the transmission data associated with an e-mail record—including  information about the senders and receivers of messages, the date the  message was sent, and any attachments to the messages—provide context  that may be crucial to understanding the message. Thus, as NARA’s e-mail  regulations and guidance reflect, transmission data must be retained, and  attachments are defined as part of the e-mail record.
Third, a given message may be part of an exchange of messages between  two or more people within or outside an agency, or even of a string  (sometimes branching) of many messages sent and received on a given  topic. In such cases, agency staff need to decide which message or  messages should be considered records and who is responsible for storing  them in a recordkeeping system.
Finally, the large number of federal e-mail users and high volume of e- mails increase the management challenge. According to NARA, the use of  e-mail results in more records being created than in the past, as it often  replaces phone conversations and face-to-face meetings that might not  have been otherwise recorded. E-mail may also replace other types of  written communications, such as letters and memorandums.
Whether agencies use paper-based or electronic recordkeeping systems,  individual users generally make decisions (based on considerations such  as those in the figure) on what messages they judge to be records. In  paper-based systems, users then print and file e-mail records—with  appropriate transmission data—in the appropriate file structure (generally  corresponding to record series or schedule). In electronic systems, the  particular steps to file the record would vary depending on the particular  type of system and its degree of integration with the agency’s other  information systems. Although details vary, an electronic recordkeeping  system, like a paper-based system, requires that a filing structure has been  established by which records can be associated with the appropriate  series.
The advantages of using a paper-based system for record copies of e-mails  are that this approach takes advantage of the recordkeeping system  already in place for the agency’s paper files and requires little or no  technological investment. The disadvantages are that a paper-based  approach depends on manual processes and requires electronic material  to be converted to paper, potentially losing some features of the electronic  original; these processes may be especially burdensome if the volume of e- mail records is large.
The advantage of using an electronic recordkeeping system, besides  avoiding the need to manage paper, is that it can be designed to capture  certain required data (such as e-mail transmission data) automatically.
Electronic recordkeeping systems also make searches for records on  particular topics much more efficient. In addition, electronic systems that  are integrated with other applications may have features that make it  easier for the user to identify records and that potentially could provide  automatic or partially automatic classification functions. However, as  with other information technology investments, acquiring an electronic  recordkeeping system requires careful planning and analysis of agency  requirements and business processes; in addition, electronic  recordkeeping raises the issue of maintaining electronic information in an  accessible form throughout its useful life. Finally, like paper-based  systems, electronic recordkeeping systems must be used properly by  employees to be effective.
These challenges have been recognized by NARA and the records  management community in numerous studies and articles. A 2001 survey  of federal recordkeeping practices conducted by a contractor—SRA  International—for NARA concluded, among other things, that managing e- mail was a major records management problem and that the quality of  recordkeeping varied considerably across agencies. The authors also  commented on features of agency missions that lead to strong  recordkeeping practices: “When agencies have a strong business need for  good recordkeeping, such as the threat of litigation or an agency mission  that revolves around maintaining ‘case’ files, then recordkeeping practices  tend to be relatively strong with regard to the records involved.” In  addition, the study concluded that for many federal employees, the  concept of a “record” and what should be scheduled and preserved was  not clear.
A 2005 survey of federal agencies’ policy and practices for electronic  records management, funded in part by NARA, concluded that procedures  for managing e-mail were underdeveloped. The study found that most of  the surveyed offices had not developed electronic recordkeeping systems,  but were instead maintaining recordkeeping copies of e-mail and other  electronic documents in paper format. However, all of the offices also  maintained electronic records (frequently electronic duplicates of paper  records). According to the study team, agencies did not establish  electronic recordkeeping systems partly because of a lack of support and  resources, and the complexity of implementing such systems increased  with the size of the agency. As a result, organizations were maintaining  unsynchronized parallel paper and electronic systems, resulting in extra  work, confusion regarding which is the recordkeeping copy, and retention  of many records beyond their disposition date. The study team also  concluded that disposition of electronic records was too cumbersome and  uncertain. According to the report, employees delete electronic records,  such as e-mails, one at a time, a cumbersome process which may result in  retention of too many records for too long or premature disposition that is  inconsistent with approved retention schedules. (This is in contrast to  records disposition in a recordkeeping system, in which categories of  temporary records may be disposed of at the end of their retention  periods.) The report also discussed NARA’s role in promoting agencies’  adoption of electronic recordkeeping systems.
Commenting on these points, NARA expressed the view that for agencies  that maintain paper as the record copy, the early destruction of electronic  copies was not a significant problem because such copies generally have  very short term retentions, and no information is lost. It considered that  the overly long retention of electronic copies did raise concerns regarding  legal discovery and compliance with requests under the Freedom of  Information Act or the Privacy Act. In these circumstances, agencies are  required to search for all information, not just information in  recordkeeping systems; thus, maintaining large volumes of nonrecord  material increases this burden.
Most recently, a NARA study team examined in 2007 the experiences of  five federal agencies (including itself) with electronic records management  applications, with a particular emphasis on how these organizations used  these applications to manage e-mail. The purpose of the study was to  gather information on the strategies that organizations are using that may  be useful to others. Among the major conclusions from the survey was  that implementing an electronic records management application requires  considerable effort in planning, testing, and implementation, and that  although the functionality of the software product itself is important, other  factors are also crucial, such as agency culture and the quality of the  records management system in place. With regard to e-mail in particular,  the survey concluded that for some agencies, the volume of e-mail  messages created and received may be too overwhelming to be managed  at the desktop by thousands of employees across many sites using a  records management application alone, and that e-mail messages can  constitute the most voluminous type of record that is filed into these  applications. Finally, further study was recommended of technologies that  are being used to manage e-mail and what federal agencies are doing with  their record e-mail messages.
NARA is planning to perform such a study in 2008. According to NARA, the  study will take a close look at how selected agencies are implementing  electronic recordkeeping for their program records, including those e-mail  messages that need to be retained and managed as federal records. The  study will look at electronic recordkeeping projects that have a records  management application in place as well as other solutions that provide  recordkeeping functionality. In both cases, NARA plans to explore how e- mail messages in particular are identified and managed as records.  According to NARA officials, they have begun planning for the study and  identifying agencies to be included; they expect to have the report  completed by the end of September 2008.
Such a study could provide useful information to help NARA develop  additional guidance to agencies looking for electronic solutions for  records management of e-mail and other electronic records. As the earlier  studies suggest, implementing such solutions is not a simple or easy  process. Although NARA has referred to the decision to move to electronic  recordkeeping as inevitable, it emphasizes that the timing of the decision  depends on an agency’s specific mission and circumstances.
section_title: NARA Has Taken Action to Address Management of Electronic Records, Including E-Mail
paragraphs: For the last several years, NARA’s records management program has  increasingly reflected the importance of electronic records and  recordkeeping. For example, NARA has undertaken a redesign of its  records management activities, including (among other things) the  following three activities, which are significant for management of  electronic records, including e-mail:    NARA established flexible scheduling (the so-called “big bucket” approach  described earlier), under which agencies can schedule records at any level  of aggregation that meets their business needs. By simplifying disposition  instructions, “big bucket” schedules have advantages for electronic  records management; filing e-mail records under a “big bucket” system, for  example, is simplified because users can be presented with fewer filing  categories.
NARA developed e-mail regulations that eliminated the previous  requirement to file transitory e-mail dealing with routine matters in a  formal agency recordkeeping system. According to NARA, this change  would allow agencies to focus their resources on managing e-mail that is  important for long-term documentation of agency business. The change  was reflected in a revision to General Records Schedule 23 that explicitly  included very short-term temporary e-mail messages. The final rule  became effective on March 23, 2006.
NARA developed regulations and guidance to make retention schedules  media neutral. According to NARA, its objective was to eliminate routine  rescheduling work so that agencies and NARA could focus their  resources on high records management priorities. Under its revised  regulations, in effect as of December 2007, new records schedules would  be media neutral unless otherwise specified. At the same time, NARA  revised General Records Schedule 20 (which provides disposition  authorities for electronic records) to expand agencies’ authority to apply  previously approved schedules to electronic records and to dispose of  hard copy records that have been converted to an electronic format,  among other things.
section_title: Our Prior Work Has Addressed Electronic Records Management
paragraphs: In July 1999, we reported that NARA and federal agencies were facing the  substantial challenge of managing and preserving electronic records in an  era of rapidly changing technology. In that report, we stated that in  addition to handling the burgeoning volume of electronic records, NARA  and the agencies would have to address several hardware and software  issues to ensure that electronic records were properly created,  maintained, secured, and retrievable in the future. We also noted that  NARA did not have governmentwide data on the records management  capabilities and programs of all federal agencies. As a result, we  recommended that NARA conduct a governmentwide survey of agencies’  electronic records management programs and use the information as input  to its efforts to reengineer its business processes.
NARA subsequently undertook efforts to assess governmentwide records  management practices and study the redesign of its business processes. As  mentioned earlier, in 2001 NARA completed an assessment of  governmentwide records management practices, as we had recommended.  NARA’s assessment of the federal recordkeeping environment concluded  that although agencies were creating and maintaining records  appropriately, most electronic records remained unscheduled, and records  of historical value were not being identified and provided to NARA for  archiving.
In 2002, we reported that factors contributing to the problems of managing  and preserving electronic records included records management guidance  that was inadequate in the current technological environment, the low  priority often given to records management programs, and the lack of  technology tools to manage electronic records. In addition, NARA did not  perform systematic inspections of agency records management, so that it  did not have comprehensive information on implementation issues and  areas where guidance needed strengthening. Although NARA had plans to  improve its guidance and address technology issues, these did not address  the low priority generally given to records management programs nor the  inspection issue.
With regard to inspections, we noted that in 2000, NARA had replaced  agency evaluations (inspections) with a new approach—targeted  assistance—because it considered that its previous approach to  evaluations had been flawed: it reached only a few agencies, it was often  perceived negatively, and it resulted in a list of records management  problems that agencies then had to resolve on their own. Under targeted  assistance, NARA entered into partnerships with federal agencies to  provide them with guidance, assistance, or training in any area of records  management. Despite the possible benefits of such assistance to the  targeted agencies, however, we concluded that it was not a substitute for  systematic inspections. Only agencies requesting assistance were  evaluated, and the scope and focus of the assistance were determined not  by NARA but by the requesting agency. Thus, it did not provide systematic  and comprehensive information for assessing progress over time.
To address the low priority generally given to records management  programs, we recommended that NARA develop a strategy for raising  agency senior management awareness of and commitment to records  management. To address the inspection issue, we recommended that  NARA develop a strategy for conducting systematic inspections of agency  records management programs to (1) periodically assess agency progress  in improving records management programs and (2) evaluate the efficacy  of NARA’s governmentwide guidance.
In response to our recommendations, NARA devised a strategy for raising  awareness among senior agency management of the importance of good  federal records management, as well as a comprehensive approach to  improving agency records management that included inspections and  identification of risks and priorities. NARA also took steps to improve  federal records management programs by updating its guidance to reflect  new types of electronic records. In 2003, we testified that the plan for  improving agency records management did not include provisions for  using inspections to evaluate the efficacy of its governmentwide guidance,  and an implementation plan for the approach had not yet been  established. NARA later addressed these shortcomings by developing an  implementation plan that included using agency inspections to evaluate  the efficacy of its guidance, with such inspections to be undertaken based  on a risk-based model, government studies, or media reports. Such an  approach, if appropriately implemented, had the potential to help avoid  the weaknesses in records management programs that led to the  scheduling and disposition problems that we and NARA had described in  earlier work.
section_title: NARA’s Oversight Activities Have Been Limited
paragraphs: To fulfill its responsibility under the Federal Records Act for oversight of  agency records management programs, NARA planned to conduct  activities including inspections, studies, and reporting. However, despite  NARA’s plans, in recent years its oversight activities have been primarily  limited to performing studies. Although it has performed or sponsored six  records management studies since 2003, it has not conducted any  inspections since 2000. In addition, although NARA’s reporting to the  Congress and OMB has generally described progress in improving records  management at individual agencies and provided an overview of some of  its major records management activities, it has not consistently provided  evaluations of responses by federal agencies to its recommendations, as  required, or details on records management problems or recommended  practices that were discovered as a result of inspections, studies, or  targeted assistance projects. Without a consistent oversight program that  provides it with a governmentwide perspective, NARA has limited  assurance that agencies are appropriately managing the records in their  custody, thus increasing the risk that important records will be lost.
subsections: section_title: NARA Has Oversight Responsibilities Regarding Federal Records Management
paragraphs: Oversight is a key activity in governance that addresses whether  organizations are carrying out their responsibilities and serves to detect  other shortcomings. Our reports emphasize the importance of effective  oversight of government operations by individual agency management, by  agencies having governmentwide oversight responsibilities, and by the  Congress. Various functions and activities may be part of oversight,  including monitoring, evaluating, and reporting on the performance of  organizations and their management and holding them accountable for  results.
The Federal Records Act gave NARA responsibility for oversight of agency  records management programs by, among other functions, making it  responsible for conducting inspections or surveys of agencies’ records and  records management programs and practices; conducting records  management studies; and reporting the results of these activities to the  Congress and OMB. In particular, the reports are to include evaluations of  responses by agencies to any recommendations resulting from inspections  or studies that NARA conducts and, to the extent practicable, estimates of  costs to the government if agencies do not implement such  recommendations.
According to NARA, it planned to carry out its oversight responsibilities  using inspections, studies, and reporting. Specifically, in 2003, NARA  stated that it would    perform inspections of agency records and records management    conduct studies that focus on cross-government issues, analyze and  identify best practices, and use the results to develop governmentwide  recommendations and guidance; and  report to the Congress and OMB on problems and recommended  practices discovered as part of inspections, studies, and targeted  assistance projects.
section_title: NARA No Longer Performs Inspections of Agency Records Management Programs
paragraphs: Although inspections were included in NARA’s oversight plans in 2003,  NARA has not conducted any since 2000. NARA laid out a strategy for  performing inspections and studies in 2003 as part of its records  management redesign efforts. According to this strategy, NARA  anticipated undertaking inspections only under what it termed exceptional  circumstances: that is, if (1) agencies have high-level records management  problems that put at risk federal records that protect rights, assure  accountability, or document the national experience, and (2) agencies  refuse targeted assistance from NARA and fail to mitigate or otherwise  effectively deal with such risks. In other words, NARA considered  inspections its tool of last resort: to be used when the risk to records was  deemed high and other tools (such as targeted assistance and training)  failed to mitigate the risk to records.
Under this strategy, NARA planned to determine when to undertake  inspections based on its risk-based resource allocation model (or when it  learned through other means of a clear and egregious records  management problem in an agency or line of business). Using this model,  developed in 2003, NARA’s Resource Allocation Project performed a  governmentwide assessment in 2004 of high-priority federal records and  records programs. After reviewing program areas and work processes of  the government (as opposed to organizational units), the project  identified the business processes, subfunctions, and agency activities that  were likely to generate the majority of high-priority records. Based on  input and assessments from NARA staff with expertise in the subfunctions  and associated agencies, the project then rated the subfunctions according  to three criteria for establishing resource priorities:  the risk to records (based on such factors as whether the subfunctions  or associated agencies had experienced major scheduling issues or  known problems, such as allegations of unauthorized destruction of  records),  the level of significance of the records to rights and accountability, and  the likelihood that the subfunction would generate permanent records  (and if so, their volume and significance).
According to the final report on the project, this assessment showed that  the risks to records were being addressed and managed by the Archives’  own records management activities and those of the agencies. As a result,  the Resource Allocation Project did not lead to the identification of  records management risks that met the new inspection criteria. Instead,  NARA applied its resources to other activities that it considered more  effective and less resource-intensive than the inspections it undertook in  the past. These include regular contacts between appraisal archivists and  agencies, updated guidance information, and training.
However, the Resource Allocation Project was primarily based on NARA’s  in-house information sources and expertise. Although this information and  expertise may be considerable and collecting and assessing it potentially  valuable, it is not a substitute for examinations of agency programs,  surveys of practices, agency self-assessments, or other external sources of  information. Further, although the final report on the 2004 project  included important lessons learned for improving future assessments,  NARA did not set up a process for continuing the effort and applying the  lessons learned to updating the assessment or validating its results.
Officials had also stated that targeted assistance was a tool that NARA  would use in preference to inspections to solve urgent records  management problems and that the results of the Resource Allocation  Project were also to be used in determining where to use this tool.  However, NARA’s use of targeted assistance has declined significantly  over the past 5 years. (NARA reported that in 2002, 77 projects were  opened and 76 completed; in contrast, 4 were opened and none  completed in 2007.) Officials ascribed the reduced emphasis on targeted  assistance projects to various factors, including competing demands (such  as work on the development of its advanced electronic records archive  and on helping agencies to schedule electronic records), the difficulty of  getting agencies to devote resources to the projects, and the removal of  numerical targets for targeted assistance projects, which occurred when  NARA revised performance metrics to emphasize results rather than  quantity. According to NARA, it also works with agencies to address  critical records management issues outside formal targeted assistance  arrangements. In addition, it identifies and investigates allegations of  unauthorized destruction of federal records.
Thus, neither inspections nor targeted assistance have made significant  contributions to NARA’s oversight of agency records management.  Without a more comprehensive method of evaluating agency records  management programs, NARA lacks assurance that agencies are  effectively managing records throughout their life cycle.
section_title: NARA Has Performed Several Records Management Studies
paragraphs: NARA has performed records management studies in accordance with its  2003 plan. According to the plan, it was to conduct records management  studies to focus on cross-government issues, to identify and analyze best  practices, and to develop governmentwide recommendations and  guidance. In addition, NARA planned to undertake records management  studies when it believed an agency or agencies in a specific line of  business were using records management practices that could benefit the  rest of a specific line of business or the federal government as a whole.
Since developing its 2003 plan, NARA has conducted or sponsored six  records management studies (see table 2).
Most of these studies were focused on records management issues with  wide application. For example, two were related to helping NARA  improve its guidance on particular types of records—health and safety  records, and research and development (R&D) records. Another two were  limited in scope to components of a single agency, but they addressed  issues with potentially broad application and included conclusions  regarding factors that needed to be considered in the appraisal of given  types of records.
section_title: NARA Has Not Reported on Its Oversight Activities as Required
paragraphs: Under the Federal Records Act, NARA is responsible for reporting the  results of its records management activities to the Congress and OMB,  including evaluations of responses by agencies to any recommendations  resulting from its inspections or studies and (where practicable) estimates  of costs if its recommendations are not implemented. Further, NARA’s  plan for carrying out its oversight responsibilities states that it will report  to the Congress and OMB on problems and recommended practices  discovered as part of inspections, studies, and targeted assistance  projects. According to NARA, it fulfills its statutory reporting requirement  through annual Performance and Accountability Reports, which include  sections on “Federal Records Management Evaluations.”
However, although NARA has issued reports on its records management  studies, the Federal Records Management Evaluations sections of the  Performance and Accountability Reports have not included the studies’  results or evaluations of responses by agencies to its recommendations.  Instead, the reports have generally provided an overview of NARA’s major  records management activities, as well as describing noteworthy records  management progress at individual agencies. For example, the report for  fiscal year 2007 provided statistics on the appraisal and scheduling of  electronic records systems and listed agencies that had scheduled  electronic records or transferred permanent electronic records to NARA  during the fiscal year.
Elsewhere in the reports, NARA mentioned four of the six records  management studies as part of its reporting on records management goals.  However, it included few details on the results of these studies regarding  the records management problems or recommended practices that they  uncovered. For example, in the fiscal year 2005 Performance and  Accountability Report, NARA reported that it had completed a January  2005 study on Air Force Headquarters offices (see table 2), but NARA did  not discuss the results, and later reports did not discuss actions taken in  response to its recommendations. Similarly, the fiscal year 2007  Performance and Accountability Report did not describe any actions that  the Department of Energy had taken in response to an August 2006 study.
Also, in 2007, NARA stopped reporting on its targeted assistance projects.  In prior years, its Performance and Accountability Reports generally  provided statistics on targeted assistance projects and described their  general goals, although the reports did not generally discuss problems or  recommended practices resulting from them. In the fiscal year 2007 report,  NARA stated that the strategies described in its Strategic Directions,  including targeted assistance, had become part of its standard business  practices and would no longer be highlighted individually. However, as  mentioned earlier, the number of targeted assistance projects had declined  significantly by that time.
The Director and senior officials from NARA’s Modern Records Program  agreed that the annual reports did not specify the problems and  recommended practices discovered as part of inspections, studies, and  targeted assistance projects. According to these officials, the annual  Performance and Accountability Reports have been focused on positive  news, and NARA has struggled with developing an objective way to report  negative news about agencies’ records management. The officials  attributed this difficulty to the agency’s conservatism in this regard.
NARA’s limited use of oversight tools and incomplete reporting on the  specific results of its oversight activities can be attributed to an  organizational preference for using persuasion and cooperation when  working with agencies. This preferred approach is consistent with NARA’s  reasons (as we noted in 2003) for replacing agency evaluations  (inspections) with targeted assistance: among these reasons was that  inspections were perceived negatively by agencies. NARA officials have  said that they prefer to use “carrots, rather than sticks.” NARA officials  added that full-scale inspections were resource intensive and took several  years to complete, and that agencies took years to address NARA’s  recommendations.
Although, as described earlier, NARA regularly works with agencies on  scheduling and disposition of records (activities related to the end of the  records life cycle), officials agreed that these activities provide limited  insight into records management at earlier stages—that is, creation,  maintenance, and use. The officials also agreed that their work with  agencies on scheduling records does not fulfill the Archivist’s  responsibility under the Federal Records Act to conduct inspections or  surveys of agency records and records management programs and  practices. Further, by giving the Archivist the responsibility to report to  the Congress and OMB on records management issues, the Federal  Records Act provides NARA with a tool for holding agencies accountable,  a key aspect of oversight. However, NARA has been reluctant to use this  tool, limiting its ability to determine whether federal agencies are carrying  out their records management responsibilities. Without more specific and  comprehensive information about how agencies are managing their  records and without the means to hold agencies accountable for  shortcomings, NARA’s ability to identify and address common records  management problems is impaired. As a result, there is reduced assurance  that records are adequately managed and that important records are not  being lost.
section_title: Agencies Reviewed Generally Used Paper Processes for E-Mail Records Management, but Three Are Moving Toward Electronic Recordkeeping
paragraphs: The four agencies reviewed—the Department of Homeland Security  (DHS); the Environmental Protection Agency (EPA); the Federal Trade  Commission (FTC); and the Department of Housing and Urban  Development (HUD)—generally preserved e-mail records through paper- based processes, although one agency—EPA—is in the process of  deploying an electronic content management system that is to be used for  managing e-mail messages that are agency records; two others have long- term plans to develop electronic recordkeeping. Three of the four agencies  also used electronic systems to manage documents, correspondence, and  so on, but these systems generally did not have recordkeeping features.  Each of the business units that we reviewed (one at each agency)  maintained “case” files to fulfill its mission that were used for  recordkeeping. The practice at the units was to include e-mail printouts in  the case files if they contained information necessary to document the  case—that is, record material. These printouts included transmission data  and distribution lists, as required.
DHS: DHS primarily uses “print and file” recordkeeping for all records.  None of the department’s e-mail systems is a recordkeeping system;  accordingly, they may be used to store only transitory e-mail records.  Officials from the Office of the DHS Chief Information Officer (CIO) told  us that DHS e-mail systems house transitory e-mails and retain them for at  least 90 days. In addition, according to the CIO office, although employees  can currently access Web-based and Internet-accessible private e-mail  systems, the department is taking steps to restrict or remove this access.
Although its current recordkeeping is generally paper-based, DHS has  begun planning for an enterprisewide Electronic Records Management  System. According to the business case submitted by DHS to OMB to  justify the proposed investment, the proposed system is to allow  electronic storage and retrieval of records by authorized staff throughout  DHS and permit the elimination of paper file copies. According to the  department’s senior records officer, DHS’s current records schedules are  now media neutral. DHS’s records management handbook also provides  instructions for both electronic and paper e-mail recordkeeping.
In addition, DHS CIO officials told us that the department has  implemented several electronic knowledge and document management  systems, at least two of which have recordkeeping features but are not  used for e-mail recordkeeping.
E-mail records were maintained in paper at the DHS business unit  reviewed, the Washington Regional Office of Detention and Removal  Operations under Immigration and Customs Enforcement (ICE). The  primary responsibility of the Office of Detention and Removal Operations  is to identify, apprehend, and remove illegal aliens from the United States.  To fulfill its mission, the business unit maintained paper-based case files,  and these files were used for recordkeeping.
To store deportation case information, the unit uses the so-called “alien  files” or “A-files.” These files are created by DHS’s Citizenship and  Immigration Services for certain noncitizens, such as immigrants, to serve  as the one central file for all of the noncitizen’s immigration-related  applications and related documents that pertain to that person’s  activities. The A-files are managed by Citizenship and Immigration  Services and shared among DHS components as necessary. Because A- files are paper-based, they require physical transfer from one location to  another. To track these files, DHS uses the National File Tracking System,  an automated file-tracking system developed to enable all DHS staff at  numerous DHS locations around the country to locate, request, receive,  and transfer A-files. Each A-file has a National File Tracking System  number.
According to business unit officials, e-mails would not usually be found in  the A-files because the primary use of e-mail was to share information  within the business unit, and so it would rarely rise to the level of a record.  The A-files mainly contain other kinds of information, including forms  from agency information systems, investigation results, charging  documents, conviction documents, photos, fingerprints, and memos. A  deportation officer provided 10 active open case files for inspection (each  officer is usually responsible for 40 to 60 active open immigration cases).  The 10 case files contained a total of 18 e-mail records, which included  transmittal data and distribution lists.
EPA: EPA’s current recordkeeping is largely print and file, but the agency  is undergoing a transition to electronic recordkeeping, beginning with e- mail records. According to EPA officials, the commitment to establish its  Enterprise Content Management System (ECMS), which has  recordkeeping features, was a result of an agency decision to develop a  long-term solution to manage hurricane records electronically in the wake  of Hurricanes Katrina and Rita. According to a memorandum sent to all  EPA employees, the goal was to ensure that these records be placed in a  recordkeeping system that met both EPA and NARA requirements, while  allowing easy access to the records when needed. At the same time, the  agency ordered that the automatic delete function in the agency’s e-mail  system be deactivated so that no hurricane records could be deleted  accidentally.
According to agency officials, the e-mail capability of ECMS was available  in fiscal year 2007, and the agency expects that by the end of fiscal year  2009, 50 percent of EPA staff and contractors will be using the system. The  ECMS repository is an electronic recordkeeping system that uses  commercial software that complies with a standard endorsed by NARA.  According to officials, as part of its preparations for the transition, EPA  recently updated its record schedules so that its treatment of records  would be media neutral; this is to facilitate uploading records into ECMS.  It has also developed materials, such as a brochure and a user guide, to  support its transition.
The agency’s e-mail systems are not currently used as recordkeeping  systems and will not be under ECMS. Accordingly, they can be used to  store only transitory e-mail records. Officials also told us that employees  could access Web-based e-mail systems for limited personal use, but that  they were not permitted to use these for official business.
E-mail records were maintained in paper at the EPA business unit  reviewed, the Assessment and Remediation Division of the Office of  Superfund Remediation and Technology Innovation (part of EPA’s Office  of Solid Waste and Emergency Response). Among other things, this  division processes claims related to Superfund cleanup settlements.
Officials from the Office of Superfund Remediation and Technology  Innovation told us that recordkeeping for this office was print and file, but  that employees were also directed to include all records (including e-mail  records) into the office’s electronic Superfund Document Management  System. This was not a recordkeeping system, but the plan was to  integrate it with ECMS for long-term stewardship of Superfund files.  According to these officials, they expect to be able to capture Superfund e- mail records in ECMS by fall 2008.
Officials of the Assessment and Remediation Division stated that few e- mail messages would be considered records, because most official  business regarding claims was conducted through correspondence on  letterhead with an original signature. Although copies of these might be  sent as e-mail attachments, these officials said, they would not be the  official recordkeeping copy. However, division officials stated that e-mail  records were more likely to be included in case files regarding “mixed  funding” claims related to Superfund cleanup settlements, because these  involved communication between regional offices and parties involved in  the claims. (Mixed funding refers to the government assuming some  proportion of cleanup expenses, with other parties assuming the rest.)  According to officials, mixed funding documentation could include e-mail  records documenting information to justify claims and facilitate payment.  Officials provided a mixed funding case file for inspection, in which they  had identified 10 e-mail records. All these records included transmission  data and distribution lists, as required.
FTC: FTC recordkeeping for e-mail and other records is print and file. The  commission’s e-mail system is not a recordkeeping system, and the  commission has not implemented the option allowed by NARA’s guidance  to use the e-mail system for storing transitory e-mail records. The agency  has no current plans to institute electronic recordkeeping. According to  FTC officials, the commission’s processes are largely paper based. The  commission’s records management guidance states that few e-mails are  expected to rise to the level of a record. For example, agency officials  explained that official decisions of the commission are generally reached  jointly by the commissioners and recorded in documents such as  memorandums, letters, and meeting minutes. According to officials, FTC  uses a case management system to track work products (such as  depositions, filings, and briefs), but this is not a document management or  recordkeeping system. According to officials, about 80 percent of all FTC  files are case files.
The records manager said that the records schedules for FTC programs  currently include instructions for e-mail disposition, but that the office is  in the process of conducting a records inventory and reassessing records  scheduling, with the next step being to do “big bucket” media-neutral  scheduling. According to this official, this approach will provide flexibility  in the event that FTC adopts electronic business processes in the future.  According to FTC officials, the commission is currently assessing its needs  for electronic document management tools, including an electronic  recordkeeping system.
The CIO told us that agency staff cannot directly access external Web- based e-mail through the agency’s Web browsers, and agency employees  have been instructed not to use such systems for official FTC business.  However, this official said that agency employees may use the  commission’s remote application delivery environment to obtain limited  access to external Web-based e-mail as a convenience.
The business unit reviewed at FTC was the Division of Marketing  Practices within the Consumer Protection Bureau, which responds to  problems of consumer fraud in the marketplace, such as deceptive  marketing schemes that use false and misleading information. The division  enforces federal consumer protection laws by, among other things,  developing rules to protect consumers and filing actions in federal district  court for immediate and permanent orders to stop scams and get  compensation for scam victims.
The business unit follows the FTC’s print and file approach to  recordkeeping, saving e-mails and other communications if they are  related to a case. At this unit, cases are investigations of Internet fraud and  marketing practices, each of which is assigned to a lead attorney. Officials  provided one closed case file for inspection, consisting of four boxes of  records. The case file provided contained about 65 e-mails, all of which  included transmittal data and distribution lists.
HUD: HUD currently uses a print and file approach to e-mail  recordkeeping. The department’s e-mail system is not a recordkeeping  system, and according to officials, they have not implemented the option  allowed by NARA’s guidance to use the e-mail system for storing transitory  e-mail records. However, as part of an overall modernization plan, HUD is  undertaking an enterprise office system modernization project for its  records and document management. According to the business case  submitted by HUD to OMB to justify the modernization investment, the  HUD Electronic Record System (HERS) will replace eight legacy systems  and support the full life cycle of document management activities and  correspondence management, including the creation and processing of  records, record disposition, and retrieval of historical archived  information. HUD plans to implement HERS by the fourth quarter of 2010.  In the first phase of the plan, HUD is implementing modernized systems  for tracking correspondence and Freedom of Information Act requests.  Although the correspondence system is used for tracking e-mail  correspondence, it is not a recordkeeping system for e-mail.
The business unit reviewed at HUD was the Office of Healthy Homes and  Lead Hazard Control. Among other things, this office manages grants  related to lead hazard and conducts investigations to determine  compliance with HUD’s Lead Disclosure Rule. HUD records management  officials stated that each program area has a file plan, and that the Office  of Healthy Homes and Lead Hazard Control has its own records schedule.
According to officials from the office, most of their business is transacted  via certified mail, so that relatively few e-mail messages would be record  material. Two units provided active open files for inspection: nine grant  files from six Government Technical Representatives in the Program  Management and Assurance Division, and four lead hazard investigation  case files from one inspector in the Compliance Assistance and  Enforcement Division. The nine grant files included 120 e-mail messages,  and the four investigation files included 5 e-mail messages, all in the same  case file. All 125 of the e-mail records included transmittal data and  distribution lists, as required.
section_title: E-mail Record Policies at Three of the Four Agencies Generally Addressed NARA Guidance
paragraphs: At three of the four agencies reviewed, the policies in place generally  addressed the requirements for e-mail records management that we  identified, but each was missing one of the nine requirements. At the  fourth agency (HUD), the policies in place did not cover three of eight  applicable requirements.
According to NARA’s regulations on records management, agencies are  required to establish policies and procedures that provide for appropriate  retention and disposition of electronic records. In addition to including  general provisions on electronic records, agency procedures must address  specific requirements for e-mail records. The regulations provide  minimum requirements, which allow agencies flexibility to establish  processes for managing e-mail records that are appropriate to their  business, size, and resources.
According to the regulations, certain aspects of e-mail must be addressed  in the instructions that agencies provide staff on identifying and  preserving electronic mail messages, such as the need to preserve  transmission data. Agencies are also required to address the use of  external e-mail systems that are not controlled by the agency (such as  private e-mail accounts on commercial systems such as Gmail, Hotmail,  .Mac, etc.). Where agency staff have access to external systems, agencies  must ensure that federal records sent or received on such systems are  preserved in the appropriate recordkeeping system and that reasonable  steps are taken to capture available transmission and receipt data needed  by the agency for recordkeeping purposes. One of the four agencies  (HUD) had its systems configured so that staff could not access external e- mail applications; thus, this requirement was not applicable for HUD.
In summary, we extracted nine key requirements from the regulation.  Agency records management policy and guidance with regard to e-mail  must address these requirements, which are shown in table 3.
The policies and guidance at three of the four agencies (DHS, FTC, and  EPA) each omitted one applicable requirement.
At DHS, the policies and guidance did not state that draft documents  circulated on e-mail systems are potential federal records. Department  officials told us that they recognized that their policies did not specifically  address the need to assess the records status of draft documents, and said  they planned to address the omission during an ongoing effort to revise  the policies.
At EPA and FTC, the e-mail management policy did not instruct staff on  the management and preservation of e-mail messages sent or received  from nongovernmental e-mail systems. According to officials at both  agencies, such instructions were not included because agency employees  were instructed not to use such accounts for agency business. However,  whenever access to such external systems is available at an agency, the  agency should provide these instructions.
If agency records management policies and guidance are not complete,  agency e-mail records may be at increased risk of loss. If agencies do not  state that draft documents circulated on e-mail systems are potential  records, agency officials may not preserve such record materials. If  agencies do not instruct staff on the management and preservation of e- mail messages sent or received from nongovernmental e-mail systems,  officials may create or receive e-mail records in external systems that may  not be preserved in recordkeeping systems.
In the course of our review at EPA, officials told us that this situation may  have arisen: they had discovered that certain e-mail messages for a  previous Administrator, possibly including records, had not been saved.  According to these officials, they had discovered an e-mail message from a  former Acting Administrator instructing a private consultant not to use the  Administrator’s EPA e-mail account to discuss a sensitive government  issue (World Trade Center issues) but to use a personal e-mail account.  EPA officials reported this incident to NARA on April 11, 2008, in a letter  that also described the agency’s response to the incident and planned  safeguards to avoid such incidents in the future; these safeguards included  the release of a policy statement prohibiting the use of non-EPA messaging  systems for the conduct of agency business and a review of e-mail account  auto-delete settings. NARA replied on April 30 that the safeguards EPA  planned appeared appropriate.
Finally, HUD’s policies and guidance did not include, or did not  implement, three of eight applicable e-mail records management  requirements. For one requirement, HUD’s policy was inconsistent with  NARA’s regulations, and it was silent on two of the requirements.
HUD did not fully implement the requirement to ensure that staff are  capable of identifying federal records because its e-mail policy states that  only the sender is responsible for reviewing the record status of an e-mail.  However, NARA’s regulation defines e-mail messages as material either  created or received on electronic mail systems. HUD officials  acknowledged that the department’s policy omits the recipient’s  responsibility for determining the record status of e-mail messages and  stated that the e-mail policy fell short of fully implementing NARA  regulations in this regard because the department’s practice is not to use e- mail for business matters in which official records would need to be  created. However, this practice does not remove the requirement for  agency employees to assess e-mail received for its record status, because  the agency cannot know that employees will not receive e-mail with  record status; the determination of record status depends on the content  of the information, not its medium.
In addition, two other requirements were missing from HUD’s policy: it did  not state, as required, that recordkeeping copies of e-mail should not be  stored in e-mail systems or that backup tapes should not be used for  recordkeeping purposes. HUD officials stated that they considered that  these requirements were met by a reference in their policy to the NARA  regulations in which these requirements appear. However, this reference is  too general to make clear to staff that e-mail systems and backup tapes are  not to be used for recordkeeping.
Table 4 summarizes the results for the four agencies.
If requirements for e-mail management are not included in agency records  management policies and guidance, agency e-mail records may be at  increased risk of loss. The loss of records that are important for  documenting government functions, activities, decisions, and other  important transactions could potentially impair agencies’ ability to carry  out their missions.
section_title: E-Mail Records Management Practices of Senior Officials Did Not Fully Comply with Key Requirements
paragraphs: E-mail messages that qualified as records were not being appropriately  identified and preserved for 8 of the 15 senior officials we reviewed.  Senior officials at three agencies did not consistently conform to key  requirements in NARA’s regulations for e-mail records; only at FTC did the  four senior officials fully follow these requirements. The other three  agencies showed varying compliance: three officials at DHS, two officials  at EPA, and three officials at HUD were not following required e-mail  recordkeeping practices. Factors contributing to the inconsistent e-mail  recordkeeping practices include inadequate training and oversight. Other  factors included the difficulty of managing large volumes of e-mail in  paper-based recordkeeping systems and the stated practice at one agency  that e-mail would not be used for record material.
As described, the four agencies primarily used “print and file”  recordkeeping systems, which require agency staff to print out e-mail  messages for filing as the official recordkeeping copies in designated filing  systems. Each agency’s policy also required the preservation of e-mail  transmission data, distribution lists, and acknowledgments.
DHS. At DHS, our review covered three senior officials because, according  to DHS officials, the Secretary of Homeland Security did not use e-mail:  these officials told us that the Secretary did not have a DHS e-mail  account, and that he did not conduct any official communications using  external nongovernmental e-mail systems.
For the remaining three officials, the e-mail management practices did not  fully comply with the requirements. None of the e-mails of the senior  officials were reviewed for their status as a record or filed in an  appropriate recordkeeping system. Instead, the officials were using their e- mail accounts to store all e-mails. Two of the three officials personally  managed their e-mail accounts; the third shared this responsibility with a  member of his staff. The staff of one of the officials who managed his own  e-mail had access to the official’s e-mail account, but the staff reviewed or  accessed these only if instructed to do so by the official. The department  said that the third official’s office administrator had access to calendar  functions only.
According to one of these senior officials, storing e-mails on the computer  is convenient for searching and retrieving. It was this official’s opinion that  this approach was safe from a legal standpoint because no e-mails were  deleted. Nonetheless, using an e-mail system to retain all e-mails  indefinitely increases the difficulty of performing searches based on  categories of records; in contrast, such searches are facilitated by a true  recordkeeping system. Further, if e-mail records are not stored in an  appropriate recordkeeping system (paper or electronic), there is reduced  assurance that they are useful and accessible to the agency as needed, or  that they will be retained for the appropriate period.
EPA: At EPA, the e-mail records of two of the four senior officials were  being managed in accordance with key requirements reviewed. For these  two senior officials, one of whom was the agency head, e-mail records  were stored in paper-based recordkeeping systems.
The EPA Administrator had two EPA e-mail accounts, one intended for  messages from the public and one for communicating with select senior  EPA officials (not intended for use by the public). In the paper-based  recordkeeping system, of 25 e-mail records inspected, all included  transmission data and distribution lists, as required. For the nonpublic  account, staff provided eight e-mail records for inspection, all of which  also included transmission data and distribution lists. According to EPA  officials, the nonpublic account generated few records because the  Administrator receives most of his information from other sources,  including face-to-face briefings and meetings.
For the second senior official, administrative staff told us that the official  reviewed e-mail personally and forwarded records to the staff for printing  and filing in a paper-based recordkeeping system that followed the  agency’s records schedules. We selected 20 e-mails from the official’s files  for examination. These files were associated with four EPA records  schedules. All of the e-mails included transmission data and distribution  lists as required.
The e-mail records of two other senior officials were not being managed in  compliance with requirements, because e-mail records were not being  stored in appropriate recordkeeping systems, but rather in the e-mail  system:    One of these officials was in the process of migrating e-mail records from  the e-mail system to ECMS. This official had been storing e-mail records in  e-mail system folders since January 2006, in anticipation of the rollout of  the ECMS, and had not been using a paper-based recordkeeping system in  the interim. The e-mail system’s folders were organized according to the  agency’s records schedules to facilitate the transfer, which was ongoing.  Because this senior official did not store e-mail records in a paper-based  recordkeeping system during this transition, the official’s e-mail account  was being used as a recordkeeping system, which is contrary to regulation.  However, when the transition to the electronic recordkeeping system is  complete, the new system should provide the opportunity for this official’s  recordkeeping practices to be brought into compliance with requirements.
The second official was also saving all e-mail in the e-mail system. EPA  officials stated that most of the senior official’s e-mail was sent to an  administrative assistant, who was responsible for identifying and  maintaining the records received and filing them accordingly. However,  the administrative assistant for this official stated that although she had  been briefed on maintaining and preserving the senior official’s calendar in  a recordkeeping system, she had not received guidance or training in how  to preserve or categorize the official’s e-mail for recordkeeping purposes.  In addition, the assistant stated that all e-mails remained stored in the e- mail system where they could be retrieved if necessary.
FTC: The four senior officials at FTC were managing e-mail in compliance  with key requirements reviewed. These officials were the Chairman and  three Commissioners. According to an FTC official, the Commissioners  do not discuss substantive issues in e-mails to one another because of the  possibility that such group e-mails could be construed as meetings subject  to the Sunshine Act, which must be open to the public. FTC staff told us  that the then-Chairman and two Commissioners delegated part or all of the  responsibility for e-mail management; the remaining Commissioner  personally managed e-mails. E-mails with record status were to be printed  and filed in the commission’s paper-based recordkeeping systems. The  FTC recordkeeping systems contained e-mail records of the four officials;  of the 155 e-mail records inspected, all included the required distribution  lists and transmission data.
HUD: One of the four senior officials at HUD was managing e-mail in  compliance with key requirements, but for the other three officials, e-mail  records were not stored in appropriate recordkeeping systems.
The e-mail records for the agency head were being managed in accordance  with key requirements. According to HUD officials, management of e-mails  for the agency head was delegated to staff: that is, the agency head’s e- mails were forwarded by his administrative assistant to the Office of the  Executive Secretariat, where they were reviewed for record status and  preserved as necessary in paper files. Staff from the Office of the  Executive Secretariat flagged 10 e-mail records using the department’s  correspondence tracking system, which were then retrieved from the  paper-based recordkeeping system for inspection; all of these files  included the required distribution lists and transmission data.
The practices of the three other senior officials varied, except that for all  three, they or their staff stated that the officials retained e-mail messages  in the e-mail system. One senior official told us that he read his own e- mail and forwarded messages to staff to determine record status. Another  official’s staff stated that the staff was responsible for managing e-mail,  but that the official would determine what should be printed and filed. The  third official’s staff stated that the official did not review e-mails for record  status but forwarded all program-related e-mails to staff, who would  decide which e-mails should be included in the program files as records.  Neither the three senior officials nor several of their staff had received  records management training.
HUD provided copies of e-mail messages from one senior official for  review, but there was no evidence that the messages were stored in an  appropriate recordkeeping system, and HUD officials stated that the  provided e-mails were not records. They offered to provide similar  nonrecord messages for the two other officials, but we declined to review  them because the messages would not have addressed the question of  whether the officials were storing e-mail records in appropriate  recordkeeping systems. Thus, for these three officials the department did  not provide examples of printed e-mail records that had been stored in  appropriate recordkeeping files.
According to department officials, this situation is explained by HUD’s  practice of not using e-mail for business matters that would produce  records. According to department officials, official business is conducted  through paper processes, some electronic processes (such as Web-based  systems), but rarely through e-mail.
Nonetheless, although e-mail may rarely rise to the level of a record under  paper-based processes, it does not follow that no e-mail records are ever  created or received, as shown by the e-mail records maintained by the  department’s Executive Secretariat and the Office of Healthy Homes and  Lead Hazard Control. The weakness in HUD’s policy regarding  responsibility for determining which e-mails are records, combined with  the lack of training in e-mail records management, reduces the  department’s assurance that those e-mail messages that are records are  being appropriately identified.
Factors contributing to the inconsistent practices at the three agencies  include inadequate training and oversight, as well as the difficulties of  managing large volumes of e-mail with the tools and resources available,  which in most cases do not include electronic recordkeeping systems.
The regulations require agencies to develop adequate training to ensure  that staff implement agency policies. All four agencies have issued  guidance and developed training materials, and all state that they  performed records management training. For example, according to DHS  officials, all three senior officials and staff had received records  management training as new employees. However, DHS and HUD had no  documentation to indicate that employees had received such training,  and our review of practices found instances in which staff did not  understand their recordkeeping responsibilities for e-mail and stated that  they had not been informed of them or received training. For example,  three senior HUD officials had not received training on records  management. Staff explained that formal briefings had last taken place at  that time.
Agencies must also periodically evaluate their records management  programs, including periodic monitoring of staff determinations of the  record status of materials. However, the three agencies have not fully  developed and implemented oversight mechanisms, and do not determine  the extent to which senior officials or other staff are following applicable  requirements for e-mail records. According to DHS, it has initiated  oversight and review activities, but these are not yet at the pilot stage  because of other demands on records management staff, such as  completion of records scheduling. EPA has developed an oversight plan  and has pilot-tested a records management survey tool, but it has not yet  begun agencywide reviews. It plans to fully deploy this tool when ECMS is  fully implemented. HUD had not initiated oversight and review activities,  according to officials, because of its practice of not using e-mail for  matters that would necessitate the creation of official records. These  officials stated that when the department’s modernized system for records  and document management is in place, the department’s e-mail policies  will be updated and appropriate oversight and review activities put in  place.
Unless agencies train staff adequately in records management and perform  periodic evaluations or establish other controls to ensure that staff receive  training and are carrying out their responsibilities, agencies have little  assurance that e-mail records are appropriately identified, stored, and  preserved. Further, keeping large numbers of record and nonrecord  messages in e-mail systems potentially increases the time and effort  needed to search for information in response to a business need or an  outside inquiry, such as a Freedom of Information Act request.
The volume of e-mail is also described as contributing to e-mail records  management shortcomings. Agency officials and staff referred to the  difficulty of managing large volumes of e-mail, suggesting that limited  resources contributed to their inability to fully comply with records  management and preservation policies. To help ensure that e-mail records  are managed appropriately, it is helpful to incorporate recordkeeping into  the process by which agency staff create and respond to mission-related e- mail. Because this process is electronic, the most straightforward  approach is to perform e-mail recordkeeping electronically. All four  agencies, however, still rely either entirely or primarily on paper for their  recordkeeping systems, even for “born digital” records like e-mail.
Weaknesses in the processes in place at three of the four agencies  reviewed raise questions about the appropriateness of paper  recordkeeping processes for their e-mail records. Simply devoting more  resources to paper records management may be neither efficient nor cost- effective, and the agencies have recognized that this is not a tenable long- term solution. EPA is beginning a transition to electronic recordkeeping,  and HUD and DHS have plans focused on future enterprisewide  transitions.
Managing electronic documents, including e-mail, in electronic  recordkeeping systems would potentially provide the efficiencies of  automation and avoid the expenditure of resources on duplicative manual  processes and storage. It is important to recognize, however, that moving  to electronic recordkeeping has proved not to be a simple or easy process  and that projects at large agencies have presented the most significant  challenges. For projects of all sizes, agencies must balance the potential  benefits of electronic recordkeeping against the costs of redesigning  business processes and investing in technology. NARA has called the  decision to move to electronic recordkeeping inevitable. Nonetheless,  like other information technology investments, such a move requires  careful planning in the context of the specific agency’s circumstances, in  addition to well-managed implementation.
section_title: Conclusions
paragraphs: NARA’s limited performance of its oversight responsibilities leaves it with  little assurance that agencies are effectively managing records, including e- mail records, throughout their life cycle. NARA has an organizational  preference for partnering with and supporting agencies’ records  management activities, which is appropriate for many of its guidance and  assistance responsibilities. However, this preference has led NARA to  avoid performing oversight activities that it judged to be perceived  negatively—the full-scale inspections/evaluations that it performed in  previous years. Although it has performed studies that provide it with  insights into records management issues and it has taken action in  response to the findings, it has not developed means to evaluate the state  of federal records management programs and practices. As a result,  NARA’s oversight of federal records management programs, including  management of e-mail, has been limited. Further, NARA’s limited reporting  on problems and solutions identified at individual agencies reduces its  own ability to hold agencies accountable for addressing identified  problems, as well as reducing the ability of agencies to learn from the  experience of others.
At the four agencies reviewed, e-mail records management policies were  generally compliant with NARA regulations, with some exceptions. If  policies do not fully conform to regulatory requirements, it increases the  likelihood that those requirements will not be met in practice.
Senior officials at three of the four agencies stored e-mail records in e-mail  systems, rather than in recordkeeping systems, which is not in accordance  with NARA’s regulations. Factors contributing to this noncompliance  generally included insufficient training and oversight regarding  recordkeeping practices, as well as the onerousness of handling large  volumes of e-mail. Providing adequate training and oversight is a  prerequisite for improvement, but real improvements in e-mail  recordkeeping may require replacing the paper-based recordkeeping  processes currently in place. Properly implemented, the transition to  electronic recordkeeping of e-mail has the potential not only to reduce the  burden of e-mail management but also to provide positive benefits in  improving the usefulness and accessibility of records.
section_title: Recommendations for Executive Action
paragraphs: To better ensure that federal records, including those that originated as e- mail messages, are appropriately identified, retained, and archived, we  recommend that the Archivist of the United States    develop and implement an approach to oversight of agency records  management programs that provides adequate assurance that agencies  are following NARA guidance, including    developing various types of inspections, surveys, and other means  to evaluate the state of agency records and records management  programs;    developing criteria for using these means of assessment that ensure  that they are regularly performed; and  regularly report to the Congress and OMB on the findings,  recommendations, and agency responses to its oversight activities,  as required by law.
In addition, we recommend that the Administrator of the Environmental  Protection Agency  revise the agency’s policies to ensure that they appropriately reflect  NARA’s requirement on instructing staff on the management and  preservation of e-mail messages sent or received from  nongovernmental e-mail systems and    develop and apply oversight practices, such as reviews and monitoring  of records management training and practices, that are adequate to  ensure that policies are effective and that staff are adequately trained  and are implementing policies appropriately.
We further recommend that the Chairman of the Federal Trade  Commission revise the commission’s policies to ensure that they  appropriately reflect NARA’s requirement to instruct staff on the  management and preservation of e-mail messages sent or received from  nongovernmental e-mail systems.
We further recommend that the Secretary of Homeland Security  revise the department’s policies to ensure that they appropriately  reflect NARA’s requirement to state that draft documents circulated on  e-mail systems are potential federal records and    develop and apply oversight practices, such as reviews and monitoring  of records management training and practices, that are adequate to  ensure that policies are effective and that staff are adequately trained  and are implementing policies appropriately.
Finally, we recommend that the Secretary of Housing and Urban  Development  revise the department’s policies to ensure that they appropriately  reflect NARA’s requirements to ensure that staff is capable of  identifying federal records and to state that e-mail systems must not be  used to store recordkeeping copies of e-mail records (other than those  exceptions provided in the regulation) and that e-mail system backup  tapes should not be used for recordkeeping purposes, and    develop and apply oversight practices, such as reviews and monitoring  of records management training and practices, that are adequate to  ensure that policies are effective and that staff are adequately trained  and are implementing policies appropriately.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to NARA, DHS, EPA, FTC, and HUD for  review and comment. Three agencies provided written comments (which  are reproduced in apps. II to IV), and two provided comments via e-mail.  All five agencies indicated that they were implementing or intended to  implement our recommendations. Three of the five agencies generally  agreed with our findings and recommendations. One agency provided  information about its use of outside e-mail accounts, and one agency  agreed to implement our recommendations but questioned aspects of our  report.
In written comments, the Archivist of the United States stated that NARA  generally agreed with our draft report and would develop an action plan to  implement our recommendation. The Archivist also provided technical  comments, and we clarified our report to address each of them.   (see app. II).
In e-mail comments, the Director, Records, Publications, and Mail  Management at DHS, stated that the department agreed with our draft  report and that it correctly represented the condition at the time of the  review. The Director also said that future DHS records management policy  documents would be revised to reflect our recommendations.
In written comments, the Chief Information Officer of EPA stated that the  agency accepted our two recommendations. In addition, she provided  additional information on the EPA records management program. Finally,  this official provided technical comments, which we addressed as  appropriate; our assessment of these comments is contained in   appendix III.
In e-mail comments, an official from FTC’s Office of the General Counsel  stated that FTC had instructed staff not to use outside e-mail accounts for  official business, but it was nonetheless taking action to implement our  recommendation by issuing a notice to staff regarding policies and  procedures for e-mail records, which included a statement that work- related e-mails inadvertently sent or received from non-FTC accounts  must be handled in accordance with the agency’s records preservation  policies and procedures. Our draft recognized FTC’s instruction not to use  outside accounts for official business, but also noted that that FTC did not  totally prohibit access to such accounts. Because access to outside  accounts was available, FTC was required by NARA regulations to provide  staff with guidance on the proper handling of e-mail records sent or  received through such accounts. FTC also provided technical comments,  which we incorporated as appropriate.
In written comments, HUD’s Acting Chief Information Officer stated that  HUD planned to implement our recommendations, but also stated that our  draft was inaccurate in three areas:    The Acting CIO questioned the clarity of a figure we included to illustrate a  decision process that could be used to decide if an e-mail message is a  record. As noted in our draft, the illustration is provided as an example to  illustrate the kinds of factors that may be considered when deciding  whether an e-mail message is a record.
The Acting CIO disagreed with our conclusions regarding HUD’s  compliance with the requirements we reviewed, stating that the  department’s records policies comply with all these requirements because  they incorporate NARA’s regulations by reference. While our draft  recognized the reference to NARA regulations in HUD’s policy, we  concluded that such a reference was not adequate to comply with NARA  regulations. As we stated in our draft, the reference in HUD’s policy is too  general to make clear to HUD staff which practices are prohibited. In  addition, HUD did not establish procedures to implement the requirements  in question, as the regulations require.
The Acting CIO questioned the accuracy of a statement on the number of  senior officials whose files were reviewed. Our evidence shows that our  statement was accurate, but we revised it to include further clarifying  detail.
We provide more detailed responses to these points in appendix IV.
As agreed with your offices, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this report. At that time, we will send copies of this report to the  Archivist of the United States, the Administrator of the Environmental  Protection Agency, the Chairman of the Federal Trade Commission, the  Secretary of Homeland Security, and the Secretary of Housing and Urban  Development. Copies will be made available to others on request. In  addition, this report will be available at no charge on our Web site at  www.gao.gov.
If you have questions about this report, please contact me at (202) 512- 6240 or koontzl@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made major contributions to this report are listed in  appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: assess to what extent the National Archives and Records  Administration (NARA) provides oversight of federal records  management programs and practices, particularly with regard to e-mail,    describe processes followed by selected federal agencies to manage     assess to what extent the selected agencies’ e-mail records  management policies comply with federal requirements, and    assess compliance of selected senior officials with key e-mail  recordkeeping requirements.
To determine the extent to which NARA provides oversight of federal  agencies for managing and preserving federal e-mail records, we analyzed  applicable laws, regulations, and guidance; reviewed NARA’s oversight  activities from 2003 to 2007, including its reports to OMB and the Congress  on records management activities; reviewed recent NARA’s records  management reports; and interviewed NARA officials.
To address our other objectives, we judgmentally selected four agencies  for review based upon several factors. First, we identified four general  government functions from those functions that NARA identified in a 2004  resource allocation study as having records that had a direct and  significant impact on the rights, welfare, and/or well-being of American  citizens or foreign nationals: homeland security, health, economic  development, and environmental management. (NARA classified these  functions as high risk for rights/accountability.) Next, using NARA’s  analysis, we compiled a list of the federal agencies and their components  that performed those high-risk functions. For each identified agency, we  further classified it according to agency structure (a department with  component bureaus or agencies, a department with an office structure, an  independent agency, or an independent commission) and size (a large  department over 150,000 employees, a small department less than 11,000  employees, a small independent agency less than 1,100 employees, or a  large independent agency over 18,000 employees).
We then judgmentally selected four agencies from the high-risk list that  presented various combinations of structure and size. These were as  follows:  Department of Homeland Security (U.S. Immigration and Customs  Enforcement)
Rated by NARA as high on rights and accountability for records in the  Homeland Security: Immigrant and Non-Citizen Services function    Department with component agencies    Over 162,000 employees Department of Housing and Urban Development (Office of Healthy  Homes and Lead Hazard Control)
Rated by NARA as high on rights and accountability for records in the  Health: Illness Prevention function    Department with offices    Less than 11,000 employees   Rated by NARA as high on rights and accountability for records in the  Environmental Management: Environmental Remediation function  Independent agency    Rated by NARA as high on rights and accountability for records in the  Economic Development: Business, Trade, Trust, and Financial  Oversight  Independent commission  At each of the four selected agencies, we    assessed e-mail records management policies of the agency;    described processes followed by agencies to manage e-mail records,  specifically reviewing e-mail records management practices of a  business unit associated with the high-risk function; and    assessed compliance of four senior officials with key e-mail  recordkeeping requirements.
We selected a business unit from each organization that (1) performed the  particular line of business we identified in our agency selection process  and (2) had permanent records that NARA rated high on risk to  accountability and citizen rights. Table 5 identifies the business unit we  selected at each agency.
We also selected four senior officials at each agency. At DHS, EPA, and  HUD, we selected the head of the agency, the head of the office  responsible for policy, a randomly selected senior official, and the most  senior agency official associated with the business unit we inspected. At  FTC, we selected the Chairman and three Commissioners. The selected  senior officials are listed in table 6.
To describe the agencies’ e-mail records management practices, we  analyzed documents, interviewed appropriate officials at the agency  (including business unit officials and staff), and performed limited  inspections of selected e-mail records.
To assess each agency’s e-mail records management policies, we reviewed  the agency’s published policy documents, including formal policies and  operational manuals, as well as agency-provided responses to a data  collection instrument on e-mail management, and compared their contents  to the e-mail related requirements in NARA’s records management  regulations.
To assess compliance of senior officials with key e-mail recordkeeping  requirements, we analyzed documents, used data collection instruments to  gather information from the senior officials, their staffs, or other  appropriate officials, and inspected selected e-mail records. We asked  each agency to provide examples of senior officials’ e-mail messages  stored as records to corroborate their responses. We then analyzed the  information provided by the agencies and assessed it against the e-mail  requirements in NARA’s regulations on federal records.
We did not attempt to assess the extent to which the agencies’ staff  correctly identified e-mail records or the extent to which the agencies’  records appropriately included e-mail.
The four data collection instruments we used are briefly described in   table 7.
We performed our work at agency offices in the Washington, D.C.,  metropolitan area.
We conducted this performance audit from April 2007 to May 2008 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: Comments from the National Archives and Records Administration
section_title: Appendix III: Comments from the Environmental Protection Agency
subsections: section_title: The following are GAO’s comments on the on the EPA’s written response dated May 29, 2008, to our draft report.
paragraphs: 1.   We clarified our discussion of this topic.   2.   We clarified our discussion of this topic.  3.  We removed the reference to the 180 day limit.  4.  In our discussion of the exchange between EPA and NARA on the  incident involving possible loss of e-mail records, we included  information on EPA’s plan to promulgate a policy on the use on non- EPA e-mail systems.  5.  See comment 4. EPA plans to promulgate a policy prohibiting the use  of non-EPA e-mail systems for EPA business.  6.  We updated our discussion of this topic to reflect NARA’s response.  7.  We do not use EPA’s terminology because we do not find “primary”  and “secondary” to be useful descriptions. However, we revised our  discussion to clarify the references.  8.  See note 7.  9.  If EPA implements the oversight mechanism we recommend, it will  help ensure that e-mail records are properly identified and protected.  10. We updated our discussion to indicate when EPA plans to deploy its  survey tool.
section_title: Appendix IV: Comments from the Department of Housing and Urban Development
paragraphs: The following are GAO’s comments on the on the HUD’s written response  dated May 28, 2008, to our draft report.
subsections: section_title: GAO Comments
paragraphs: 1.  As noted in our report, the described decision process is an example of  one that could be used to determine whether an e-mail message is a  record. We did not state that the process is a requirement that must be   followed by any particular agency.  2.  See comment 1.  3.  See comment 5.  4.  See comment 5.  5.  Our draft noted that HUD incorporated Parts 1220, 1222, and 1228 of  NARA’s regulations by reference. However, the policy requirements at  issue are contained in Part 1234 of NARA’s regulations. In its  comments, HUD argues that the Parts it cites incorporate Part 1234 by  reference. We do not agree with HUD that this type of indirect  reference is a sufficient or effective way of informing HUD staff of  their e-mail recordkeeping responsibilities as well as of prohibited  practices. In addition, HUD did not fully implement the applicable e- mail management requirements because it did not establish  procedures to implement appropriate procedures that protect e-mail  records.  6.  See comment 5.  7.  The text suggested by HUD is incorrect in that we requested copies of  e-mail records from all three selected officials. We revised our report  to provide additional detail on this.  8.  We agree that enhancing HUD’s policies on e-mail records as we  recommend could increase their usability by all HUD officials and  staff; among other things, this could clarify for HUD staff which  practices are prohibited.  9.  We agree that not every e-mail is an official record, and we emphasized  this point in our report. However, we also emphasized that the content  of a communication, not its form, determines its record status.
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Mirko Dolak and James R.  Sweetman, Jr. (Assistant Directors); Monica Anatalio; Timothy Case;  Barbara Collier; Pamlutricia Greenleaf; Jennifer Franks; Tarunkant N.  Mithani; Sushmita Srikanth; and Jennifer Stavros-Turner made key  contributions to this report.