Information Management: Additional Actions Are Needed to Meet Requirements of the Managing Government Records Directive
Released: 2015-05-14T00:00:00

Letter

Background

Records are the foundation of open government, supporting the principles of transparency, participation, and collaboration. Well-managed records can be used to assess the impact of programs, improve business processes, and share knowledge across the government. Effective records management is also an important tool for efficient government operations. Without adequate and readily accessible documentation, agencies may not have access to important operational information needed to make decisions and carry out their missions.

Directive Established Federal Records Management Requirements

In response to the November 2011 presidential memorandum to begin an executive branch-wide effort to reform records management policies and develop a framework for the management of electronic government records, the Director of OMB and the Archivist of the United States jointly issued a directive to heads of federal departments and agencies. The directive was aimed at creating a robust records management framework for electronic records that complies with statutes and regulations to achieve the benefits outlined in the presidential memorandum. It required agencies, to the fullest extent possible, to eliminate paper and use electronic recordkeeping.

In particular, the directive set forth two goals that federal agencies, including OMB and NARA, are to work toward: require electronic recordkeeping to ensure transparency, efficiency, and accountability; and demonstrate compliance with federal records management statutes and regulations.

To meet the two goals, the directive identified 10 requirements that agencies had to address by established deadlines. As shown in table 1, seven of the requirements had deadlines that ranged from November 15, 2012, to December 31, 2014.

The directive also required NARA, OMB, and OPM to take 13 actions to assist agencies with meeting goal 2 of the directive. Table 2 describes the required actions and their due dates.

Agencies Took Actions in Response to the Directive but Did Not Fully Meet All Requirements

The 24 federal agencies took actions toward implementing each of the seven requirements due in November 2012, December 2013, and December 2014. These actions included designating and reaffirming senior agency officials at the appropriate level to oversee agencies’ records management programs, developing and implementing plans to manage permanent electronic records, reporting progress in managing permanent and temporary e-mail in an electronic format, identifying 30- year or older permanent records for transfer, identifying unscheduled records, obtaining the NARA federal records management training certificate, and developing records management training. However, certain requirements were not fully met by 5 of the agencies because these agencies were either still working on addressing the requirement, or did not view the requirement as being mandatory. Until agencies fully implement the directive’s requirements, the federal government may be hindered in its efforts to improve performance and promote openness and accountability through the reform of records management.

All Agencies Designated a Senior Agency Official to Oversee Records Management Activities, but Not All Designated the Official at the Appropriate Level

According to the directive, by November 15, 2012, and every year thereafter, each agency is required to name or reaffirm the Senior Agency Official who is responsible for coordinating with the agency records officer and other appropriate officials to ensure the agency’s compliance with records management statutes and regulations. The Senior Agency Official should hold a position at the assistant secretary level or its equivalent. Further, according to the directive, this official should be empowered to make adjustments to agency practices, personnel, and funding, as may be necessary, to ensure compliance and support the business needs of the department or agency.

All 24 agencies had designated a Senior Agency Official to oversee records management and had subsequently reaffirmed or named a new official. Among these agencies, 22 had designated a Senior Agency Official at the assistant secretary level or its equivalent and had given the official responsibilities for overseeing records management, including being empowered to make adjustments to agency practices, personnel, and funding, as required.

Two agencies, OPM and the Department of Veterans Affairs, had not designated their officials at the appropriate level. Further, at the Department of Veterans Affairs, the official was not always reaffirmed in accordance with the directive. Additionally, the department had not assigned its Senior Agency Official the responsibilities for ensuring records management compliance in the manner called for in the directive. Specifically:

Within OPM, the Senior Agency Official was not at the assistant secretary level or its equivalent. Rather, the position was delegated by the Chief Information Officer to the Chief of Records Management and Data Policy, within the Office of the Chief Information Officer. The Chief Information Officer did not view the Senior Agency Official designation at the assistant secretary level or its equivalent to be mandatory, and thus, did not assign the official at that level. Further, the Senior Agency Official said the position had the full responsibility, as stated in the directive, for ensuring that the agency’s records program complies with all records management statues and regulations. Nevertheless, while OPM’s Chief Information Officer did not consider the designation at the assistant secretary level or its equivalent to be mandatory, NARA records management officials stated that doing so is mandatory.

At the Department of Veterans Affairs, the Senior Agency Official was named in 2012, and reaffirmed in 2013. However, the official was not reaffirmed in 2014, thus not adhering to the directive requirement to reaffirm the Senior Agency Official annually. According to records management officials, the department regarded the requirement as not applicable when the Senior Agency Official did not change, but subsequently reaffirmed the official in February 2015. These officials added that the current Senior Agency Official position is held by an Associate Deputy Assistant Secretary who is instrumental in making recommendations and follow-up justifications to ensure compliance with the directive. However, the officials acknowledged that the Senior Agency Official does not have the authority to make decisions about agency practices, personnel, and funding to ensure compliance.

By not designating the Senior Agency Official at the level stated in the directive, OPM has not demonstrated its commitment to ensuring that the official it assigns to oversee compliance with records management statutes and regulations is consistent with the directive requirement. Further, by not designating a Senior Agency Official with the authority to make necessary decisions about agency practices, personnel, and funding critical to its electronic records management, the Department of Veterans Affairs has not demonstrated its priority to ensuring compliance with the directive in support of the department’s business needs.

Agencies Have Taken Actions to Manage and Transfer Temporary and Permanent Electronic Records, but More Action Is Needed

The managing government records directive established four requirements that agencies were to complete by December 31, 2013. Specifically, agencies were to develop and begin to implement plans to manage all permanent records in an electronic format; report to NARA annually the status of the agency’s progress in managing both permanent and temporary e-mail records in an electronic format; ensure that permanent records that have been in existence for more than 30 years are identified for transfer and reported to NARA; and coordinate with NARA to identify all unscheduled records, including records stored at NARA’s and the agencies’ records storage facilities that have not yet been properly scheduled.

As shown in table 3, the majority of the 24 agencies took actions to implement the directive requirements.

The directive required each agency to develop and begin to implement plans to manage all permanent records in an electronic format. To assist agencies in meeting this requirement, NARA developed a Senior Agency Official report template.agencies report on a number of specific areas, to include In using the template, NARA requested that details on how permanent electronic records are currently captured, retained, searched, and retrieved; plans to digitize permanent records currently in hard-copy format or plans to manage all permanent electronic records in electronic format, including how the plans will be implemented; and challenges the agency faced in achieving the requirement of managing all permanent electronic records in an electronic format.

All but 1 of the 24 agencies described their efforts to address these areas in the Senior Agency Official reports that they submitted to NARA. For example, 1 agency stated that its permanent records were being captured in both electronic and paper format and that permanent records were retained in agency shared drives. Another agency stated that electronic records capabilities were rolled out to its components to capture, retain, search, and retrieve the agency’s permanent electronic records; while another stated that its components capture, retain, search, and retrieve permanent electronic records in a variety of ways depending on their unique missions, business processes, and available technologies.

The National Science Foundation did not submit a Senior Agency Official report and did not provide information to NARA on how it intends to manage permanent records electronically. According to National Science Foundation records management officials, the agency is in the process of formalizing plans to manage permanent electronic records in an electronic format and intends to complete the plan in fiscal year 2015. However, the officials did not provide a date as to when the agency intends to report its plans to NARA, as required. Until the National Science Foundation completes and reports on its plans, it will not be positioned to provide NARA with required information on how it intends to manage permanent electronic records, or to receive feedback from NARA that could help ensure the effectiveness of its approach.

Most Agencies Reported Progress in Managing Permanent and Temporary E- mail Records

The directive required that each agency report to NARA, on an annual basis, regarding the status of its progress to manage both permanent and temporary e-mail records in an electronic format. Toward this end, 23 agencies met this reporting requirement. The agencies reported their progress through written responses in their Senior Agency Official reports. (Within the report template, a section was designated for the agency to describe its progress in managing both permanent and temporary e-mail records in an electronic format.) The 23 agencies’ written responses described how their e-mail records were currently captured, retained, searched, and retrieved, and how they identified temporary and permanent e-mail records.

As previously discussed, the National Science Foundation did not submit a Senior Agency Official report to NARA. In this regard, the agency’s records management officials stated that the management of permanent and temporary e-mail records was reviewed internally in May 2014 and that they were looking into whether a current agency system could be used to convert records into useable record types. However, no date was given by the officials as to when the required review for permanent and temporary e-mail records would be completed; nor did the agency provide a date as to when it will report to NARA, as required.

By not reporting on its progress toward managing permanent and temporary e-mail records in an electronic format, the National Science Foundation has not taken an important step toward ensuring that NARA is aware of the agency’s ability to retain e-mail records in an electronic system that supports records management and litigation requirements, including the capability to identify, retrieve, and retain the records for as long as they are needed. Further, the agency risks not receiving feedback from NARA that could help ensure it is prepared to retain e-mail records in an electronic system, as envisioned.

Most Agencies Identified and Reported on the Transfer of Permanent Records to NARA

The directive required agencies to ensure that permanent records that have been in existence for more than 30 years are identified for transfer and reported to NARA. In accordance with that requirement, the majority of the agencies identified for transfer and reported on their permanent records that were in existence for 30 years or more. Specifically, 21 of 24 agencies submitted to NARA, as part of their annual records management self-assessment reports, their lists of permanent records, or reported that there were no permanent 30-year-old records in their possession.

One agency, the National Science Foundation, did not report to NARA on its possession of permanent 30-year-old records. Records management officials at the National Science Foundation stated that the agency did not meet the reporting requirement because it did not complete its process of validating the accuracy of records that it had identified as potentially being 30 years old or older until the reporting deadline had passed. According to these officials, the agency completed this process in December 2014 and determined that there were no 30-year-old or older records in existence within the agency. The officials stated that, because the agency had no such records in its possession, the agency did not view reporting to NARA as a requirement. However, reporting that it had no permanent records in existence for 30 years or more would be a practice that is consistent with the majority of the agencies’ efforts to inform NARA regarding the state of these records and would demonstrate the National Science Foundation’s adherence with the directive.

Two other agencies—the General Services Administration and the Department of Transportation—had not fully addressed this requirement because they had not identified and reported on permanent 30-year-old records stored at either NARA’s federal records centers or the agency’s records storage facilities.

According to General Services Administration records management officials, permanent records stored at NARA’s federal records centers were identified, but permanent records stored at agency records storage facilities had not been identified. The officials stated that the agency plans to finalize, and report to NARA on, the identification of these records as part of its next agency-wide records inventory, which is supposed to occur in the summer and fall of 2017.

According to Department of Transportation records management officials, the department had met the requirement for all but 3 of its 10 components. In particular, the officials stated that 1 component had identified 30-year-old permanent records during its 2012 records inventory and, as of March 2015, was working with NARA to transfer these records by May 2015. The officials also stated that another component reported to NARA in January 2014 that it did not have permanent records that were in existence for more than 30 years. However, this component subsequently identified one 30-year-old permanent record in June 2014, and the department plans to report and transfer this record to NARA by the end of fiscal year 2015. The officials stated that the third remaining component had not completed its records inventory, but as of March 2015, had not identified any permanent 30-year-old records in its possession. Department of Transportation officials stated that they plan to report this information to NARA once their inventory is completed.

By not finalizing its identification of records stored at the agency’s records storage facility until approximately 4 years beyond the date specified in the directive, the General Services Administration delays its ability to report the status of, and transfer to NARA, its records that have been in existence for 30 years or more. Similarly, until the Department of Transportation ensures that its component completes the identification of permanent 30-year old records in its possession, it also limits its ability to report this information to NARA, as required.

Most Agencies Identified Unscheduled Records

The directive required each agency to coordinate with NARA to identify all unscheduled records, including all records stored at NARA and at agencies’ records storage facilities that have not yet been properly scheduled. We previously found that this is an essential step since NARA considers unscheduled records an important indicator of the risk of unauthorized destruction of records.

Among the 24 agencies, 20 had either identified unscheduled records and reported their progress in identifying these records to NARA, or had reported that they did not have any known unscheduled records by the reporting deadline. In particular, Senior Agency Officials and records officers for these agencies had either (1) worked in conjunction with NARA staff and identified their unscheduled records, (2) independently identified the unscheduled records, or (3) reported that there were no unscheduled records in their possession.

Three agencies—the Departments of Commerce and Transportation and the General Services Administration—did not complete the identification of their unscheduled records by the reporting deadline, although they subsequently did so for all or most of their components.

The Department of Commerce reported that it did not fully meet the requirement for identifying unscheduled records until the reporting deadline had passed. In particular, Commerce records management officials reported that the department completed the process of identifying the unscheduled records in September 2014.

Department of Transportation records management officials stated that the department identified unscheduled records for 1 remaining component (out of 10) in December 2013 and reported to NARA on those unscheduled records in January 2014.

According to General Services Administration records management officials, the agency did not identify unscheduled records stored at agency records storage facilities until November 2014, following an agency-wide records inventory in that same month.

Lastly, the National Science Foundation had not completed its identification of, or reported on, any portion of its unscheduled records. In July 2014, agency records management officials noted that they had identified the unscheduled records, but a preliminary internal inspection of the records had revealed administrative errors. Subsequently, the officials stated that a review of the unscheduled records list was under way in September 2014. However, as of March 2015, the officials stated that the review was still ongoing and they could not provide a date for when it would be completed. By not completing the identification of unscheduled records, the National Science Foundation increases the risk that its records could be destroyed without NARA’s awareness and approval.

Most Agencies Obtained Certifications and Established Records Management Training Programs

The records management directive established two requirements that were to be completed by December 31, 2014. The first was that each agency’s designated agency records officer must hold the NARA certificate of Federal Records Management Training and that new records officers must acquire the certification within 1 year of assuming the position of agency records officer. The second requirement was that each agency was to establish its own method to inform all employees of the agency’s records management responsibilities and develop suitable records management training for appropriate staff.

On December 4, 2013, NARA issued a bulletinagencies providing further guidance on agency records officer training requirements as stated in the directive. The requirement applied to all to the heads of federal formally appointed federal agency records officers. In the bulletin, NARA stated that it recognized that some designated agency records officers had years of experience and accreditation in the records management profession. In those cases, it agreed to grant the officer an exemption from obtaining the certificate of Federal Records Management Training. If an exemption was approved, no further action would be required to meet the directive training requirement. To receive an exemption from NARA, designated agency records officers must meet one of three criteria: (1) have 3 years of experience as a designated agency records officer and an Institute of Certified Records Managers certification, (2) have 3 years of experience as a designated agency records officer and an Academy of Certified Archivistsdesignated agency records officer at one or more federal agencies. certification, or (3) have 7 years of experience as a The majority of the federal agencies (22 of 24) either fully met the first requirement that each designated agency records officer hold the NARA certificate for Federal Records Management Training, were granted an exemption from obtaining the certificate, or were appointed in 2014 and have until a date in 2015 to complete the certification. Specifically, 17 agencies’ designated agency records officers had obtained the NARA certificate for federal records management; 4 agencies had received NARA exemptions for some or all of their designated agency records officers; and 1 agency had recently appointed its designated agency records officer, who has until September 2015 to complete the Federal Records Management Training.

Among the remaining two agencies—the Departments of Commerce and Defense—at least 1 designated agency records officer had not obtained the NARA training certificate or been granted a NARA exemption by the required deadline. Each of the agencies’ officials stated that their records officers were in the process of completing classes or obtaining the exemption. Specifically, at the Department of Commerce, 12 of 17 designated agency records officers had obtained the required NARA training certificate or received an exemption. According to the department’s records management officials, the remaining 5 designated agency records officers plan to complete their training by the end of fiscal year 2015.

For the Department of Defense, 23 of 24 designated agency records officers had obtained the required NARA training certificate or received an exemption. The department’s records management officials stated that the remaining designated agency records officer expects to complete training by August 2015.

With regard to the second requirement, all 24 agencies had established a method to inform employees of their records management responsibilities, as outlined in federal laws and policies. Specifically, these agencies had established a method to inform employees of their records management responsibilities either through agency-wide policy, departmental regulation, or through an agency-wide e-mail.

However, two agencies had not yet completed the development of their agency records management training. Specifically, the Departments of Commerce and Energy were in the process of developing training for their staff, and officials from these agencies said they plan to complete the training by June 2015.

OPM, OMB, and NARA Took Actions to Oversee Agencies’ Implementation of the Directive, but Not All Specified Actions Were Completed

OPM, OMB, and NARA had taken steps toward implementing the 11 of 13 actions specified in the directive as their responsibility, but selected requirements had not been fully addressed by the specified deadlines. For example, OPM had finalized an occupational series to elevate records management roles, responsibilities, and skill sets for agency records professionals. In addition, according to an official in OMB’s Office of Information and Regulatory Affairs, that agency was still in the process of updating its Circular A-130 to include records management requirements for agencies that are moving to cloud-based services or storage solutions, with the updated circular expected to be released by the end of calendar year 2015. Further, NARA had met with Senior Agency Officials and produced a plan to move agencies toward greater automation of records management. Moreover, NARA, in cooperation with the Federal Records Council, had worked with community of interest groups to identify tools that support electronic records management. However, it had not included metadata requirements in its guidance, as required. Until NARA completes the actions specified in the directive, agencies may not have the guidance needed to help improve the efficiency and effectiveness of records management across the federal government, as envisioned by the directive.

OPM Established the Records and Information Management Occupational Series

The managing government records directive required OPM to establish, by December 31, 2013, a formal records management occupational series. In doing so, OPM was to elevate records management roles, responsibilities, and skill sets for agency records officers and other records professionals.

In response to the directive, OPM created a draft position classification document for the Records and Information Management Series, 0308, by the December 2013 deadline, but did not finalize it until March 2015. The document was created to establish the records management series and classify positions within this series.

OPM disseminated the document to all federal agencies and obtained comments. Specifically, it issued a memorandum on December 27, 2013, to announce the release of the draft position classification document for the records management work. Federal agencies were asked to provide their comments by February 7, 2014.

All 24 agencies, including NARA, provided comments to OPM regarding the records management occupational series. Among the comments, agencies suggested that OPM incorporate changes to the position series and title, update the series to include the duties of federal records managers at senior levels and the working relationship between records management staff and senior officials, such as the Senior Agency Official, to ensure that agencies have efficient and effective records management programs.

Other comments suggested that personnel in this series should be considered as subject matter experts, and indicated that the draft series did not acknowledge the records management position as a full-time position with full-time responsibilities. The comments also stated that OPM should revise the series and consider that some positions would be a combination of records management, knowledge and information management, and information compliance roles, including data protection and freedom of information.

According to the Records and Information Management Occupational Series document, OPM summarized what it described as “major” agency comments on the occupational information, occupational title, and grading criteria, along with OPM’s response to these comments, in an appendix of the final series document. According to the document, OPM revised the occupational information to include language that addressed the modernization of records management, electronic records, and training, among other things. OPM also changed the occupational title to “Records and Information Management Specialist,” based on agency comments that it received on the title. Additionally, OPM revised the grading criteria language to align with the language of other recently issued series. By establishing a formal records management occupational series in March 2015, OPM took steps to elevate the roles, responsibilities, and skill sets for agency records officers and other records professionals.

OMB Has Not Yet Updated Its Policy for the Management of Federal Information Resources

According to the directive, OMB is to include in its next revision of Circular A-130 provisions for federal agencies to incorporate records management requirements when moving to cloud-based services or storage solutions. The directive did not establish a date by which this was to be accomplished.

As of March 2015, OMB had not finalized its revisions to Circular A-130 to require agencies to incorporate records management requirements when moving to cloud-based services or storage solutions, as specified in the directive. Officials in OMB’s Office of Information and Regulatory Affairs stated, however, that the requirement is expected to be included in the circular when it is finalized.

In explaining the status of this initiative, an official stated that revisions to the circular began in 2012 and were distributed for interagency comments. Additional revisions to the circular continued in 2013 and, in 2014 the agency waited for the approval of legislation, such as the Federal Information Security Modernization Act of 2014, which requires OMB to amend or revise Circular A-130 to eliminate inefficient or wasteful According to OMB officials, the agency expects reporting within 1 year.to finalize and issue the revised OMB Circular A-130 in December 2015. If consistent with the directive, this planned action of revising Circular A- 130 by OMB should help agencies incorporate records management requirements when moving to cloud-based services or storage solutions.

NARA Acted on Nine Specific Requirements, but Work Remains

The directive included nine specific actions that NARA was to implement by the end of December 2012, December 2013, and December 2014. Many, but not all of NARA’s actions met the requirements of the directive.

By December 31, 2012, the Archivist of the United States was required to convene the first of periodic meetings of all Senior Agency Officials to discuss progress on (1) implementation of the directive, (2) agency federal records management responsibilities, and (3) partnerships for improving records management in the federal government. Additionally, by this date, NARA was to complete a review of its records management reporting requirements and produce a template for a single annual report that each Senior Agency Official was to send to the Chief Records Officer for the U.S. Government beginning on October 1, 2013.

Toward this end, in November 2012, the Archivist held the first meeting with Senior Agency Officials, agency records officers, and NARA staff.

According to documentation we reviewed, meeting topics addressed two of the required areas: (1) an overview of the implementation of the directive and (2) Senior Agency Officials’ responsibilities and duties. Subsequent meetings were also held with the Senior Agency Officials of various agencies from August 2013 to August 2014 that addressed the implementation of an e-mail management approach and strategies for meeting the goals of the directive, among other topics.

Nevertheless, NARA records management officials acknowledged that the Senior Agency Official meetings did not include a discussion of partnerships for improving records management in the federal government, as required by the directive. According to the officials, the agency considered these meetings to be information-sharing discussions that would facilitate the exploration for future partnerships. The officials added that NARA planned to contact Senior Agency Officials and agencies when it dedicates more resources to address these partnerships.

Also in December 2012, NARA completed a review of its records management reporting requirements. Among other things, this review examined instances in which agencies were required to report on their progress through the managing government records directive, agencies’ records management self assessments, and inventories that the agencies were to conduct of electronic recordkeeping systems.

The review concluded that federal agencies were required to submit information to NARA for its use in measuring the state of federal records management in 11 different instances. These submissions were in addition to other information, such as plans and improvements that the agencies were making in response to the managing government records directive. NARA officials stated that, as a result of the review, it took steps to streamline agencies’ reporting requirements and reduce the number of times that agencies submit information. For example, in 2013, it eliminated the requirement for federal agencies to report semi-annually on their electronic records inventories. Instead, in 2014, NARA began requiring agencies to report annually on their electronic records as part of their records management self-assessment submissions.

Further, the officials stated that NARA had used the results of the review to create the required template that was to guide Senior Agency Officials in the development of their annual reports on the management of government records. NARA disseminated the template to federal agencies via an August 2013 memorandum. Subsequently, the agencies were to use the template to guide their descriptions of current and future plans to manage permanent electronic records, temporary and permanent e-mail records, and the use of cloud computing services. As discussed earlier, specific details of the template included questions about how agencies capture, retain, search, and digitize records. Also required were details on how the agencies intend to implement plans, as well as anticipated challenges to their management of permanent records electronically. According to the directive, agencies were to submit their reports based on the template by December 31, 2013.

NARA officials stated that their assessment of information provided by agencies in the Senior Agency Official report template had disclosed that responses varied in length and detail. Specifically, some agencies provided brief generalizations while others provided an abundance of information. We also found variations in the extent of Senior Agency Official template responses and supporting information. For example, in addition to providing descriptions of its progress being made toward specific directive goals and requirements in the Senior Agency Official template, the Nuclear Regulatory Commission submitted a preliminary plan that contained, among other things, the objective, scope of work, schedule, project team members, and project costs needed to modernize its information and records management program. This degree of specificity was not common in other agency submissions.

NARA records management officials acknowledged that the original reporting template had lacked specificity regarding the level of detail that it required agencies to provide. The officials stated that they did not require agencies to provide items, such as project plans, and did not intend to evaluate the report submissions for the sufficiency of agency plans. Rather, the officials indicated that NARA had wanted to identify what agencies were doing well, so those methods could be shared with other agencies that were in the initial stages of planning. Further, according to the officials, NARA wanted to encourage agencies to begin planning how they would meet the final December 2019 requirement to manage all permanent electronic records in an electronic format in advance of the deadline. Moreover, it wanted agencies to consider the sequential steps as well as timing and resources needed to move toward electronic recordkeeping.

NARA records management officials recognized the need for more information and stated that the next version of the Senior Agency Official reporting template, based on the data collected in 2013, is expected to seek information to be used as metrics to show what progress is being made across the government toward meeting the directive’s goals. In particular, in September 2014 NARA revised the reporting template to collect information on, among other things, agency records officers’ efforts in obtaining the federal records management certificate, and best practices applied and lessons learned on each agency’s transition to electronic recordkeeping.

According to the officials, NARA is committed to making the template instrumental to agencies, providing support to records management programs, and achieving the goals of the directive. By taking steps to ensure that agencies provide consistent and complete information regarding their efforts to manage permanent electronic records, NARA stands to have better awareness of agencies’ readiness to meet the established deadline.

NARA Revised Transfer Guidance for Permanent Electronic Records, but Metadata Requirements Were Not Included

According to the records management directive, NARA was to complete and make available by December 31, 2013, revised guidance, including metadata requirements for agency transfer of permanent electronic records to NARA. The revised guidance was to include additional sustainable formats commonly used to meet agency business needs. Also, NARA was to update the guidance regularly, as required, to stay current with technology changes.

In January 2014, NARA revised its transfer guidance for permanent electronic records and made the document available to the public on its website in the form of NARA Bulletin 2014-04, Revised Format Guidance for the Transfer of Permanent Electronic Records.covered categories not addressed in the previous guidance, such as digital audio and moving images. Among its revisions, the bulletin applies to all electronic records that have been appraised and scheduled for permanent retention, specifies which file formats are acceptable when transferring permanent electronic records to NARA, identifies preferred and acceptable formats for each category of electronic file, and expands the number of suitable formats that NARA will accept for transfer, based on their sustainability.

However, NARA’s revised guidance did not include metadata requirements, as called for in the directive. The bulletin stated that NARA would develop metadata requirements for electronic records separately, although no date was given for when it intends to do so. Further, as an alternative, NARA included in the bulletin a list of other currently available guidance for electronic records that address metadata. For example, the bulletin refers to guidance for electronic pointers (such as metadata tags) to establish linkages and the capture and maintenance of required metadata. The bulletin also specifies that agencies must comply with existing requirements for documentation and metadata as described in existing federal regulations until new requirements for metadata for electronic records are published.

NARA records management officials stated that the previous guidance for transferring permanent electronic records had identified metadata for a few record types, including digital photographs, geospatial records, and e- mail records. However, the development of new guidance on metadata requirements will be the first time that NARA has specified individual elements of metadata for all permanent electronic records. According to the officials, NARA anticipates that agencies will use the revised metadata guidance when implementing automated technologies for records management, and to address the creation, management, and eventual transfer of permanent electronic records to NARA. Nevertheless, the officials acknowledge that NARA had not set a time frame for making the revised metadata guidance available to agencies. Until NARA establishes a time frame for and, accordingly, takes steps to include metadata requirements in its revised guidance, agencies will remain unaware of all of the information they need to provide when transferring electronic records to NARA.

NARA Created New E-mail Guidance

The directive required NARA to issue new e-mail guidance by December 31, 2013. The guidance was to describe methods for managing, disposing of, and transferring e-mail.

Accordingly, in August 2013, the agency released NARA Bulletin 2013- 02, Guidance on a New Approach to Managing Email Records. The bulletin presented an e-mail management approach called Capstone. NARA records management officials described Capstone as an automated or manual method of categorizing and scheduling e-mail based on the work or positions of e-mail account owners. It is to be employed using various tools or systems and offers agencies a more simplified way to manage e-mail when compared to print and file systems or records management applications that require staff to file e-mail records individually.

NARA records management officials anticipate that the Capstone approach will provide agencies with a feasible solution to e-mail records management challenges, especially as agencies consider cloud-based solutions. Further, according to these officials, the Capstone approach is expected to allow agencies to consider whether e-mails contain the required metadata elements at the time of transfer to NARA. For its part, NARA has supplemented Capstone with training materials and other related guidance and resources, and has made this information available to agencies on its website to assist them in evaluating or adapting Capstone features.

By providing agencies the Capstone bulletin and related information representing a simplified automated e-mail management methodology, NARA has taken steps to assist agencies in incorporating recordkeeping requirements into their business processes and, in identifying the specific means by which they can fulfill their responsibilities under the Federal Records Act.

NARA Developed a Plan to Move Agencies toward the Increased Automation of Records Management

NARA was required to produce a comprehensive plan, in collaboration with the Federal Chief Information Officers Council, the Federal Records Council, private industry, and other stakeholders that describes suitable approaches for the automated management of e-mail, social media, and other types of digital record content, including advanced search techniques. The plan was to detail expected outcomes and potential associated risks and be completed by December 31, 2013.

Although not completed by the required deadline, NARA finalized and released a plan in September 2014 that was developed in consultation with the Federal Chief Information Officers Council, the Federal Records Council, private industry, and other stakeholders. The plan identified approaches for federal agencies to pursue when automating electronic records management, to include automated management of e-mail, social media, and other types of digital record content, as well as advanced search techniques. The plan discussed the outcomes, benefits, and risks of these approaches and described a framework that agencies may use to help meet the goals of the directive. It also listed ideas or activities intended to help NARA, agencies, and stakeholders achieve effective federal electronic records management.

NARA records management officials described the plan as being a living document and stated that the community of private industry and federal councils intends to continue to revise it as more is learned about automation technologies and additional efforts are made to work toward easier and consistent electronic information management. Moreover, the officials stated that NARA anticipates continuing to work with its stakeholders to identify milestones and tasks intended to, among other things, increase automation, reduce burden on end users, and achieve more consistent and affordable compliance with recordkeeping requirements. If effectively implemented, NARA’s plan could serve as an important tool to aid records management stakeholders’ awareness of recommended approaches for improving automated management of e- mail, social media, and other types of digital record content.

NARA Created a Template for Reporting Cloud Initiatives

The directive required NARA, by December 31, 2013, to incorporate into existing reporting requirements an annual agency update on new “cloud” initiatives, including a description of how each initiative meets Federal Records Act obligations and the goals outlined in the directive. For the initial report, agencies were to identify any existing uses of cloud services or storage, and the dates of implementation.

The Senior Agency Official annual reporting template created by NARA for 2013 included reporting requirements for cloud initiatives. As discussed earlier, NARA disseminated the template to federal agencies via an August 2013 memorandum.

NARA’s Feasibility Study Concluded That It Should Not Provide Government-Wide Storage and Management Services for Electronic Records

The directive required NARA, by December 31, 2013, to evaluate its feasibility of establishing a secure cloud-based service to store and manage unclassified electronic records on behalf of agencies. Further, the directive stated that this basic, shared service should adhere to NARA’s records management regulations and provide standards and tools to preserve records and make them accessible within their originating agency until NARA performs disposition.

In response to this requirement, NARA conducted a study examining the technical feasibility and cost for it to establish a repository and system to store, manage, and dispose of electronic records on behalf of federal agencies. The study included an assessment of secure cloud-based services and the cloud-based data-at-rest model. For the data-at-rest model, the study presupposed an environment where records are managed within the same clouds as agencies’ active business and administrative records. Also, these same clouds would be used for access and preservation of records. According to the study, disposition rules would then be applied where the records are stored because the data sets would be expected to continue to grow in size, thus becoming impractical to physically move them from repository to repository.

Additionally, the feasibility study determined that “data at rest” would require procedures, tools, and a processing environment that allows for archival records to be accessioned, preserved, and made publicly available without being physically transferred from their initial host environments. The report anticipated that these types of issues could be effectively managed with the assistance of external service providers.

NARA also considered cost factors in conducting the feasibility study and concluded that it should not serve as a direct service provider in assisting agencies with the storage and management of electronic records. Specifically, the study determined that costs were not practical for a secure cloud-based service needed to meet the requirements of a an infrastructure capable of managing large volumes of agency- large user base, the investment required to establish a cloud-based repository, and owned records.

Consequently, the study concluded that a more sustainable approach to improving electronic recordkeeping may be to pursue alternative service models where NARA does not store and manage electronic records on behalf of agencies. According to NARA, these services and the agency’s role in providing them could be developed and tested as part of the managing government records directive’s work with automation, open source technology development, and cloud computing.

NARA Created Community of Interest Groups to Help Support Electronic Records Management Initiatives

By December 31, 2013, NARA, in cooperation with the Federal Chief Information Officers Council, the Federal Records Council, and other government-wide councils that expressed interest, was to establish a community of interest to bring together leaders from the information technology, legal counsel, and records management communities to solve specific records management challenges. In particular, the community of interest group was to develop and propose guidance, share information, create training, and identify tools that support electronic records management.

Toward this end, NARA reported that two communities of interest were established: (1) the Electronic Records Management Automation Working Group, established in March 2013; and (2) the Federal Records Officer Network, established in May 2013.

According to NARA records management officials, the Electronic Records Management Automation Working Group is made up of 133 members from the information technology, legal counsel, and records management communities in the federal government. The officials stated that, through this working group, records managers, information managers, and IT staff share information with other group members on increasing the automation of electronic records management tasks. Further, the officials stated that the Electronic Records Management Automation Working Group has suggested topics for guidance that NARA could produce, including the disposal of paper records after digitization, required metadata, and auto-categorization.

The Federal Records Officer Network has 172 members from various federal agencies and collaborates on projects, shares information, and develops training on records management. According to NARA’s records management officials, the Network, in consultation with NARA, has consolidated records management training materials from multiple agencies into a single e-learning product that agencies can download and use to meet training requirements. NARA records management officials also stated that the Federal Records Officer Network has made suggestions on records management best practices and training projects.

Additionally, NARA records management officials stated that the agency has, in cooperation with the Federal Records Council, worked with community of interest groups, including the Electronic Records Management Automation Working Group and the Federal Records Officer Network, to identify tools for records management. By creating communities of interest that proposed guidance, shared information, developed training, and helped to identify tools to support electronic records management, NARA has taken steps toward assisting agencies with records management challenges.

NARA Identified and Enhanced an Analytical Tool to Evaluate the Effectiveness of Federal Records Management Programs

By December 31, 2013, NARA was required to identify a government- wide analytical tool to evaluate the effectiveness of records management programs. The tool was intended to supplement NARA’s assessments, inspections, and studies of agencies’ records management programs. The tool was also to help NARA and agencies measure program compliance more effectively, assess risks, and aid in agency decision making.

In accordance with the directive, by the second quarter of fiscal year 2013, NARA had identified the Records Management Maturity Model Integrated tool developed by the Department of Homeland Security, as the most feasible foundation for a records management solution to evaluate agency records management programs. NARA then created a working group of agency officials from the Federal Records Council to modify the Records Management Maturity Model Integrated tool. The working group members represented six federal agencies: NARA; the Securities and Exchange Commission; and the Departments of Homeland Security, the Interior, Justice, and Transportation.

The working group’s efforts resulted in the development of the Federal Records and Information Management Program Maturity Model, a government-wide analytical tool. According to the Federal Records and Information Management Program Maturity Model’s user guide, the purpose of the tool is to help agencies or components assess areas of their records management programs to determine where improvements are most needed. The tool is also intended to measure the maturity of an agency records management program, regardless of the program’s size and records management maturity level. The working group developed organizing principles, assessment criteria, and performance measures for the tool and, as of January 2015, had completed the tool and finalized a guide for its intended users.

NARA records management officials stated that the agency presented the Federal Records and Information Management Program Maturity Model tool at its bi-monthly records management meeting in March 2015 and posted the final product on its records management website in April 2015. If the tool and the actions planned by NARA work as intended, they could assist NARA and the agencies in evaluating the effectiveness of agencies’ records management programs and measuring agency compliance.

NARA Obtained External Involvement for Development of Open Source Records Management Solutions

The directive required NARA to collaborate with the Federal Chief Information Officers Council and the Federal Records Council, and obtain external involvement to develop open source records management solutions by December 31, 2014.

To address this requirement, in 2013 and 2014, NARA engaged the Federal Chief Information Officers Council, the Federal Records Council, and the private sector to develop open source records management solutions. For example, as discussed earlier, NARA generated a plan with stakeholder participation that included activities that pertained to the development of open source opportunities. Specifically, the plan, among other things, (1) identified activities that will aid in developing open source records management tools and (2) encourages external involvement to develop open source records management tools.

The plan described a NARA activity to identify open source records management tools by compiling a list of available open source tools that could be used for various records management functions. This list and related information would be maintained online as a resource for the federal records management community. In addition, the plan specified that NARA intends to identify gaps in open source records management tools and identify opportunities for external involvement in the development of new records management solutions. Further, to encourage external involvement in the development of open source records management tools, NARA requested information from selected private sector vendors pertaining to cloud-based and open source records management solutions for the federal government. According to NARA officials, their outreach to vendors discovered that many viable automated records management solutions are already on the market, including some open source solutions. Consequently, in collaboration with the Federal Chief Information Officers Council and the Federal Records Council, NARA worked with private industry to help familiarize agencies with existing solutions with the goal of identifying any remaining unmet requirements. For example, NARA Invited presentations to the federal records management community on particular automated solutions and provided a list of questions for vendors to answer about their products during those presentations.

Hosted an industry day event on September 10, 2013. At this event, records officers, IT staff, and chief information officers from several agencies, including NARA, discussed with vendors automated electronic records management and the kinds of solutions the agencies were seeking.

Published a request for information in FedBizOpps13, 2013, requesting vendor capability statements describing their solutions and services to support automated electronic records management. By April 15, 2014, NARA had received 52 capability statements in response, all of which were shared with the federal records management community through the Electronic Records Management Automation Working Group.

Additionally, NARA provided evidence that it worked with other stakeholders, such as in 2013, when it invited volunteers from other federal agencies to share ideas and good practices and lessons learned with each other in the Electronic Records Management Automation Working Group. Further, according to its records management officials, NARA issued the open source records management tools report in March 2015. According to NARA records management officials, the report compiled a list of available open source tools that could be used for various records management functions and maintain the information online as a resource for the federal records management community. This action, coupled with the work involving the private sector and other stakeholders, should assist NARA in identifying and developing open source records management solutions.

Conclusions

The majority of the 24 federal agencies had taken steps toward addressing the seven directive requirements for managing government records that had completion dates from November 2012 through December 2014. However, certain requirements were not fully met by 5 of the agencies. Specifically, not all agencies had designated Senior Agency Officials at the assistant secretary level; reported to NARA on how they planned to manage permanent electronic records, including e-mails; identified and reported on permanent records that have been in existence for 30 years or more; or identified unscheduled records. Further, the Departments of Commerce, Defense, and Energy had not fully implemented the requirement to develop records management training for all employees, or had not ensured that all agency records officers held the NARA certificate for Federal Records Management Training. However, these 3 agencies indicated that they expect to complete their requirements by the end of fiscal year 2015. Until agencies fully implement the directive requirements, they may not be well-positioned to implement the records management reforms envisioned by the directive.

In addition, OPM had finalized the records management occupational series, and OMB had established a deadline for updating key guidance to direct agencies to incorporate records management requirements when moving to a cloud-based service. However, while NARA had taken action to oversee agencies’ directive compliance and identified tools for addressing electronic records management challenges, it had not developed metadata requirements, which are needed to assess progress and streamline agency efforts to process records. Completing this effort could provide agencies with resources for more efficiently managing their records.

Recommendations for Executive Action

To help ensure that directive requirements are met, we are making 10 recommendations to specific agencies and NARA.

We recommend that the Director of the Office of Personnel Management take the following action:

Ensure that the Senior Agency Official designated to oversee the agency’s compliance with records management statutes and regulations is at or equivalent to the level of an assistant secretary, as required by the directive.

We recommend that the Secretary of Veterans Affairs take the

Designate a Senior Agency Official at or equivalent to the level of assistant secretary who has direct responsibility for ensuring that the agency complies with applicable records management statutes, regulations, and NARA policy, including being able to make adjustments to agency practices, personnel, and funding.

We recommend that the Secretary of Transportation take the following Identify permanent records that were in existence for 30 years or more for one remaining component and report this information to NARA.

We recommend that the Administrator of General Services Administration take the following action:

Expedite efforts to ensure that permanent records that were in existence for 30 years or more, including records stored at agency records storage facilities, are identified and reported to NARA.

We recommend that the Director of the National Science Foundation take the following four actions:

Establish a date by which the agency will complete, and then report to NARA, its plans for managing permanent records electronically. The plan should describe, among other things, how permanent electronic records are currently captured, retained, searched, and retrieved; plans to digitize permanent records currently in hard-copy format or other analog formats; plans to manage all permanent electronic records in electronic format, including how the plans will be implemented; and challenges the agency faced in achieving the requirement of managing all permanent electronic records in an electronic format.

Establish a date by which the agency will complete, and then report to NARA on, its progress toward managing permanent and temporary e-mail records in an electronic format, to include the agency’s ability to retain e-mail records in an electronic system that supports records management and litigation requirements, including the capability to identify, retrieve, and retain the records for as long as they are needed.

Report to NARA on the identification of its permanent records in existence for 30 years or more, to include when no such records exist.

Complete the identification of unscheduled records stored at agency records storage facilities.

We recommend that the Archivist of the United States take the

Establish a time frame and revise NARA transfer guidance for permanent electronic records to include all aspects of metadata requirements.

Identify tools to assist agencies with addressing records management challenges in cooperation with the Federal Chief Information Officers Council, the Federal Records Council, and other government-wide councils that express interest.

Agency Comments and Our Evaluation

We requested comments on a draft of this report from the 24 major agencies included in our study and from OMB and NARA. We received comments from the six agencies to which we made recommendations, which included NARA. Among these, OPM, the Department of Veterans Affairs, the General Services Administration, the National Science Foundation, and NARA provided written comments. Further, on May 5, 2015, the Deputy Director of Audit Relations for the Department of Transportation provided comments via e-mail. Four of the agencies and NARA either agreed or generally agreed with our recommendations, while one agency had no comments, as summarized below:

The Chief Operating Officer for OPM stated that the agency concurred with our recommendation and plans to designate its Chief Information Officer as the Senior Agency Official. According to the Chief Operating Officer, the agency’s Chief Information Officer is the equivalent of an assistant secretary, and is appropriately located within OPM to make adjustments to the agency’s practices, personnel, and funding to ensure compliance and support the business needs of OPM. The official added that the Chief Information Officer has direct responsibility for ensuring that OPM efficiently and appropriately complies with all applicable records management statutes, regulations, and NARA policy. OPM’s comments are reprinted in appendix II.

The Department of Veterans Affairs’ Chief of Staff stated that the department concurred with our recommendation. The Chief of Staff added that the department plans to designate its Chief Information Officer as the Senior Agency Official, with delegation of daily responsibility for complying with applicable records management statutes, regulations, and NARA policy to the Associate Deputy Assistant Secretary for Policy, Privacy, and Incident Response. The department’s comments are reprinted in appendix III.

The Acting Administrator of the General Services Administration stated that the agency concurred with and is developing a plan to address our recommendation. The Acting Administrator further stated that the agency would accelerate efforts to identify the location of its records by the end of fiscal year 2015. The agency’s comments are reprinted in appendix IV.

The National Science Foundation’s Chief Information Officer stated that the agency had no comments on the draft report but is committed to the continual improvement of information technology management, including its efforts related to records management. The agency’s comments are reprinted in appendix V.

In its comments, the Archivist of the United States said that NARA concurred with the recommendation to establish a time frame and revise transfer guidance for permanent electronic records to include all aspects of metadata requirements. The Archivist added that NARA believed it had met the second recommendation related to identifying tools to assist agencies with addressing records management challenges. In this regard, NARA provided us with evidence supporting its identification of tools, and in response we updated our report to reflect the actions taken. As an additional comment, the Archivist expressed concern that the report did not include a recommendation for NARA to revisit its guidance for the Senior Agency Official’s roles, responsibilities, and overall designation, especially as it pertains to independent agencies. The Archivist believed such a recommendation would further empower Senior Agency Officials within their component agencies. With regard to this comment, we believe clearly designated roles and responsibilities are important to ensuring the effectiveness of all agencies’ Senior Agency Officials and that NARA has taken an important step in recognizing its need to revisit guidance for independent agencies. As for the study results and recommendations included in this report, our work focused on the actions of NARA and the 24 major federal agencies to implement the specific requirements outlined in the Managing Government Records directive. NARA’s comments are reprinted in appendix VI.

In comments provided via email, the Deputy Director of Audit Relations stated that the Department of Transportation concurred with our recommendation and that the agency would provide a detailed response to the recommendation within 60 days of our report’s issuance.

We also received written comments from the Department of Defense (reprinted in appendix VII) and the Social Security Administration (reprinted in appendix VIII). In the comments, the Principal Deputy for the Department of Defense stated that the department concurred with the report as written. The Executive Counselor to the Commissioner of the Social Security Administration stated that the agency had no comments on the draft report.

Further, we received technical comments via e-mail from the Department of Justice, NARA, and the National Science Foundation, which we have incorporated, as appropriate.

In addition to the aforementioned comments, liaisons for 15 other agencies sent e-mails stating that their agencies had no comments on the draft report. These agencies were the Departments of Agriculture, Commerce, Education, Energy, Health and Human Services, Housing and Urban Development, the Interior, Labor, State, and Treasury; the Environmental Protection Agency; National Aeronautics and Space Administration; Small Business Administration; U.S. Agency for International Development; and Nuclear Regulatory Commission.

Two agencies—the Department of Homeland Security, and the Office of Management and Budget—did not provide any responses to our request for comments.

We are sending copies of this report to the Secretaries of the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, the Interior, Labor, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, Small Business Administration, and the U.S. Agency for International Development; the Archivist of the United States; the Directors of the National Science Foundation, Office of Management and Budget, and Office of Personnel Management; the Chairman of the Nuclear Regulatory Commission; the Commissioner of Social Security; and other interested parties. This report also is available at no charge on the GAO website at http://www.gao.gov.

Should you or your staff have any questions on information discussed in this report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IX.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) assess the extent to which federal agencies have taken the actions called for in the Office of Management and Budget (OMB) and National Archives and Records Administration (NARA) Managing Government Records Directive, and (2) determine the extent to which the Office of Personnel Management (OPM), OMB, and NARA have taken actions called for in the directive, including overseeing agencies’ compliance. The scope of our review included the 24 major agencies covered by the Chief Financial Officers Act of 1990, as well as OMB and NARA.

To address the first objective, we took the following steps for each of the 24 agencies:

Compared agency documentation, such as records management policy and departmental regulations to the requirements specified in the directive that were required to be completed by the December 31, 2014, deadline. These requirements pertained to: (1) designating a senior agency official, (2) managing permanent electronic records, (3) managing permanent and temporary e-mail records, (4) identifying permanent records and reporting on that information to NARA, (5) identifying unscheduled records, (6) obtaining the NARA certificate of Federal Records Management Training, and (7) establishing records management training.

Obtained and reviewed records management policies, procedures, and guidance.

Collected and analyzed documentation that described actions each agency had taken to meet requirements of the directive, such as the annual records management self assessment and Senior Agency Official report.

Conducted structured interviews with records management officials from each agency to discuss steps taken to address directive areas and obtain additional supporting documentation to determine the agencies’ status in implementing the directive requirements.

Followed up with those agencies that did not fully meet the directive requirements to determine reasons for their noncompliance.

For the second objective, regarding NARA’s, OPM’s, and OMB’s implementation of their responsibilities under the directive, we took the following steps:

Collected and analyzed documentation on senior agency official meetings held by NARA and records management communities of interest and the Federal Records and Information Management Program Maturity Model tool to evaluate agencies’ records management programs.

Obtained and analyzed NARA documentation, to include transfer guidance for permanent electronic records; guidance for managing, disposing of, and transferring e-mail; the Senior Agency Official template; and the results of a feasibility study on establishing a cloud- based service.

Obtained and reviewed NARA’s records management policies, plans, and other documentation related to electronic recordkeeping.

Conducted structured interviews with NARA’s Chief Records Officer and other agency officials regarding their interactions with the 24 agencies on the use of electronic recordkeeping and implementation of federal records management policies and practices.

Interviewed OPM’s Chief of Records Management and other agency officials to discuss the development of the records management occupational series, and obtained and evaluated related documentation.

Interviewed officials within OMB’s Offices of Information Regulatory Affairs and E-Government & Information Technology to discuss OMB’s efforts to update Circular A-130 and actions taken to assist agencies with meeting the goals of the records management directive.

To assess the reliability of what agency officials told us about how they met the requirements specified in the directive, we collected and analyzed documentation from the 24 agencies to determine the steps that each agency had taken to meet the requirements of the directive. We also collected and reviewed documentation that NARA provided regarding the status of agencies’ implementation of the directive areas.

Our study was conducted to determine whether the agencies in our review had complied with requirements of the directive agency-wide, and did not include a comprehensive assessment of all actions that agencies may have taken to carry out responsibilities at the branch or sub-agency levels.

We conducted this performance audit from March 2014 to May 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Office of Personnel Management

Appendix III: Comments from the Department of Veterans Affairs

Appendix IV: Comments from the General Services Administration

Appendix V: Comments from the National Science Foundation

Appendix VI: Comments from the National Archives and Records Administration

Appendix VII: Comments from the Department of Defense

Appendix VIII: Comments from the Social Security Administration

Appendix IX: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, the following staff made significant contributions to this report: Anjalique Lawrence, Assistant Director; Sharhonda Deloach; Elena Epps; Angel Ip; Lee McCracken; and Robert Williams.