Information Management: Selected Agencies Need to Fully Address Federal Electronic Recordkeeping Requirements
Released: 2020-03-30T00:00:00

Letter

Background

Records are the foundation of open government, supporting the principles of transparency, participation, and collaboration. Effective management of federal agency records is important for efficient government operations: it ensures that sufficient documentation is created; that agencies can efficiently locate and retrieve records needed in the daily performance of their missions; and that records of historical significance are identified, preserved, and made available to the public.

Requirements for managing federal records include the following:

The FRA establishes requirements for the management of records in federal agencies. Every federal agency is required to preserve records that document the organization, functions, policies, decisions, procedures, and essential transactions of the agency to furnish the information necessary to protect the legal and financial rights of the government and of persons directly affected by the agency’s activities. The act also gives NARA regulatory responsibilities for records management as well as general responsibilities for archiving records.

In response to a presidential memorandum to begin an executive branch effort to reform records management policies and develop a framework for the management of electronic government records, the Director of OMB and the Archivist of the United States jointly issued the Managing Government Records Directive to heads of federal departments and agencies. This directive aimed at creating a robust records management framework for electronic records that complied with statutes and regulations to achieve the benefits outlined in the presidential memorandum. It required agencies to eliminate paper and use electronic recordkeeping to the fullest extent possible.

Among other things, the directive identified two requirements related to electronic records that agencies were to implement between December 2016 and December 2019.

By December 31, 2016, federal agencies were to manage all permanent and temporary email records in an accessible electronic format. Email records were to be retained in an appropriate electronic system that supports records management litigation requirements, including the capability to identify, retrieve, and retain the records for as long as they are needed.

By December 31, 2019, federal agencies are to manage all permanent electronic records in an electronic format to the fullest extent possible for eventual transfer and accessioning by NARA.

NARA and Federal Agencies Share Responsibilities for Federal Records Management

Under the FRA and its implementing regulations, NARA has general oversight responsibilities for records management and the preservation of permanent records documenting the activities of the government in the National Archives of the United States. Thus, NARA is responsible for overseeing agency management of temporary and permanent records used in everyday operations and, ultimately, for taking control of permanent agency records judged to be of historic value.

In particular, NARA is responsible for: issuing records management guidance covering topics such as managing electronic records; assigning an appraisal archivist to each agency to answer agency questions about federal records management; providing services to agencies, such as records scheduling and working with agencies to implement effective controls over the creation, maintenance, and use of records in the conduct of agency business; approving the disposition (destruction or preservation) of records; providing storage facilities for agency records; and conducting inspections or surveys of agency records and records management programs.

NARA is also responsible for reporting to Congress on the state of federal records management. It accomplishes this responsibility, in part, by requiring all federal agencies to submit an annual report to the Office of the Chief Records Officer for the federal government. As part of these annual reports, agencies are required to include three submissions:

The Senior Agency Official Records Management Report includes responses about the agency’s progress toward the targets and requirements in the Managing Government Records Directive.

The Federal Email Management Report includes a self-evaluation of their email management.

The Records Management Self-Assessment includes a self- evaluation of their compliance with federal records management statutes, regulations, and program functions.

In addition to NARA’s responsibilities, the FRA requires each federal agency to make and preserve records that document the organization, functions, policies, decisions, procedures, and essential transactions of the agency.

Effective Records Management Must Address Electronic Records, Including Email The FRA covers documentary material, regardless of physical form or media, although, until the advent of computers, records management and archiving mostly focused on handling paper documents. However, as information is increasingly created and stored electronically, records management has had to take into account the creation of records in various electronic formats, including email messages. As such, agencies need to adapt their records management practices to manage those electronic files that may be federal records.

NARA’s implementing regulations and guidance, such as periodic NARA bulletins, provide direction to agencies about the management of electronic records. To ensure that the management of agency electronic records is consistent with provisions of the FRA, NARA requires each agency to maintain an inventory of all agency information systems that identifies basic facts about each system, such as technical characteristics and the electronic records it contains. NARA also requires that agencies maintain all federal records, including those in electronic format, in its systems. Further, NARA requires agencies to provide instructions to staff regarding how to maintain the agency’s operational records and what to do when they are no longer needed for current business. Like other records, electronic records must be scheduled either under agency- specific schedules or pursuant to a general records schedule.

Further, in order to effectively address NARA regulations, agencies are to establish policies and procedures that provide for appropriate retention and disposition of their electronic records. Disposition involves transferring records of permanent, historical value to NARA for the archiving of records (preservation) and the destruction of all other records that are no longer needed for agency operations.

In addition to adherence to general requirements governing electronic records, according to the electronic records management regulation, agencies are to also issue instructions to staff that specifically address retention and management of their email records. The regulation requires agencies’ email records to be managed as are other federal records with regard to the adequacy of documentation, recordkeeping requirements, agency records management responsibilities, and records disposition.

The FRA Amendments enacted on November 26, 2014, include, among other things, disclosure requirements for official business conducted using a non-official electronic messaging account. The law states an officer or employee of an executive agency may not create or send a record using a non-official electronic messaging account unless the officer or employee (1) includes a copy to an official electronic messaging account of the officer or employee in the original creation or transmission of the record or (2) forwards a complete copy of the record to an official electronic messaging account of the officer or employee not later than 20 days after the original creation or transmission of the record.

Our Prior Work Has Addressed Electronic Records Management

In 2015, we reported that the 24 major federal departments and agencies covered by the Chief Financial Officers Act of 1990 had taken action in response to the Managing Government Records Directive, but not all of the agencies met all of the requirements. In that report, we stated that most of the agencies, including the Department of Commerce (Commerce) and the National Aeronautics and Space Administration (NASA), described plans to manage permanent electronic records, reported progress in managing permanent and temporary email records, and identified unscheduled records. We also noted that certain requirements were not fully met by a few agencies, including the National Science Foundation (NSF) and Office of Personnel Management (OPM), because these agencies were either still working on addressing the requirement, or did not view the requirement as being mandatory.

Specifically, we reported that NSF did not submit a Senior Agency Official report that would have provided information to NARA on how it intended to manage permanent records electronically. In addition, we reported that NSF did not report to NARA on its possession of permanent 30-year-old records, and had not completed its identification of, or reported on, any portion of its unscheduled records. As a result, we recommended that NSF establish a date by which the agency would complete, and then report to NARA, its plans for managing permanent records electronically and its progress toward managing permanent and temporary email records in an electronic format. We also recommended that the agency complete the identification of unscheduled records stored at agency records storage facilities. NSF concurred with our recommendations and, in response, completed its plans for managing permanent records electronically and managing permanent and temporary email records in an electronic format. We verified in February 2017 that the agency reported these plans to NARA.

For OPM, the agency had not designated their Senior Agency Official at the assistant secretary level or its equivalent because they did not view the requirement as mandatory. We recommended that the designated Senior Agency Official be at or equivalent to the level of an assistant secretary. OPM concurred with our recommendations and, in response, designated the Chief Information Officer as the Senior Agency Official with direct responsibility for ensuring that OPM efficiently and appropriately complies with all applicable records management statutes, regulations, and NARA policy.

Federal Agencies’ Policies and Procedures Did Not Fully Address Electronic Recordkeeping Requirements

The 17 agencies selected for review varied in the extent to which their records management policies, procedures, and documentation addressed 10 key requirements in the Managing Government Records Directive, the FRA and its amendments, and implementing regulations related to electronic records. Specifically, most of the selected agencies addressed the requirements related to establishing records management programs, submitting records schedules to NARA, incorporating activities for electronic records into their overall records management program, developing plans for managing permanent electronic records in an electronic format, managing email records in an electronic format, and using non-official electronic messaging. However, agencies did not fully address the requirements related to maintaining an inventory of electronic information systems, establishing controls and preservation considerations for their electronic information systems, and issuing retention and management requirements for email.

Most Agencies Established Records Management Programs and Developed Records Schedules

According to the FRA and its amendments, agencies are to establish effective records management programs, which includes developing comprehensive records schedules, in order to achieve adequate and proper documentation of the policies and transactions of the federal government and to aid in the effective and economical management of agency operations. Specifically, each agency is required to: establish and maintain an active, continuing records management program that, among other things, includes effective controls over the creation, maintenance, and use of records and submit lists and schedules of records to the Archivist of the United States that describe, among other things, when eligible temporary records must be disposed of.

As shown in figure 1, the majority of the 17 selected agencies addressed these requirements.

Establishing a records management program: Fourteen of the 17 selected agencies—Armed Forces Retirement Home (AFRH), Consumer Financial Protection Bureau (CFPB), Commerce, U.S. Election Assistance Commission (EAC), Federal Housing Finance Agency (FHFA), Federal Trade Commission (FTC), NASA, NSF, Office of Management and Budget (OMB), Office of National Drug Control Policy (ONDCP), Overseas Private Investment Corporation (OPIC), OPM, Peace Corps, and Special Inspector General for Afghanistan Reconstruction (SIGAR)—had developed policies and procedures that outlined their records management program. The agencies’ records management documentation discussed, among other things, the requirement for effective controls over the creation, maintenance, and use of records at the agency.

However, three agencies—Marine Mammal Commission, Presidio Trust, and the Morris K. Udall and Stewart L. Udall Foundation (Udall Foundation)—did not have an active, continuing agency records management program, including documentation that described effective controls over the creation, maintenance, and use of records at the agency. All three agencies indicated that they have taken or intend to take actions to establish such a program.

Marine Mammal Commission officials responsible for records management stated that the agency had engaged a contractor who completed and submitted for agency review and approval a draft policy that would govern its records management program. As of January 2020, the Executive Director stated that the commission has a signed policy and draft handbook to govern its records management program and that it is working towards full implementation and compliance by December of 2022.

Presidio Trust officials responsible for records management stated that the agency intends to address the requirements and plans to have records management policies and procedures at the agency in fiscal years 2020 and 2021.

Udall Foundation officials responsible for records management stated that the agency had entered into an interagency agreement with NARA for consulting services to assess its current records management environment. According to the same officials, their intent is to review NARA’s recommendations and develop a plan to comply with the FRA, federal regulations, and NARA guidelines as they relate to records management. The agency did not provide an estimated date for completing these activities.

Until these agencies establish an active and continuing records management program, they cannot provide assurance that, among other things, effective controls are in place over the creation, maintenance, and use of records in the conduct of current business.

Submitting lists and schedules of records to the Archivist: Thirteen of the 17 selected agencies—AFRH, CFPB, EAC, FHFA, FTC, Marine Mammal Commission, NASA, ONDCP, OPIC, Peace Corps, Presidio Trust, SIGAR, and the Udall Foundation—had submitted a comprehensive list of records and disposition schedules to the Archivist. The remaining four agencies—Commerce, NSF, OMB, and OPM—had partially addressed this requirement because they had submitted only partial lists and schedules to the Archivist. Each of these agencies acknowledged they did not provide comprehensive lists of records and disposition schedules and stated they were currently working toward submitting them to the Archivist. OMB officials stated that they plan to complete this task by the end of calendar year 2019, while the other agencies did not provide an estimated date for completion. Without submitting lists of records and disposition schedules to the Archivist, Commerce, NSF, OMB, and OPM are at risk of maintaining records that are no longer relevant or needed.

Agencies Varied in Addressing Requirements for Managing Electronic Records

The Managing Government Records Directive was aimed at creating a robust records management framework for electronic records that complies with statutes and regulations. In order to ensure transparency, efficiency, and accountability, the directive instructed agencies to manage all permanent and temporary e-mail records in an accessible electronic format by December 2016 and manage all permanent electronic records in an electronic format to the fullest extent possible by December 2019.

The directive also required NARA to develop revised guidance for transferring permanent electronic records and issue new guidance describing methods for managing, disposing of, and transferring e-mail. Accordingly, NARA regulations and guidance outline requirements for agencies to establish a framework for managing electronic records, including requirements pertaining to electronic systems and email. Additionally, the FRA Amendments described the disclosure requirements for official business conducted using non-official electronic messaging accounts.

Based on our analysis, these documents identify, among other things, eight key requirements that agencies should include in their policies and procedures to ensure that they can effectively manage electronic records. These requirements are summarized in table 1.

The 14 agencies with an established records management program varied greatly in the extent to which they addressed these electronic records requirements, as seen in figure 2.

Management Requirements

Incorporate activities for electronic records into the agency’s overall records management program: Thirteen of 14 agencies that had established records management programs—AFRH, Commerce, CFPB, EAC, FHFA, FTC, NASA, NSF, OPIC, ONDCP, OPM, Peace Corps, and SIGAR—developed written policies and procedures that incorporated the management of electronic records into their records management program.

The remaining agency—OMB—did not address this requirement. Staff from OMB responsible for records management stated that the Executive Office of the President’s (EOP) Office of Administration is responsible for records management for all Executive Office components and has procedures that incorporate the management of electronic records into their records management program. However, the officials did not provide evidence that the existing policies and procedures incorporated the management of electronic records into their records program. Without being able to ensure that records management considerations are incorporated into the design and implementation of electronic systems, OMB risks not being positioned to properly manage records electronically.

Maintain an inventory of electronic systems: Three of the 14 agencies that had established records management programs— Commerce, FHFA, and SIGAR—also maintained an inventory of electronic information systems that documented the information and records produced and maintained by each application. Officials responsible for records management at these agencies stated that their inventory was maintained with the agency’s security plans.

Additionally, three of the 14 agencies that had established a records management program —FTC, NSF, and Peace Corps—partially addressed the requirement, as their policies and procedures addressed some, but not all, of the necessary elements. More specifically:

FTC documented various technical characteristics, such as authorizations, purpose and function of the electronic information systems, and authorized procedures for the disposition of records. However, the agency did not include the characteristics for reading and processing the records contained in the system, inputs and outputs, contents of the files and records, and cycle updates.

NSF documented the categories of records in the electronic information systems, record access procedures, purpose of the systems, and retention and disposition of the system’s records. However, the agency did not specify the technical characteristics of the systems, identify inputs and outputs, or describe update cycles.

Peace Corps documented update cycles and the purpose of the electronic information systems. However, the documentation did not specify the technical characteristics necessary for reading and processing the records contained in the system, identify system inputs and outputs, define the contents of the files and records, determine restrictions on access to and use of the system, and specify how the agency ensures the timely disposition of records.

According to officials responsible for records management at each of these agencies, they intend to address or would consider addressing the requirement. However, none of them provided a time frame for doing so.

The remaining eight agencies—AFRH, CFPB, EAC, NASA, OMB, ONDCP, OPM, and OPIC—either did not maintain an inventory of electronic information systems or did not provide documentation that outlined the technical characteristics, such as identifying all inputs and outputs necessary for reading and processing records contained in the system. Records management officials at AFRH, CFPB, EAC, NASA, OPM, and OPIC stated that they intend to address the requirement, but did not provide a time frame for doing so. Staff from OMB and ONDCP responsible for records management stated that EOP’s Office of Administration is responsible for records management for all components and maintains an inventory of electronic information systems. However, the officials did not provide evidence of this inventory. Without maintaining an inventory and documentation of electronic information systems used to store agency records, these agencies are at a heightened risk of records being lost and not identified and scheduled in accordance with agency records schedules.

Electronic System Requirements

Manage permanent electronic records in an electronic format: The Managing Government Records Directive requires each agency to develop and begin to implement plans to manage all permanent records in an electronic format. In accordance with this requirement, 12 of the 14 agencies that had established records management programs—AFRH, CFPB, Commerce, FHFA, FTC, NASA, NSF, OMB, ONDCP, OPIC, Peace Corps, and SIGAR—described their efforts to address the requirement in their Senior Agency Official reports to NARA. For example, these agencies described, among other things, plans on how permanent electronic records were being captured, retained, searched, and retrieved.

However, two agencies—EAC and OPM—did not address how they plan to manage permanent electronic records in their Senior Agency Official reports or other agency documentation. EAC officials stated that they were still deciding on a solution to manage permanent records, and OPM officials stated they were planning to update policies to ensure automated systems incorporate proper records management life cycle controls. Further, neither agency provided a time frame for developing and implementing a plan. By not having a plan to manage their permanent records in an electronic format, these agencies face an increased risk that they may not be positioned to manage permanent electronic records.

Incorporate required recordkeeping functionalities: Eight of the 14 selected agencies that established records management programs— Commerce, CFPB, FHFA, FTC, NASA, NSF, ONDCP, and SIGAR— had documented policies, procedures, or other records management documentation that addressed the required functionalities for recordkeeping systems. Additionally, one agency—OPIC—partially addressed this requirement because it included some, but not all, of the required functionality. More specifically, the agency did not identify whether the system could declare records and assign unique identifiers, capture records, maintain security, and preserve records. According to OPIC officials, the agency intends to work toward having better documentation outlining system functionalities in alignment with the requirements; however, the officials did not provide a time frame for completing this documentation.

Further, five of the 14 agencies that had established records management programs— AFRH, EAC, OMB, OPM, and Peace Corps—did not address this requirement. Officials responsible for records management at each of these agencies stated that their records management system encompassed all of the aforementioned functionality or that the agency was working toward a full electronic records management system. However, these agencies’ policies and procedures did not include the required functionalities for recordkeeping systems. According to the same officials, each agency intends to have written documentation that outlines the records management functionalities; however, they did not provide a time frame in which the documentation will be completed. Without using electronic recordkeeping systems with appropriate functionalities, these agencies face increased risk of not being able to reliably access and retrieve the records needed to conduct agency business.

Establish records management controls and preservation considerations: Seven of the 14 agencies that had established a records management program—CFPB, Commerce, FHFA, FTC, NASA, OPM, and SIGAR—included all records management controls in their electronic information systems policy and included preservation considerations in the design, development, and implementation of electronic information systems. Additionally, six of the 14 agencies that had established records management programs—AFRH, EAC, OMB, ONDCP, OPIC, and the Peace Corps—had policies that partially addressed establishing the records management controls for their electronic information systems. More specifically:

AFRH records management documentation included information controls to ensure the reliability, authenticity, and integrity of records. However, the documentation did not define controls for usability, content, context, and structure.

EAC’s documentation included controls for reliability, authenticity, integrity, and usability. However, the agency did not define controls for content, context, and structure.

OMB and ONDCP’s documentation outlined controls for authenticity, integrity, usability and content. However, the documentation did not define controls for reliability, context, and structure. Staff stated that both offices’ records management was handled by the Office of Administration in the EOP and that the office had acquired an object-based data storage system that was expected to address all of the required controls. However, the offices did not provide any evidence that the new system or the associated policies and procedures would address the required controls.

OPIC’s documentation defined controls for authenticity, integrity, and usability. However, the documentation did not define controls for reliability, content, context, and structure.

Peace Corps’ documentation included controls for reliability, authenticity, integrity, and content. However, the agency did not define controls for usability, context, and structure.

Additionally, each agency’s documentation did not describe how the agency ensures that records in the system are retrievable and useable for as long as needed to conduct agency business. Records management officials at each of the agencies acknowledged that not all of the controls or preservation considerations were included in their systems and that they planned to work toward implementing all of the controls; however, the agencies did not provide a time frame for documenting the controls.

The remaining agency—NSF—did not address this requirement because its existing policies and procedures did not demonstrate that the agency had established the required controls. NSF officials stated that they intend to comply with this requirement but did not provide a time frame for doing so. Without ensuring that records management controls and preservation considerations are incorporated into electronic information systems, the agencies cannot ensure these systems can produce retrievable and useable records for as long as needed to conduct agency business.

Email Requirements

Manage permanent and temporary email records in an electronic format: Thirteen agencies—AFRH, CFPB, EAC, FHFA, FTC, NASA, NSF, OMB, ONDCP, OPIC, OPM, Peace Corps, and SIGAR— addressed this requirement. The remaining agency—Commerce—did not address this requirement. Officials responsible for records management at Commerce stated that they use an email management system for email, email preservation, and litigation holds. However, their policies and procedures did not show how the agency managed both permanent and temporary email records in an accessible electronic format. Until Commerce ensures that its systems are capable of managing permanent and temporary email records and have the capability to identify, retrieve, and retain these records, the agency faces an increased risk that its emails are not able to be preserved or accessed when needed.

Issue retention and management requirements: Nine of the 14 agencies that had established records management programs— AFRH, Commerce, CFPB, EAC, FHFA, FTC, NASA, Peace Corps, and SIGAR—issued instructions or had policies on retention and management requirements for electronic mail. Additionally, two of the 14 agencies that had established records management programs— OPIC and OPM—had policies that partially addressed this requirement. More specifically:

OPIC’s policies and procedures documented that agency email messages and attachments that meet the statutory definition of a record are to be documented as an official record. However, the agency documentation did not discuss retention requirements for calendars. Officials responsible for records management stated that they intend to update the records and information management handbook to include the calendar requirement, but did not provide a time frame for updating the handbook.

OPM’s policies and procedures described how employees were to ensure that email records included most of the requirements, but the policies and procedures did not address retaining calendars and draft documents. Officials responsible for records management stated that they intend to review and update its records management policy, but did not provide a time frame for doing so.

The policies of the remaining three agencies—NSF, OMB, and ONDCP—did not address this requirement for various reasons. NSF officials responsible for records management stated that the agency issued instructions regarding record retention and management of email to staff through memos and bulletins. However, these documents did not include instructions to staff that ensured the names and addresses of the sender, date of message, attachments, calendars, and draft documents would be retained.

Additionally, staff from OMB and ONDCP responsible for records management stated that the Office of Administration within the EOP captured and managed all email on behalf of all components. According to these staff, email is permanent until the end of the presidential administration, at which time the email is transferred to NARA in accordance with each component’s records schedules. However, the staff did not provide evidence that the existing policies and procedures included these instructions. By not issuing instruction to staff on retention and management requirements for email, agencies are at risk of not being able to retrieve email and its associated metadata when needed to conduct agency business.

Use of non-official electronic messaging: Twelve of the 14 agencies that had established records management programs — CFPB, Commerce, FHFA, FTC, NASA, NSF, OMB, ONDCP, OPM, OPIC, Peace Corps, and SIGAR—had policies and procedures outlining the rules that their employees are to follow when creating records using a non-official electronic messaging account. The remaining two of 14 agencies that had established records management programs—AFRH and EAC—did not have written documentation describing the agencies’ disclosure requirements for official business conducted using non-official electronic messaging accounts.

The EAC records management officials acknowledged that the agency did not outline this requirement and stated that policies and procedures were being drafted to address this requirement; however, the officials did not provide an estimated completion date. AFRH stated that it had updated its “Network Rules of Behavior” document and its IT information security awareness training to new employees to reflect the requirement, but we were unable to verify the updates. Without establishing rules for employees on the use of non-official electronic messaging accounts, agencies are at risk of not retaining email records sent from personal accounts.

The 10 aforementioned requirements are important elements to address while establishing a framework for managing electronic records. While most of the selected agencies had established policies and procedures addressing the requirements, some had not. Until these agencies do so, they will lack assurance that electronic records are being managed in a way that promotes openness and accountability in documenting agency actions and decisions.

NARA Assisted Selected Agencies in Managing Electronic Records, but Did Not Ensure Agencies Addressed Identified Weaknesses NARA Issued Guidance and Provided Assistance to the Selected Agencies

NARA provided various forms of assistance to the selected agencies, which included issuing guidance regarding electronic records management, training, and professional development. In addition, NARA monitored the selected agencies’ compliance with records management regulations and implementation of policies, guidance, and other records management best practices through its self-assessment program. However, NARA had not ensured that any of the selected small or micro agencies that self-assessed to be at high risk of improper records management in calendar year 2017 were taking appropriate actions to improve their records management program.

According to the FRA, NARA is responsible for providing guidance and assistance to federal agencies with respect to ensuring economical and effective records management, adequate and proper documentation of the policies and transactions of the federal government, and proper records disposition.

In accordance with its responsibilities, NARA provided guidance and assistance to the selected agencies through various methods. All of the selected agencies stated that NARA guidance and assistance were generally helpful and that they relied on it to some extent for implementing the electronic records management requirements discussed in this report.

Specifically, NARA issued guidance particular to electronic records creation, policies and procedures, management, and disposition. Officials from the selected agencies found NARA’s guidance related to managing email and its December 2017 General Records Schedule to be helpful when fulfilling their responsibilities with respect to electronic records. The guidance related to managing email describes federal agencies’ responsibilities for email management and the Capstone approach to email management. The Records Officer at AFRH stated that the agency used guidance that described the minimum set of metadata elements that must accompany transfers of permanent electronic records to NARA. The General Records Schedule provides mandatory disposition instructions for records that are common to several or all federal agencies. An FHFA official responsible for records and information management stated this guidance was useful because it was used at the agency during regular records management activities, such as records disposition.

Further, NARA provided assistance to the selected agencies such as professional development training and assigning an archivist to assist each agency. Officials responsible for records management at the selected agencies stated that NARA offers agencies records management training and professional development to federal employees and contractors. For example, NARA provides a certificate program for Federal Agency Records Officers and records management professionals to manage information collected by their agency. In addition, these officials stated that NARA offers a bi-monthly Records Information Discussion Group where individuals involved with federal records management can share their experiences and discuss the latest developments from NARA.

Additionally, officials responsible for records management at the selected agencies stated that NARA assigns an archivist to each agency to field questions about federal records management, including services such as records scheduling and appraisal, and technical assistance. For example, Udall Foundation officials responsible for records management stated that the agency worked with its assigned archivist who provided direction on how to manage agency records, connected the agency with other records management subject matter experts, and fielded questions on the scheduling of agency records.

NARA Required Agencies to Self-Assess Their Programs, but Did Not Ensure They Have Plans to Make Improvements

In addition to providing assistance to federal agencies, NARA also has the responsibility to monitor compliance with records management regulations and implementation of NARA policies, guidance, and other records management best practices by federal agencies. One way in which NARA accomplishes this is to require federal agencies to conduct an annual self-assessment that evaluates the agency’s reported compliance with federal records management statutes, regulations, and program functions and is also useful to target resources to areas needing improvement. NARA scores each agency’s responses and, based on this score, determines whether an agency is at risk of not complying with statutory and regulatory records management requirements.

For the self-assessments that covered calendar year 2017, four of our 17 selected agencies—AFRH, Marine Mammal Commission, Presidio Trust and the Udall Foundation—were assessed as being at high risk of not complying with statutory and regulatory records management requirements. See table 2 for how 16 of the 17 selected agencies scored.

While NARA requires agencies to self-assess their records management programs annually, it does not ensure that agencies that scored poorly on their self-assessments develop a plan to improve their programs or monitor their progress in such efforts. According to NARA officials, after reviewing the reports the agency conducted phone interviews with staff from selected small and micro agencies to determine if there were any common factors for why they scored poorly on the self-assessments and what NARA could do to help them improve their records management programs.

Given the self-assessment process was designed to measure agency compliance and to target resources to areas needing improvement, it is important for NARA to ensure the small and micro agencies that have assessed their programs as high-risk are taking appropriate actions to improve their records management programs. Until NARA requires high- risk small and micro agencies to develop plans to make necessary improvements to their record management programs and monitor their progress, it cannot be certain that these agencies are managing electronic records in accordance with governing regulations. Similarly, agencies that have not submitted self-assessments may also not be addressing statutory and regulatory records management requirements.

Conclusions

While most of the selected agencies addressed the key electronic recordkeeping requirements, others did not. Specifically, many agencies did not address requirements related to electronic system and email implementation, including establishing controls for their electronic information systems, incorporating preservation considerations into systems, and issuing retention and management requirements for email. Until these agencies do so, they will lack assurance that electronic records are being created, managed, retained, preserved, and disposed of in a way that improves performance and promotes openness and accountability by better documenting agency actions and decisions.

NARA continues to assist the selected agencies in managing electronic records by providing guidance and training as well as monitoring their compliance with records management regulations. However, while NARA oversees the selected agencies’ compliance through records management self-assessments, it has not ensured that the selected small and micro agencies that were at high risk of improper records management have developed plans to address weaknesses in their records management programs.

Recommendations for Executive Action

We are making 42 recommendations to 15 agencies. Specifically, we are making the following recommendations to NARA: The Archivist of the United States should 1. require small and micro agencies that were determined to be at high risk of not complying with statutory and regulatory records management requirements to develop plans and timelines to address their records management weaknesses (Recommendation 1) 2. monitor the agencies’ progress towards these efforts on a regular basis. (Recommendation 2)

In addition, we are making 40 recommendations to 14 agencies to fully address the electronic recordkeeping requirements found in the Managing Government Records Directive and the Presidential and Federal Records Act Amendments of 2014 in their policies and procedures. Appendix II contains these recommendations.

Agency Comments and Our Evaluation

We requested comments on a draft of this report from NARA and the 17 other agencies included in our review. All of the agencies provided responses, as further discussed.

In written comments, NARA concurred with our recommendations and stated that the agency will develop an action plan to require small and micro agencies that consistently score in the high risk category on NARA’s annual records management self-assessment to address their records management weaknesses. In addition, NARA stated that it will continue to gather data to identify where inspections, guidance, and training are needed to ensure that small and micro agencies are improving their records management programs. NARA’s comments are reprinted in appendix III.

Of the 17 other agencies in our review, six agencies (CFPB, Commerce, NASA, NSF, OPM, and the Udall Foundation) concurred with our recommendations; five agencies (Marine Mammal Commission, OMB, ONDCP, OPIC, and Presidio Trust) did not state whether they agreed or disagreed with our recommendations; and six agencies (AFRH, EAC, FHFA, FTC, Peace Corps, and SIGAR) stated that they had no comments on the report. Multiple agencies also provided technical comments, which we incorporated as appropriate.

Among these agencies, the following six concurred with our recommendations and, in most cases, described steps planned or under way to address them:

The Consumer Financial Protection Bureau provided written comments in which the agency stated that it did not object to our recommendation. The agency added that it would establish a time frame to update its current inventory of electronic systems used to store agency records, so that the inventory includes all of the required elements. CFPB’s comments are reprinted in appendix IV.

In written comments, the Department of Commerce concurred with our two recommendations and stated that the agency intends to take additional steps to implement them. Specifically, with regard to our recommendation regarding up-to-date records schedules, the agency stated that it will ensure that its records schedules are updated and submitted to NARA no later than December 2020. Commerce also stated that, while it believes its current electronic system that manages email meets our recommendation, the agency intends to take additional steps by updating its policies and ensuring that users are correctly implementing the system to address federal recordkeeping requirements by December 2020. Commerce’s comments are reprinted in appendix V.

The National Aeronautics and Space Administration provided written comments in which it concurred with our recommendation. The agency added that it is currently developing a comprehensive inventory to serve as an authoritative source for identifying where the agency’s electronic records reside, which should be completed by June 2021. NASA comments are reprinted in appendix VI.

In written comments, the National Science Foundation concurred with our four recommendations. NSF stated that the agency is updating its schedules and intends to ensure that its records management practices and policies address current requirements and best practices for federal records management. NSF’s comments are reprinted in appendix VII.

The Office of Personnel Management provided written comments in which it concurred with our five recommendations and noted steps that the agency has begun or is planning to take to address them. OPM stated that, in fiscal year 2020, it intends to issue a strategic plan on the digitization and management of permanent and electronic records, update agency policies and procedures to include the required electronic information system function for recordkeeping systems, and implement the requirements of the agency’s Capstone email policy. The agency also noted that, in fiscal year 2021, it plans to complete the updates needed on all agency disposition schedules and develop an inventory of all electronic information systems that store agency records. OPM’s comments are reprinted in appendix VIII.

In written comments, the Udall Foundation concurred with our recommendation and described the steps it plans to take in fiscal years 2020 and 2021 to establish records management policies and procedures. For example, according to the foundation, in September 2020, it plans to complete the initial build-out of required infrastructure to manage electronic records. Further, in March 2021, it plans to finalize a formal records management policy and associated procedures for creating, maintaining, and using records across the agency. The Udall Foundation’s comments are reprinted in appendix IX.

Further, the following five agencies did not state whether they agreed or disagreed with the recommendations: In written comments, the Office of Management and Budget did not state whether it agreed or disagreed with our recommendations. However, OMB stated that it is diligently working with NARA to revise and update its records schedule and intends to closely review and close any gaps in documentation that GAO identified. The office also provided technical comments, which we incorporated as appropriate. OMB’s comments are reprinted in appendix X.

In an email from the Executive Director, the Marine Mammal Commission did not state whether it agreed or disagreed with our recommendations. However, according to the executive director, the commission now has a signed records management policy that describes staff responsibilities for the management of electronic records and email as well as a draft records management handbook. The official also stated that the commission will continue efforts to fully implement the records management policy and procedures aiming toward full implementation and compliance by December 2022. The Commission also provided technical comments, which we incorporated as appropriate.

In an email from the Acting General Counsel, the Office of National Drug Control Policy did not state whether it agreed or disagreed with our recommendations. The office provided technical comments, which we incorporated as appropriate.

In an email from its GAO audit liaison, the Overseas Private Investment Corporation did not state whether it agreed or disagreed with our recommendations. However, the liaison stated that the agency intends to implement a new solution for electronic records and information management that includes the recordkeeping functionalities required by NARA. The liaison added that the agency plans to update its records and information management policies and procedures to strengthen the records management controls and preservation guidance in fiscal year 2021.

In an email from the Chief Financial and Administrative Officer, Presidio Trust did not state whether it agreed or disagreed with our recommendations. However, the official stated that the trust had recently implemented the Capstone approach for email and would continue to work on records management throughout 2020 and 2021.

Lastly, we received emails from the Armed Forces Retirement Home’s Information Technology Manager, the U.S. Election Assistance Commission’s Communication Specialist, the Federal Housing Finance Agency’s Privacy Act Officer, the Federal Trade Commission’s attorney representative in the Office of General Counsel, the Peace Corps Agency Records Officer, and the Special Inspector General for Afghanistan Reconstruction’s Director of Information Technology. All of the emails stated that these agencies had no comments on the draft report.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Commerce; the Administrator of the National Aeronautics and Space Administration; the Archivist of the United States; the Chief Executive Officers of the Armed Forces Retirement Home and Overseas Private Investment Corporation; the Executive Directors of the U.S. Election Assistance Commission and Udall Foundation; the Directors of the Consumer Financial Protection Bureau, Federal Housing Finance Agency, National Science Foundation, Office of Management and Budget, Office of National Drug Control Policy, Office of Personnel Management and Peace Corps; the Chairman of the Federal Trade Commission, Marine Mammal Commission, and the Presidio Trust Board; the Special Inspector General for Afghanistan Reconstruction and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9342 or marinosn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix XI.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) selected agencies’ policies and procedures address electronic recordkeeping requirements in the Managing Government Records Directive and the Presidential and Federal Records Act Amendments of 2014 and (2) NARA assisted selected agencies in managing their electronic records.

To determine the agencies for our review, we identified agencies that established a Senior Agency Official for Records Management and submitted an annual report on NARA’s website between fiscal year 2015 and fiscal year 2017. Of the 95 agencies that met these criteria, we removed two from consideration because they were not part of the executive branch: one was a judicial branch agency and the other was a legislative branch agency. The 93 remaining agencies to include in our review represented the following categories: (1) executive departments, (2) Executive Office of the President, and (3) independent agencies.

To ensure that a variety of agencies were selected across the designated categories, we chose a selection of 17 agencies and ensured that at least two agencies were selected from the three identified categories. In order to generate this selection, we sorted the list of 93 agencies by assigned random numbers and selected the top 17 agencies in this list, while ensuring that at least two agencies from each category were selected. The selection of 17 agencies cannot be used to make generalizable statements about the full population of agencies. The 17 agencies selected were: 1. Armed Forces Retirement Home 2. Consumer Financial Protection Bureau 3. Department of Commerce 4. U.S. Election Assistance Commission 5. Federal Housing Finance Agency 6. Federal Trade Commission 7. Marine Mammal Commission 8. Morris K. Udall and Stewart L. Udall Foundation 9. National Aeronautics and Space Administration 10. National Science Foundation 11. Office of Management and Budget 12. Office of the National Drug Control Policy 13. Office of Personnel Management 14. Overseas Private Investment Corporation 17. Special Inspector General for Afghanistan Reconstruction To address the first objective, we identified key requirements specified in the Federal Records Act, the Presidential and Federal Records Act Amendments of 2014, and its implementing regulations, and the Office of Management and Budget’s (OMB) and NARA’s Managing Government Records Directive. In selecting the requirements for our assessment, we focused on requirements related to electronic records management, such as managing permanent and temporary records, managing email records, and managing electronic records management programs.

To assess whether agencies’ policies and procedures addressed the key requirements, we collected and analyzed policies, procedures, and other documentation that described how agencies are positioned to effectively manage electronic records. In particular, we reviewed agencies’ recordkeeping handbooks, agencies’ bulletins, file plans, records schedules, and electronic system user guides. Further, we collected and reviewed documentation that described agencies’ actions or planned actions to meet the specified deadlines in the Managing Government Records Directive. Specifically, we analyzed agencies’ records schedules, reports from NARA’s Senior Agency Official for Records Management’s web page, agencies’ email management system specifications, and agencies’ Capstone approach to email management.

We also verified with NARA records management officials whether selected agencies submitted records schedules by the December 31, 2016, deadline specified in the Managing Government Records Directive. We assessed these documents against each of the key requirements to determine each agency’s status in developing policies and procedures to address federal record keeping requirements.

Subsequent to our initial assessment, we conducted interviews with records management officials from the 17 selected agencies to discuss steps taken and obtain additional supporting evidence to determine the agencies’ status for implementing key federal recordkeeping requirements. We followed up with those agencies that did not fully address the key federal recordkeeping requirements to determine reasons for their lack of implementation.

For the second objective, we reviewed federal laws and guidance, such as the Federal Records Act, NARA regulations, and OMB’s and NARA’s Managing Government Records Directive, to determine NARA’s role and responsibilities in assisting the 17 agencies in managing their electronic records. Subsequently, we collected and analyzed guidance and other documentation from NARA, such as the agency’s Records Management Oversight and Reporting Handbook, Guidance on Senior Agency Officials for Records Management bulletin, and Frequently Asked Questions about Selecting Sustainable Formats for Electronic Records, to determine whether the documentation addressed all of the requirements needed to assist agencies in managing their electronic records.

We also analyzed responses in agencies’ fiscal year 2017 and 2018 Senior Agency Official for Records Management reports stating what assistance the agencies would like NARA to provide. We then conducted interviews with NARA’s Chief Records Officer and other agency officials regarding their interactions with the 17 agencies on the use of electronic recordkeeping and implementation of federal records management policies and practices to determine to what extent NARA assisted selected agencies in managing their electronic records. We also conducted interviews with officials from each of the 17 selected agencies to gain insight into how the agencies use the resources provided by NARA.

Lastly, we reviewed NARA’s annual self-assessment program that evaluates agencies’ reported compliance with federal records management statutes, regulations, and program functions to obtain information on how NARA was determining which agencies needed assistance with implementing their records management programs. We supplemented our document reviews and analysis with interviews of selected agency officials responsible for records management and NARA agency officials to gain an understanding of these and other relevant documents aimed at helping agencies implement their records management programs. Additionally, to identify which of our selected agencies were to be categorized as small and micro agencies, we used OMB’s definition of small agencies as agencies with fewer than 6,000 employees and micro agencies as agencies having fewer than 100 employees.

We conducted our work from March 2018 to February 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Recommendations to Departments and Agencies

We are making a total of 40 recommendations to 14 of the 17 agencies in our review to fully address the electronic recordkeeping requirements in their policies and procedures.

The Chief Executive Officer of the Armed Forces Retirement Home should take the following four actions:

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 3)

Establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 4)

Establish a time frame to update the agency’s policies and procedures to include the (1) following records management controls required for electronic information systems: usability, content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 5)

Ensure existing policies and procedures describe the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 6)

The Secretary of Commerce should take the following two actions:

Establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 7)

Ensure the electronic system that manages email provides the capabilities to manage permanent and temporary email records and to identify, retrieve, and retain records. (Recommendation 8)

The Director of the Consumer Financial Protection Bureau should take the following action:

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 9)

The Executive Director of the Election Assistance Commission should take the following five actions:

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 10)

Establish a time frame to develop a plan on how the agency intends to manage permanent electronic records. (Recommendation 11)

Establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 12)

Establish a time frame to update the agency’s policies and procedures to include the (1) following records management controls required for electronic information systems: content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 13)

Develop a written policy that describes the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 14)

The Chairman of the Federal Trade Commission should take the following action:

Establish a time frame to update the agency’s electronic information system inventory to include the following characteristics: reading and processing the records contained in the system, inputs and outputs, contents of the files and records, and cycle updates. (Recommendation 15)

The Chairman of the Marine Mammal Commission should take the following action:

Use recently developed policies and procedures to implement and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 16)

The Administrator of the National Aeronautics and Space Administration should take the following action:

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 17)

The Director of the National Science Foundation should take the following four actions:

Establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 18)

Establish a time frame to update the agency’s electronic information system inventory to include the following characteristics: technical characteristics of the systems, identify inputs and outputs, and describe update cycles. (Recommendation 19)

Establish a time frame to update the agency’s policies and procedures to include all of the records management controls required for electronic information systems and the required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 20)

Develop policies and procedures for the required retention and management requirements for email, including instructions to staff to ensure that the names and addresses of the sender, date of message, attachments, calendars, and draft documents will be retained. (Recommendation 21)

The Director of the Office of Management and Budget should take the following five actions:

Ensure, in conjunction with the Executive Office of the President’s Office of Administration, that existing policies and procedures incorporate the management of electronic records into its overall records management program. (Recommendation 22)

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 23)

Establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 24)

Establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 25)

Ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 26)

The Director of the Office of National Drug Control Policy should take the following three actions:

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 27)

Establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 28)

Ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 29)

The Director of the Office of Personnel Management should take the following five actions:

Establish a time frame to ensure that all records schedules are up-to- date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 30)

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 31)

Establish a time frame to develop a plan to manage permanent electronic records. (Recommendation 32)

Establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 33)

Establish a time frame to update the agency’s policies and procedures on retention and management for email to include retaining electronic calendars and draft documents. (Recommendation 34)

The Chief Executive Officer of the Overseas Private Investment Corporation should take the following four actions:

Establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 35)

Establish a time frame to develop policies and procedures that define required electronic information system functionalities for recordkeeping systems including declaring records and assigning unique identifiers, capturing records, maintaining security, and preserving records. (Recommendation 36)

Establish a time frame to update the agency’s policies and procedures to include the (1) following records management controls required for electronic information systems: reliability, content, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 37)

Establish a time frame to update the agency’s policies and procedures on retention and management for email to include policies for retaining electronic calendars. (Recommendation 38)

The Director of the Peace Corps should take the following three actions:

Establish a time frame to update the agency’s electronic information systems inventory to (1) specify technical characteristics necessary for reading and processing the records contained in the system, (2) identify system inputs and outputs, (3) define the contents of the files and records, (4) determine restrictions on access and use, and (5) specify how the agency ensures the timely disposition of records. (Recommendation 39)

Establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 40)

Establish a time frame to update the agency’s policies and procedures to include (1) following records management controls required for electronic information systems: usability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 41)

The Executive Director of Udall Foundation should take the following action:

Establish a time frame to develop and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 42)

Appendix III: Comments from the National Archives and Records Administration

Appendix IV: Comments from the Consumer Financial Protection Bureau

Appendix V: Comments from the Department of Commerce

Appendix VI: Comments from the National Aeronautics and Space Administration

Appendix VII: Comments from the National Science Foundation

Appendix VIII: Comments from the Office of Personnel Management

Appendix IX: Comments from the Morris K. Udall and Stewart L. Udall Foundation

Appendix X: Comments from the Office of Management and Budget

Appendix XI: GAO Contact and Staff Acknowledgments

GAO Contact Staff Acknowledgments

Nick Marinos, (202) 512-9342, marinosn@gao.gov In addition to the individual named above, Marisol Cruz Cain (Assistant Director), Anjalique Lawrence (Assistant Director), Elena Epps (Analyst- in-Charge), Roger Bracy, Kami Brown, Christopher Businsky, Alan Daigle, Nancy Glover, Charles Hubbard, Lee McCracken; Brian Palmer, and Monica Perez-Nelson made significant contributions to this report.