Advances in information technology and the explosion in computer interconnectivity have had far-reaching effects, including the transformation from a paper-based to an electronic business environment and the capability for rapid communication through e-mail. Although these developments have led to improvements in speed and productivity, they also pose challenges, including the need to manage those e-mail messages that may be federal records. Under the Federal Records Act, NARA is given general oversight responsibilities for records management as well as general responsibilities for archiving. This includes the preservation in the National Archives of the United States of permanent records documenting the activities of the government. NARA thus oversees agency management of temporary and permanent records used in everyday operations and ultimately takes control of permanent agency records judged to be of historic value. (Of the total number of federal records, less than 3 percent are designated permanent.) In particular, NARA is responsible for issuing records management guidance; working with agencies to implement effective controls over the creation, maintenance, and use of records in the conduct of agency business; providing oversight of agencies’ records management programs; approving the disposition (destruction or preservation) of records, and providing storage facilities for agency records. The act also gives NARA the responsibility for conducting inspections or surveys of agency records and records management programs. The act requires each federal agency to make and preserve records that (1) document the organization, functions, policies, decisions, procedures, and essential transactions of the agency and (2) provide the information necessary to protect the legal and financial rights of the government and of persons directly affected by the agency’s activities. These records, which include e-mail records, must be effectively managed. As used in this chapter, “records” includes all books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of data in them. Library and museum material made or acquired and preserved solely for reference or exhibition purposes, extra copies of documents preserved only for convenience of reference, and stocks of publications and of processed documents are not included. As the definition shows, although government documentary materials (including e-mails) may be “records” in this sense, many are not. For example, not all e-mails document government “organization, functions, policies, decisions, procedures, operations, or other activities” or contain data of informational value. According to NARA, the activities of an agency records management program include, briefly, the following identifying records and sources of records; developing a file plan for organizing records, including identifying the classes of records that the agency produces; developing records schedules—that is, proposing for each type of content where and how long records need to be retained and their final disposition (destruction or preservation) based on time, or event, or a combination of time and event; and providing records management guidance to agency staff, including agency-specific recordkeeping practices that establish what records need to be created in order to conduct agency business. Developing record schedules is a cornerstone of the records management process. Scheduling involves not individual documents or file folders, but rather broad categories of records. Traditionally, these were record series: that is, “records arranged according to a filing system or kept together because they relate to a particular subject or function, result from the same activity, document a specific kind of transaction, take a particular physical form, or have some other relationship arising out of their creation, receipt, or use, such as restrictions on access and use.” More recently, NARA introduced flexible scheduling, which allows so-called “big bucket” or large aggregation schedules for temporary and permanent records. Under this approach, the schedule applies not necessarily to records series, but to all records relating to a work process, group of work processes, or a broad program area to which the same retention time would be applied. To develop records schedules, agencies identify and inventory records, and NARA’s appraisal archivists work with agencies to appraise their value (which includes informational, evidential, and historical value), determine whether they are temporary or permanent, and determine how long the temporary records should be kept. NARA then approves the necessary records schedules. No record may be destroyed unless it has been scheduled, and for temporary records the schedule is of critical importance because it provides the authority to dispose of the record after a specified time period. Records schedules may be of two kinds: an agency-specific schedule or a general records schedule, which covers records common to several or all agencies. According to NARA, general records schedules cover about a third of all federal records. For the other two-thirds, NARA and the agencies must agree upon specific records schedules. Once a schedule has been approved, the agency is to issue it as a management directive, train employees in its use, apply its provisions to temporary and permanent records, and ensure proper implementation. The Federal Records Act covers documentary material regardless of physical form or media, but until the advent of computers, records management and archiving had been largely focused on handling paper documents. As information is increasingly created and stored electronically, records management has had to take into account the creation of records in varieties of electronic formats, including e-mail messages. NARA has promulgated regulations at 36 C.F.R. Part 1234 that provide guidance to agencies about the management of electronic records. This guidance is supplemented by the issuance of periodic NARA bulletins and other forms of guidance to agencies. To ensure that the management of agency electronic records is consistent with the Federal Records Act, NARA requires each agency to maintain an inventory of all agency information systems that identifies basic facts about each system and the information it contains, and it requires that agencies schedule the electronic records in its systems. Like other records, electronic records must be scheduled either under agency-specific schedules or pursuant to a general records schedule. According to the regulation, agencies are required to establish policies and procedures that provide for appropriate retention and disposition of electronic records. In addition to including general provisions on electronic records, agency procedures must specifically address e-mail records: that is, the creation, maintenance and use, and disposition of federal records created by individuals using electronic mail systems. “a document created or received on an electronic mail system including brief notes, more formal or substantive narrative documents, and any attachments, such as word processing and other electronic documents, which may be transmitted with the message.” The regulation requires e-mail records to be managed as are other potential federal records with regard to adequacy of documentation, recordkeeping requirements, agency records management responsibilities, and records disposition. This entails, in particular, ensuring that staff are aware that e-mails are potential records and training them in identifying which e-mails are records. Specific requirements for e-mail records include, for example, that for each e-mail record, agencies must preserve transmission data, including names of sender and addressees and message date, because these provide context that may be needed for the message to be understood. Further, except for a limited category of “transitory” e-mail records, agencies are not permitted to store the recordkeeping copy of e-mail records in the e- mail system, unless that system has all the features of a recordkeeping system; table 1 lists these required features. If agency e-mail systems do not have the required recordkeeping features, either agencies must copy e-mail records to a separate electronic recordkeeping system, or they must print e-mail messages (including associated transmission information that is needed for purposes of context) and file the copies in traditional paper recordkeeping files. NARA’s guidance allows agencies to use either paper or electronic recordkeeping systems for record copies of e-mail messages, depending on the agencies’ business needs. Each of the required features listed in table 1 is important because it helps ensure that e-mail records remain both accessible and usable during their useful lives. For example, it is essential to be able to classify records according to their business purpose so that they can be retrieved in case of mission need. Further, if records cannot be retrieved easily and quickly, or they are not retained in a usable format, they do not serve the mission or historical purpose that led to their being preserved. In many cases, e-mail systems do not have the features in the table. If e-mail records are retained in such systems and not in recordkeeping systems, they may be harder to find and use, as well as being at increased risk of loss from inadvertent or automatic deletion. Agencies must also have procedures that specifically address the destruction of e-mail records. In particular, e-mail records may not be deleted or otherwise disposed of without prior authority from NARA. (Recall that not all e-mail is record material. Agencies may destroy nonrecord e-mail.) Agencies can dispose of e-mail records in three situations: First, agencies are authorized to dispose of e-mail records with very short-term (transitory) value that are stored in e-mail systems at the end of their retention periods (as mentioned earlier). Second, for other records in e- mail systems, NARA authorizes agencies to delete the version in the e-mail system after the record has been preserved in a recordkeeping system along with all appropriate transmission data. Finally, agencies are authorized to dispose of e-mail records in the recordkeeping system in accordance with the appropriate records schedule. If the records in the recordkeeping system are not scheduled, the agency must schedule them before they can be disposed of. Because of its nature, e-mail can present particular challenges to records management. First, the information contained in e-mail records is not uniform. This is in contrast to many information systems, particularly those in computer centers engaged in large-scale data processing, which contain structured data that generally can be categorized into a relatively limited set of logical groupings. The information in e-mail systems, on the other hand, is not structured in this way: it may concern any subject or function and document various types of transactions. As a result, in many cases, decisions on which e-mail messages are records must be made individually. The kinds of considerations that may go into determining the record status of an e-mail message are illustrated in figure 1. As shown by the decision tree in the figure (developed at Sandia National Laboratories), agency staff have to be aware of the defining features of a record in order to make these decisions. Second, the transmission data associated with an e-mail record—including information about the senders and receivers of messages, the date the message was sent, and any attachments to the messages—provide context that may be crucial to understanding the message. Thus, as NARA’s e-mail regulations and guidance reflect, transmission data must be retained, and attachments are defined as part of the e-mail record. Third, a given message may be part of an exchange of messages between two or more people within or outside an agency, or even of a string (sometimes branching) of many messages sent and received on a given topic. In such cases, agency staff need to decide which message or messages should be considered records and who is responsible for storing them in a recordkeeping system. Finally, the large number of federal e-mail users and high volume of e- mails increase the management challenge. According to NARA, the use of e-mail results in more records being created than in the past, as it often replaces phone conversations and face-to-face meetings that might not have been otherwise recorded. E-mail may also replace other types of written communications, such as letters and memorandums. Whether agencies use paper-based or electronic recordkeeping systems, individual users generally make decisions (based on considerations such as those in the figure) on what messages they judge to be records. In paper-based systems, users then print and file e-mail records—with appropriate transmission data—in the appropriate file structure (generally corresponding to record series or schedule). In electronic systems, the particular steps to file the record would vary depending on the particular type of system and its degree of integration with the agency’s other information systems. Although details vary, an electronic recordkeeping system, like a paper-based system, requires that a filing structure has been established by which records can be associated with the appropriate series. The advantages of using a paper-based system for record copies of e-mails are that this approach takes advantage of the recordkeeping system already in place for the agency’s paper files and requires little or no technological investment. The disadvantages are that a paper-based approach depends on manual processes and requires electronic material to be converted to paper, potentially losing some features of the electronic original; these processes may be especially burdensome if the volume of e- mail records is large. The advantage of using an electronic recordkeeping system, besides avoiding the need to manage paper, is that it can be designed to capture certain required data (such as e-mail transmission data) automatically. Electronic recordkeeping systems also make searches for records on particular topics much more efficient. In addition, electronic systems that are integrated with other applications may have features that make it easier for the user to identify records and that potentially could provide automatic or partially automatic classification functions. However, as with other information technology investments, acquiring an electronic recordkeeping system requires careful planning and analysis of agency requirements and business processes; in addition, electronic recordkeeping raises the issue of maintaining electronic information in an accessible form throughout its useful life. Finally, like paper-based systems, electronic recordkeeping systems must be used properly by employees to be effective. These challenges have been recognized by NARA and the records management community in numerous studies and articles. A 2001 survey of federal recordkeeping practices conducted by a contractor—SRA International—for NARA concluded, among other things, that managing e- mail was a major records management problem and that the quality of recordkeeping varied considerably across agencies. The authors also commented on features of agency missions that lead to strong recordkeeping practices: “When agencies have a strong business need for good recordkeeping, such as the threat of litigation or an agency mission that revolves around maintaining ‘case’ files, then recordkeeping practices tend to be relatively strong with regard to the records involved.” In addition, the study concluded that for many federal employees, the concept of a “record” and what should be scheduled and preserved was not clear. A 2005 survey of federal agencies’ policy and practices for electronic records management, funded in part by NARA, concluded that procedures for managing e-mail were underdeveloped. The study found that most of the surveyed offices had not developed electronic recordkeeping systems, but were instead maintaining recordkeeping copies of e-mail and other electronic documents in paper format. However, all of the offices also maintained electronic records (frequently electronic duplicates of paper records). According to the study team, agencies did not establish electronic recordkeeping systems partly because of a lack of support and resources, and the complexity of implementing such systems increased with the size of the agency. As a result, organizations were maintaining unsynchronized parallel paper and electronic systems, resulting in extra work, confusion regarding which is the recordkeeping copy, and retention of many records beyond their disposition date. The study team also concluded that disposition of electronic records was too cumbersome and uncertain. According to the report, employees delete electronic records, such as e-mails, one at a time, a cumbersome process which may result in retention of too many records for too long or premature disposition that is inconsistent with approved retention schedules. (This is in contrast to records disposition in a recordkeeping system, in which categories of temporary records may be disposed of at the end of their retention periods.) The report also discussed NARA’s role in promoting agencies’ adoption of electronic recordkeeping systems. Commenting on these points, NARA expressed the view that for agencies that maintain paper as the record copy, the early destruction of electronic copies was not a significant problem because such copies generally have very short term retentions, and no information is lost. It considered that the overly long retention of electronic copies did raise concerns regarding legal discovery and compliance with requests under the Freedom of Information Act or the Privacy Act. In these circumstances, agencies are required to search for all information, not just information in recordkeeping systems; thus, maintaining large volumes of nonrecord material increases this burden. Most recently, a NARA study team examined in 2007 the experiences of five federal agencies (including itself) with electronic records management applications, with a particular emphasis on how these organizations used these applications to manage e-mail. The purpose of the study was to gather information on the strategies that organizations are using that may be useful to others. Among the major conclusions from the survey was that implementing an electronic records management application requires considerable effort in planning, testing, and implementation, and that although the functionality of the software product itself is important, other factors are also crucial, such as agency culture and the quality of the records management system in place. With regard to e-mail in particular, the survey concluded that for some agencies, the volume of e-mail messages created and received may be too overwhelming to be managed at the desktop by thousands of employees across many sites using a records management application alone, and that e-mail messages can constitute the most voluminous type of record that is filed into these applications. Finally, further study was recommended of technologies that are being used to manage e-mail and what federal agencies are doing with their record e-mail messages. NARA is planning to perform such a study in 2008. According to NARA, the study will take a close look at how selected agencies are implementing electronic recordkeeping for their program records, including those e-mail messages that need to be retained and managed as federal records. The study will look at electronic recordkeeping projects that have a records management application in place as well as other solutions that provide recordkeeping functionality. In both cases, NARA plans to explore how e- mail messages in particular are identified and managed as records. According to NARA officials, they have begun planning for the study and identifying agencies to be included; they expect to have the report completed by the end of September 2008. Such a study could provide useful information to help NARA develop additional guidance to agencies looking for electronic solutions for records management of e-mail and other electronic records. As the earlier studies suggest, implementing such solutions is not a simple or easy process. Although NARA has referred to the decision to move to electronic recordkeeping as inevitable, it emphasizes that the timing of the decision depends on an agency’s specific mission and circumstances. For the last several years, NARA’s records management program has increasingly reflected the importance of electronic records and recordkeeping. For example, NARA has undertaken a redesign of its records management activities, including (among other things) the following three activities, which are significant for management of electronic records, including e-mail: NARA established flexible scheduling (the so-called “big bucket” approach described earlier), under which agencies can schedule records at any level of aggregation that meets their business needs. By simplifying disposition instructions, “big bucket” schedules have advantages for electronic records management; filing e-mail records under a “big bucket” system, for example, is simplified because users can be presented with fewer filing categories. NARA developed e-mail regulations that eliminated the previous requirement to file transitory e-mail dealing with routine matters in a formal agency recordkeeping system. According to NARA, this change would allow agencies to focus their resources on managing e-mail that is important for long-term documentation of agency business. The change was reflected in a revision to General Records Schedule 23 that explicitly included very short-term temporary e-mail messages. The final rule became effective on March 23, 2006. NARA developed regulations and guidance to make retention schedules media neutral. According to NARA, its objective was to eliminate routine rescheduling work so that agencies and NARA could focus their resources on high records management priorities. Under its revised regulations, in effect as of December 2007, new records schedules would be media neutral unless otherwise specified. At the same time, NARA revised General Records Schedule 20 (which provides disposition authorities for electronic records) to expand agencies’ authority to apply previously approved schedules to electronic records and to dispose of hard copy records that have been converted to an electronic format, among other things. In July 1999, we reported that NARA and federal agencies were facing the substantial challenge of managing and preserving electronic records in an era of rapidly changing technology. In that report, we stated that in addition to handling the burgeoning volume of electronic records, NARA and the agencies would have to address several hardware and software issues to ensure that electronic records were properly created, maintained, secured, and retrievable in the future. We also noted that NARA did not have governmentwide data on the records management capabilities and programs of all federal agencies. As a result, we recommended that NARA conduct a governmentwide survey of agencies’ electronic records management programs and use the information as input to its efforts to reengineer its business processes. NARA subsequently undertook efforts to assess governmentwide records management practices and study the redesign of its business processes. As mentioned earlier, in 2001 NARA completed an assessment of governmentwide records management practices, as we had recommended. NARA’s assessment of the federal recordkeeping environment concluded that although agencies were creating and maintaining records appropriately, most electronic records remained unscheduled, and records of historical value were not being identified and provided to NARA for archiving. In 2002, we reported that factors contributing to the problems of managing and preserving electronic records included records management guidance that was inadequate in the current technological environment, the low priority often given to records management programs, and the lack of technology tools to manage electronic records. In addition, NARA did not perform systematic inspections of agency records management, so that it did not have comprehensive information on implementation issues and areas where guidance needed strengthening. Although NARA had plans to improve its guidance and address technology issues, these did not address the low priority generally given to records management programs nor the inspection issue. With regard to inspections, we noted that in 2000, NARA had replaced agency evaluations (inspections) with a new approach—targeted assistance—because it considered that its previous approach to evaluations had been flawed: it reached only a few agencies, it was often perceived negatively, and it resulted in a list of records management problems that agencies then had to resolve on their own. Under targeted assistance, NARA entered into partnerships with federal agencies to provide them with guidance, assistance, or training in any area of records management. Despite the possible benefits of such assistance to the targeted agencies, however, we concluded that it was not a substitute for systematic inspections. Only agencies requesting assistance were evaluated, and the scope and focus of the assistance were determined not by NARA but by the requesting agency. Thus, it did not provide systematic and comprehensive information for assessing progress over time. To address the low priority generally given to records management programs, we recommended that NARA develop a strategy for raising agency senior management awareness of and commitment to records management. To address the inspection issue, we recommended that NARA develop a strategy for conducting systematic inspections of agency records management programs to (1) periodically assess agency progress in improving records management programs and (2) evaluate the efficacy of NARA’s governmentwide guidance. In response to our recommendations, NARA devised a strategy for raising awareness among senior agency management of the importance of good federal records management, as well as a comprehensive approach to improving agency records management that included inspections and identification of risks and priorities. NARA also took steps to improve federal records management programs by updating its guidance to reflect new types of electronic records. In 2003, we testified that the plan for improving agency records management did not include provisions for using inspections to evaluate the efficacy of its governmentwide guidance, and an implementation plan for the approach had not yet been established. NARA later addressed these shortcomings by developing an implementation plan that included using agency inspections to evaluate the efficacy of its guidance, with such inspections to be undertaken based on a risk-based model, government studies, or media reports. Such an approach, if appropriately implemented, had the potential to help avoid the weaknesses in records management programs that led to the scheduling and disposition problems that we and NARA had described in earlier work. To fulfill its responsibility under the Federal Records Act for oversight of agency records management programs, NARA planned to conduct activities including inspections, studies, and reporting. However, despite NARA’s plans, in recent years its oversight activities have been primarily limited to performing studies. Although it has performed or sponsored six records management studies since 2003, it has not conducted any inspections since 2000. In addition, although NARA’s reporting to the Congress and OMB has generally described progress in improving records management at individual agencies and provided an overview of some of its major records management activities, it has not consistently provided evaluations of responses by federal agencies to its recommendations, as required, or details on records management problems or recommended practices that were discovered as a result of inspections, studies, or targeted assistance projects. Without a consistent oversight program that provides it with a governmentwide perspective, NARA has limited assurance that agencies are appropriately managing the records in their custody, thus increasing the risk that important records will be lost. Oversight is a key activity in governance that addresses whether organizations are carrying out their responsibilities and serves to detect other shortcomings. Our reports emphasize the importance of effective oversight of government operations by individual agency management, by agencies having governmentwide oversight responsibilities, and by the Congress. Various functions and activities may be part of oversight, including monitoring, evaluating, and reporting on the performance of organizations and their management and holding them accountable for results. The Federal Records Act gave NARA responsibility for oversight of agency records management programs by, among other functions, making it responsible for conducting inspections or surveys of agencies’ records and records management programs and practices; conducting records management studies; and reporting the results of these activities to the Congress and OMB. In particular, the reports are to include evaluations of responses by agencies to any recommendations resulting from inspections or studies that NARA conducts and, to the extent practicable, estimates of costs to the government if agencies do not implement such recommendations. According to NARA, it planned to carry out its oversight responsibilities using inspections, studies, and reporting. Specifically, in 2003, NARA stated that it would perform inspections of agency records and records management conduct studies that focus on cross-government issues, analyze and identify best practices, and use the results to develop governmentwide recommendations and guidance; and report to the Congress and OMB on problems and recommended practices discovered as part of inspections, studies, and targeted assistance projects. Although inspections were included in NARA’s oversight plans in 2003, NARA has not conducted any since 2000. NARA laid out a strategy for performing inspections and studies in 2003 as part of its records management redesign efforts. According to this strategy, NARA anticipated undertaking inspections only under what it termed exceptional circumstances: that is, if (1) agencies have high-level records management problems that put at risk federal records that protect rights, assure accountability, or document the national experience, and (2) agencies refuse targeted assistance from NARA and fail to mitigate or otherwise effectively deal with such risks. In other words, NARA considered inspections its tool of last resort: to be used when the risk to records was deemed high and other tools (such as targeted assistance and training) failed to mitigate the risk to records. Under this strategy, NARA planned to determine when to undertake inspections based on its risk-based resource allocation model (or when it learned through other means of a clear and egregious records management problem in an agency or line of business). Using this model, developed in 2003, NARA’s Resource Allocation Project performed a governmentwide assessment in 2004 of high-priority federal records and records programs. After reviewing program areas and work processes of the government (as opposed to organizational units), the project identified the business processes, subfunctions, and agency activities that were likely to generate the majority of high-priority records. Based on input and assessments from NARA staff with expertise in the subfunctions and associated agencies, the project then rated the subfunctions according to three criteria for establishing resource priorities: the risk to records (based on such factors as whether the subfunctions or associated agencies had experienced major scheduling issues or known problems, such as allegations of unauthorized destruction of records), the level of significance of the records to rights and accountability, and the likelihood that the subfunction would generate permanent records (and if so, their volume and significance). According to the final report on the project, this assessment showed that the risks to records were being addressed and managed by the Archives’ own records management activities and those of the agencies. As a result, the Resource Allocation Project did not lead to the identification of records management risks that met the new inspection criteria. Instead, NARA applied its resources to other activities that it considered more effective and less resource-intensive than the inspections it undertook in the past. These include regular contacts between appraisal archivists and agencies, updated guidance information, and training. However, the Resource Allocation Project was primarily based on NARA’s in-house information sources and expertise. Although this information and expertise may be considerable and collecting and assessing it potentially valuable, it is not a substitute for examinations of agency programs, surveys of practices, agency self-assessments, or other external sources of information. Further, although the final report on the 2004 project included important lessons learned for improving future assessments, NARA did not set up a process for continuing the effort and applying the lessons learned to updating the assessment or validating its results. Officials had also stated that targeted assistance was a tool that NARA would use in preference to inspections to solve urgent records management problems and that the results of the Resource Allocation Project were also to be used in determining where to use this tool. However, NARA’s use of targeted assistance has declined significantly over the past 5 years. (NARA reported that in 2002, 77 projects were opened and 76 completed; in contrast, 4 were opened and none completed in 2007.) Officials ascribed the reduced emphasis on targeted assistance projects to various factors, including competing demands (such as work on the development of its advanced electronic records archive and on helping agencies to schedule electronic records), the difficulty of getting agencies to devote resources to the projects, and the removal of numerical targets for targeted assistance projects, which occurred when NARA revised performance metrics to emphasize results rather than quantity. According to NARA, it also works with agencies to address critical records management issues outside formal targeted assistance arrangements. In addition, it identifies and investigates allegations of unauthorized destruction of federal records. Thus, neither inspections nor targeted assistance have made significant contributions to NARA’s oversight of agency records management. Without a more comprehensive method of evaluating agency records management programs, NARA lacks assurance that agencies are effectively managing records throughout their life cycle. NARA has performed records management studies in accordance with its 2003 plan. According to the plan, it was to conduct records management studies to focus on cross-government issues, to identify and analyze best practices, and to develop governmentwide recommendations and guidance. In addition, NARA planned to undertake records management studies when it believed an agency or agencies in a specific line of business were using records management practices that could benefit the rest of a specific line of business or the federal government as a whole. Since developing its 2003 plan, NARA has conducted or sponsored six records management studies (see table 2). Most of these studies were focused on records management issues with wide application. For example, two were related to helping NARA improve its guidance on particular types of records—health and safety records, and research and development (R&D) records. Another two were limited in scope to components of a single agency, but they addressed issues with potentially broad application and included conclusions regarding factors that needed to be considered in the appraisal of given types of records. Under the Federal Records Act, NARA is responsible for reporting the results of its records management activities to the Congress and OMB, including evaluations of responses by agencies to any recommendations resulting from its inspections or studies and (where practicable) estimates of costs if its recommendations are not implemented. Further, NARA’s plan for carrying out its oversight responsibilities states that it will report to the Congress and OMB on problems and recommended practices discovered as part of inspections, studies, and targeted assistance projects. According to NARA, it fulfills its statutory reporting requirement through annual Performance and Accountability Reports, which include sections on “Federal Records Management Evaluations.” However, although NARA has issued reports on its records management studies, the Federal Records Management Evaluations sections of the Performance and Accountability Reports have not included the studies’ results or evaluations of responses by agencies to its recommendations. Instead, the reports have generally provided an overview of NARA’s major records management activities, as well as describing noteworthy records management progress at individual agencies. For example, the report for fiscal year 2007 provided statistics on the appraisal and scheduling of electronic records systems and listed agencies that had scheduled electronic records or transferred permanent electronic records to NARA during the fiscal year. Elsewhere in the reports, NARA mentioned four of the six records management studies as part of its reporting on records management goals. However, it included few details on the results of these studies regarding the records management problems or recommended practices that they uncovered. For example, in the fiscal year 2005 Performance and Accountability Report, NARA reported that it had completed a January 2005 study on Air Force Headquarters offices (see table 2), but NARA did not discuss the results, and later reports did not discuss actions taken in response to its recommendations. Similarly, the fiscal year 2007 Performance and Accountability Report did not describe any actions that the Department of Energy had taken in response to an August 2006 study. Also, in 2007, NARA stopped reporting on its targeted assistance projects. In prior years, its Performance and Accountability Reports generally provided statistics on targeted assistance projects and described their general goals, although the reports did not generally discuss problems or recommended practices resulting from them. In the fiscal year 2007 report, NARA stated that the strategies described in its Strategic Directions, including targeted assistance, had become part of its standard business practices and would no longer be highlighted individually. However, as mentioned earlier, the number of targeted assistance projects had declined significantly by that time. The Director and senior officials from NARA’s Modern Records Program agreed that the annual reports did not specify the problems and recommended practices discovered as part of inspections, studies, and targeted assistance projects. According to these officials, the annual Performance and Accountability Reports have been focused on positive news, and NARA has struggled with developing an objective way to report negative news about agencies’ records management. The officials attributed this difficulty to the agency’s conservatism in this regard. NARA’s limited use of oversight tools and incomplete reporting on the specific results of its oversight activities can be attributed to an organizational preference for using persuasion and cooperation when working with agencies. This preferred approach is consistent with NARA’s reasons (as we noted in 2003) for replacing agency evaluations (inspections) with targeted assistance: among these reasons was that inspections were perceived negatively by agencies. NARA officials have said that they prefer to use “carrots, rather than sticks.” NARA officials added that full-scale inspections were resource intensive and took several years to complete, and that agencies took years to address NARA’s recommendations. Although, as described earlier, NARA regularly works with agencies on scheduling and disposition of records (activities related to the end of the records life cycle), officials agreed that these activities provide limited insight into records management at earlier stages—that is, creation, maintenance, and use. The officials also agreed that their work with agencies on scheduling records does not fulfill the Archivist’s responsibility under the Federal Records Act to conduct inspections or surveys of agency records and records management programs and practices. Further, by giving the Archivist the responsibility to report to the Congress and OMB on records management issues, the Federal Records Act provides NARA with a tool for holding agencies accountable, a key aspect of oversight. However, NARA has been reluctant to use this tool, limiting its ability to determine whether federal agencies are carrying out their records management responsibilities. Without more specific and comprehensive information about how agencies are managing their records and without the means to hold agencies accountable for shortcomings, NARA’s ability to identify and address common records management problems is impaired. As a result, there is reduced assurance that records are adequately managed and that important records are not being lost. The four agencies reviewed—the Department of Homeland Security (DHS); the Environmental Protection Agency (EPA); the Federal Trade Commission (FTC); and the Department of Housing and Urban Development (HUD)—generally preserved e-mail records through paper- based processes, although one agency—EPA—is in the process of deploying an electronic content management system that is to be used for managing e-mail messages that are agency records; two others have long- term plans to develop electronic recordkeeping. Three of the four agencies also used electronic systems to manage documents, correspondence, and so on, but these systems generally did not have recordkeeping features. Each of the business units that we reviewed (one at each agency) maintained “case” files to fulfill its mission that were used for recordkeeping. The practice at the units was to include e-mail printouts in the case files if they contained information necessary to document the case—that is, record material. These printouts included transmission data and distribution lists, as required. DHS: DHS primarily uses “print and file” recordkeeping for all records. None of the department’s e-mail systems is a recordkeeping system; accordingly, they may be used to store only transitory e-mail records. Officials from the Office of the DHS Chief Information Officer (CIO) told us that DHS e-mail systems house transitory e-mails and retain them for at least 90 days. In addition, according to the CIO office, although employees can currently access Web-based and Internet-accessible private e-mail systems, the department is taking steps to restrict or remove this access. Although its current recordkeeping is generally paper-based, DHS has begun planning for an enterprisewide Electronic Records Management System. According to the business case submitted by DHS to OMB to justify the proposed investment, the proposed system is to allow electronic storage and retrieval of records by authorized staff throughout DHS and permit the elimination of paper file copies. According to the department’s senior records officer, DHS’s current records schedules are now media neutral. DHS’s records management handbook also provides instructions for both electronic and paper e-mail recordkeeping. In addition, DHS CIO officials told us that the department has implemented several electronic knowledge and document management systems, at least two of which have recordkeeping features but are not used for e-mail recordkeeping. E-mail records were maintained in paper at the DHS business unit reviewed, the Washington Regional Office of Detention and Removal Operations under Immigration and Customs Enforcement (ICE). The primary responsibility of the Office of Detention and Removal Operations is to identify, apprehend, and remove illegal aliens from the United States. To fulfill its mission, the business unit maintained paper-based case files, and these files were used for recordkeeping. To store deportation case information, the unit uses the so-called “alien files” or “A-files.” These files are created by DHS’s Citizenship and Immigration Services for certain noncitizens, such as immigrants, to serve as the one central file for all of the noncitizen’s immigration-related applications and related documents that pertain to that person’s activities. The A-files are managed by Citizenship and Immigration Services and shared among DHS components as necessary. Because A- files are paper-based, they require physical transfer from one location to another. To track these files, DHS uses the National File Tracking System, an automated file-tracking system developed to enable all DHS staff at numerous DHS locations around the country to locate, request, receive, and transfer A-files. Each A-file has a National File Tracking System number. According to business unit officials, e-mails would not usually be found in the A-files because the primary use of e-mail was to share information within the business unit, and so it would rarely rise to the level of a record. The A-files mainly contain other kinds of information, including forms from agency information systems, investigation results, charging documents, conviction documents, photos, fingerprints, and memos. A deportation officer provided 10 active open case files for inspection (each officer is usually responsible for 40 to 60 active open immigration cases). The 10 case files contained a total of 18 e-mail records, which included transmittal data and distribution lists. EPA: EPA’s current recordkeeping is largely print and file, but the agency is undergoing a transition to electronic recordkeeping, beginning with e- mail records. According to EPA officials, the commitment to establish its Enterprise Content Management System (ECMS), which has recordkeeping features, was a result of an agency decision to develop a long-term solution to manage hurricane records electronically in the wake of Hurricanes Katrina and Rita. According to a memorandum sent to all EPA employees, the goal was to ensure that these records be placed in a recordkeeping system that met both EPA and NARA requirements, while allowing easy access to the records when needed. At the same time, the agency ordered that the automatic delete function in the agency’s e-mail system be deactivated so that no hurricane records could be deleted accidentally. According to agency officials, the e-mail capability of ECMS was available in fiscal year 2007, and the agency expects that by the end of fiscal year 2009, 50 percent of EPA staff and contractors will be using the system. The ECMS repository is an electronic recordkeeping system that uses commercial software that complies with a standard endorsed by NARA. According to officials, as part of its preparations for the transition, EPA recently updated its record schedules so that its treatment of records would be media neutral; this is to facilitate uploading records into ECMS. It has also developed materials, such as a brochure and a user guide, to support its transition. The agency’s e-mail systems are not currently used as recordkeeping systems and will not be under ECMS. Accordingly, they can be used to store only transitory e-mail records. Officials also told us that employees could access Web-based e-mail systems for limited personal use, but that they were not permitted to use these for official business. E-mail records were maintained in paper at the EPA business unit reviewed, the Assessment and Remediation Division of the Office of Superfund Remediation and Technology Innovation (part of EPA’s Office of Solid Waste and Emergency Response). Among other things, this division processes claims related to Superfund cleanup settlements. Officials from the Office of Superfund Remediation and Technology Innovation told us that recordkeeping for this office was print and file, but that employees were also directed to include all records (including e-mail records) into the office’s electronic Superfund Document Management System. This was not a recordkeeping system, but the plan was to integrate it with ECMS for long-term stewardship of Superfund files. According to these officials, they expect to be able to capture Superfund e- mail records in ECMS by fall 2008. Officials of the Assessment and Remediation Division stated that few e- mail messages would be considered records, because most official business regarding claims was conducted through correspondence on letterhead with an original signature. Although copies of these might be sent as e-mail attachments, these officials said, they would not be the official recordkeeping copy. However, division officials stated that e-mail records were more likely to be included in case files regarding “mixed funding” claims related to Superfund cleanup settlements, because these involved communication between regional offices and parties involved in the claims. (Mixed funding refers to the government assuming some proportion of cleanup expenses, with other parties assuming the rest.) According to officials, mixed funding documentation could include e-mail records documenting information to justify claims and facilitate payment. Officials provided a mixed funding case file for inspection, in which they had identified 10 e-mail records. All these records included transmission data and distribution lists, as required. FTC: FTC recordkeeping for e-mail and other records is print and file. The commission’s e-mail system is not a recordkeeping system, and the commission has not implemented the option allowed by NARA’s guidance to use the e-mail system for storing transitory e-mail records. The agency has no current plans to institute electronic recordkeeping. According to FTC officials, the commission’s processes are largely paper based. The commission’s records management guidance states that few e-mails are expected to rise to the level of a record. For example, agency officials explained that official decisions of the commission are generally reached jointly by the commissioners and recorded in documents such as memorandums, letters, and meeting minutes. According to officials, FTC uses a case management system to track work products (such as depositions, filings, and briefs), but this is not a document management or recordkeeping system. According to officials, about 80 percent of all FTC files are case files. The records manager said that the records schedules for FTC programs currently include instructions for e-mail disposition, but that the office is in the process of conducting a records inventory and reassessing records scheduling, with the next step being to do “big bucket” media-neutral scheduling. According to this official, this approach will provide flexibility in the event that FTC adopts electronic business processes in the future. According to FTC officials, the commission is currently assessing its needs for electronic document management tools, including an electronic recordkeeping system. The CIO told us that agency staff cannot directly access external Web- based e-mail through the agency’s Web browsers, and agency employees have been instructed not to use such systems for official FTC business. However, this official said that agency employees may use the commission’s remote application delivery environment to obtain limited access to external Web-based e-mail as a convenience. The business unit reviewed at FTC was the Division of Marketing Practices within the Consumer Protection Bureau, which responds to problems of consumer fraud in the marketplace, such as deceptive marketing schemes that use false and misleading information. The division enforces federal consumer protection laws by, among other things, developing rules to protect consumers and filing actions in federal district court for immediate and permanent orders to stop scams and get compensation for scam victims. The business unit follows the FTC’s print and file approach to recordkeeping, saving e-mails and other communications if they are related to a case. At this unit, cases are investigations of Internet fraud and marketing practices, each of which is assigned to a lead attorney. Officials provided one closed case file for inspection, consisting of four boxes of records. The case file provided contained about 65 e-mails, all of which included transmittal data and distribution lists. HUD: HUD currently uses a print and file approach to e-mail recordkeeping. The department’s e-mail system is not a recordkeeping system, and according to officials, they have not implemented the option allowed by NARA’s guidance to use the e-mail system for storing transitory e-mail records. However, as part of an overall modernization plan, HUD is undertaking an enterprise office system modernization project for its records and document management. According to the business case submitted by HUD to OMB to justify the modernization investment, the HUD Electronic Record System (HERS) will replace eight legacy systems and support the full life cycle of document management activities and correspondence management, including the creation and processing of records, record disposition, and retrieval of historical archived information. HUD plans to implement HERS by the fourth quarter of 2010. In the first phase of the plan, HUD is implementing modernized systems for tracking correspondence and Freedom of Information Act requests. Although the correspondence system is used for tracking e-mail correspondence, it is not a recordkeeping system for e-mail. The business unit reviewed at HUD was the Office of Healthy Homes and Lead Hazard Control. Among other things, this office manages grants related to lead hazard and conducts investigations to determine compliance with HUD’s Lead Disclosure Rule. HUD records management officials stated that each program area has a file plan, and that the Office of Healthy Homes and Lead Hazard Control has its own records schedule. According to officials from the office, most of their business is transacted via certified mail, so that relatively few e-mail messages would be record material. Two units provided active open files for inspection: nine grant files from six Government Technical Representatives in the Program Management and Assurance Division, and four lead hazard investigation case files from one inspector in the Compliance Assistance and Enforcement Division. The nine grant files included 120 e-mail messages, and the four investigation files included 5 e-mail messages, all in the same case file. All 125 of the e-mail records included transmittal data and distribution lists, as required. At three of the four agencies reviewed, the policies in place generally addressed the requirements for e-mail records management that we identified, but each was missing one of the nine requirements. At the fourth agency (HUD), the policies in place did not cover three of eight applicable requirements. According to NARA’s regulations on records management, agencies are required to establish policies and procedures that provide for appropriate retention and disposition of electronic records. In addition to including general provisions on electronic records, agency procedures must address specific requirements for e-mail records. The regulations provide minimum requirements, which allow agencies flexibility to establish processes for managing e-mail records that are appropriate to their business, size, and resources. According to the regulations, certain aspects of e-mail must be addressed in the instructions that agencies provide staff on identifying and preserving electronic mail messages, such as the need to preserve transmission data. Agencies are also required to address the use of external e-mail systems that are not controlled by the agency (such as private e-mail accounts on commercial systems such as Gmail, Hotmail, .Mac, etc.). Where agency staff have access to external systems, agencies must ensure that federal records sent or received on such systems are preserved in the appropriate recordkeeping system and that reasonable steps are taken to capture available transmission and receipt data needed by the agency for recordkeeping purposes. One of the four agencies (HUD) had its systems configured so that staff could not access external e- mail applications; thus, this requirement was not applicable for HUD. In summary, we extracted nine key requirements from the regulation. Agency records management policy and guidance with regard to e-mail must address these requirements, which are shown in table 3. The policies and guidance at three of the four agencies (DHS, FTC, and EPA) each omitted one applicable requirement. At DHS, the policies and guidance did not state that draft documents circulated on e-mail systems are potential federal records. Department officials told us that they recognized that their policies did not specifically address the need to assess the records status of draft documents, and said they planned to address the omission during an ongoing effort to revise the policies. At EPA and FTC, the e-mail management policy did not instruct staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems. According to officials at both agencies, such instructions were not included because agency employees were instructed not to use such accounts for agency business. However, whenever access to such external systems is available at an agency, the agency should provide these instructions. If agency records management policies and guidance are not complete, agency e-mail records may be at increased risk of loss. If agencies do not state that draft documents circulated on e-mail systems are potential records, agency officials may not preserve such record materials. If agencies do not instruct staff on the management and preservation of e- mail messages sent or received from nongovernmental e-mail systems, officials may create or receive e-mail records in external systems that may not be preserved in recordkeeping systems. In the course of our review at EPA, officials told us that this situation may have arisen: they had discovered that certain e-mail messages for a previous Administrator, possibly including records, had not been saved. According to these officials, they had discovered an e-mail message from a former Acting Administrator instructing a private consultant not to use the Administrator’s EPA e-mail account to discuss a sensitive government issue (World Trade Center issues) but to use a personal e-mail account. EPA officials reported this incident to NARA on April 11, 2008, in a letter that also described the agency’s response to the incident and planned safeguards to avoid such incidents in the future; these safeguards included the release of a policy statement prohibiting the use of non-EPA messaging systems for the conduct of agency business and a review of e-mail account auto-delete settings. NARA replied on April 30 that the safeguards EPA planned appeared appropriate. Finally, HUD’s policies and guidance did not include, or did not implement, three of eight applicable e-mail records management requirements. For one requirement, HUD’s policy was inconsistent with NARA’s regulations, and it was silent on two of the requirements. HUD did not fully implement the requirement to ensure that staff are capable of identifying federal records because its e-mail policy states that only the sender is responsible for reviewing the record status of an e-mail. However, NARA’s regulation defines e-mail messages as material either created or received on electronic mail systems. HUD officials acknowledged that the department’s policy omits the recipient’s responsibility for determining the record status of e-mail messages and stated that the e-mail policy fell short of fully implementing NARA regulations in this regard because the department’s practice is not to use e- mail for business matters in which official records would need to be created. However, this practice does not remove the requirement for agency employees to assess e-mail received for its record status, because the agency cannot know that employees will not receive e-mail with record status; the determination of record status depends on the content of the information, not its medium. In addition, two other requirements were missing from HUD’s policy: it did not state, as required, that recordkeeping copies of e-mail should not be stored in e-mail systems or that backup tapes should not be used for recordkeeping purposes. HUD officials stated that they considered that these requirements were met by a reference in their policy to the NARA regulations in which these requirements appear. However, this reference is too general to make clear to staff that e-mail systems and backup tapes are not to be used for recordkeeping. Table 4 summarizes the results for the four agencies. If requirements for e-mail management are not included in agency records management policies and guidance, agency e-mail records may be at increased risk of loss. The loss of records that are important for documenting government functions, activities, decisions, and other important transactions could potentially impair agencies’ ability to carry out their missions. E-mail messages that qualified as records were not being appropriately identified and preserved for 8 of the 15 senior officials we reviewed. Senior officials at three agencies did not consistently conform to key requirements in NARA’s regulations for e-mail records; only at FTC did the four senior officials fully follow these requirements. The other three agencies showed varying compliance: three officials at DHS, two officials at EPA, and three officials at HUD were not following required e-mail recordkeeping practices. Factors contributing to the inconsistent e-mail recordkeeping practices include inadequate training and oversight. Other factors included the difficulty of managing large volumes of e-mail in paper-based recordkeeping systems and the stated practice at one agency that e-mail would not be used for record material. As described, the four agencies primarily used “print and file” recordkeeping systems, which require agency staff to print out e-mail messages for filing as the official recordkeeping copies in designated filing systems. Each agency’s policy also required the preservation of e-mail transmission data, distribution lists, and acknowledgments. DHS. At DHS, our review covered three senior officials because, according to DHS officials, the Secretary of Homeland Security did not use e-mail: these officials told us that the Secretary did not have a DHS e-mail account, and that he did not conduct any official communications using external nongovernmental e-mail systems. For the remaining three officials, the e-mail management practices did not fully comply with the requirements. None of the e-mails of the senior officials were reviewed for their status as a record or filed in an appropriate recordkeeping system. Instead, the officials were using their e- mail accounts to store all e-mails. Two of the three officials personally managed their e-mail accounts; the third shared this responsibility with a member of his staff. The staff of one of the officials who managed his own e-mail had access to the official’s e-mail account, but the staff reviewed or accessed these only if instructed to do so by the official. The department said that the third official’s office administrator had access to calendar functions only. According to one of these senior officials, storing e-mails on the computer is convenient for searching and retrieving. It was this official’s opinion that this approach was safe from a legal standpoint because no e-mails were deleted. Nonetheless, using an e-mail system to retain all e-mails indefinitely increases the difficulty of performing searches based on categories of records; in contrast, such searches are facilitated by a true recordkeeping system. Further, if e-mail records are not stored in an appropriate recordkeeping system (paper or electronic), there is reduced assurance that they are useful and accessible to the agency as needed, or that they will be retained for the appropriate period. EPA: At EPA, the e-mail records of two of the four senior officials were being managed in accordance with key requirements reviewed. For these two senior officials, one of whom was the agency head, e-mail records were stored in paper-based recordkeeping systems. The EPA Administrator had two EPA e-mail accounts, one intended for messages from the public and one for communicating with select senior EPA officials (not intended for use by the public). In the paper-based recordkeeping system, of 25 e-mail records inspected, all included transmission data and distribution lists, as required. For the nonpublic account, staff provided eight e-mail records for inspection, all of which also included transmission data and distribution lists. According to EPA officials, the nonpublic account generated few records because the Administrator receives most of his information from other sources, including face-to-face briefings and meetings. For the second senior official, administrative staff told us that the official reviewed e-mail personally and forwarded records to the staff for printing and filing in a paper-based recordkeeping system that followed the agency’s records schedules. We selected 20 e-mails from the official’s files for examination. These files were associated with four EPA records schedules. All of the e-mails included transmission data and distribution lists as required. The e-mail records of two other senior officials were not being managed in compliance with requirements, because e-mail records were not being stored in appropriate recordkeeping systems, but rather in the e-mail system: One of these officials was in the process of migrating e-mail records from the e-mail system to ECMS. This official had been storing e-mail records in e-mail system folders since January 2006, in anticipation of the rollout of the ECMS, and had not been using a paper-based recordkeeping system in the interim. The e-mail system’s folders were organized according to the agency’s records schedules to facilitate the transfer, which was ongoing. Because this senior official did not store e-mail records in a paper-based recordkeeping system during this transition, the official’s e-mail account was being used as a recordkeeping system, which is contrary to regulation. However, when the transition to the electronic recordkeeping system is complete, the new system should provide the opportunity for this official’s recordkeeping practices to be brought into compliance with requirements. The second official was also saving all e-mail in the e-mail system. EPA officials stated that most of the senior official’s e-mail was sent to an administrative assistant, who was responsible for identifying and maintaining the records received and filing them accordingly. However, the administrative assistant for this official stated that although she had been briefed on maintaining and preserving the senior official’s calendar in a recordkeeping system, she had not received guidance or training in how to preserve or categorize the official’s e-mail for recordkeeping purposes. In addition, the assistant stated that all e-mails remained stored in the e- mail system where they could be retrieved if necessary. FTC: The four senior officials at FTC were managing e-mail in compliance with key requirements reviewed. These officials were the Chairman and three Commissioners. According to an FTC official, the Commissioners do not discuss substantive issues in e-mails to one another because of the possibility that such group e-mails could be construed as meetings subject to the Sunshine Act, which must be open to the public. FTC staff told us that the then-Chairman and two Commissioners delegated part or all of the responsibility for e-mail management; the remaining Commissioner personally managed e-mails. E-mails with record status were to be printed and filed in the commission’s paper-based recordkeeping systems. The FTC recordkeeping systems contained e-mail records of the four officials; of the 155 e-mail records inspected, all included the required distribution lists and transmission data. HUD: One of the four senior officials at HUD was managing e-mail in compliance with key requirements, but for the other three officials, e-mail records were not stored in appropriate recordkeeping systems. The e-mail records for the agency head were being managed in accordance with key requirements. According to HUD officials, management of e-mails for the agency head was delegated to staff: that is, the agency head’s e- mails were forwarded by his administrative assistant to the Office of the Executive Secretariat, where they were reviewed for record status and preserved as necessary in paper files. Staff from the Office of the Executive Secretariat flagged 10 e-mail records using the department’s correspondence tracking system, which were then retrieved from the paper-based recordkeeping system for inspection; all of these files included the required distribution lists and transmission data. The practices of the three other senior officials varied, except that for all three, they or their staff stated that the officials retained e-mail messages in the e-mail system. One senior official told us that he read his own e- mail and forwarded messages to staff to determine record status. Another official’s staff stated that the staff was responsible for managing e-mail, but that the official would determine what should be printed and filed. The third official’s staff stated that the official did not review e-mails for record status but forwarded all program-related e-mails to staff, who would decide which e-mails should be included in the program files as records. Neither the three senior officials nor several of their staff had received records management training. HUD provided copies of e-mail messages from one senior official for review, but there was no evidence that the messages were stored in an appropriate recordkeeping system, and HUD officials stated that the provided e-mails were not records. They offered to provide similar nonrecord messages for the two other officials, but we declined to review them because the messages would not have addressed the question of whether the officials were storing e-mail records in appropriate recordkeeping systems. Thus, for these three officials the department did not provide examples of printed e-mail records that had been stored in appropriate recordkeeping files. According to department officials, this situation is explained by HUD’s practice of not using e-mail for business matters that would produce records. According to department officials, official business is conducted through paper processes, some electronic processes (such as Web-based systems), but rarely through e-mail. Nonetheless, although e-mail may rarely rise to the level of a record under paper-based processes, it does not follow that no e-mail records are ever created or received, as shown by the e-mail records maintained by the department’s Executive Secretariat and the Office of Healthy Homes and Lead Hazard Control. The weakness in HUD’s policy regarding responsibility for determining which e-mails are records, combined with the lack of training in e-mail records management, reduces the department’s assurance that those e-mail messages that are records are being appropriately identified. Factors contributing to the inconsistent practices at the three agencies include inadequate training and oversight, as well as the difficulties of managing large volumes of e-mail with the tools and resources available, which in most cases do not include electronic recordkeeping systems. The regulations require agencies to develop adequate training to ensure that staff implement agency policies. All four agencies have issued guidance and developed training materials, and all state that they performed records management training. For example, according to DHS officials, all three senior officials and staff had received records management training as new employees. However, DHS and HUD had no documentation to indicate that employees had received such training, and our review of practices found instances in which staff did not understand their recordkeeping responsibilities for e-mail and stated that they had not been informed of them or received training. For example, three senior HUD officials had not received training on records management. Staff explained that formal briefings had last taken place at that time. Agencies must also periodically evaluate their records management programs, including periodic monitoring of staff determinations of the record status of materials. However, the three agencies have not fully developed and implemented oversight mechanisms, and do not determine the extent to which senior officials or other staff are following applicable requirements for e-mail records. According to DHS, it has initiated oversight and review activities, but these are not yet at the pilot stage because of other demands on records management staff, such as completion of records scheduling. EPA has developed an oversight plan and has pilot-tested a records management survey tool, but it has not yet begun agencywide reviews. It plans to fully deploy this tool when ECMS is fully implemented. HUD had not initiated oversight and review activities, according to officials, because of its practice of not using e-mail for matters that would necessitate the creation of official records. These officials stated that when the department’s modernized system for records and document management is in place, the department’s e-mail policies will be updated and appropriate oversight and review activities put in place. Unless agencies train staff adequately in records management and perform periodic evaluations or establish other controls to ensure that staff receive training and are carrying out their responsibilities, agencies have little assurance that e-mail records are appropriately identified, stored, and preserved. Further, keeping large numbers of record and nonrecord messages in e-mail systems potentially increases the time and effort needed to search for information in response to a business need or an outside inquiry, such as a Freedom of Information Act request. The volume of e-mail is also described as contributing to e-mail records management shortcomings. Agency officials and staff referred to the difficulty of managing large volumes of e-mail, suggesting that limited resources contributed to their inability to fully comply with records management and preservation policies. To help ensure that e-mail records are managed appropriately, it is helpful to incorporate recordkeeping into the process by which agency staff create and respond to mission-related e- mail. Because this process is electronic, the most straightforward approach is to perform e-mail recordkeeping electronically. All four agencies, however, still rely either entirely or primarily on paper for their recordkeeping systems, even for “born digital” records like e-mail. Weaknesses in the processes in place at three of the four agencies reviewed raise questions about the appropriateness of paper recordkeeping processes for their e-mail records. Simply devoting more resources to paper records management may be neither efficient nor cost- effective, and the agencies have recognized that this is not a tenable long- term solution. EPA is beginning a transition to electronic recordkeeping, and HUD and DHS have plans focused on future enterprisewide transitions. Managing electronic documents, including e-mail, in electronic recordkeeping systems would potentially provide the efficiencies of automation and avoid the expenditure of resources on duplicative manual processes and storage. It is important to recognize, however, that moving to electronic recordkeeping has proved not to be a simple or easy process and that projects at large agencies have presented the most significant challenges. For projects of all sizes, agencies must balance the potential benefits of electronic recordkeeping against the costs of redesigning business processes and investing in technology. NARA has called the decision to move to electronic recordkeeping inevitable. Nonetheless, like other information technology investments, such a move requires careful planning in the context of the specific agency’s circumstances, in addition to well-managed implementation. NARA’s limited performance of its oversight responsibilities leaves it with little assurance that agencies are effectively managing records, including e- mail records, throughout their life cycle. NARA has an organizational preference for partnering with and supporting agencies’ records management activities, which is appropriate for many of its guidance and assistance responsibilities. However, this preference has led NARA to avoid performing oversight activities that it judged to be perceived negatively—the full-scale inspections/evaluations that it performed in previous years. Although it has performed studies that provide it with insights into records management issues and it has taken action in response to the findings, it has not developed means to evaluate the state of federal records management programs and practices. As a result, NARA’s oversight of federal records management programs, including management of e-mail, has been limited. Further, NARA’s limited reporting on problems and solutions identified at individual agencies reduces its own ability to hold agencies accountable for addressing identified problems, as well as reducing the ability of agencies to learn from the experience of others. At the four agencies reviewed, e-mail records management policies were generally compliant with NARA regulations, with some exceptions. If policies do not fully conform to regulatory requirements, it increases the likelihood that those requirements will not be met in practice. Senior officials at three of the four agencies stored e-mail records in e-mail systems, rather than in recordkeeping systems, which is not in accordance with NARA’s regulations. Factors contributing to this noncompliance generally included insufficient training and oversight regarding recordkeeping practices, as well as the onerousness of handling large volumes of e-mail. Providing adequate training and oversight is a prerequisite for improvement, but real improvements in e-mail recordkeeping may require replacing the paper-based recordkeeping processes currently in place. Properly implemented, the transition to electronic recordkeeping of e-mail has the potential not only to reduce the burden of e-mail management but also to provide positive benefits in improving the usefulness and accessibility of records. To better ensure that federal records, including those that originated as e- mail messages, are appropriately identified, retained, and archived, we recommend that the Archivist of the United States develop and implement an approach to oversight of agency records management programs that provides adequate assurance that agencies are following NARA guidance, including developing various types of inspections, surveys, and other means to evaluate the state of agency records and records management programs; developing criteria for using these means of assessment that ensure that they are regularly performed; and regularly report to the Congress and OMB on the findings, recommendations, and agency responses to its oversight activities, as required by law. In addition, we recommend that the Administrator of the Environmental Protection Agency revise the agency’s policies to ensure that they appropriately reflect NARA’s requirement on instructing staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems and develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately. We further recommend that the Chairman of the Federal Trade Commission revise the commission’s policies to ensure that they appropriately reflect NARA’s requirement to instruct staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems. We further recommend that the Secretary of Homeland Security revise the department’s policies to ensure that they appropriately reflect NARA’s requirement to state that draft documents circulated on e-mail systems are potential federal records and develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately. Finally, we recommend that the Secretary of Housing and Urban Development revise the department’s policies to ensure that they appropriately reflect NARA’s requirements to ensure that staff is capable of identifying federal records and to state that e-mail systems must not be used to store recordkeeping copies of e-mail records (other than those exceptions provided in the regulation) and that e-mail system backup tapes should not be used for recordkeeping purposes, and develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately. We provided a draft of this report to NARA, DHS, EPA, FTC, and HUD for review and comment. Three agencies provided written comments (which are reproduced in apps. II to IV), and two provided comments via e-mail. All five agencies indicated that they were implementing or intended to implement our recommendations. Three of the five agencies generally agreed with our findings and recommendations. One agency provided information about its use of outside e-mail accounts, and one agency agreed to implement our recommendations but questioned aspects of our report. In written comments, the Archivist of the United States stated that NARA generally agreed with our draft report and would develop an action plan to implement our recommendation. The Archivist also provided technical comments, and we clarified our report to address each of them. (see app. II). In e-mail comments, the Director, Records, Publications, and Mail Management at DHS, stated that the department agreed with our draft report and that it correctly represented the condition at the time of the review. The Director also said that future DHS records management policy documents would be revised to reflect our recommendations. In written comments, the Chief Information Officer of EPA stated that the agency accepted our two recommendations. In addition, she provided additional information on the EPA records management program. Finally, this official provided technical comments, which we addressed as appropriate; our assessment of these comments is contained in appendix III. In e-mail comments, an official from FTC’s Office of the General Counsel stated that FTC had instructed staff not to use outside e-mail accounts for official business, but it was nonetheless taking action to implement our recommendation by issuing a notice to staff regarding policies and procedures for e-mail records, which included a statement that work- related e-mails inadvertently sent or received from non-FTC accounts must be handled in accordance with the agency’s records preservation policies and procedures. Our draft recognized FTC’s instruction not to use outside accounts for official business, but also noted that that FTC did not totally prohibit access to such accounts. Because access to outside accounts was available, FTC was required by NARA regulations to provide staff with guidance on the proper handling of e-mail records sent or received through such accounts. FTC also provided technical comments, which we incorporated as appropriate. In written comments, HUD’s Acting Chief Information Officer stated that HUD planned to implement our recommendations, but also stated that our draft was inaccurate in three areas: The Acting CIO questioned the clarity of a figure we included to illustrate a decision process that could be used to decide if an e-mail message is a record. As noted in our draft, the illustration is provided as an example to illustrate the kinds of factors that may be considered when deciding whether an e-mail message is a record. The Acting CIO disagreed with our conclusions regarding HUD’s compliance with the requirements we reviewed, stating that the department’s records policies comply with all these requirements because they incorporate NARA’s regulations by reference. While our draft recognized the reference to NARA regulations in HUD’s policy, we concluded that such a reference was not adequate to comply with NARA regulations. As we stated in our draft, the reference in HUD’s policy is too general to make clear to HUD staff which practices are prohibited. In addition, HUD did not establish procedures to implement the requirements in question, as the regulations require. The Acting CIO questioned the accuracy of a statement on the number of senior officials whose files were reviewed. Our evidence shows that our statement was accurate, but we revised it to include further clarifying detail. We provide more detailed responses to these points in appendix IV. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this report. At that time, we will send copies of this report to the Archivist of the United States, the Administrator of the Environmental Protection Agency, the Chairman of the Federal Trade Commission, the Secretary of Homeland Security, and the Secretary of Housing and Urban Development. Copies will be made available to others on request. In addition, this report will be available at no charge on our Web site at www.gao.gov. If you have questions about this report, please contact me at (202) 512- 6240 or koontzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. assess to what extent the National Archives and Records Administration (NARA) provides oversight of federal records management programs and practices, particularly with regard to e-mail, describe processes followed by selected federal agencies to manage assess to what extent the selected agencies’ e-mail records management policies comply with federal requirements, and assess compliance of selected senior officials with key e-mail recordkeeping requirements. To determine the extent to which NARA provides oversight of federal agencies for managing and preserving federal e-mail records, we analyzed applicable laws, regulations, and guidance; reviewed NARA’s oversight activities from 2003 to 2007, including its reports to OMB and the Congress on records management activities; reviewed recent NARA’s records management reports; and interviewed NARA officials. To address our other objectives, we judgmentally selected four agencies for review based upon several factors. First, we identified four general government functions from those functions that NARA identified in a 2004 resource allocation study as having records that had a direct and significant impact on the rights, welfare, and/or well-being of American citizens or foreign nationals: homeland security, health, economic development, and environmental management. (NARA classified these functions as high risk for rights/accountability.) Next, using NARA’s analysis, we compiled a list of the federal agencies and their components that performed those high-risk functions. For each identified agency, we further classified it according to agency structure (a department with component bureaus or agencies, a department with an office structure, an independent agency, or an independent commission) and size (a large department over 150,000 employees, a small department less than 11,000 employees, a small independent agency less than 1,100 employees, or a large independent agency over 18,000 employees). We then judgmentally selected four agencies from the high-risk list that presented various combinations of structure and size. These were as follows: Department of Homeland Security (U.S. Immigration and Customs Enforcement) Rated by NARA as high on rights and accountability for records in the Homeland Security: Immigrant and Non-Citizen Services function Department with component agencies Over 162,000 employees Department of Housing and Urban Development (Office of Healthy Homes and Lead Hazard Control) Rated by NARA as high on rights and accountability for records in the Health: Illness Prevention function Department with offices Less than 11,000 employees Rated by NARA as high on rights and accountability for records in the Environmental Management: Environmental Remediation function Independent agency Rated by NARA as high on rights and accountability for records in the Economic Development: Business, Trade, Trust, and Financial Oversight Independent commission At each of the four selected agencies, we assessed e-mail records management policies of the agency; described processes followed by agencies to manage e-mail records, specifically reviewing e-mail records management practices of a business unit associated with the high-risk function; and assessed compliance of four senior officials with key e-mail recordkeeping requirements. We selected a business unit from each organization that (1) performed the particular line of business we identified in our agency selection process and (2) had permanent records that NARA rated high on risk to accountability and citizen rights. Table 5 identifies the business unit we selected at each agency. We also selected four senior officials at each agency. At DHS, EPA, and HUD, we selected the head of the agency, the head of the office responsible for policy, a randomly selected senior official, and the most senior agency official associated with the business unit we inspected. At FTC, we selected the Chairman and three Commissioners. The selected senior officials are listed in table 6. To describe the agencies’ e-mail records management practices, we analyzed documents, interviewed appropriate officials at the agency (including business unit officials and staff), and performed limited inspections of selected e-mail records. To assess each agency’s e-mail records management policies, we reviewed the agency’s published policy documents, including formal policies and operational manuals, as well as agency-provided responses to a data collection instrument on e-mail management, and compared their contents to the e-mail related requirements in NARA’s records management regulations. To assess compliance of senior officials with key e-mail recordkeeping requirements, we analyzed documents, used data collection instruments to gather information from the senior officials, their staffs, or other appropriate officials, and inspected selected e-mail records. We asked each agency to provide examples of senior officials’ e-mail messages stored as records to corroborate their responses. We then analyzed the information provided by the agencies and assessed it against the e-mail requirements in NARA’s regulations on federal records. We did not attempt to assess the extent to which the agencies’ staff correctly identified e-mail records or the extent to which the agencies’ records appropriately included e-mail. The four data collection instruments we used are briefly described in table 7. We performed our work at agency offices in the Washington, D.C., metropolitan area. We conducted this performance audit from April 2007 to May 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 1. We clarified our discussion of this topic. 2. We clarified our discussion of this topic. 3. We removed the reference to the 180 day limit. 4. In our discussion of the exchange between EPA and NARA on the incident involving possible loss of e-mail records, we included information on EPA’s plan to promulgate a policy on the use on non- EPA e-mail systems. 5. See comment 4. EPA plans to promulgate a policy prohibiting the use of non-EPA e-mail systems for EPA business. 6. We updated our discussion of this topic to reflect NARA’s response. 7. We do not use EPA’s terminology because we do not find “primary” and “secondary” to be useful descriptions. However, we revised our discussion to clarify the references. 8. See note 7. 9. If EPA implements the oversight mechanism we recommend, it will help ensure that e-mail records are properly identified and protected. 10. We updated our discussion to indicate when EPA plans to deploy its survey tool. The following are GAO’s comments on the on the HUD’s written response dated May 28, 2008, to our draft report. 1. As noted in our report, the described decision process is an example of one that could be used to determine whether an e-mail message is a record. We did not state that the process is a requirement that must be followed by any particular agency. 2. See comment 1. 3. See comment 5. 4. See comment 5. 5. Our draft noted that HUD incorporated Parts 1220, 1222, and 1228 of NARA’s regulations by reference. However, the policy requirements at issue are contained in Part 1234 of NARA’s regulations. In its comments, HUD argues that the Parts it cites incorporate Part 1234 by reference. We do not agree with HUD that this type of indirect reference is a sufficient or effective way of informing HUD staff of their e-mail recordkeeping responsibilities as well as of prohibited practices. In addition, HUD did not fully implement the applicable e- mail management requirements because it did not establish procedures to implement appropriate procedures that protect e-mail records. 6. See comment 5. 7. The text suggested by HUD is incorrect in that we requested copies of e-mail records from all three selected officials. We revised our report to provide additional detail on this. 8. We agree that enhancing HUD’s policies on e-mail records as we recommend could increase their usability by all HUD officials and staff; among other things, this could clarify for HUD staff which practices are prohibited. 9. We agree that not every e-mail is an official record, and we emphasized this point in our report. However, we also emphasized that the content of a communication, not its form, determines its record status. In addition to the individual named above, Mirko Dolak and James R. Sweetman, Jr. (Assistant Directors); Monica Anatalio; Timothy Case; Barbara Collier; Pamlutricia Greenleaf; Jennifer Franks; Tarunkant N. Mithani; Sushmita Srikanth; and Jennifer Stavros-Turner made key contributions to this report.

Summary: Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked, among other things, to review the extent to which NARA provides oversight of federal records management, describe selected agencies' processes for managing e-mail records, and assess these agencies' e-mail policies and key practices. To do so, GAO examined NARA guidance, regulations, and oversight activities, as well as e-mail policies at four agencies (of contrasting sizes and structures) and the practices of selected officials. Although NARA has responsibilities for oversight of agencies' records and records management programs and practices, including conducting inspections or surveys, performing studies, and reporting results to the Congress and the Office of Management and Budget (OMB), in recent years NARA's oversight activities have been primarily limited to performing studies. NARA has conducted no inspections of agency records management programs since 2000, because it uses inspections only to address cases of the highest risk, and no recent cases have met its criteria. In addition, NARA has not consistently reported details on records management problems or recommended practices that were discovered as a result of its studies. Without more comprehensive evaluations of agency records management, NARA has limited assurance that agencies are appropriately managing the records in their custody and that important records are not lost. The four agencies reviewed generally managed e-mail records through paper-based processes, rather than using electronic recordkeeping. A transition to electronic recordkeeping was under way at one of the four agencies, and two had long-term plans to use electronic recordkeeping. (The fourth agency had no current plans to make such a transition.) Each of the business units that GAO reviewed (one at each agency) maintained "case" files to fulfill its mission and used these for recordkeeping. The practice at the units was to include e-mail printouts in the case files if the e-mail contained information necessary to document the case--that is, record material. These printouts included transmission data and distribution lists, as required. All four agencies had e-mail records management policies that addressed, with a few exceptions, the requirements in NARA's regulations. However, the practices of senior officials at those agencies did not always conform to requirements. Of the 15 senior officials whose practices were reviewed, the e-mail records for 7 (including all 4 at one agency) were managed in compliance with requirements. (One additional official was selected for review but did not use e-mail.) The other 8 officials generally kept e-mail messages, record or nonrecord, in e-mail systems that were not recordkeeping systems. (Among other things, recordkeeping systems allow related records to be categorized according to their business purposes.) If e-mail records are not kept in recordkeeping systems, they may be harder to find and use, as well as being at increased risk of loss from inadvertent or automatic deletion. Factors contributing to noncompliance included insufficient training and oversight as well as the difficulties of managing large volumes of e-mail. Without periodic evaluations of recordkeeping practices or other controls to ensure that staff are trained and carry out their responsibilities, agencies have little assurance that e-mail records are properly identified, stored, and preserved.