Summary
Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. Under the act, both the National Archives and Records Administration (NARA) and federal agencies have responsibilities for managing federal records, including e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked, among other things, to review the extent to which NARA provides oversight of federal records management, describe selected agencies' processes for managing e-mail records, and assess these agencies' e-mail policies and key practices. To do so, GAO examined NARA guidance, regulations, and oversight activities, as well as e-mail policies at four agencies (of contrasting sizes and structures) and the practices of selected officials.
Although NARA has responsibilities for oversight of agencies' records and records management programs and practices, including conducting inspections or surveys, performing studies, and reporting results to the Congress and the Office of Management and Budget (OMB), in recent years NARA's oversight activities have been primarily limited to performing studies. NARA has conducted no inspections of agency records management programs since 2000, because it uses inspections only to address cases of the highest risk, and no recent cases have met its criteria. In addition, NARA has not consistently reported details on records management problems or recommended practices that were discovered as a result of its studies. Without more comprehensive evaluations of agency records management, NARA has limited assurance that agencies are appropriately managing the records in their custody and that important records are not lost. The four agencies reviewed generally managed e-mail records through paper-based processes, rather than using electronic recordkeeping. A transition to electronic recordkeeping was under way at one of the four agencies, and two had long-term plans to use electronic recordkeeping. (The fourth agency had no current plans to make such a transition.) Each of the business units that GAO reviewed (one at each agency) maintained "case" files to fulfill its mission and used these for recordkeeping. The practice at the units was to include e-mail printouts in the case files if the e-mail contained information necessary to document the case--that is, record material. These printouts included transmission data and distribution lists, as required. All four agencies had e-mail records management policies that addressed, with a few exceptions, the requirements in NARA's regulations. However, the practices of senior officials at those agencies did not always conform to requirements. Of the 15 senior officials whose practices were reviewed, the e-mail records for 7 (including all 4 at one agency) were managed in compliance with requirements. (One additional official was selected for review but did not use e-mail.) The other 8 officials generally kept e-mail messages, record or nonrecord, in e-mail systems that were not recordkeeping systems. (Among other things, recordkeeping systems allow related records to be categorized according to their business purposes.) If e-mail records are not kept in recordkeeping systems, they may be harder to find and use, as well as being at increased risk of loss from inadvertent or automatic deletion. Factors contributing to noncompliance included insufficient training and oversight as well as the difficulties of managing large volumes of e-mail. Without periodic evaluations of recordkeeping practices or other controls to ensure that staff are trained and carry out their responsibilities, agencies have little assurance that e-mail records are properly identified, stored, and preserved.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
Linda D. Koontz
Government Accountability Office: Information Technology
(202) 512-6240
Recommendations for Executive Action
Recommendation: To better ensure that federal records, including those that originated as e-mail messages, are appropriately identified, retained, and archived, the Archivist of the United States should develop and implement an approach to oversight of agency records management programs that provides adequate assurance that agencies are following NARA guidance, including: (1) developing various types of inspections, surveys, and other means to evaluate the state of agency records and records management programs; (2) developing criteria for using these means of assessment that ensure that they are regularly performed; and (3) regularly report to the Congress and OMB on the findings, recommendations, and agency responses to its oversight activities, as required by law.
Agency Affected: General Services Administration: National Archives and Records Administration
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Administrator of the Environmental Protection Agency should revise the agency's policies to ensure that they appropriately reflect NARA's requirement on instructing staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems.
Agency Affected: Environmental Protection Agency
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Administrator of the Environmental Protection Agency should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.
Agency Affected: Environmental Protection Agency
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Chairman of the Federal Trade Commission should revise the commission's policies to ensure that they appropriately reflect NARA's requirement to instruct staff on the management and preservation of e-mail messages sent or received from nongovernmental e-mail systems.
Agency Affected: Federal Trade Commission
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Homeland Security should revise the department's policies to ensure that they appropriately reflect NARA's requirement to state that draft documents circulated on e-mail systems are potential federal records.
Agency Affected: Department of Homeland Security
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Homeland Security should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.
Agency Affected: Department of Homeland Security
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Housing and Urban Development should revise the department's policies to ensure that they appropriately reflect NARA's requirements to ensure that staff is capable of identifying federal records and to state that e-mail systems must not be used to store recordkeeping copies of e-mail records (other than those exceptions provided in the regulation) and that e-mail system backup tapes should not be used for recordkeeping purposes.
Agency Affected: Department of Housing and Urban Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Recommendation: The Secretary of Housing and Urban Development should develop and apply oversight practices, such as reviews and monitoring of records management training and practices, that are adequate to ensure that policies are effective and that staff are adequately trained and are implementing policies appropriately.
Agency Affected: Department of Housing and Urban Development
Status: In process
Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
