Information Management: Selected Agencies Need to Fully Address Federal Electronic Recordkeeping Requirements

The Federal Records Act , a subsequent directive, and NARA regulations establish requirements for agencies to ensure the transparency, efficiency, and accountability of federal records, including those in electronic form. In addition, NARA plays an important role in overseeing and assisting agencies' records management efforts.

GAO was asked to evaluate federal agencies' implementation of the aforementioned requirements related to electronic records. The objectives were to determine the extent to which (1) selected agencies' policies and procedures address the electronic recordkeeping requirements in the Managing Government Records Directive and the Presidential and FRA Amendments of 2014 and (2) NARA assisted selected agencies in managing their electronic records. To do so, GAO selected 17 agencies and reviewed their records management policies and procedures. GAO also reviewed laws and requirements pertaining to NARA's roles and responsibilities for assisting agencies in managing their electronic records. Further, GAO analyzed NARA guidance and other documents that discussed NARA's efforts in carrying out these responsibilities.

Seventeen agencies GAO selected for review varied in the extent to which their policies and procedures addressed the electronic recordkeeping requirements in the Managing Government Records Directive and the Federal Records Act ( FRA ) and its amendments. More specifically, 14 of the 17 agencies established records management programs, while three agencies did not. Of those 14 agencies with established records management programs, almost all addressed requirements related to incorporating electronic records into their existing programs, but many did not have policies and procedures to fully incorporate recordkeeping functionalities into electronic systems, establish controls and preservation considerations for systems, and issue instructions on email requirements (see table).

NARA provided guidance and assistance to the selected agencies, including guidance on electronic records management and training. All of the agencies stated that the assistance was generally helpful and that they relied on it to some extent for implementing the key requirements discussed in this report. Further, NARA oversaw the selected agencies' implementation of federal records management regulations through their self-assessment progam. However, NARA had not ensured that the selected small or micro agencies that self-assessed to be at high risk of improper records management in calendar year 2017 were taking appropriate actions to make improvements to their records management programs. NARA officials stated they conduct follow-up with the agencies that report poor scores, but they do not proactively require the agencies to address their weaknesses. Until NARA requires these agencies to develop plans to make necessary improvements, these agencies will likely miss important opportunities to improve their record management practices.

GAO is making 40 recommendations to 14 of the 17 selected agencies to improve their management of electronic records. GAO is also recommending that NARA (1) require high-risk smaller agencies to create improvement plans and (2) monitor progress on a regular basis. Six agencies, including NARA, agreed with the recommendations, while 11 did not state whether they agreed or disagreed, or had no comments.

Advances in technology and electronic communications, such as email,  have transformed agency operations while creating new opportunities  with respect to the effective management of agency records. For  example, these services can improve agency performance and promote  openness and accountability through better documentation of agency  actions and decisions. However, these services also pose risks to the  adequate protection of government information and have radically  increased the volume and diversity of information that federal agencies  must manage.

Recognizing this challenge, in November 2011, a presidential  memorandum entitled Managing Government Records was issued, which  started a government-wide effort to reform federal records management.  Subsequently, the Office of Management and Budget (OMB) and the  National Archives and Records Administration (NARA) jointly issued a  memorandum to the heads of federal departments and agencies entitled  Managing Government Records Directive. The directive provided  implementation guidance for improved records management and  required, to the fullest extent possible, that agencies eliminate paper and  use electronic recordkeeping.

The directive, the Federal Records Act (FRA), NARA regulations, and  the Presidential and Federal Records Act Amendments of 2014 (FRA  Amendments), require federal agencies to take specific actions to create,  manage, and preserve federal records and provide a framework for  managing electronic records. For example, the directive states that  agencies must retain email records in an electronic system that supports  records management requirements, including the capability to identify,  retrieve, and retain these records as long as they are needed.

You asked us to conduct a review of federal agencies’ management of  electronic records. Our review examined the extent to which (1) selected  agencies’ policies and procedures address the electronic recordkeeping  requirements in the Managing Government Records Directive and the  Presidential and FRA Amendments of 2014 and (2) NARA assisted  selected agencies in managing their electronic records.

To determine the agencies for our review, we first identified agencies that  established a Senior Agency Official for Records Management (SAORM)  and submitted an annual report to NARA’s website between fiscal year  2015 and fiscal year 2017. Of the 95 agencies that met these criteria, we  removed two from consideration because they were not part of the  executive branch: one was a judicial branch agency and the other was a  legislative branch agency. The 93 remaining agencies represented the  following categories: (1) executive departments, (2) Executive Office of  the President agencies, and (3) independent agencies.

To ensure the selection of a variety of agencies across the designated  categories, we chose a sample of 17 agencies and ensured that at least  two agencies were selected from each of the three categories. In order to  generate this sample, we sorted the list of 93 agencies by assigned  random numbers and selected the top 17 agencies in this list, while  ensuring that at least two agencies from each category were selected.  This sample of 17 agencies cannot be used to make generalizations  about all agencies.

To address our first objective, we obtained and analyzed the selected  agencies’ guidance, directives, policies, plans, procedures, and other  documentation that described key requirements specified in the Federal  Records Act, the Federal Records Act Amendments of 2014, and its  implementing regulations. The selected requirements included general  records management provisions as well as specific requirements  regarding the management of electronic records, such as the requirement  to establish records management controls for records in electronic  information systems and to protect records against technological  obsolescence. Further, we analyzed agencies’ progress in meeting the  Office of Management and Budget’s (OMB) and NARA’s Managing  Government Records Directive. For the directive, we focused on  requirements related to electronic records management, such as  managing permanent records, managing email records, and managing  electronic records management programs. We also interviewed cognizant  agency officials regarding any gaps we identified in agencies’ policies and  procedures and to understand their approach to records management.

To address our second objective, we reviewed NARA’s annual self- assessment program that evaluates agencies’ reported compliance with  federal records management statutes, regulations, and program functions  to obtain information on how NARA was determining which agencies  needed assistance with implementing their records management  programs. We supplemented our document reviews and analysis with  interviews of selected agency officials responsible for records  management and NARA agency officials to gain an understanding of  these and other relevant documents aimed at helping agencies  implement their records management programs.

We conducted this performance audit from March 2018 to February 2020  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Additional details of our  objectives, scope, and methodology are contained in appendix I.

Records are the foundation of open government, supporting the principles  of transparency, participation, and collaboration. Effective management of  federal agency records is important for efficient government operations: it  ensures that sufficient documentation is created; that agencies can  efficiently locate and retrieve records needed in the daily performance of  their missions; and that records of historical significance are identified,  preserved, and made available to the public.

Requirements for managing federal records include the following:

The FRA establishes requirements for the management of records in  federal agencies. Every federal agency is required to preserve  records that document the organization, functions, policies, decisions,  procedures, and essential transactions of the agency to furnish the  information necessary to protect the legal and financial rights of the  government and of persons directly affected by the agency’s activities.  The act also gives NARA regulatory responsibilities for records  management as well as general responsibilities for archiving records.

In response to a presidential memorandum to begin an executive  branch effort to reform records management policies and develop a  framework for the management of electronic government records, the  Director of OMB and the Archivist of the United States jointly issued  the Managing Government Records Directive to heads of federal  departments and agencies. This directive aimed at creating a robust  records management framework for electronic records that complied  with statutes and regulations to achieve the benefits outlined in the  presidential memorandum. It required agencies to eliminate paper and  use electronic recordkeeping to the fullest extent possible.

Among other things, the directive identified two requirements related to  electronic records that agencies were to implement between December  2016 and December 2019.

By December 31, 2016, federal agencies were to manage all  permanent and temporary email records in an accessible electronic  format. Email records were to be retained in an appropriate electronic  system that supports records management litigation requirements,  including the capability to identify, retrieve, and retain the records for  as long as they are needed.

By December 31, 2019, federal agencies are to manage all  permanent electronic records in an electronic format to the fullest  extent possible for eventual transfer and accessioning by NARA.

NARA and Federal Agencies Share Responsibilities for Federal Records Management

Under the FRA and its implementing regulations, NARA has general  oversight responsibilities for records management and the preservation of  permanent records documenting the activities of the government in the  National Archives of the United States. Thus, NARA is responsible for  overseeing agency management of temporary and permanent records  used in everyday operations and, ultimately, for taking control of  permanent agency records judged to be of historic value.

In particular, NARA is responsible for:  issuing records management guidance covering topics such as  managing electronic records; assigning an appraisal archivist to each agency to answer agency  questions about federal records management; providing services to agencies, such as records scheduling and working with agencies to implement effective controls over the  creation, maintenance, and use of records in the conduct of agency  business; approving the disposition (destruction or preservation) of records; providing storage facilities for agency records; and  conducting inspections or surveys of agency records and records  management programs.

NARA is also responsible for reporting to Congress on the state of federal  records management. It accomplishes this responsibility, in part, by  requiring all federal agencies to submit an annual report to the Office of  the Chief Records Officer for the federal government. As part of these  annual reports, agencies are required to include three submissions:

The Senior Agency Official Records Management Report includes  responses about the agency’s progress toward the targets and  requirements in the Managing Government Records Directive.

The Federal Email Management Report includes a self-evaluation of  their email management.

The Records Management Self-Assessment includes a self- evaluation of their compliance with federal records management  statutes, regulations, and program functions.

In addition to NARA’s responsibilities, the FRA requires each federal  agency to make and preserve records that document the organization,  functions, policies, decisions, procedures, and essential transactions of  the agency.

Effective Records Management Must Address Electronic Records,  Including Email  The FRA covers documentary material, regardless of physical form or  media, although, until the advent of computers, records management and  archiving mostly focused on handling paper documents. However, as  information is increasingly created and stored electronically, records  management has had to take into account the creation of records in  various electronic formats, including email messages. As such, agencies  need to adapt their records management practices to manage those  electronic files that may be federal records.

NARA’s implementing regulations and guidance, such as periodic NARA  bulletins, provide direction to agencies about the management of  electronic records. To ensure that the management of agency electronic  records is consistent with provisions of the FRA, NARA requires each  agency to maintain an inventory of all agency information systems that  identifies basic facts about each system, such as technical characteristics  and the electronic records it contains. NARA also requires that agencies  maintain all federal records, including those in electronic format, in its  systems. Further, NARA requires agencies to provide instructions to staff  regarding how to maintain the agency’s operational records and what to  do when they are no longer needed for current business. Like other  records, electronic records must be scheduled either under agency- specific schedules or pursuant to a general records schedule.

Further, in order to effectively address NARA regulations, agencies are to  establish policies and procedures that provide for appropriate retention  and disposition of their electronic records. Disposition involves  transferring records of permanent, historical value to NARA for the archiving of records (preservation) and the destruction of all other records  that are no longer needed for agency operations.

In addition to adherence to general requirements governing electronic  records, according to the electronic records management regulation,  agencies are to also issue instructions to staff that specifically address  retention and management of their email records. The regulation requires  agencies’ email records to be managed as are other federal records with  regard to the adequacy of documentation, recordkeeping requirements,  agency records management responsibilities, and records disposition.

The FRA Amendments enacted on November 26, 2014, include, among  other things, disclosure requirements for official business conducted  using a non-official electronic messaging account. The law states an  officer or employee of an executive agency may not create or send a  record using a non-official electronic messaging account unless the  officer or employee (1) includes a copy to an official electronic messaging  account of the officer or employee in the original creation or transmission  of the record or (2) forwards a complete copy of the record to an official  electronic messaging account of the officer or employee not later than 20  days after the original creation or transmission of the record.

Our Prior Work Has Addressed Electronic Records Management

In 2015, we reported that the 24 major federal departments and agencies  covered by the Chief Financial Officers Act of 1990 had taken action in  response to the Managing Government Records Directive, but not all of  the agencies met all of the requirements. In that report, we stated that  most of the agencies, including the Department of Commerce  (Commerce) and the National Aeronautics and Space Administration  (NASA), described plans to manage permanent electronic records,  reported progress in managing permanent and temporary email records,  and identified unscheduled records. We also noted that certain  requirements were not fully met by a few agencies, including the National  Science Foundation (NSF) and Office of Personnel Management (OPM),  because these agencies were either still working on addressing the  requirement, or did not view the requirement as being mandatory.

Specifically, we reported that NSF did not submit a Senior Agency Official  report that would have provided information to NARA on how it intended  to manage permanent records electronically. In addition, we reported that  NSF did not report to NARA on its possession of permanent 30-year-old  records, and had not completed its identification of, or reported on, any  portion of its unscheduled records. As a result, we recommended that  NSF establish a date by which the agency would complete, and then  report to NARA, its plans for managing permanent records electronically  and its progress toward managing permanent and temporary email  records in an electronic format. We also recommended that the agency  complete the identification of unscheduled records stored at agency  records storage facilities. NSF concurred with our recommendations and,  in response, completed its plans for managing permanent records  electronically and managing permanent and temporary email records in  an electronic format. We verified in February 2017 that the agency  reported these plans to NARA.

For OPM, the agency had not designated their Senior Agency Official at  the assistant secretary level or its equivalent because they did not view  the requirement as mandatory. We recommended that the designated  Senior Agency Official be at or equivalent to the level of an assistant  secretary. OPM concurred with our recommendations and, in response,  designated the Chief Information Officer as the Senior Agency Official  with direct responsibility for ensuring that OPM efficiently and  appropriately complies with all applicable records management statutes,  regulations, and NARA policy.

Federal Agencies’ Policies and Procedures Did Not Fully Address Electronic Recordkeeping Requirements

The 17 agencies selected for review varied in the extent to which their  records management policies, procedures, and documentation addressed  10 key requirements in the Managing Government Records Directive, the  FRA and its amendments, and implementing regulations related to  electronic records. Specifically, most of the selected agencies addressed  the requirements related to establishing records management programs,  submitting records schedules to NARA, incorporating activities for  electronic records into their overall records management program,  developing plans for managing permanent electronic records in an  electronic format, managing email records in an electronic format, and  using non-official electronic messaging. However, agencies did not fully  address the requirements related to maintaining an inventory of electronic  information systems, establishing controls and preservation  considerations for their electronic information systems, and issuing  retention and management requirements for email.

Most Agencies Established Records Management Programs and Developed Records Schedules

According to the FRA and its amendments, agencies are to establish  effective records management programs, which includes developing  comprehensive records schedules, in order to achieve adequate and  proper documentation of the policies and transactions of the federal  government and to aid in the effective and economical management of  agency operations. Specifically, each agency is required to: establish and maintain an active, continuing records management  program that, among other things, includes effective controls over the  creation, maintenance, and use of records and  submit lists and schedules of records to the Archivist of the United  States that describe, among other things, when eligible temporary  records must be disposed of.

As shown in figure 1, the majority of the 17 selected agencies addressed  these requirements.

Establishing a records management program: Fourteen of the 17  selected agencies—Armed Forces Retirement Home (AFRH),  Consumer Financial Protection Bureau (CFPB), Commerce, U.S.  Election Assistance Commission (EAC), Federal Housing Finance  Agency (FHFA), Federal Trade Commission (FTC), NASA, NSF,  Office of Management and Budget (OMB), Office of National Drug  Control Policy (ONDCP), Overseas Private Investment Corporation  (OPIC), OPM, Peace Corps, and Special Inspector General for  Afghanistan Reconstruction (SIGAR)—had developed policies and  procedures that outlined their records management program. The  agencies’ records management documentation discussed, among  other things, the requirement for effective controls over the creation,  maintenance, and use of records at the agency.

However, three agencies—Marine Mammal Commission, Presidio Trust,  and the Morris K. Udall and Stewart L. Udall Foundation (Udall  Foundation)—did not have an active, continuing agency records  management program, including documentation that described effective  controls over the creation, maintenance, and use of records at the  agency. All three agencies indicated that they have taken or intend to  take actions to establish such a program.

Marine Mammal Commission officials responsible for records  management stated that the agency had engaged a contractor who  completed and submitted for agency review and approval a draft  policy that would govern its records management program. As of  January 2020, the Executive Director stated that the commission has  a signed policy and draft handbook to govern its records management  program and that it is working towards full implementation and  compliance by December of 2022.

Presidio Trust officials responsible for records management stated  that the agency intends to address the requirements and plans to  have records management policies and procedures at the agency in  fiscal years 2020 and 2021.

Udall Foundation officials responsible for records management stated  that the agency had entered into an interagency agreement with  NARA for consulting services to assess its current records  management environment. According to the same officials, their intent  is to review NARA’s recommendations and develop a plan to comply  with the FRA, federal regulations, and NARA guidelines as they relate  to records management. The agency did not provide an estimated  date for completing these activities.

Until these agencies establish an active and continuing records  management program, they cannot provide assurance that, among other  things, effective controls are in place over the creation, maintenance, and  use of records in the conduct of current business.

Submitting lists and schedules of records to the Archivist:  Thirteen of the 17 selected agencies—AFRH, CFPB, EAC, FHFA,  FTC, Marine Mammal Commission, NASA, ONDCP, OPIC, Peace  Corps, Presidio Trust, SIGAR, and the Udall Foundation—had  submitted a comprehensive list of records and disposition schedules  to the Archivist. The remaining four agencies—Commerce, NSF,  OMB, and OPM—had partially addressed this requirement because  they had submitted only partial lists and schedules to the Archivist.  Each of these agencies acknowledged they did not provide  comprehensive lists of records and disposition schedules and stated  they were currently working toward submitting them to the Archivist.  OMB officials stated that they plan to complete this task by the end of  calendar year 2019, while the other agencies did not provide an  estimated date for completion. Without submitting lists of records and  disposition schedules to the Archivist, Commerce, NSF, OMB, and  OPM are at risk of maintaining records that are no longer relevant or  needed.

Agencies Varied in Addressing Requirements for Managing Electronic Records

The Managing Government Records Directive was aimed at creating a  robust records management framework for electronic records that  complies with statutes and regulations. In order to ensure transparency,  efficiency, and accountability, the directive instructed agencies to manage  all permanent and temporary e-mail records in an accessible electronic  format by December 2016 and manage all permanent electronic records  in an electronic format to the fullest extent possible by December 2019.

The directive also required NARA to develop revised guidance for  transferring permanent electronic records and issue new guidance  describing methods for managing, disposing of, and transferring e-mail.  Accordingly, NARA regulations and guidance outline requirements for  agencies to establish a framework for managing electronic records,  including requirements pertaining to electronic systems and email.  Additionally, the FRA Amendments described the disclosure requirements  for official business conducted using non-official electronic messaging  accounts.

Based on our analysis, these documents identify, among other things,  eight key requirements that agencies should include in their policies and  procedures to ensure that they can effectively manage electronic records.  These requirements are summarized in table 1.

The 14 agencies with an established records management program  varied greatly in the extent to which they addressed these electronic  records requirements, as seen in figure 2.

Incorporate activities for electronic records into the agency’s  overall records management program: Thirteen of 14 agencies that  had established records management programs—AFRH, Commerce,  CFPB, EAC, FHFA, FTC, NASA, NSF, OPIC, ONDCP, OPM, Peace  Corps, and SIGAR—developed written policies and procedures that  incorporated the management of electronic records into their records  management program.

The remaining agency—OMB—did not address this requirement. Staff  from OMB responsible for records management stated that the  Executive Office of the President’s (EOP) Office of Administration is  responsible for records management for all Executive Office  components and has procedures that incorporate the management of  electronic records into their records management program. However,  the officials did not provide evidence that the existing policies and  procedures incorporated the management of electronic records into  their records program. Without being able to ensure that records  management considerations are incorporated into the design and  implementation of electronic systems, OMB risks not being positioned  to properly manage records electronically.

Maintain an inventory of electronic systems: Three of the 14  agencies that had established records management programs— Commerce, FHFA, and SIGAR—also maintained an inventory of  electronic information systems that documented the information and  records produced and maintained by each application. Officials  responsible for records management at these agencies stated that  their inventory was maintained with the agency’s security plans.

Additionally, three of the 14 agencies that had established a records  management program —FTC, NSF, and Peace Corps—partially  addressed the requirement, as their policies and procedures  addressed some, but not all, of the necessary elements. More  specifically:

FTC documented various technical characteristics, such as  authorizations, purpose and function of the electronic information  systems, and authorized procedures for the disposition of records.  However, the agency did not include the characteristics for  reading and processing the records contained in the system,  inputs and outputs, contents of the files and records, and cycle  updates.

NSF documented the categories of records in the electronic  information systems, record access procedures, purpose of the  systems, and retention and disposition of the system’s records.  However, the agency did not specify the technical characteristics  of the systems, identify inputs and outputs, or describe update  cycles.

Peace Corps documented update cycles and the purpose of the  electronic information systems. However, the documentation did  not specify the technical characteristics necessary for reading and  processing the records contained in the system, identify system  inputs and outputs, define the contents of the files and records,  determine restrictions on access to and use of the system, and  specify how the agency ensures the timely disposition of records.

According to officials responsible for records management at each of  these agencies, they intend to address or would consider addressing the  requirement. However, none of them provided a time frame for doing so.

The remaining eight agencies—AFRH, CFPB, EAC, NASA, OMB,  ONDCP, OPM, and OPIC—either did not maintain an inventory of  electronic information systems or did not provide documentation that  outlined the technical characteristics, such as identifying all inputs and  outputs necessary for reading and processing records contained in the  system. Records management officials at AFRH, CFPB, EAC, NASA,  OPM, and OPIC stated that they intend to address the requirement, but  did not provide a time frame for doing so. Staff from OMB and ONDCP  responsible for records management stated that EOP’s Office of  Administration is responsible for records management for all components  and maintains an inventory of electronic information systems. However,  the officials did not provide evidence of this inventory. Without  maintaining an inventory and documentation of electronic information  systems used to store agency records, these agencies are at a  heightened risk of records being lost and not identified and scheduled in  accordance with agency records schedules.

Manage permanent electronic records in an electronic format:  The Managing Government Records Directive requires each agency  to develop and begin to implement plans to manage all permanent  records in an electronic format. In accordance with this requirement,  12 of the 14 agencies that had established records management  programs—AFRH, CFPB, Commerce, FHFA, FTC, NASA, NSF,  OMB, ONDCP, OPIC, Peace Corps, and SIGAR—described their  efforts to address the requirement in their Senior Agency Official  reports to NARA. For example, these agencies described, among  other things, plans on how permanent electronic records were being  captured, retained, searched, and retrieved.

However, two agencies—EAC and OPM—did not address how they  plan to manage permanent electronic records in their Senior Agency  Official reports or other agency documentation. EAC officials stated  that they were still deciding on a solution to manage permanent  records, and OPM officials stated they were planning to update  policies to ensure automated systems incorporate proper records  management life cycle controls. Further, neither agency provided a  time frame for developing and implementing a plan. By not having a  plan to manage their permanent records in an electronic format, these  agencies face an increased risk that they may not be positioned to  manage permanent electronic records.

Incorporate required recordkeeping functionalities: Eight of the 14  selected agencies that established records management programs— Commerce, CFPB, FHFA, FTC, NASA, NSF, ONDCP, and SIGAR— had documented policies, procedures, or other records management  documentation that addressed the required functionalities for  recordkeeping systems. Additionally, one agency—OPIC—partially  addressed this requirement because it included some, but not all, of  the required functionality. More specifically, the agency did not identify  whether the system could declare records and assign unique  identifiers, capture records, maintain security, and preserve records.  According to OPIC officials, the agency intends to work toward having  better documentation outlining system functionalities in alignment with  the requirements; however, the officials did not provide a time frame  for completing this documentation.

Further, five of the 14 agencies that had established records  management programs— AFRH, EAC, OMB, OPM, and Peace  Corps—did not address this requirement. Officials responsible for  records management at each of these agencies stated that their  records management system encompassed all of the aforementioned  functionality or that the agency was working toward a full electronic  records management system. However, these agencies’ policies and  procedures did not include the required functionalities for  recordkeeping systems. According to the same officials, each agency  intends to have written documentation that outlines the records  management functionalities; however, they did not provide a time  frame in which the documentation will be completed. Without using  electronic recordkeeping systems with appropriate functionalities,  these agencies face increased risk of not being able to reliably access  and retrieve the records needed to conduct agency business.

Establish records management controls and preservation  considerations: Seven of the 14 agencies that had established a  records management program—CFPB, Commerce, FHFA, FTC,  NASA, OPM, and SIGAR—included all records management controls  in their electronic information systems policy and included  preservation considerations in the design, development, and  implementation of electronic information systems. Additionally, six of  the 14 agencies that had established records management  programs—AFRH, EAC, OMB, ONDCP, OPIC, and the Peace  Corps—had policies that partially addressed establishing the records  management controls for their electronic information systems. More  specifically:

AFRH records management documentation included information  controls to ensure the reliability, authenticity, and integrity of  records. However, the documentation did not define controls for  usability, content, context, and structure.

EAC’s documentation included controls for reliability, authenticity,  integrity, and usability. However, the agency did not define  controls for content, context, and structure.

OMB and ONDCP’s documentation outlined controls for  authenticity, integrity, usability and content. However, the  documentation did not define controls for reliability, context, and  structure. Staff stated that both offices’ records management was  handled by the Office of Administration in the EOP and that the  office had acquired an object-based data storage system that was  expected to address all of the required controls. However, the  offices did not provide any evidence that the new system or the  associated policies and procedures would address the required  controls.

OPIC’s documentation defined controls for authenticity, integrity,  and usability. However, the documentation did not define controls  for reliability, content, context, and structure.

Peace Corps’ documentation included controls for reliability,  authenticity, integrity, and content. However, the agency did not  define controls for usability, context, and structure.

Additionally, each agency’s documentation did not describe how the  agency ensures that records in the system are retrievable and useable for  as long as needed to conduct agency business. Records management  officials at each of the agencies acknowledged that not all of the controls  or preservation considerations were included in their systems and that  they planned to work toward implementing all of the controls; however,  the agencies did not provide a time frame for documenting the controls.

The remaining agency—NSF—did not address this requirement because  its existing policies and procedures did not demonstrate that the agency  had established the required controls. NSF officials stated that they intend  to comply with this requirement but did not provide a time frame for doing  so. Without ensuring that records management controls and preservation  considerations are incorporated into electronic information systems, the  agencies cannot ensure these systems can produce retrievable and  useable records for as long as needed to conduct agency business.

Manage permanent and temporary email records in an electronic  format: Thirteen agencies—AFRH, CFPB, EAC, FHFA, FTC, NASA,  NSF, OMB, ONDCP, OPIC, OPM, Peace Corps, and SIGAR— addressed this requirement. The remaining agency—Commerce—did  not address this requirement. Officials responsible for records  management at Commerce stated that they use an email  management system for email, email preservation, and litigation  holds. However, their policies and procedures did not show how the  agency managed both permanent and temporary email records in an  accessible electronic format. Until Commerce ensures that its systems  are capable of managing permanent and temporary email records and  have the capability to identify, retrieve, and retain these records, the  agency faces an increased risk that its emails are not able to be  preserved or accessed when needed.

Issue retention and management requirements: Nine of the 14  agencies that had established records management programs— AFRH, Commerce, CFPB, EAC, FHFA, FTC, NASA, Peace Corps,  and SIGAR—issued instructions or had policies on retention and  management requirements for electronic mail. Additionally, two of the  14 agencies that had established records management programs— OPIC and OPM—had policies that partially addressed this  requirement. More specifically:

OPIC’s policies and procedures documented that agency email  messages and attachments that meet the statutory definition of a  record are to be documented as an official record. However, the  agency documentation did not discuss retention requirements for  calendars. Officials responsible for records management stated  that they intend to update the records and information  management handbook to include the calendar requirement, but  did not provide a time frame for updating the handbook.

OPM’s policies and procedures described how employees were to  ensure that email records included most of the requirements, but  the policies and procedures did not address retaining calendars  and draft documents. Officials responsible for records  management stated that they intend to review and update its  records management policy, but did not provide a time frame for  doing so.

The policies of the remaining three agencies—NSF, OMB, and  ONDCP—did not address this requirement for various reasons. NSF  officials responsible for records management stated that the agency  issued instructions regarding record retention and management of  email to staff through memos and bulletins. However, these  documents did not include instructions to staff that ensured the names  and addresses of the sender, date of message, attachments,  calendars, and draft documents would be retained.

Additionally, staff from OMB and ONDCP responsible for records  management stated that the Office of Administration within the EOP  captured and managed all email on behalf of all components.  According to these staff, email is permanent until the end of the  presidential administration, at which time the email is transferred to  NARA in accordance with each component’s records schedules.  However, the staff did not provide evidence that the existing policies  and procedures included these instructions. By not issuing instruction  to staff on retention and management requirements for email,  agencies are at risk of not being able to retrieve email and its  associated metadata when needed to conduct agency business.

Use of non-official electronic messaging: Twelve of the 14  agencies that had established records management programs — CFPB, Commerce, FHFA, FTC, NASA, NSF, OMB, ONDCP, OPM,  OPIC, Peace Corps, and SIGAR—had policies and procedures  outlining the rules that their employees are to follow when creating  records using a non-official electronic messaging account. The  remaining two of 14 agencies that had established records  management programs—AFRH and EAC—did not have written  documentation describing the agencies’ disclosure requirements for  official business conducted using non-official electronic messaging  accounts.

The EAC records management officials acknowledged that the  agency did not outline this requirement and stated that policies and  procedures were being drafted to address this requirement; however,  the officials did not provide an estimated completion date. AFRH  stated that it had updated its “Network Rules of Behavior” document  and its IT information security awareness training to new employees  to reflect the requirement, but we were unable to verify the updates.  Without establishing rules for employees on the use of non-official  electronic messaging accounts, agencies are at risk of not retaining  email records sent from personal accounts.

The 10 aforementioned requirements are important elements to  address while establishing a framework for managing electronic  records. While most of the selected agencies had established policies  and procedures addressing the requirements, some had not. Until  these agencies do so, they will lack assurance that electronic records  are being managed in a way that promotes openness and  accountability in documenting agency actions and decisions.

NARA Assisted Selected Agencies in Managing Electronic Records, but Did Not Ensure Agencies Addressed Identified Weaknesses NARA Issued Guidance and Provided Assistance to the Selected Agencies

NARA provided various forms of assistance to the selected agencies,  which included issuing guidance regarding electronic records  management, training, and professional development. In addition, NARA  monitored the selected agencies’ compliance with records management  regulations and implementation of policies, guidance, and other records  management best practices through its self-assessment program.  However, NARA had not ensured that any of the selected small or micro  agencies that self-assessed to be at high risk of improper records  management in calendar year 2017 were taking appropriate actions to  improve their records management program.

According to the FRA, NARA is responsible for providing guidance and  assistance to federal agencies with respect to ensuring economical and effective records management, adequate and proper documentation of the policies and transactions  of the federal government, and proper records disposition.

In accordance with its responsibilities, NARA provided guidance and  assistance to the selected agencies through various methods. All of the  selected agencies stated that NARA guidance and assistance were  generally helpful and that they relied on it to some extent for  implementing the electronic records management requirements  discussed in this report.

Specifically, NARA issued guidance particular to electronic records  creation, policies and procedures, management, and disposition. Officials  from the selected agencies found NARA’s guidance related to managing  email and its December 2017 General Records Schedule to be helpful  when fulfilling their responsibilities with respect to electronic records. The  guidance related to managing email describes federal agencies’  responsibilities for email management and the Capstone approach to  email management. The Records Officer at AFRH stated that the agency  used guidance that described the minimum set of metadata elements  that must accompany transfers of permanent electronic records to NARA.  The General Records Schedule provides mandatory disposition  instructions for records that are common to several or all federal  agencies. An FHFA official responsible for records and information  management stated this guidance was useful because it was used at the  agency during regular records management activities, such as records  disposition.

Further, NARA provided assistance to the selected agencies such as  professional development training and assigning an archivist to assist  each agency. Officials responsible for records management at the  selected agencies stated that NARA offers agencies records  management training and professional development to federal employees  and contractors. For example, NARA provides a certificate program for  Federal Agency Records Officers and records management professionals  to manage information collected by their agency. In addition, these  officials stated that NARA offers a bi-monthly Records Information  Discussion Group where individuals involved with federal records  management can share their experiences and discuss the latest  developments from NARA.

Additionally, officials responsible for records management at the selected  agencies stated that NARA assigns an archivist to each agency to field  questions about federal records management, including services such as  records scheduling and appraisal, and technical assistance. For example,  Udall Foundation officials responsible for records management stated that  the agency worked with its assigned archivist who provided direction on  how to manage agency records, connected the agency with other records  management subject matter experts, and fielded questions on the  scheduling of agency records.

NARA Required Agencies to Self-Assess Their Programs, but Did Not Ensure They Have Plans to Make Improvements

In addition to providing assistance to federal agencies, NARA also has  the responsibility to monitor compliance with records management  regulations and implementation of NARA policies, guidance, and other  records management best practices by federal agencies. One way in  which NARA accomplishes this is to require federal agencies to conduct  an annual self-assessment that evaluates the agency’s reported  compliance with federal records management statutes, regulations, and  program functions and is also useful to target resources to areas needing  improvement. NARA scores each agency’s responses and, based on this  score, determines whether an agency is at risk of not complying with  statutory and regulatory records management requirements.

For the self-assessments that covered calendar year 2017, four of our 17  selected agencies—AFRH, Marine Mammal Commission, Presidio Trust  and the Udall Foundation—were assessed as being at high risk of not  complying with statutory and regulatory records management  requirements. See table 2 for how 16 of the 17 selected agencies scored.

While NARA requires agencies to self-assess their records management  programs annually, it does not ensure that agencies that scored poorly on  their self-assessments develop a plan to improve their programs or  monitor their progress in such efforts. According to NARA officials, after  reviewing the reports the agency conducted phone interviews with staff  from selected small and micro agencies to determine if there were any  common factors for why they scored poorly on the self-assessments and  what NARA could do to help them improve their records management  programs.

Given the self-assessment process was designed to measure agency  compliance and to target resources to areas needing improvement, it is  important for NARA to ensure the small and micro agencies that have  assessed their programs as high-risk are taking appropriate actions to  improve their records management programs. Until NARA requires high- risk small and micro agencies to develop plans to make necessary  improvements to their record management programs and monitor their  progress, it cannot be certain that these agencies are managing  electronic records in accordance with governing regulations. Similarly,  agencies that have not submitted self-assessments may also not be  addressing statutory and regulatory records management requirements.

While most of the selected agencies addressed the key electronic  recordkeeping requirements, others did not. Specifically, many agencies  did not address requirements related to electronic system and email  implementation, including establishing controls for their electronic  information systems, incorporating preservation considerations into  systems, and issuing retention and management requirements for email.  Until these agencies do so, they will lack assurance that electronic  records are being created, managed, retained, preserved, and disposed  of in a way that improves performance and promotes openness and  accountability by better documenting agency actions and decisions.

NARA continues to assist the selected agencies in managing electronic  records by providing guidance and training as well as monitoring their  compliance with records management regulations. However, while NARA  oversees the selected agencies’ compliance through records  management self-assessments, it has not ensured that the selected small  and micro agencies that were at high risk of improper records  management have developed plans to address weaknesses in their  records management programs.

We are making 42 recommendations to 15 agencies. Specifically, we are  making the following recommendations to NARA:  The Archivist of the United States should  1.  require small and micro agencies that were determined to be at high  risk of not complying with statutory and regulatory records  management requirements to develop plans and timelines to address  their records management weaknesses (Recommendation 1)  2.  monitor the agencies’ progress towards these efforts on a regular  basis. (Recommendation 2)

In addition, we are making 40 recommendations to 14 agencies to fully  address the electronic recordkeeping requirements found in the Managing  Government Records Directive and the Presidential and Federal Records  Act Amendments of 2014 in their policies and procedures. Appendix II  contains these recommendations.

We requested comments on a draft of this report from NARA and the 17  other agencies included in our review. All of the agencies provided  responses, as further discussed.

In written comments, NARA concurred with our recommendations and  stated that the agency will develop an action plan to require small and  micro agencies that consistently score in the high risk category on  NARA’s annual records management self-assessment to address their  records management weaknesses. In addition, NARA stated that it will  continue to gather data to identify where inspections, guidance, and  training are needed to ensure that small and micro agencies are  improving their records management programs. NARA’s comments are  reprinted in appendix III.

Of the 17 other agencies in our review, six agencies (CFPB, Commerce,  NASA, NSF, OPM, and the Udall Foundation) concurred with our  recommendations; five agencies (Marine Mammal Commission, OMB,  ONDCP, OPIC, and Presidio Trust) did not state whether they agreed or  disagreed with our recommendations; and six agencies (AFRH, EAC,  FHFA, FTC, Peace Corps, and SIGAR) stated that they had no  comments on the report. Multiple agencies also provided technical  comments, which we incorporated as appropriate.

Among these agencies, the following six concurred with our  recommendations and, in most cases, described steps planned or under  way to address them:

The Consumer Financial Protection Bureau provided written  comments in which the agency stated that it did not object to our  recommendation. The agency added that it would establish a time  frame to update its current inventory of electronic systems used to  store agency records, so that the inventory includes all of the required  elements. CFPB’s comments are reprinted in appendix IV.

In written comments, the Department of Commerce concurred with  our two recommendations and stated that the agency intends to take  additional steps to implement them. Specifically, with regard to our  recommendation regarding up-to-date records schedules, the agency  stated that it will ensure that its records schedules are updated and  submitted to NARA no later than December 2020. Commerce also  stated that, while it believes its current electronic system that  manages email meets our recommendation, the agency intends to  take additional steps by updating its policies and ensuring that users  are correctly implementing the system to address federal  recordkeeping requirements by December 2020. Commerce’s  comments are reprinted in appendix V.

The National Aeronautics and Space Administration provided written  comments in which it concurred with our recommendation. The  agency added that it is currently developing a comprehensive  inventory to serve as an authoritative source for identifying where the  agency’s electronic records reside, which should be completed by  June 2021. NASA comments are reprinted in appendix VI.

In written comments, the National Science Foundation concurred with  our four recommendations. NSF stated that the agency is updating its  schedules and intends to ensure that its records management  practices and policies address current requirements and best  practices for federal records management. NSF’s comments are  reprinted in appendix VII.

The Office of Personnel Management provided written comments in  which it concurred with our five recommendations and noted steps  that the agency has begun or is planning to take to address them.  OPM stated that, in fiscal year 2020, it intends to issue a strategic  plan on the digitization and management of permanent and electronic  records, update agency policies and procedures to include the  required electronic information system function for recordkeeping  systems, and implement the requirements of the agency’s Capstone  email policy. The agency also noted that, in fiscal year 2021, it plans  to complete the updates needed on all agency disposition schedules  and develop an inventory of all electronic information systems that  store agency records. OPM’s comments are reprinted in appendix  VIII.

In written comments, the Udall Foundation concurred with our  recommendation and described the steps it plans to take in fiscal  years 2020 and 2021 to establish records management policies and  procedures. For example, according to the foundation, in September  2020, it plans to complete the initial build-out of required infrastructure  to manage electronic records. Further, in March 2021, it plans to  finalize a formal records management policy and associated  procedures for creating, maintaining, and using records across the  agency. The Udall Foundation’s comments are reprinted in appendix  IX.

Further, the following five agencies did not state whether they agreed or  disagreed with the recommendations:  In written comments, the Office of Management and Budget did not  state whether it agreed or disagreed with our recommendations.  However, OMB stated that it is diligently working with NARA to revise  and update its records schedule and intends to closely review and  close any gaps in documentation that GAO identified. The office also  provided technical comments, which we incorporated as appropriate.  OMB’s comments are reprinted in appendix X.

In an email from the Executive Director, the Marine Mammal  Commission did not state whether it agreed or disagreed with our  recommendations. However, according to the executive director, the  commission now has a signed records management policy that  describes staff responsibilities for the management of electronic  records and email as well as a draft records management handbook.  The official also stated that the commission will continue efforts to fully  implement the records management policy and procedures aiming  toward full implementation and compliance by December 2022. The  Commission also provided technical comments, which we  incorporated as appropriate.

In an email from the Acting General Counsel, the Office of National  Drug Control Policy did not state whether it agreed or disagreed with  our recommendations. The office provided technical comments, which  we incorporated as appropriate.

In an email from its GAO audit liaison, the Overseas Private  Investment Corporation did not state whether it agreed or disagreed  with our recommendations. However, the liaison stated that the  agency intends to implement a new solution for electronic records and  information management that includes the recordkeeping  functionalities required by NARA. The liaison added that the agency  plans to update its records and information management policies and  procedures to strengthen the records management controls and  preservation guidance in fiscal year 2021.

In an email from the Chief Financial and Administrative Officer,  Presidio Trust did not state whether it agreed or disagreed with our  recommendations. However, the official stated that the trust had  recently implemented the Capstone approach for email and would  continue to work on records management throughout 2020 and 2021.

Lastly, we received emails from the Armed Forces Retirement Home’s  Information Technology Manager, the U.S. Election Assistance  Commission’s Communication Specialist, the Federal Housing Finance  Agency’s Privacy Act Officer, the Federal Trade Commission’s attorney  representative in the Office of General Counsel, the Peace Corps Agency  Records Officer, and the Special Inspector General for Afghanistan  Reconstruction’s Director of Information Technology. All of the emails  stated that these agencies had no comments on the draft report.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees, the Secretary of Commerce; the Administrator  of the National Aeronautics and Space Administration; the Archivist of the  United States; the Chief Executive Officers of the Armed Forces  Retirement Home and Overseas Private Investment Corporation; the  Executive Directors of the U.S. Election Assistance Commission and  Udall Foundation; the Directors of the Consumer Financial Protection  Bureau, Federal Housing Finance Agency, National Science Foundation,  Office of Management and Budget, Office of National Drug Control Policy,  Office of Personnel Management and Peace Corps; the Chairman of the  Federal Trade Commission, Marine Mammal Commission, and the  Presidio Trust Board; the Special Inspector General for Afghanistan  Reconstruction and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9342 or marinosn@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix XI.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which (1) selected  agencies’ policies and procedures address electronic recordkeeping  requirements in the Managing Government Records Directive and the  Presidential and Federal Records Act Amendments of 2014 and (2)  NARA assisted selected agencies in managing their electronic records.

To determine the agencies for our review, we identified agencies that  established a Senior Agency Official for Records Management and  submitted an annual report on NARA’s website between fiscal year 2015  and fiscal year 2017. Of the 95 agencies that met these criteria, we  removed two from consideration because they were not part of the  executive branch: one was a judicial branch agency and the other was a  legislative branch agency. The 93 remaining agencies to include in our  review represented the following categories: (1) executive departments,  (2) Executive Office of the President, and (3) independent agencies.

To ensure that a variety of agencies were selected across the designated  categories, we chose a selection of 17 agencies and ensured that at least  two agencies were selected from the three identified categories. In order  to generate this selection, we sorted the list of 93 agencies by assigned  random numbers and selected the top 17 agencies in this list, while  ensuring that at least two agencies from each category were selected.  The selection of 17 agencies cannot be used to make generalizable  statements about the full population of agencies. The 17 agencies  selected were:  1.  Armed Forces Retirement Home  2.  Consumer Financial Protection Bureau  3.  Department of Commerce  4.  U.S. Election Assistance Commission  5.  Federal Housing Finance Agency  6.  Federal Trade Commission  7.  Marine Mammal Commission  8.  Morris K. Udall and Stewart L. Udall Foundation  9.  National Aeronautics and Space Administration  10. National Science Foundation  11. Office of Management and Budget  12. Office of the National Drug Control Policy  13. Office of Personnel Management  14. Overseas Private Investment Corporation  17. Special Inspector General for Afghanistan Reconstruction  To address the first objective, we identified key requirements specified in  the Federal Records Act, the Presidential and Federal Records Act  Amendments of 2014, and its implementing regulations, and the Office  of Management and Budget’s (OMB) and NARA’s Managing Government  Records Directive. In selecting the requirements for our assessment, we  focused on requirements related to electronic records management, such  as managing permanent and temporary records, managing email records,  and managing electronic records management programs.

To assess whether agencies’ policies and procedures addressed the key  requirements, we collected and analyzed policies, procedures, and other  documentation that described how agencies are positioned to effectively  manage electronic records. In particular, we reviewed agencies’  recordkeeping handbooks, agencies’ bulletins, file plans, records  schedules, and electronic system user guides. Further, we collected and  reviewed documentation that described agencies’ actions or planned  actions to meet the specified deadlines in the Managing Government  Records Directive. Specifically, we analyzed agencies’ records  schedules, reports from NARA’s Senior Agency Official for Records  Management’s web page, agencies’ email management system  specifications, and agencies’ Capstone approach to email management.

We also verified with NARA records management officials whether  selected agencies submitted records schedules by the December 31,  2016, deadline specified in the Managing Government Records Directive.  We assessed these documents against each of the key requirements to  determine each agency’s status in developing policies and procedures to  address federal record keeping requirements.

Subsequent to our initial assessment, we conducted interviews with  records management officials from the 17 selected agencies to discuss  steps taken and obtain additional supporting evidence to determine the  agencies’ status for implementing key federal recordkeeping  requirements. We followed up with those agencies that did not fully  address the key federal recordkeeping requirements to determine  reasons for their lack of implementation.

For the second objective, we reviewed federal laws and guidance, such  as the Federal Records Act, NARA regulations, and OMB’s and NARA’s  Managing Government Records Directive, to determine NARA’s role and  responsibilities in assisting the 17 agencies in managing their electronic  records. Subsequently, we collected and analyzed guidance and other  documentation from NARA, such as the agency’s Records Management  Oversight and Reporting Handbook, Guidance on Senior Agency Officials  for Records Management bulletin, and Frequently Asked Questions about  Selecting Sustainable Formats for Electronic Records, to determine  whether the documentation addressed all of the requirements needed to  assist agencies in managing their electronic records.

We also analyzed responses in agencies’ fiscal year 2017 and 2018  Senior Agency Official for Records Management reports stating what  assistance the agencies would like NARA to provide. We then conducted  interviews with NARA’s Chief Records Officer and other agency officials  regarding their interactions with the 17 agencies on the use of electronic  recordkeeping and implementation of federal records management  policies and practices to determine to what extent NARA assisted  selected agencies in managing their electronic records. We also  conducted interviews with officials from each of the 17 selected agencies  to gain insight into how the agencies use the resources provided by  NARA.

Lastly, we reviewed NARA’s annual self-assessment program that  evaluates agencies’ reported compliance with federal records  management statutes, regulations, and program functions to obtain  information on how NARA was determining which agencies needed  assistance with implementing their records management programs. We  supplemented our document reviews and analysis with interviews of  selected agency officials responsible for records management and NARA  agency officials to gain an understanding of these and other relevant  documents aimed at helping agencies implement their records  management programs. Additionally, to identify which of our selected  agencies were to be categorized as small and micro agencies, we used  OMB’s definition of small agencies as agencies with fewer than 6,000  employees and micro agencies as agencies having fewer than 100  employees.

We conducted our work from March 2018 to February 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Recommendations to Departments and Agencies

We are making a total of 40 recommendations to 14 of the 17 agencies in  our review to fully address the electronic recordkeeping requirements in  their policies and procedures.

The Chief Executive Officer of the Armed Forces Retirement Home  should take the following four actions:

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 3)

Establish a time frame to update its policies and procedures to include  all of the required electronic information system functionalities for  recordkeeping systems. (Recommendation 4)

Establish a time frame to update the agency’s policies and procedures  to include the (1) following records management controls required for  electronic information systems: usability, content, context, and  structure and (2) required preservation mechanisms to ensure that  records in its electronic recordkeeping system will be retrievable and  useable. (Recommendation 5)

Ensure existing policies and procedures describe the rules for using  personal email accounts when conducting official agency business to  include instructing the employee to (1) copy an official electronic  messaging account of the employee in the original creation or  transmission of the records and (2) forward a complete copy of the  record to an official electronic messaging account of the employee no  later than 20 days after the original creation or transmission of the  record. (Recommendation 6)

The Secretary of Commerce should take the following two actions:

Establish a time frame to ensure all records schedules are up-to-date  and submitted to NARA. The schedules should include all required  information, including when eligible temporary records must be  destroyed or deleted and when permanent records are to be  transferred to NARA. (Recommendation 7)

Ensure the electronic system that manages email provides the  capabilities to manage permanent and temporary email records and to  identify, retrieve, and retain records. (Recommendation 8)

The Director of the Consumer Financial Protection Bureau should take  the following action:

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 9)

The Executive Director of the Election Assistance Commission should  take the following five actions:

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 10)

Establish a time frame to develop a plan on how the agency intends to  manage permanent electronic records. (Recommendation 11)

Establish a time frame to update its policies and procedures to include  all of the required electronic information system functionalities for  recordkeeping systems. (Recommendation 12)

Establish a time frame to update the agency’s policies and procedures  to include the (1) following records management controls required for  electronic information systems: content, context, and structure and (2)  required preservation mechanisms to ensure that records in its  electronic recordkeeping system will be retrievable and useable.  (Recommendation 13)

Develop a written policy that describes the rules for using personal  email accounts when conducting official agency business to include  instructing the employee to (1) copy an official electronic messaging  account of the employee in the original creation or transmission of the  records and (2) forward a complete copy of the record to an official  electronic messaging account of the employee no later than 20 days  after the original creation or transmission of the record.  (Recommendation 14)

The Chairman of the Federal Trade Commission should take the following  action:

Establish a time frame to update the agency’s electronic information  system inventory to include the following characteristics: reading and  processing the records contained in the system, inputs and outputs,  contents of the files and records, and cycle updates.  (Recommendation 15)

The Chairman of the Marine Mammal Commission should take the  following action:

Use recently developed policies and procedures to implement and  maintain an active, continuing agency records management program  that includes policies and procedures to provide for effective controls  over the creation, maintenance, and use of records in the conduct of  current business. (Recommendation 16)

The Administrator of the National Aeronautics and Space Administration  should take the following action:

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 17)

The Director of the National Science Foundation should take the following  four actions:

Establish a time frame to ensure all records schedules are up-to-date  and submitted to NARA. The schedules should include all required  information, including when eligible temporary records must be  destroyed or deleted and when permanent records are to be  transferred to NARA. (Recommendation 18)

Establish a time frame to update the agency’s electronic information  system inventory to include the following characteristics: technical  characteristics of the systems, identify inputs and outputs, and  describe update cycles. (Recommendation 19)

Establish a time frame to update the agency’s policies and procedures  to include all of the records management controls required for  electronic information systems and the required preservation  mechanisms to ensure that records in its electronic recordkeeping  system will be retrievable and useable. (Recommendation 20)

Develop policies and procedures for the required retention and  management requirements for email, including instructions to staff to  ensure that the names and addresses of the sender, date of  message, attachments, calendars, and draft documents will be  retained. (Recommendation 21)

The Director of the Office of Management and Budget should take the  following five actions:

Ensure, in conjunction with the Executive Office of the President’s  Office of Administration, that existing policies and procedures  incorporate the management of electronic records into its overall  records management program. (Recommendation 22)

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 23)

Establish a time frame to update its policies and procedures to include  all of the required electronic information system functionalities for  recordkeeping systems. (Recommendation 24)

Establish a time frame to ensure, in conjunction with the Office of  Administration, that policies and procedures include the (1) following  records management controls required for electronic information  systems: reliability, context, and structure and (2) required  preservation mechanisms to ensure that records in its electronic  recordkeeping system will be retrievable and useable.  (Recommendation 25)

Ensure, in conjunction with the Office of Administration, that existing  policies and procedures include the required retention and  management requirements for email. (Recommendation 26)

The Director of the Office of National Drug Control Policy should take the  following three actions:

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 27)

Establish a time frame to ensure, in conjunction with the Office of  Administration, that policies and procedures include the (1) following  records management controls required for electronic information  systems: reliability, context, and structure; and (2) required  preservation mechanisms to ensure that records in its electronic  recordkeeping system will be retrievable and useable.  (Recommendation 28)

Ensure, in conjunction with the Office of Administration, that existing  policies and procedures include the required retention and  management requirements for email. (Recommendation 29)

The Director of the Office of Personnel Management should take the  following five actions:

Establish a time frame to ensure that all records schedules are up-to- date and submitted to NARA. The schedules should include all  required information, including when eligible temporary records must  be destroyed or deleted and when permanent records are to be  transferred to NARA. (Recommendation 30)

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 31)

Establish a time frame to develop a plan to manage permanent  electronic records. (Recommendation 32)

Establish a time frame to update its policies and procedures to include  all of the required electronic information system functionalities for  recordkeeping systems. (Recommendation 33)

Establish a time frame to update the agency’s policies and procedures  on retention and management for email to include retaining electronic  calendars and draft documents. (Recommendation 34)

The Chief Executive Officer of the Overseas Private Investment  Corporation should take the following four actions:

Establish a time frame to develop an inventory of electronic  information systems used to store agency records that includes all of  the required elements. (Recommendation 35)

Establish a time frame to develop policies and procedures that define  required electronic information system functionalities for  recordkeeping systems including declaring records and assigning  unique identifiers, capturing records, maintaining security, and  preserving records. (Recommendation 36)

Establish a time frame to update the agency’s policies and procedures  to include the (1) following records management controls required for  electronic information systems: reliability, content, context, and  structure; and (2) required preservation mechanisms to ensure that  records in its electronic recordkeeping system will be retrievable and  useable. (Recommendation 37)

Establish a time frame to update the agency’s policies and procedures  on retention and management for email to include policies for  retaining electronic calendars. (Recommendation 38)

The Director of the Peace Corps should take the following three actions:

Establish a time frame to update the agency’s electronic information  systems inventory to (1) specify technical characteristics necessary  for reading and processing the records contained in the system, (2)  identify system inputs and outputs, (3) define the contents of the files  and records, (4) determine restrictions on access and use, and (5)  specify how the agency ensures the timely disposition of records.  (Recommendation 39)

Establish a time frame to update its policies and procedures to include  all of the required electronic information system functionalities for  recordkeeping systems. (Recommendation 40)

Establish a time frame to update the agency’s policies and procedures  to include (1) following records management controls required for  electronic information systems: usability, context, and structure and  (2) required preservation mechanisms to ensure that records in its  electronic recordkeeping system will be retrievable and useable.  (Recommendation 41)

The Executive Director of Udall Foundation should take the following  action:

Establish a time frame to develop and maintain an active, continuing  agency records management program that includes policies and  procedures to provide for effective controls over the creation,  maintenance, and use of records in the conduct of current business.  (Recommendation 42)

Appendix III: Comments from the National Archives and Records Administration

Appendix IV: Comments from the Consumer Financial Protection Bureau

Appendix V: Comments from the Department of Commerce

Appendix VI: Comments from the National Aeronautics and Space Administration

Appendix VII: Comments from the National Science Foundation

Appendix VIII: Comments from the Office of Personnel Management

Appendix IX: Comments from the Morris K. Udall and Stewart L. Udall Foundation

Appendix X: Comments from the Office of Management and Budget

Appendix XI: GAO Contact and Staff Acknowledgments

Nick Marinos, (202) 512-9342, marinosn@gao.gov  In addition to the individual named above, Marisol Cruz Cain (Assistant  Director), Anjalique Lawrence (Assistant Director), Elena Epps (Analyst- in-Charge), Roger Bracy, Kami Brown, Christopher Businsky, Alan  Daigle, Nancy Glover, Charles Hubbard, Lee McCracken; Brian Palmer,  and Monica Perez-Nelson made significant contributions to this report.

Federal recordkeeping requirements seek to ensure transparency and efficiency in federal agency records, including electronic records.

Most of the 17 agencies we reviewed had records management programs, and many of those included electronic records requirements. Some agencies’ programs hadn’t fully addressed electronic records requirements, e.g., they didn’t ensure that appropriate emails are preserved.

The National Archives and Records Administration hasn’t ensured that smaller agencies at higher risk of improper records management have improvement plans. We recommended doing so and also made recommendations to 15 other agencies.