Information Management: Selected Agencies Need to Fully Address Federal Electronic Recordkeeping Requirements
GAO-20-59
Published: Feb 27, 2020. Publicly Released: Mar 30, 2020.
Fast Facts
Federal recordkeeping requirements seek to ensure transparency and efficiency in federal agency records, including electronic records.
Most of the 17 agencies we reviewed had records management programs, and many of those included electronic records requirements. Some agencies’ programs hadn’t fully addressed electronic records requirements, e.g., they didn’t ensure that appropriate emails are preserved.
The National Archives and Records Administration hasn’t ensured that smaller agencies at higher risk of improper records management have improvement plans. We recommended doing so and also made recommendations to 15 other agencies.
National archives
Highlights
What GAO Found
Seventeen agencies GAO selected for review varied in the extent to which their policies and procedures addressed the electronic recordkeeping requirements in the Managing Government Records Directive and the Federal Records Act ( FRA ) and its amendments. More specifically, 14 of the 17 agencies established records management programs, while three agencies did not. Of those 14 agencies with established records management programs, almost all addressed requirements related to incorporating electronic records into their existing programs, but many did not have policies and procedures to fully incorporate recordkeeping functionalities into electronic systems, establish controls and preservation considerations for systems, and issue instructions on email requirements (see table).
Assessment of Selected Agencies' Policies and Procedures Addressing Key Electronic Records Requirements
NARA provided guidance and assistance to the selected agencies, including guidance on electronic records management and training. All of the agencies stated that the assistance was generally helpful and that they relied on it to some extent for implementing the key requirements discussed in this report. Further, NARA oversaw the selected agencies' implementation of federal records management regulations through their self-assessment progam. However, NARA had not ensured that the selected small or micro agencies that self-assessed to be at high risk of improper records management in calendar year 2017 were taking appropriate actions to make improvements to their records management programs. NARA officials stated they conduct follow-up with the agencies that report poor scores, but they do not proactively require the agencies to address their weaknesses. Until NARA requires these agencies to develop plans to make necessary improvements, these agencies will likely miss important opportunities to improve their record management practices.
Why GAO Did This Study
The Federal Records Act , a subsequent directive, and NARA regulations establish requirements for agencies to ensure the transparency, efficiency, and accountability of federal records, including those in electronic form. In addition, NARA plays an important role in overseeing and assisting agencies' records management efforts.
GAO was asked to evaluate federal agencies' implementation of the aforementioned requirements related to electronic records. The objectives were to determine the extent to which (1) selected agencies' policies and procedures address the electronic recordkeeping requirements in the Managing Government Records Directive and the Presidential and FRA Amendments of 2014 and (2) NARA assisted selected agencies in managing their electronic records. To do so, GAO selected 17 agencies and reviewed their records management policies and procedures. GAO also reviewed laws and requirements pertaining to NARA's roles and responsibilities for assisting agencies in managing their electronic records. Further, GAO analyzed NARA guidance and other documents that discussed NARA's efforts in carrying out these responsibilities.
Recommendations
GAO is making 40 recommendations to 14 of the 17 selected agencies to improve their management of electronic records. GAO is also recommending that NARA (1) require high-risk smaller agencies to create improvement plans and (2) monitor progress on a regular basis. Six agencies, including NARA, agreed with the recommendations, while 11 did not state whether they agreed or disagreed, or had no comments.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Archivist | The Archivist of the United States should require small and micro agencies that were determined to be at high risk of not complying with statutory and regulatory records management requirements to develop plans and timelines to address their records management weaknesses (Recommendation 1) |
In January 2022, in response to our recommendation, NARA stated that they now have a repeatable process to identify small and micro agencies that scored in the high-risk category based on annual reporting data. NARA determined that the majority of high risk small and micro agencies are boards, commissions and foundations. Therefore, in FY 2021, NARA conducted a multi-agency inspection of the records management practices of boards, commissions, and foundations specifically focusing on agencies in the high risk category. According to NARA's Federal Boards, Commissions, and Foundations Multi-Agency Inspection Report, each of the five micro agencies inspected are required to submit a Plan of Corrective Action to NARA that specifies how the agency will address each inspection report recommendation, including a timeline for completion and proposed progress reporting dates. NARA will analyze the adequacy of the action plans, provide comments to each agency on their plans, and assist each agency in implementing recommendations. The Agency Records Officers will be required to submit progress reports to NARA on the implementation of their respective action plans until all actions are completed. NARA also stated that other small and micro agencies have been included in ongoing records management inspections and the agencies will be required to create plans of corrective action when these inspections have been completed. By requiring high-risk small and micro agencies to develop plans to make necessary improvements to their record management programs and monitor their progress, NARA is better positioned to ensure that these agencies are managing electronic records in accordance with governing regulations.
|
| Office of the Archivist | The Archivist of the United States should monitor the agencies' progress towards these efforts on a regular basis. (Recommendation 2) |
In response to our recommendation, in May 2022, NARA reported that the agency established Plans of Corrective Action for monitoring inspected small and micro agencies to ensure that recommended records management improvements are properly implemented. According to NARA, beginning in fiscal year 2020, they had inspected 20 small and micro agencies and created and monitored plans of corrective action. For example, in July 2021, NARA issued a report on the inspection of 5 small or micro-agencies. The report noted follow-up actions that each of the five agencies are required to take, such as submitting a Plan of Corrective Action to NARA that specifies how the agency will address each inspection report recommendation, including a timeline for completion and proposed progress reporting dates. After that submission, NARA will analyze the adequacy of the action plans, provide comments on the plans, and assist each agency in implementing the recommendations. As of May 2022, NARA stated that 12 Plans of Corrective Action for small agencies were being monitored. By requiring small or micro agencies to develop plans to make necessary improvements to their records management programs, NARA is better positioned to monitor these agencies progress in managing its electronic records in accordance with governing regulations.
|
| Armed Forces Retirement Home | The Chief Executive Officer of the Armed Forces Retirement Home should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 3) |
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Armed Forces Retirement Home | The Chief Executive Officer of the Armed Forces Retirement Home establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 4) |
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Armed Forces Retirement Home | The Chief Executive Officer of the Armed Forces Retirement Home should establish a time frame to update the agency's policies and procedures to include the (1) following records management controls required for electronic information systems: usability, content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 5) |
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Armed Forces Retirement Home | The Chief Executive Officer of the Armed Forces Retirement Home should ensure existing policies and procedures describe the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 6) |
The Armed Forces Retirement Home did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of the Secretary for DOC | The Secretary of Commerce should establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 7) |
In response to our recommendation, in May 2021, we reviewed evidence showing Commerce's newly established timeframes to ensure all records schedules are up-to-date and submitted to NARA by December 2022. By establishing a time frame to submit all records schedules to NARA, Commerce decreases the risk of maintaining records that are no longer relevant or needed.
|
| Office of the Secretary for DOC | The Secretary of Commerce should ensure the electronic system that manages email provides the capabilities to manage permanent and temporary email records and to identify, retrieve, and retain records. (Recommendation 8) |
In response to our recommendation, in May 2021, Commerce provided evidence that it now uses an email solution to manage its permanent and temporary email records that meet NARA's requirements. Commerce stated that through the collaboration of the new Records Manager and email operations team, the department will continue to ensure that their email solution meets NARA's requirements of having the capability to identify, retrieve, and retain records. By taking these actions, Commerce is decreasing its risk that its emails are not able to be preserved or accessed when needed.
|
| Consumer Financial Protection Bureau | The Director of the Consumer Financial Protection Bureau should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 9) |
In response to our recommendation, in February 2022, we confirmed that CFPB established a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the requirements elements. Specifically, CFPB developed an electronic systems inventory that identified the system name, system owner, describes the contents of the files and records of the systems, among other things. By establishing a time frame to maintain an inventory and documentation of electronic information systems used to store agency records, CFPB will be better positioned to reduce the heightened risk of records being lost and not identified and scheduled in accordance with agency records schedules.
|
| Election Assistance Commission | The Executive Director of the Election Assistance Commission should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 10) |
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. However, the agency has implemented the recommendation. In September 2024, the EAC acting General Counsel reported and we verified that, in response to our recommendation, the agency had established a timeframe for developing an inventory of electronic information systems that encompasses each of the required necessary elements for federal records management. Specifically, the agency is developing a spreadsheet tracking system and outlined a step-by-step implementation strategy, which includes steps for identifying electronic information systems, verifying and validating the inventory to ensure its adequacy and completeness, integrating the inventory into the EAC's records management framework, and developing a process for training employees on the new inventory system. The estimated completion date for the inventory system is December 2025.
|
| Election Assistance Commission | The Executive Director of the Election Assistance Commission should establish a time frame to develop a plan on how the agency intends to manage permanent electronic records. (Recommendation 11) |
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. However, the agency implemented the recommendation. In September 2024, the EAC acting General Counsel reported and we verified that, in response to our recommendation, the agency had established a time frame for developing a plan to manage permanent electronic records. Specifically, the agency's plan includes the identification and classification of permanent electronic records (including the record's title, description, format, location, disposition, points of contact, and essential designation), as well as preservation strategies for permanent electronic records through the designation of a system for maintaining permanent electronic records in a database. EAC reported that the plan is awaiting NARA approval of classification for some temporary electronic records and has an estimated completion date of August 2025.
|
| Election Assistance Commission | The Executive Director of the Election Assistance Commission should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 12) |
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. However, the agency implemented the recommendation. In September 2024 the EAC Acting General Counsel reported and we verified that, in response to our recommendation, the agency had established a timeframe for updating its policies and procedures to include electronic information system functionalities for recordkeeping to ensure compliance with federal requirements. Specifically, the policies and procedures apply to all electronic recordkeeping systems used by the EAC and will include required functionalities for the capture of records at the point of creation or receipt, as well as features related to the capture, categorization, and disposal of records. EAC reported that the planned update has an estimated completion date of August 2025.
|
| Election Assistance Commission | The Executive Director of the Election Assistance Commission should establish a time frame to update its policies and procedures to include the (1) following records management controls required for electronic information systems: content, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 13) |
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. However, the agency implemented the recommendation. In September 2024, the EAC acting General Counsel reported and we verified that, in response to our recommendation, the agency had established a timeframe for updating its records management controls required for electronic information systems, including preservation mechanisms to ensure regular backups occur through a records management application. The policies and procedures include requirements for records to have comprehensive metadata that describes their content and context, as well as requirements to ensure that records are stored in formats that maintain their structure and can be rendered accurately using current and future technology. EAC reported that the planned update has an estimated completion date of August 2025.
|
| Election Assistance Commission | The Executive Director of the Election Assistance Commission should develop a written policy that describes the rules for using personal email accounts when conducting official agency business to include instructing the employee to (1) copy an official electronic messaging account of the employee in the original creation or transmission of the records and (2) forward a complete copy of the record to an official electronic messaging account of the employee no later than 20 days after the original creation or transmission of the record. (Recommendation 14) |
The U.S. Election Assistance Commission did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the commission states that it has taken action, we plan to verify whether implementation has occurred.
|
| Federal Trade Commission | The Chairman of the Federal Trade Commission should establish a time frame to update the agency's electronic information system inventory to include the following characteristics: reading and processing the records contained in the system, inputs and outputs, contents of the files and records, and cycle updates. (Recommendation 15) |
The Federal Trade Commission did not state whether or not it concurred with this recommendation. In June 2020, in response to our recommendation, FTC stated that it interpreted the recommendation as requiring FTC to update its electronic information system inventory to identify those systems and applications that contain federal records and establish a process for periodically updating this information. In March 2024, FTC reported that they had developed an electronic records survey that they require each FTC system owner to complete. However, this survey does not ask the respondent to provide information such as the specific data inputs and outputs of the system or the contents of the files stored in it. Additionally, while FTC stated that the survey would be filled out on a recurring schedule, it did not define the specific cycle that updates would occur on. As of March 2024, FTC has not established a time frame to update the agency's electronic information system inventory to include reading and processing the records contained in the system, inputs and outputs, contents of the files and records, and cycle updates.
|
| Marine Mammal Commission | The Chairman of the Marine Mammal Commission should use recently developed policies and procedures to implement and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 16) |
The Marine Mammal Commission did not state whether or not it concurred with this recommendation. However, the agency has now implemented this recommendation. In September 2024, in response to our recommendation, the Marine Mammal Commission reported, and we verified, that it developed and implemented an agency-wide records management program. Specifically, the agency developed a records management policy that applies to all Marine Mammal Commission employees and contractors and includes requirements related to the creation, maintenance, and use of agency records. The policy also designates responsible agency officials and establishes an email retention policy. By establishing an active and continuing records management program, the Marine Mammal Commission has better assurance that effective controls are in place over the creation, maintenance, and use of records in the conduct of current business.
|
| National Aeronautics and Space Administration |
Priority Rec.
The Administrator of the National Aeronautics and Space Administration should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 17) |
As of July 2021, we verified the National Aeronautics and Space Administration (NASA) reporting that the Office of the Chief Information Officer (OCIO) had established a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. Specifically, the OCIO identified an application that would be used for the entire agency's inventory of electronic information systems. According to NASA, the agency intends to have an organizational records inventory to list all electronic information systems that contain records by January 2022. By establishing a time frame to maintain an inventory and documentation of electronic information systems used to store agency records, NASA will be better positioned to reduce the heightened risk of records being lost and not identified and scheduled in accordance with agency records schedules.
|
| National Science Foundation | The Director of the National Science Foundation should establish a time frame to ensure all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 18) |
In response to our recommendation, in May 2021, NSF stated and we verified that in September 2022 all schedules were submitted and four were approved by NARA. By submitting all records schedules to NARA, NSF has decreased the risk of maintaining records that are no longer relevant or needed.
|
| National Science Foundation | The Director of the National Science Foundation should establish a time frame to update the agency's electronic information system inventory to include the following characteristics: technical characteristics of the systems, identify inputs and outputs, and describe update cycles. (Recommendation 19) |
In May 2021, in response to our recommendation, NSF stated and we verified that it completed its electronic information system inventory. The inventory includes systems technical characteristics, inputs, outputs, and updated cycles. By completing its electronic information systems inventory, NSF is better positioned to reduce the heightened risk of records being lost and not identified and scheduled in accordance with agency records schedules
|
| National Science Foundation | The Director of the National Science Foundation should establish a time frame to update the agency's policies and procedures to include all of the records management controls required for electronic information systems and the required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 20) |
In response to our recommendation, we verified in April 2022 that NSF issued NSF Bulletin No. 20-11 that describes the controls required for electronic information systems and the required preservation mechanisms. Specifically, the bulletin requires NSF to integrate authenticity, reliability, integrity, usability, and structure controls along with content and context mechanisms to ensure that electronic records in information systems provide suitable documentation of NSF business for as long as the information is needed. The bulletin also stated that NSF is to implement automated or manual controls in the Electronic Records System that ensure records are searchable, retrievable, and usable for as long as they are maintained in NSF custody. By updating their policies and procedures to ensure that records management controls and preservation considerations are incorporated into their electronic information systems, NSF is better positioned to ensure these systems can produce retrievable and useable records for as long as needed to conduct agency business.
|
| National Science Foundation | The Director of the National Science Foundation should develop policies and procedures for the required retention and management requirements for email, including instructions to staff to ensure that the names and addresses of the sender, date of message, attachments, calendars, and draft documents will be retained. (Recommendation 21) |
In response to our recommendation, we verified in April 2022 that NSF issued NSF Bulletin No. 20-11, which addresses email management requirements for staff. The bulletin requires NSF to provide mandatory records management training within 60 days of hire and annually thereafter for all NSF personnel and the training includes staff recordkeeping responsibilities and the management of emails and electronic message records, such as instant messages and text messages. Additionally, the bulletin requires that NSF's Office of Information Resource Management ensure email archives include all related content, including calendars, task lists, conversation history, and associated metadata. By issuing instruction to staff on retention and management requirements for email, NSF is better positioned to retrieve emails and associated metadata when needed to conduct agency business.
|
| Office of the Director | The Director of the Office of Management and Budget should ensure, in conjunction with the Executive Office of the President's Office of Administration, that existing policies and procedures incorporate the management of electronic records into its overall records management program. (Recommendation 22) |
In response to our recommendation, OMB reported that in June 2023, they issued an updated agency wide records management policy which incorporated the management of electronic records into their overall records management program. OMB also provided a copy of their updated records management policy which includes requirements for the management of electronic records. By taking these actions, OMB is better positioned to properly manage records electronically.
|
| Office of the Director | The Director of the Office of Management and Budget should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 23) |
The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of May 2024, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of the Director |
Priority Rec.
The Director of the Office of Management and Budget should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 24) |
The Office of Management and Budget concurred with our recommendation. In March 2022, in response to our recommendation, OMB noted that the Executive Office of the President's Office of Administration is responsible for records management for all Executive Office components, which includes OMB, and now has procedures that incorporate electronic information system functionalities. However, as of March 2024, OMB has not provided a time frame for when or documentation that demonstrated that its policies and procedures were updated to include all of the required electronic information system functionalities for recordkeeping systems.
|
| Office of the Director | The Director of the Office of Management and Budget should establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 25) |
In response to our recommendation, OMB reported that in June 2023 they issued an updated agency wide records management policy which incorporated records management controls required for electronic information systems and required preservation mechanisms to ensure that records in its electronic recordkeeping system would be retrievable and useable. OMB also provided a copy of their updated records management policy, which includes a requirement that OMB officials incorporate controls into their electronic information systems to ensure reliability, context, and structure in accordance with applicable standards. The updated records management policy also requires that records kept in an electronic information system are retrievable and usable in accordance with the NARA-approved retention period. By taking these actions, OMB is better positioned to ensure their systems can produce retrievable and useable records for as long as needed to conduct agency business.
|
| Office of the Director | The Director of the Office of Management and Budget should ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 26) |
The Office of Management and Budget did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of National Drug Control Policy | The Director of the Office of National Drug Control Policy should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 27) |
The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of National Drug Control Policy | The Director of the Office of National Drug Control Policy should establish a time frame to ensure, in conjunction with the Office of Administration, that policies and procedures include the (1) following records management controls required for electronic information systems: reliability, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 28) |
The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of National Drug Control Policy | The Director of the Office of National Drug Control Policy should ensure, in conjunction with the Office of Administration, that existing policies and procedures include the required retention and management requirements for email. (Recommendation 29) |
The Office of the National Drug Control Policy did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the office states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of the Director | The Director of the Office of Personnel Management should establish a time frame to ensure that all records schedules are up-to-date and submitted to NARA. The schedules should include all required information, including when eligible temporary records must be destroyed or deleted and when permanent records are to be transferred to NARA. (Recommendation 30) |
In response to our recommendation, we confirmed in March 2022 that OPM established a time frame to ensure that all records schedules are up-to-date and submitted to NARA. Specifically, OPM stated that the agency is on track to update the records schedules for the remaining program offices and plans to submit these schedules to NARA for review and approval by the end of fiscal year 2022. By establishing a time frame to ensure that all records schedule are up-to-date and submitted to NARA, OPM has decreased the risk of maintaining records that are no longer relevant or needed
|
| Office of the Director | The Director of the Office of Personnel Management should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 31) |
The Office of Personnel Management concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of the Director |
Priority Rec.
The Director of the Office of Personnel Management should establish a time frame to develop a plan to manage permanent electronic records. (Recommendation 32) |
OPM agreed with this recommendation, which we elevated to priority status in 2022 to emphasize the importance of ensuring that agencies move from paper-based management to electronic management of records. In March 2024, OPM stated that it is in the process of procuring a contract to meet OMB's electronic recordkeeping requirements. Specifically, OPM reported that it has developed a procurement package which is being reviewed by the agency's Office of Procurement Operations before the agency publishes their Request for Quotes. OPM estimates an award date of July, 2024. To fully implement this recommendation, OPM will need to finalize a contract that describes how it will maintain permanent electronic records.
|
| Office of the Director | The Director of the Office of Personnel Management should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 33) |
The Office of Personnel Management concurred with this recommendation. In March 2022, in response to our recommendation, OPM provided a copy of their records management policy which requires that the Chief Information Officer (CIO) implement IT systems that provide records management and retention capabilities. This includes requiring that the CIO address records management and archival functions, provide guidance on the security of electronic records over the life of the records, and ensure that electronic records are properly stored as information systems are being planned. However, OPM's records management policy did not include all required electronic information system functionalities for recordkeeping systems. As of March 2024, OPM has not provided a timeframe for when the agency will update their policies and procedures to include requirements for their electronic information systems to declare records and assign unique identifiers, capture or organize records, manage access and retrieval, and execute disposition.
|
| Office of the Director | The Director of the Office of Personnel Management should establish a time frame to update the agency's policies and procedures on retention and management for email to include retaining electronic calendars and draft documents. (Recommendation 34) |
The Office of Personnel Management concurred with this recommendation. In March 2022, in response to our recommendation, OPM provided copies of their records management policy and electronic mail usage and maintenance policy, stating that they believed these documents addressed our recommendation. However, neither document included retention and management requirements related to electronic calendars and draft documents. As of March 2024, OPM has not provided a timeframe for when they will update their policies and procedures on retention and management for email to include retaining electronic calendars and draft documents.
|
| Overseas Private Investment Corporation | The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 35) |
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Overseas Private Investment Corporation | The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to develop policies and procedures that define required electronic information system functionalities for recordkeeping systems including declaring records and assigning unique identifiers, capturing records, maintaining security, and preserving records. (Recommendation 36) |
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Overseas Private Investment Corporation | The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to update the agency's policies and procedures to include the (1) following records management controls required for electronic information systems: reliability, content, context, and structure; and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 37) |
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Overseas Private Investment Corporation | The Chief Executive Officer of the Overseas Private Investment Corporation should establish a time frame to update the agency's policies and procedures on retention and management for email to include policies for retaining electronic calendars. (Recommendation 38) |
The Overseas Private Investment Corporation did not state whether or not it concurred with this recommendation. As of March 2024, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Peace Corps | The Director of the Peace Corps should establish a time frame to update the agency's electronic information systems inventory to (1) specify technical characteristics necessary for reading and processing the records contained in the system, (2) identify system inputs and outputs, (3) define the contents of the files and records, (4) determine restrictions on access and use, and (5) specify how the agency ensures the timely disposition of records. (Recommendation 39) |
As of March 2024, in response to our recommendation, Peace Corps reported that it has issued an updated Electronic Information Systems (EIS) Inventory and that records characteristics are captured in agency Privacy Impact Analyses (PIAs), which are required for every system in their EIS. Specifically, the PIA includes (1) a description of the administrative and technical controls in place for accessing and processing records contained in the system, (2) a description of the information that is collected and returned by the system (input and output), (3) a description of the type of records stored in the system (content), (4) a description of who is able to access and use the system, and (5) a description of the NARA general records schedule for disposition that the system falls under. By taking these actions, Peace Corps has reduced the risk of records being lost and not identified and scheduled in accordance with agency records schedules.
|
| Peace Corps | The Director of the Peace Corps should establish a time frame to update its policies and procedures to include all of the required electronic information system functionalities for recordkeeping systems. (Recommendation 40) |
In December 2023, Peace Corps stated that it had moved its Records Management Office (RMO) under the Office of the Chief Information Officer (OCIO) in an effort to provide better communication and compliance for all records management agency wide. Additionally, Peace corps stated that in response to our recommendation it had updated the records management policy manual in November 2020. This policy includes requirements for integrating records management requirements into electronic information systems. Specifically, the policy requires the Agency Records Officer to ensure that electronic information systems capture and organize records, maintain records security, manage access and retrieval, and preserve records for as long as they are needed . The policy also requires that automated recordkeeping systems include a disposition authority. However as of March 2024, Peace Corps has not provided a time frame to update its policies and procedures to include a requirement that the records management officer ensure that systems declare records or assign unique identifiers to them.
|
| Peace Corps | The Director of the Peace Corps should establish a time frame to update the agency's policies and procedures to include (1) following records management controls required for electronic information systems: usability, context, and structure and (2) required preservation mechanisms to ensure that records in its electronic recordkeeping system will be retrievable and useable. (Recommendation 41) |
In response to our recommendation, in December 2023, Peace Corps reported that it had moved its Records Management Office under the Office of the Chief Information Officer in an effort to provide better communication and compliance for all records management agency wide. Additionally, Peace Corps reported that it had updated its records management policy manual in November 2020. This policy manual includes requirements for the Agency Records Officer to ensure that electronic information systems or recordkeeping systems incorporate usability, context and structure controls, and that all records are retrievable and usable. By ensuring that records management controls and preservation considerations are incorporated into electronic information systems, Peace Corps is better equipped to ensure these systems can produce retrievable and useable records for as long as needed to conduct agency business.
|
| Morris K. Udall and Stewart L. Udall Foundation | The Executive Director of Udall Foundation should establish a time frame to develop and maintain an active, continuing agency records management program that includes policies and procedures to provide for effective controls over the creation, maintenance, and use of records in the conduct of current business. (Recommendation 42) |
The Udall Foundation concurred with this recommendation, and it is now implemented. In August 2024, in response to our recommendation, the Udall Foundation reported, and we verified, that it had contracted for the development and implementation of an Electronic Records Management System (ERMS) that incorporated the required system controls and preservation requirements, provided training to its staff on how to manage records electronically using the ERMS, and transferred its remaining paper records to NARA and fully transitioned to managing its records electronically. Additionally, the foundation reported that it had identified its Capstone officials and ensured that permanent email records are appropriately maintained in the email system for later accessioning to NARA and hired an Administrative Officer to provide oversight of the Records Management program and serve as the Agency Records Official (ARO). In addition, the Udall Foundation reported that it began work with NARA in Fiscal Year 2021 to update its Agency Records Schedule, had completed all required actions, and was waiting for NARA to approve the schedule. By establishing an active and continuing records management program, the Udall Foundation has better assurance that effective controls are in place over the creation, maintenance, and use of records in the conduct of current business.
|
Full Report
GAO Contacts
Public Inquiries
Topics
ElectionsRecords managementFederal records managementFederal recordsElectronic recordsPolicies and proceduresHomeland securityArmed forcesNursing homesElectronic records management