Enhanced E-mail Retention Efforts Needed

In New Developments, internal auditors will find information about the most recent IT and audit research reports and survey results; new IT, security, and privacy legislation; and other news items of importance to auditors.

Enhanced E-mail Retention Efforts Needed

Many organizations are taking steps to protect important e-mail communications and comply with regulations that require them to respond in a legally defensible manner to data recovery requests. Government agencies are no different. In the United States, e-mail communications have the potential of being considered federal records that must be managed and preserved in accordance with the U.S. Federal Records Act. To help government organizations enhance their e-mail communication programs, the U.S. Government Accountability Office (GAO) released Federal Records: Agencies Face Challenges in Managing E-mail (PDF, 200 KB), which summarizes the current state of e-mail policies in four agencies of contrasting size and structure.

According to Linda Koontz, GAO director of information management issues and author of the report, e-mail presents challenges to records management because the information contained in e-mail records is not uniform and documents various types of transactions. A message also may be part of an exchange of messages between two or more people within or outside of an agency. Consequently, decisions on which e-mail messages are records must be made individually in many cases.

"Our ongoing review of e-mail records management at four agencies provides illustrations of these difficulties," explains Koontz. As the GAO investigation found, e-mail recordkeeping requirements were not always met. For instance, e-mail messages were generally retained in systems lacking recordkeeping capabilities. "Among other things, a recordkeeping system allows related records to be grouped into classifications according to their business purposes," the report states. "Unless they have recordkeeping features, e-mail systems may not permit easy and timely retrieval of both groupings of related records as well as individual records."

In addition, GAO found that agencies were keeping large numbers of record and nonrecord messages in e-mail systems, which potentially increases the time and effort needed to search for information in response to a business need or an outside inquiry. Factors contributing to this practice were the lack of adequate staff support and training, as well as the volume of e-mail received. As the report explains, if recordkeeping requirements are not followed, organizations cannot be assured that records, including information essential to protecting the rights of individuals, is identified and preserved adequately.

To address e-mail retention challenges, many agencies are considering implementing electronic recordkeeping technology, instead of paper-based systems. "As our review shows, agencies recognize that devoting significant resources to creating paper records from electronic sources is not a viable long-term strategy," states the report. "Electronic recordkeeping systems could potentially help agencies obtain the efficiencies of automation and avoid expenditure of resources on duplicative manual processes and storage." However, these systems need to be managed appropriately to avoid unnecessary cost and performance risks.

For a copy of the full report, visit GAO's Web site.