ALEXANDRIA, Va.—Following an audit it conducted, NCUA’s Office of Inspector General (OIG) has determined that the agency lacks a comprehensive records management program. The audit’s scope ranged from 2012 through 2016.
The OIG in its report stated that its objectives were to determine: 1) whether the NCUA has a comprehensive records management framework, retention, and disposal system in place; and 2) whether the NCUA is in compliance with applicable records management policies, procedures, laws, and regulations.
“Results of our audit determined that the NCUA lacks a comprehensive records management program and needs to implement the steps that will correct the areas of weakness. In addition, we found that the depth and scope of the issues we identified are due in large part to management not making records management a priority due to competing priorities. We concluded the NCUA does not have a comprehensive records management framework, retention, and disposal system in place. We also concluded that those charged with governance over records management for the agency did not consistently follow applicable laws, regulations, and guidance to ensure the NCUA had a comprehensive records management program in place,” the report stated.
The Findings
1. The NCUA lacked records management policies and procedures during the scope period of its audit. “Specifically, management did not follow federal law by establishing policies and procedures to govern an agency-wide records management program. However, management issued a records management policy on January 31, 2018, as a foundation for a records management program moving forward,” the OIG said.
2. Many instances where more or better communication could have facilitated NCUA’s records management. “Specifically, we found that management did not update the NCUA board on specifics related to records management, offices did not effectively communicate about records management with each other, and management did not give comprehensive guidance to staff on how to handle office or personal records in the conduct of their day-to-day duties,” the OIG said.
3. During the scope period of the audit, management did not provide training to staff for records management, as required by National Archives and Records Administration (NARA) regulations and NARA and Office of Management and Budget (OMB) circulars. Training for NCUA personnel regarding their records management responsibilities did not begin until June of 2017, the OIG said.
4. Management did not timely assess and update record retention schedules, as needed. “Specifically, management did not ensure that the offices had periodically assessed and updated, as needed, their records schedules,” the report stated.
5. Based on the NCUA’s plan, management believes the agency will meet the NARA/OMB 2019 requirement to manage all permanent records electronically by the end of 2019, the OIG explained. “However, we determined NCUA will not have a single dedicated system established to manage electronic records until 2021. Although the NCUA met NARA/OMB’s 2016 requirement to retain emails electronically, we determined current information technology (IT) solutions do not allow for emails to be easily searched, identified, or retained.”
As a result, NCUA’s OIG made five recommendations it said it believes will help the NCUA implement a comprehensive records management program. The OIG noted that NCUA has already taken “significant steps” to address the findings and recommendations in this report. In March 2017, NCUA established a team of employees from across the agency and led by the Office of General Counsel (OGC), to implement improvements to the records management program.
The Recommendations
The OIG’s recommendations, which include steps the agency has already taken:
• Establishment in January 2018 of an office specifically focused on records management for the agency, including a newly authorized senior executive position to lead the operation, two new attorneys to be responsible for the agency’s privacy program and seven new authorized staff positions to implement the program.
• Establishment in early 2017 of a records liaison for each office and the new records management team, “which has yielded approved records file plans for nearly every NCUA office improved communication and training for all staff on records management responsibilities and provided ongoing guidance through a records management intranet website.”
• Updated all records retention schedules to mirror current operation status including the collaborative effort with NARA to establish records management schedules for the NCUA’s Asset Management Assistance Center (AMAC).
• Established a privacy policy and records management policy to guide staff compliance efforts.
• Reduced hard copy records at AMAC by properly migrating the substantial number of documents to the approved offsite records management service facility. This effort allowed the NCUA to eliminate the leased storage facility.
• Strengthened the agency’s records management posture in priority areas across the agency including AMAC. This includes implementing controls and processes for record intake and management, increasing the use of readily available technology for managing and storing records electronically to reduce the need to create or maintain physical records, and enhancing security of electronic records and created a secure electronic media room for electronic record assets acquired during liquidations.