U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Records Management Practices at the EPA Statement of Kevin Christensen Assistant Inspector General for Audits Before the Committee on Science, Space, and Technology Subcommittees on Oversight and Environment U.S. House of Representatives * g% \ ua&j V pR0^° March 26, 2015 ------- Statement of Kevin Christensen Assistant Inspector General for Audits Office of Inspector General U.S. Environmental Protection Agency Before the Committee on Science, Space, and Technology Subcommittees on Oversight and Environment U.S. House of Representatives March 26, 2015 Good morning, Chairman Loudermilk, Chairman Bridenstine, Ranking Member Beyer, Ranking Member Bonamici and members of the subcommittees. I am Kevin Christensen, Assistant Inspector General for the Office of Audit at the U.S. Environmental Protection Agency (EPA). Thank you for inviting me to appear before you. Today I will discuss three matters: (1) Records management policies at the EPA from 2009 to the present; (2) the Office of Inspector General's (OIG's) report Congressionally Requested Inquiry Into the EPA's Use of Private and Alias Email Accounts (Report No. 13-P-0433) and (3) the EPA's compliance with the Federal Records Act. Overview of the EPA OIG The OIG is an independent and objective office within the EPA that is uniquely charged with conducting audits and investigations related to programs and operations at the agency. The views expressed in my testimony are based on findings and recommendations of the OIG and are not intended to reflect the EPA's position. I. Records Management Policies at the EPA I have highlighted some of the EPA's most significant records management policies and procedures that have been in place between 2009 and the present. Most of these documents are available on the EPA's internal Records Management Web page, which separates the EPA's policy and guidance into two categories: Directives/Procedures and Memoranda. The Directives/Procedures section lists the EPA-specific records management guidance that agency personnel must follow. The Memoranda section lists pertinent reminders to EPA personnel regarding their records management responsibilities. The EPA's Records Management Web page lists the following policies: • EPA Records Management Policies 1. EPA Policy CIO 2155.1, Records Management Policy, published June 2009: This policy established responsibilities and requirements for managing the EPA's records to ensure that the agency is in compliance with federal laws and regulations, EPA policies and best practices for managing records. 2 EPA Policy CIO 2155.2 Interim Records Management Policy, published in June 2013: This interim policy provided EPA employees with records management 1 ------- guidance when they used personal email accounts to conduct government business and text messaging, instant messaging or other transient messaging technologies on EPA information systems. 3. EPA Policy CIO 2155.3 Records Management Policy, published in February 2015: This update provided EPA employees with records management guidance when they use text messaging on EPA information systems and personal devices. • EPA Records Management Manual, published February 2007: This manual prescribes requirements and responsibilities for conducting the EPA's records management program to ensure that the agency is in compliance with federal laws and regulations, EPA policies and best practices. • Records Schedules: These schedules are the EPA's official policies on how long to keep agency records (retention) and what to do with them afterwards (disposition). • EPA Policy CIO 2155-P-04.0, Preservation of Separating, Transferring or Separated Personnel's Records in Accordance with the Federal Records Act, published December 2014: This procedure describes how to manage records of separating, transferring or separated EPA personnel. • EPA Policy CIO 2155.P-01.0, Vital Records Procedure, published June 2009: This procedure prescribes requirements and responsibilities for establishing and maintaining the EPA's vital records program. Since November 1995, the EPA also has published several reminders to agency senior officials and employees regarding their records management responsibilities. These include: • Chief Information Officer Memorandum, Managing Records for Departing Senior Agency Officials, published September 2008 and August 2007: This memorandum reminds all senior EPA officials of their responsibility to follow federal record-keeping requirements for maintaining and disposing of agency records when they leave the EPA. • Chief Information Officer Memorandum, Scheduling Agency Electronic Information Systems as Required by Section 207(e) of the E-Government Act of2002, published March 2008: This memorandum reminds senior EPA officials of the responsibility to improve management of electronic records, including the identification and scheduling of electronic records and incorporating records management and archival functions into new information systems. • Chief Information Officer Memorandum, Calendars of Agency Senior Officials, published November 2007: This memorandum reminds senior EPA officials that their calendars are designated as permanent government records. • General Counsel Memorandum, E-Mail Legal Requirements, published November 1995: This memorandum outlines the legal responsibilities of EPA employees relating to the creation, maintenance and disposition of electronic mail. 2 ------- II. OIG's Report on the EPA's Use of Private and Alias Email Accounts In response to a request from the House Committee on Science, Space, and Technology, the OIG initiated an audit to determine whether the EPA followed applicable laws and regulations when using private and alias email accounts to conduct official business. In particular, the OIG sought to determine whether the EPA 1) promoted or encouraged the use of private or alias email accounts to conduct official government business; 2) reprimanded, counseled or took administrative actions against any employees using private or alias email accounts; 3) established and implemented email records management policies and procedures for collecting, maintaining and accessing records created from any private or alias email accounts; 4) provided adequate training to employees concerning the use of private or alias email accounts to conduct official government business; and 5) established and implemented oversight processes to ensure that employees comply with federal records management requirements pertaining to electronic records from private or alias email accounts. We conducted audit field work from December 2012 to June 2013, resulting in interviews of more than 100 EPA personnel responsible for implementing and complying with the EPA's federal records guidance. These interviews included the acting EPA Administrator, Assistant and Regional Administrators from five program and five regional offices, and the former Region 8 Administrator, as well as senior agency personnel with direct oversight of the EPA's National Records Management Program. The OIG issued its final report on September 26, 2013. We found no evidence that senior EPA officials had used, promoted or encouraged the use of private "nongovernmental" email accounts to circumvent records management responsibilities or reprimanded, counseled or took administrative actions against personnel for using private email or alias accounts for conducting official government business. EPA senior officials were aware of the agency records management policies, and we uncovered no evidence that these individuals had used private email intentionally to circumvent federal record-keeping responsibilities. For the purpose of our audit, an alias email account was defined as a secondary "epa.gov" account used to conduct EPA business. Our audit noted that the previous EPA Administrator and the subsequent acting EPA Administrator (the Deputy Administrator) each had two EPA email accounts, one intended for messages from the public and one for communicating with select senior EPA officials. Interviews with selected Assistant and Regional Administrators and records management officials disclosed that the practice of assigning personnel access to multiple email accounts is widely practiced within the agency. However, this practice is not limited to senior EPA officials, and presents risks to the agency's records management efforts if these additional email accounts are not searched to preserve federal records. Additionally, the EPA had not: • Provided guidance on preserving records created from private email accounts. • Implemented oversight processes to provide regular training on records management responsibilities. • Implemented consistent employee out-processing procedures to ensure that federal records are not identified and preserved before an employee departs the agency. • Deployed an automated tool to create federal records from its new email system. 3 ------- We made five recommendations to the EPA to address the above findings and the EPA concurred with these recommendations. Prior to our final report issuance, the EPA 1) published an updated interim records management policy to provide guidance to agency employees on the rules for using private email accounts when conducting government business and 2) developed a process to train all EPA employees and contractors on their records management responsibilities. The EPA also reported completing corrective action to implement an electronic content management tool to capture email records within the agency's new email system in December 2013. For the remaining two recommendations, the EPA reported completing the corrective actions in November and December 2014, respectively. To date, the OIG has not verified the completion of the corrective actions. Additionally, in response to our 2013 audit report on the EPA's use of alias and private email accounts, the agency reported that it completed corrective actions for two recommendations in June and July 2013; one recommendation in December 2013; and the remaining two recommendations in November and December 2014, respectively. III. EPA's Compliance with the Federal Records Act The Federal Records Act regulations, 44 U.S. Code Chapter 33, Section 3301, define "records" as including "all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them." In this regard and in addition to the above audit, the OIG conducted the following audits regarding the EPA's ability to comply with provisions of the Federal Records Act: • EPA Should Strengthen Records Management on Clean Water Act (CWA) Section 404 Permit Notification Reviews for Surface Coal Mining (Report No. 12-P-0249), issued February 2, 2012: We found that, without sufficient records, it is difficult for the EPA to know the permit status and the resolution of the EPA's comments related to the CWA. Furthermore, the lack of records makes it difficult for the EPA to determine whether its review activities have the environmental impact envisioned by the CWA. As a result, the EPA risks not being in compliance with the Federal Records Act and EPA policy. The OIG made four recommendations to the EPA for improving its record-keeping processes related to Section 404 of the CWA. The EPA concurred with all four recommendations and, in May 2013, reported that it had completed all corrective actions to improve the record- keeping capabilities of its system that maintains official records which document the agency's role in CWA Section 404 permit notification reviews. The OIG has not verified the completion of the corrective actions. Additionally, the following audit of the EPA's records management practices is ongoing: • Audit of EPA Processes for Preserving Text Messages: The objectives are to determine whether the EPA: 1) implemented policies and procedures to determine which text messages to preserve and steps to ensure that employees are knowledgeable of this guidance; 2) implemented processes to respond to congressional and Freedom of 4 ------- Information Act requests involving agency employees' text messages; 3) used text messages (on government-issued or personal devices) for official business; 4) deleted, destroyed, lost or misplaced text messages needed for records management; and, if applicable, the rationale for destroying text communication records; 5) took disciplinary actions against employees for deleting, destroying, losing or misplacing text communication records; and 6) notified the National Archives and Records Administration about the potential loss of any federal text records, and how often the losses occurred. Conclusion I am here at the request of this committee to report on how the EPA has conducted itself in line with relevant laws and rules for records management. Today, I have outlined the prevailing records management policies within the EPA, and the results of our audit work into the EPA's records management practices along with our ongoing audit work into the agency's text messaging practices. As previously discussed, the OIG issued two audit reports dated February 2012 and September 2013 on the EPA's efforts to comply with federal records requirements. These reports collectively included nine recommendations for how the EPA could improve its records management practices. The EPA has taken significant steps to publish policies that address compliance with National Archives and Records Administration and Federal Records Act requirements. The EPA's leadership has shown a commitment to address many of the problems and weaknesses identified by the OIG. We are proud to have brought these issues to light and are committed to working with this committee and the EPA to help realize the benefits of an effective records management program that enables and supports the agency's work to fulfill its mission. This concludes my statement. Thank you for the opportunity to testify before you today. I will be pleased to answer any questions that you may have. 5 ------- Biography of Assistant Inspector General for Audit Kevin Christensen Kevin Christensen is the Assistant Inspector General for Audit, Office of Inspector General (OIG), at the U.S. Environmental Protection Agency (EPA). He oversees the OIG's Office of Audit, consisting of five product lines with 90 personnel. His office conducts financial and performance audits, attestation engagements, and special reviews of EPA and U.S. Chemical Safety and Hazard Investigation Board programs, including grantee and contractor performance. Audits review compliance with federal policies and regulations to determine whether programs are effective and efficient in producing environmental results and achieving agency goals and themes. Mr. Christensen began his government career in the military, serving 9 years as a Naval officer. Upon leaving the Navy, he worked at the Naval Audit Service, where he became a manager. His experience included managing various assignments—both overseas and in the United States— of intelligence programs, major systems acquisition, financial, supply and logistics, readiness, special bonus and incentive pay, research and development, procurement/contract administration procedures, cash/financial management procedures, organizational structure analysis, grantee or contractor performance, and quality assurance. Mr. Christensen subsequently joined the EPA OIG in 2008 and served for 4 years as a member of the OIG referencing staff. He was a technical expert on Government Auditing Standards and the Inspector General Act, and led audit teams completing peer reviews of other OIGs. He also served as the acting Deputy Assistant Inspector General for Audit and the acting Assistant Inspector General for Audit. Mr. Christensen graduated from Nebraska Wesleyan University with degrees in chemistry and biology. He is very active as a leader in the Boy Scouts, and spends his free time backpacking, hiking, camping and riding his bike. 6 ------- |