Citywide Records Management Performance Audit

Transcription

1 Citywide Records Management Performance Audit August 2009 Office of the Auditor Audit Services Division City and County of Denver Dennis J. Gallagher Auditor

2 The Auditor of the City and County of Denver is independently elected by the citizens of Denver. He is responsible for examining and evaluating the operations of City agencies for the purpose of ensuring the proper and efficient use of City resources and providing other audit services and information to City Council, the Mayor and the public to improve all aspects of Denver s government. He also chairs the City s Audit Committee and oversees the City s Comprehensive Annual Financial Report (CAFR). The Audit Committee is chaired by the Auditor and consists of seven members. The Audit Committee assists the Auditor in his oversight responsibilities of the integrity of the City s finances and operations, including the integrity of the City s financial statements. The Audit Committee is structured in a manner that ensures the independent oversight of City operations, thereby enhancing citizen confidence and avoiding any appearance of a conflict of interest. Audit Committee Dennis Gallagher Robert Haddock Charles Husted Timothy O Brien Maurice Goodgaine Jeffrey Hart Bonney Lopez Audit Staff John Carlson, CIA, CICA, Deputy Director Sonia Montano, CGAP, CICA, Internal Audit Supervisor Dawn Hume, Lead Internal Auditor Kristin Donald, Senior Internal Auditor Jessica Quintana, Senior Internal Auditor You can obtain free copies of this report by contacting us at: Office of the Auditor 201 W. Colfax Avenue, Dept. 705 Denver CO, (720) Fax (720) Or view an electronic copy by visiting our website at: Dennis J. Gallagher Auditor

3 City and County of Denver Dennis J. Gallagher Auditor 201 West Colfax Ave., Dept. 705 Denver, Colorado FAX August 20, 2009 Honorable John Hickenlooper Mayor City and County of Denver Attached is the Auditor s Office Audit Services Division s performance audit report of Citywide Records Management practices. The audit period was January 1, 2008 through December 31, The purpose of the audit was to examine and assess the City's Records Management practices to identify possible inefficiencies or weaknesses. Records are the foundation of compliance within an organization and the need to manage them correctly to achieve greater efficiency and cost savings is important, especially during these difficult economic times. Audit work identified several weaknesses in the management and oversight of citywide records. These limitations hinder the City's ability to effectively monitor and manage records. These issues also increase the risk of permitting unauthorized persons access to personal data or allowing the destruction of records that contain historical value or legal significance. City employees and contractors need to possess effective recordkeeping skills. The findings and recommendations presented in this report have identified significant opportunities for process improvements with citywide records management practices. If you have any questions, please call Kip Memmott, Director of Audit Services, at Sincerely, Dennis Gallagher Auditor DJG/ect cc: Honorable Members of City Council Members of Audit Committee Ms. Kelly Brough, Chief of Staff Mr. Claude Pumilia, Chief Financial Officer Mr. David Roberts, Chief Services Officer Mr. David Fine, City Attorney To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

4 Mr. L. Michael Henry, Staff Director, Board of Ethics Ms. Lauri Dannemiller, City Council Executive Staff Director Ms. Beth Machann, Controller Mr. Derek Brown, Manager of General Services Mr. Jeff Dolan, Director of Career Service Authority Honorable Stephanie O'Malley, Clerk and Recorder Ms. Patricia Wilson-Pheanious, Manager of Human Services

5 Dennis J. Gallagher Auditor City and County of Denver 201 West Colfax Ave., Dept. 705 Denver, Colorado , FAX AUDITOR S REPORT We have completed a performance audit examining the City and County of Denver s Citywide Records Management practices for the period January 1, 2008 through December 31, The audit examined and assessed the City s Records Management practices to identify possible inefficiencies and opportunities for improvement. Audit work focused primarily on the management of citywide records, which includes preservation, safeguarding, and destruction. This performance audit is authorized pursuant to the City and County of Denver Charter, Article V, Part 2, Section 1, General Powers and Duties of Auditor, and was conducted in accordance with generally accepted government auditing standards. Records management is the systematic control of records throughout the cycle of their creation, use, storage, and eventual disposition. The audit revealed significant limitations with the City s Records Management Program. Records management-a critical management responsibility-is not being carried out with the due care and consistency required. The weaknesses identified, which are disclosed in detail within the accompanying report, hinder the City s ability to effectively maintain, monitor, assess and dispose of the City's records in an effective and efficient manner. The audit function is considered organizationally independent when audits are performed on activities or business processes not controlled by the City Auditor's Office. However, when the Audit Services Division performs an audit of operational functions controlled or partially controlled by the Office of the City Auditor, the Audit Services Division cannot be viewed as independent. Accordingly, we declare a potential impairment to our independence with respect to certain aspects of this audit of Citywide Records Management involving the Auditor s Office in accordance with generally accepted government auditing standards. We extend our appreciation to the agencies and personnel who assisted and cooperated with us during the audit. Audit Services Division Kip Memmott, MA, CGAP, CICA Director of Audit Services To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

6 TABLE OF CONTENTS EXECUTIVE SUMMARY 1 Finding 1: Records Management Executive Order Has Not Been Effectively Implemented 1 Finding 2: Records Stored at City Agencies Are Not Adequately Protected Against Loss or Unauthorized Access 1 Finding 3: Specific Records Management Processes Need Improvement 2 INTRODUCTION & BACKGROUND 3 What is Records Management? 3 Executive Order 64 Sets the City and County s Overall Records Management Policy 3 Changes Made to the City Charter Effective in 2007 Impact City Organizational Structure Related to Records Management 4 Some Agencies Have Extensive and Sensitive Records 5 Records Management Includes Storage and Eventual Disposal 6 SCOPE 7 OBJECTIVE 7 METHODOLOGY 7 FINDING 1 9 Records Management Executive Order Has Not Been Effectively Implemented 9 Recommendations 14 FINDING 2 14 Records Stored at City Agencies Are Not Adequately Protected Against Loss or Unauthorized Access 14 Recommendations 20 FINDING 3 20 Specific Records Management Processes Need Improvement 20 Recommendations 23 APPENDICES 24 Appendix A 24 Appendix B 36 Appendix C 39 AGENCY RESPONSE 41

7 EXECUTIVE SUMMARY Finding 1: Records Management Executive Order Has Not Been Effectively Implemented Effective records management is needed not only to allow the City and County to operate efficiently, but also to safeguard sensitive information about employees and residents. Although the City and County has a basic framework for records management in Executive Order 64, issued in 2002, this framework has not been effectively implemented and is currently outdated. Audit work identified five key deficiencies in the way the Executive Order has been carried out: A records management guidance manual for City agencies has not been implemented. As a result, agencies have created their own unique policies and procedures without oversight from the City Records Manager and the Records Management Committee. The program is managed by an agency that does not have the proper structure to perform such a key recordkeeping role. Agencies are retaining or destroying documents using schedules that have not been coordinated with each other or approved as required by State law and regulations. The City has only taken limited steps to ensure the permanent preservation of records with significant historic value. The Records Management Committee established under the Executive Order to oversee the program did not meet during the audit period of 2008, and has not established program performance measures such as the number of records destroyed or the volume of records stored in accordance with established retention schedules that would allow it to monitor how efficiently and effectively the program is operating. In addition to these deficiencies, through their vote, the citizens established the Office of the Clerk and Recorder as an independent function within the City under the jurisdiction of an elected official. As a result, the records management framework contained in Executive Order 64 is outdated and is no longer aligned with the City s organizational structure. The historical lack of action to effectively implement Executive Order 64 and the failure to address changes to the City s organizational structure related to records management practices has created inconsistent records management practices and policies, which in turn potentially create liability for the City and County and increase the risk that records will be improperly created, retained, and destroyed. Finding 2: Records Stored at City Agencies Are Not Adequately Protected Against Loss or Unauthorized Access Audit work found that all agencies tested are not adequately protecting records they have in storage. Agencies frequently retain records for a time before eventually sending them to a third party for permanent storage or disposal. These temporary storage sites, whether located in the P a g e 1 Office of the Auditor

8 agencies own building or at off-site locations administered by the City, were easily accessible to unauthorized persons and have poor inventory controls. The records made vulnerable by these access problems frequently contained confidential and sensitive information. For example, at off-site storage locations in the City and County Building and the Park Avenue storage facility, security was inadequate and confidential records, including employee files and juvenile court records, were easily accessible to the public. Similar problems were identified at two on-site storage locations on the fourth-floor of the Wellington Webb Building. In both of these locations, confidential and sensitive information was found to be unsecured and easily accessible. The potential consequences of these security breaches include opportunity for identity theft and removal of records with historical value. These weaknesses did not extend to the storage facility maintained by the third party (Iron Mountain) that handles longer-term storage and disposal of records for the City, where access controls were much stronger. Finding 3: Specific Records Management Processes Need Improvement Audit work identified several areas in need of improvement related to the management of records for specific agencies selected for review. The absence of more effective procedures has a number of effects, ranging from increased potential for unauthorized access to duplication of effort and an inability to keep track of records. Better implementation of an overall framework for records management, addressed in Finding 1, will help improve the City s records management efforts, but these efforts are also dependent on good procedures and practices at the agency level. Some critical improvement steps involve enhanced coordination across agency lines, while others involve steps that need to be taken by the individual agencies reviewed. Specific records management weaknesses identified through the audit work were as follows: No citywide controls have been established to ensure that when employees leave, transfer, or are terminated, their access rights to records are properly monitored and removed. Personnel files throughout the city are either incomplete or contain duplicate information. Management of the city s financial records needs improvement in several respects. For example, the administrative function involved in managing these records is not properly structured within the appropriate City entity. One agency reviewed (Career Services Authority) is retaining electronic records indefinitely, and another agency (Department of Health and Human Services) is not taking full advantage of its electronic system for managing millions of paper records. City and County of Denver P a g e 2

9 INTRODUCTION & BACKGROUND What is Records Management? Records serve as evidence of the activities and services performed and provided by the City. Official records document all City business activities and transactions, such as budgeting, contracts, correspondence, personnel files, and financial statements. Every City function generates electronic records, paper records, or both. The City and County of Denver generates millions of records each year. How these records are handled directly affects the City and County s ability to operate effectively and efficiently, recover from disasters, and comply with legal regulations. Records management is the systematic control of records throughout their life cycle that is, from creation through use, storage, and eventual disposition. Among other things, the City needs to determine how long to keep records, how to dispose of records no longer needed, and how to keep and safeguard records that need to be retained for historical or other purposes. The City also must manage the security of these records, which often have personal or other data that, if available to unauthorized persons, could be used for identity theft or other inappropriate activities. Protecting data from unauthorized access, whether through electronic means or through access to paper records, is thus an important component of records management. Effective records management ensures that the information needed is safeguarded, retrievable, authentic, and accurate. Executive Order 64 Sets the City and County s Overall Records Management Policy During 2002, the Mayor issued Executive Order 64 entitled Records Management. 1 The order establishes a City Records Management Program that incorporates effective controls over the creation, distribution, organization, maintenance, use, and disposition of City and County records. The order calls for the program to be consistent with the requirements of the Public Records Act of the State of Colorado, City and County of Denver Municipal Codes and Ordinances, and accepted records management practices. 1 See Appendix A for reference to Executive Order 64. P a g e 3 Office of the Auditor

10 Executive Order 64 created a Records Management Committee to provide oversight of the records management function. The committee s membership includes the Clerk and Recorder (Chairperson), Manager of General Services, City Attorney, Director of Finance, and a representative from Technology Services. The committee s main functions include the following: Reviewing and approving policies and procedures governing the records management program. Approving a schedule for retaining and disposing of records. Reviewing the program s overall performance. Promoting the program to the entire City and County of Denver. Executive Order 64 also establishes the position of City Records Manager. Per the order, the Clerk and Recorder hires the Records Manager, in consultation with the Records Management Committee. This individual, who also serves as an ex-officio member of the Records Management Committee, must be able to apply management techniques to the creation, use, maintenance, retention, preservation and disposal of records to reduce costs and improve the efficiency and effectiveness of recordkeeping citywide. Executive Order 64 describes the City Records Manager s function as: Assisting agencies with implementing the records management program and on-site consultation. Creating a records management procedure manual and establishing, in cooperation with Agency/Department Heads, a disaster recovery plan for each agency. Establishing a record retention schedule and coordinating the review and approval of the schedule with the State Archivist, State Attorney General, and the Records Management Committee. Developing standards for storing records and establishing procedures for archiving records. Providing reports to the Committee on the volume of records destroyed and the estimated cost and space savings as a result of destruction. Obtaining authorization for records destruction from the State Archivist and Attorney General as provided by applicable laws. The order requires all records management systems implemented by a city agency to meet the standards developed by the City Records Manager and the Records Management Committee. Changes Made to the City Charter Effective in 2007 Impact City Organizational Structure Related to Records Management In 2007, the citizens of Denver voted to amend the City Charter to establish the Office of the Clerk and Recorder as an independent agency headed by an elected official. As a result of this structural change, the City Records Manager, position previously housed under the Office of the Clerk and Recorder until March 2008 was transferred to the Department of General Services. This change occurred in order to place the functions of providing advisory services and developing policy for agencies and departments under the authority of the Mayor, since the Clerk and City and County of Denver P a g e 4

11 Recorder is an independent agency. Under this realignment, however, the Clerk and Recorder remains responsible for the content of Executive Order 64 (including the duties and responsibilities of the City Records Manager) and for issuing any procedural memorandum attachments relative to Executive Order 64. Further, per Denver Revised Municipal Code (D.R.M.C.), the Clerk and Recorder has significant citywide record management responsibilities. 2 Some Agencies Have Extensive and Sensitive Records While every City agency generates records, records management practices for some agencies are particularly important because their records are extensive or include sensitive information, ranging from Social Security numbers to details about legal proceedings to personal health information. This performance audit focuses on four such agencies the Department of Health and Human Services, the Career Services Authority, the Controller s Office, and the City Attorney s Office. Department of Health and Human Services The Denver Department of Human Services (DDHS) assists people in need and protects people of all ages from abuse and neglect. DDHS generates records covering a wide variety of clients, including children and families, the elderly, and persons who are homeless, disabled, or otherwise in need. The Department s records are extensive, with over three million paper case files to track at any time, and because of the types of services the Department provides, the records often contain sensitive information that must be kept confidential. The Department uses an electronic system to manage its paper files, and one of its divisions (Child Support Enforcement) has shifted entirely from paper to electronic files. For the period covered in this audit, the Department stored records off-site at the City s Park Avenue facility and also maintained records in storage rooms in its office at the Richard T. Castro building. Career Services Authority Career Service Authority (CSA) is the City s human resource agency. CSA maintains records on more than 10,000 employees, applicants, and other people. The agency maintains the majority of its records electronically using several different software systems, but also maintains some paper records. During 2008, the agency stored records at the Park Avenue facility and on fourth-floor storage rooms of the Wellington Webb Building. Controller s Office The Controller s Office is responsible for the accounting, payroll, and financial reporting for the City and County of Denver. Examples of its financial 2 Record keeping. The Clerk and Recorder shall keep a record of the proceedings of City Council and shall have the custody of the seal of the City and County, the original rolls of ordinances, original contracts, title deeds to public property, all official indemnity or security bonds, except his or her own bond, which shall be filed and placed in the custody of the auditor, and other records, papers and documents not required to be deposited with any other officer, D.R.M.C., Subtitle B, Article VIII, 8.1.2(B). P a g e 5 Office of the Auditor

12 records include payroll, general ledgers, warrants, journal vouchers, cash receipts, internal billing transfers, and adjusting journals. Some of these records, such as journal vouchers, are public information, but other records, such as payroll information, are confidential. The Controller s Office utilizes a number of software systems, including the City s human resource and financial system, time and attendance software, and the City s tax information system. The Office has both paper and electronic records, and during 2008, it stored records at the Wellington Webb Building (fourth, seventh, and tenth floors), the Park Avenue facility, and Iron Mountain. City Attorney s Office The Denver City Attorney's Office represents the City in all legal matters. The Office maintains many kinds of legal documents and records, some with sensitive personal or other information. The Office maintains both paper and electronic records. During 2008, it stored paper records in secure file rooms within its office. Records Management Includes Storage and Eventual Disposal Many city agencies have the ability to store their records on-site within their department, allowing them direct access prior to storing inactive records. Inactive records may include imaged records and records that are infrequently retrieved. The four agencies we reviewed stored some records on-site, either within their office space or in storage rooms elsewhere in the building. The City also maintains two off-site storage areas where agencies can place documents temporarily prior to their eventual move to disposal or permanent storage. They are as follows: City and County Building. The Clerk and Recorder is responsible for a basement storage area in this building. The area houses records from many agencies, including one of the four agencies we reviewed the City Attorney s Office. Park Avenue location. This facility, located at 3383 Park Avenue, is managed by the General Services Facilities Management Division. Like the storage area in the City and County Building, the facility houses records from many agencies, including three of the four agencies we reviewed the Department of Health and Human Services, the Career Service Authority, and the Controller s Office. For permanent storage and disposal, the City uses a facility operated by a private third party, Iron Mountain. This contractor stores inactive records and handles the destruction or other final disposition of any City records stored there. The contractor disposes of paper records using a shredding process and utilizes an incineration to dispose of most electronic and plastic documents. City and County of Denver P a g e 6

13 SCOPE This audit examined the City and County s records management program to determine if policies and procedures are in accordance with laws and regulations and effectively preserve, safeguard, and prevent the improper destruction or disposition of City records and archives. 3 OBJECTIVE Audit objectives included: Determining if the City has established policies and procedures in accordance with applicable Federal, State and City rules to adequately preserve, safeguard, and prevent the improper transfer, destruction or disposition of City Records, and archives. Evaluating whether the City adheres to its established and State Archivist approved retention schedule. Evaluating if there is proper management of document systems and to confirm whether there is proper destruction of electronic files. Identifying standards, structures and other best practices used by other municipalities and governmental entities regarding Records Management Programs. METHODOLOGY We utilized multiple methodologies to achieve audit objectives. These evidence gathering techniques included, but were not limited to: Researching federal, state and City rules and regulations pertaining to management, retention, destruction and archiving records. Researching industry standards relating to records management and comparing those standards to the City s practices. Appendix C contains more information about the organizations we contacted and their respective standards. Contacting other cities for information about their records management practices. We sent questions to seven cities that are similar in size to Denver and received information from four of them Seattle, Austin, Portland, and Dallas. Our questions 3 We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives, Government Auditing Standards, P a g e 7 Office of the Auditor

14 covered such matters as staffing, records retention policies and schedules, archival capabilities, and oversight responsibilities. Interviewing the City Records Manager and City agency staff associated with records management. Reviewing a cross-section of City and County agencies for compliance with retention schedules, rules and regulations. For the four agencies where we examined, reviewing such practices as their documentation, storage, and security of records. Reviewing procedures at the third party storage and disposal facility. National Archives and Records Administration regional repository visit. Direct observation of City storage sites. City and County of Denver P a g e 8

15 FINDING 1 Records Management Executive Order Has Not Been Effectively Implemented Executive Order 64, the basic records management framework for the City and County of Denver, has not been effectively implemented and, owing to the changes made to the City Charter effective as of January 2007, the Executive Order is outdated and is no longer aligned with the City s organizational structure. Audit work identified five key deficiencies in the way the Executive Order has been executed. Specifically, City entities have received insufficient guidance on record management requirements and there has been inadequate oversight of various City entity record management practices. As a result, agencies are largely creating their own policies and procedures. The resulting practices vary greatly from agency to agency, increasing potential liability to the City because retention and destruction schedules for records have not been properly established. In addition, the City has only taken limited steps to ensure the permanent preservation of records with significant historic value. The ineffective implementation of Executive Order 64 requirements results in inconsistent and generally weak record maintenance practices citywide creating liability and inefficiencies for the City. Records Management Procedure Manual Not in Place Executive Order 64 calls for the City Records Manager to prepare a Records Management Procedures Manual and perform on-site consultation. 4 A Records Management Procedures Manual has been developed, but it has never been issued for agency use. Consequently, agencies rely on their own judgment and experience to manage their records. Audit work showed the procedures that resulted from individual agency efforts were inconsistent and did not conform to various legal requirements. Specifically: Three of the four agencies we reviewed had internal policies and procedures that did not appear to include all of the requirements of Executive Order 64 or include applicable State record retention schedules. 5 For example, retention schedules were not submitted to the City Records Manager and the specific agency coordinators were not identifiable. One agency, the Controller s Office, had not developed any records management policies and procedures Records Management Manual Developed But Not Issued 4 See Appendix A, Executive Order 64, The Records Manager... shall: Coordinate the review and approval of the records retention schedules with the Colorado State Archivist, the State Attorney General, and the Records Advisory Committee of the City and County of Denver. Executive Order 64, (September 17, 2002). P a g e 9 Office of the Auditor

16 because the administrative function of imaging the Office s financial records is currently performed by another agency (refer to Finding 3 for detailed information regarding the alignment of the administrative function of records imaging). Staff responsible for records management at these four agencies indicated they had received little or no consultation from the City Records Manager about their records management policies. For example, no guidance has been provided to ensure record destruction and retention schedules are submitted for approval. According to the City Records Manager, a draft manual was developed in April 2008, approximately six years after the issuance of Executive Order 64, and submitted to the Records Management Committee and to General Services for review and approval. The City Records Manager did not follow up after submission to ensure the manual was implemented in a timely manner. As a result, some seven years after the adoption of the City s records management program, there is still no records management guidance manual for agency reference and use. Program Management No Longer Aligned with City Structure Executive Order 64 places the responsibility of the content and the authority to issue changes to the order with the Clerk and Recorder. At the time of the Order s issuance, the Mayor appointed the Clerk and Recorder and the Office was under the authority and responsibility of the Mayor. As a result of the change made to the City Charter, as an elected position, the Office of the Clerk and Recorder is now an independent agency and is therefore, not required to follow Executive Orders issued by the Mayor. This substantive structural change to the City s organizational structure has effectively outdated key requirements contained in Executive Order 64. Specifically, the City Records Manager function was initially placed within the Clerk and Recorder s Office. This placement appeared to be well aligned with the Clerk and Recorder s responsibility as the City s primary records management entity. 6 However, in March 2008, various records management responsibilities including the City Records Manager function were transferred to the Department of General Services. As a result, Executive Order 64 and the records management program are no longer in alignment with City structure and an organizational gap exists regarding which entity is responsible for which records and which entity has overall responsibility for ensuring the City s records management practices are sound, cost effective and fully comply with legal requirements. General Services support functions do not relate directly to records management, which may hinder the production and sustainability of an effective records management program. Moreover, benchmarking noted this administrative function in other cities commonly resides in an agency with records management functions. 6 D.R.M.C., Subtitle B, Article VIII, 8.1.2(B). City and County of Denver P a g e 10

17 Agencies Operating With Unapproved Retention Schedules Executive Order 64 directs the City Records Manager to develop a record retention schedule documenting how long each agency should retain various records as well as their method of disposal. Under the Public Records Act of the State of Colorado and City and County of Denver Municipal Codes and Ordinances, this schedule is to be submitted to the State Archivist for approval. 7 The approval process is designed to ensure compliance with applicable State Laws as required by Executive Order 64. The approved schedule remains in effect indefinitely or until rescinded by the municipality or the State Archivist. In addition, the retention schedules should be reviewed and approved by the Records Management Committee prior to submission to the State Archivist. However, the City Records Manager failed to submit a resolution to the State Archivist to Municipal Retention Schedule Process Not Complete complete the municipal retention schedule process. Audit work determined, in 2002, that the City Records Manager submitted a general City Retention Schedule for administrative, financial and personnel City records and also included agency specific retention schedules. The agency specific retention schedules were submitted because the retention period for those particular agency records varied or were not included in the general retention schedule. In 2008, agency specific retention schedules were omitted, only those records maintained by the Clerk and Recorder's Office was submitted for approval. Therefore, the retention periods for various records throughout the City were not addressed in the submission to the State Archivist. According to representatives of the four agencies we reviewed, the City Records Manager never instructed them to submit their retention schedules for review and approval. Because the State Archivist never received and approved a resolution, City agencies are not operating with approved retention schedules and may not comply with state law. This lack of formal approval increases potential legal liability for the city. For example, agencies may inadvertently retain or destroy records of significant or historical value. Lack of Effective Archival Process for Records with Historical Value Although Executive Order 64 calls for the City Records Manager to develop procedures for ensuring the permanent preservation of significant historical records, the City does not have an archive for such records. We conducted a survey to obtain data on the various records throughout the City of Denver. One area of inquiry involved identifying records agencies possess that are considered to have permanent value. A few agencies responded they have items that should be retained permanently for historical information but there is no city archive available. Examples of such records include photographs, maps, deeds, marriage licenses, and landmark legal cases. Cities responding to our benchmarking survey appear to have stronger records management programs as they have established formal archives and assigned adequate staffing to perform this important function. As table 1 demonstrates, the four responding cities had all established an 7 See Appendix A, Executive Order 64, 2.0. P a g e 11 Office of the Auditor

18 archive and employed from three to eight full-time employees (FTEs) to manage their archival activities and other citywide records management efforts. By contrast, Denver has no archive, fewer than three FTEs committed to citywide records management, and no FTE specifically responsible for archiving City records. Three of the four cities also reported formal oversight and compliance procedures for the City s records management function. Table 1: Comparison between Denver and Four Similarly Sized Cities on Selected Aspects of Records Management Austin Dallas Portland Seattle Denver Operates a city archive for records Employs three or more full-time staff for City-wide records management Formal oversight and compliance procedures for the City s records management ** Indicates the City answered yes Indicates the City answered no **Not properly established or enforced, as noted in this finding The Clerk and Recorder indicated budget pressures and related issues have limited efforts to establish an archive for Denver. Audit work indicated, however, that even with these limitations, opportunities exist to strengthen the City s practices in this area. Specifically: The Denver Public Library has an archive program located in the central library location, but does not have the resources to house a citywide archive. However, Library officials said they are willing to provide guidance about such an effort. The Colorado Historical Records Advisory Board provides guidelines to assist local governments in the organization of archival programs. Additionally, the National Historical Publications and Records Commission Training Program (NHPRC) offers advice and assistance to state and local government agencies committed to the preservation of archival materials. This program, which is affiliated with the federal National Archives and Records Administration, supports preservation planning and implementation projects that focus on the repository s preservation of collections as a whole. Some funding opportunities may be available for developing an archive program. For example, NHPRC has statutory authorization through fiscal year 2009 to receive up to $10 million in annual appropriation for grants. 8 A grant normally is for one to three years and up to $300,000. NHPRC will provide up to 50 percent of the total project costs for Electronic Records Archive projects (Cost Sharing). Projects will 8 NHPRC Funding, (accessed April 9, 2009). City and County of Denver P a g e 12

19 normally last up to eighteen months. Eligible applicants include state or local government agencies. Records Management Committee Exercises Inadequate Oversight Under Executive Order 64, the Records Management Committee has responsibility for supporting, promoting, and overseeing the records management program. The Committee is responsible for approving, reviewing, and monitoring the program developed and administered by the City Records Manager. Audit work determined that the Committee s oversight is inadequate in several ways. Infrequent meetings. Executive Order 64 calls for the Records Management Committee to meet and review the program on a regular basis. However, during the audit period of 2008, it was determined that the Records Management Committee had not met since The Committee s lack of involvement reduces the effectiveness of the program, because necessary changes and improvements are not being reviewed and revised. For example, one of the Committee s duties is to review and approve a record retention schedule before the schedule is submitted to the State for approval. As discussed earlier, an incomplete schedule was submitted to the State and not submitted to the Committee. If the Committee were more active, members would have been more likely to notice the omission. Lack of performance criteria. Monitoring the Records Management Program also includes communication with the City Records Manager to ensure that the program is working as designed. The Committee has not established performance measures such as the number of records destroyed or the volume of records stored in accordance with established retention schedules that would allow it to review and assess the effectiveness of the program. Without such measures, the Committee s ability to monitor the program and the City Records Manager s performance is significantly diminished, resulting in greater risk of inefficient use of City resources and improper handling of City records. Inadequate Citywide Records Management Program has Several Negative Impacts The absence of an effective Citywide records management program has led to noncompliance with State laws and regulations governing the retention and disposal of records. This, in turn, leaves the City vulnerable to improper retention and destruction of City records. 9 Records management policies and procedures are created by each agency without the oversight of the City Records Manager and the Records Management Committee. The disposition of records is at the discretion of the agency with little or no consultation with the City Records Manager, further diminishing controls over City records. Additionally, records of historical value throughout the City may be poorly maintained, inadvertently destroyed or removed from the custody of the City due to the lack of controls of the current storage facility and the absence of an archive. 9 See Appendix A, Executive Order 64, P a g e 13 Office of the Auditor

20 Recommendations We offer the following recommendations to assist the City with improving compliance with Executive Order Working with the City Attorney, the Mayor s Office and Office of the Clerk and Recorder should clearly identify areas of citywide records management responsibility. Once identified, records management responsibilities should be delineated in governance documents such as City Code, Executive Orders, and inter-agency agreements. 2. The City Records Manager should be held accountable by the Records Management Committee for duties and responsibilities in accordance with Executive Order 64. The City Records Manager and the Records Management Committee should ensure that a manual with suitable guidance on records management including requirements for retention policies and schedules be developed and distributed as quickly as possible. The Records Management Committee should provide oversight of the City Records Management Program by ensuring that it meets on a regular basis as prescribed in Executive Order The City Records Manager should develop and submit an updated citywide retention schedule to the State Archivist including a resolution as encouraged by the State. 4. The City Records Manager should take the lead in initiating a development strategy for a city archive. A development strategy would include the following: Articulating a vision that meets the City s archival needs. Researching initiatives and exploratory development. Developing a workable plan for achieving the vision, and refining this plan as conditions change, and developing a comprehensive means of preserving and providing continued access to any type of archival records. FINDING 2 Records Stored at City Agencies Are Not Adequately Protected Against Loss or Unauthorized Access Audit work found that agencies are not adequately protecting stored records. Agencies frequently retain records for a time before eventually sending them to Iron Mountain, the City s third party storage facility for permanent storage or disposal. These temporary storage sites, whether located in the agencies own building or at off-site locations administered by the City, were easily accessible to unauthorized persons and have poor inventory controls. Vulnerable records resulting from these access problems frequently contained confidential and sensitive information. Consequences of potential security breaches include opportunity for identity theft City and County of Denver P a g e 14

21 and removal of records with historical and monetary value. The weaknesses we identified did not extend to Iron Mountain s storage facility, where access controls were much stronger. Inadequate Oversight of Confidential Information at Off-Site Storage Locations The City s two off-site storage areas, which agencies can use to temporarily place documents prior to their eventual move to disposal or permanent storage, have security and inventory control problems. These two locations include the City s Park Avenue facility and a basement storage room in the City and County Building. Poor security at the Park Avenue location. During a February 2009 review of the Park Avenue storage location, we found that access to the storage area is not restricted during business hours. Badges are not checked and anyone can remove boxes at any time. Three of the four agencies in our review the Career Services Authority, Controller s Office, and the Department of Health and Human Services had boxes at the site with confidential information such as social security numbers and dates of birth. The following pictures are examples of what records were found at the location: This box that contained social security numbers and children s dates of birth was not labeled appropriately. CSA Box contained employees flex spending account forms. Auditor blocked social security numbers and last names Many of the boxes stored by the three agencies were labeled to be destroyed prior to our February 2009 visit. On our last visit to the Park Avenue location in May 2009, we noted that all of these boxes had been removed for storage or disposal at either the agency or Iron Mountain. Poor security at the City and County Building. The storage room in the basement of the City and County Building is locked, with the key maintained in the Clerk and Recorder s Office, but members of the general public can check out the key. An escort is not required to enter and review records in the storage area, and there is no P a g e 15 Office of the Auditor

22 monitoring equipment inside the room. Further, there is no copy machine available for members of the public to make copies of public documents housed within the room. Staff in the Clerk and Recorder s office estimated someone requests the key 2-3 times a week. We requested the key and inside the public room, we found eight boxes labeled inactive employee files. These boxes contained names, addresses and social security numbers of former City employees. We also found records from the early 1900 s that are in poor condition. Files from the early 1900 s in poor condition in public access section. Inside the storage area, is a door to another room; this door has a sign warning that only authorized staff are permitted to enter. However, the door is unlocked and cannot be locked from the public access side. Inside the restricted area are two vaults with juvenile court case files. During our observation, a staff member entered the room but did not question us or ask for any identification. Random boxes and file cabinets are kept along the sides of the vaulted room. Some items were labeled Clerk and Recorder and Department of Law. Sign on door inside public access section. The door was not locked and as shown, cannot be locked from the public access side due to no keyhole, code security or dead bolt. City and County of Denver P a g e 16

23 Inside the unlocked restricted area are two vaults with juvenile court records. Auditors met with the Clerk and Recorder and informed her about the potential for unauthorized access to juvenile records through the storage room. The Clerk and Recorder sent letters to the Presiding Judge of Denver County Court and the District Court Chief Judge on March 3, 2009, alerting them to the lack of security for court records. The letters also requested immediate follow up for security on the interior door that leads to the court records. When we returned to the room on April 9, 2009, the door remained without a lock. On April 29, 2009, we issued an Audit Alert titled City Records Storage Site Security and Privacy Risks. 10 This alert focused on the records stored at the City and County Building. The areas of concern mentioned in the alert included: o o o o Confidential juvenile court case files Personnel files stored among public records Access not being monitored Historical City records being inappropriately removed and permanently lost As a result of this Audit Alert, City Officials initiated activity to address this problem. Lack of accurate inventory of records stored at the Park Avenue and City and County Building location. At the Park Avenue facility, we found that inventory records were available but were not accurate. In February 2009, the City Records Manager sent an to agency liaisons informing them about files that would need to be removed or destroyed because a different agency was going to occupy the facility. The Records Manager performed an inventory before sending out this , but during our observation, the Records Manager stated that apparently, this inventory was not accurate. The Records Manager s inventory indicated that one of the agencies, the Career Services Authority, had 30 boxes in storage, but the Career Service Authority s own inventory indicated it had more than 100 boxes at the site. For the storage area in the City and County Building, no inventory records existed, meaning that city agencies do not know which records are stored in the room. 10 See Appendix B for reference to the Audit Alert. P a g e 17 Office of the Auditor

24 Inadequate Oversight of Confidential Information at On-Site Storage Locations Our audit also found inadequate oversight of confidential information at two on-site storage locations housed in the Wellington Webb Building. The Career Service Authority and the Controller s Office store records on the fourth-floor of the Wellington Webb Building. During a walkthrough of CSA we found that some of the records that were previously stored at the Park Avenue location are now stored in a fourth-floor file room. This room is unlocked at all times. We found the records stored there contained confidential beneficiary information, including social security numbers. The Payroll Division of the Controller s Office has confidential records in another fourth-floor room. We found the records stored there contained employee W-4 (payroll withholding information) pictured here, direct deposit authorization forms, and child support information. Both of these rooms are easily accessible through the agencies working area, as the receptionist at the front does not require identification to enter. Weaknesses Did Not Extend to Final Storage or Disposal by City s Third Party Storage Facility The weaknesses we identified in procedures at the agencies on-site and off-site storage locations did not exist at the facility operated by Iron Mountain, the contractor the City uses for permanent storage or disposal. As part of the audit, we reviewed Iron Mountain s processes for receiving, storing, retrieving and destroying documents as well as the safety measures and internal controls Iron Mountain takes to safeguard the City s records. This review showed the following: Inventory is tracked. Prior to storage, the City applies bar codes provided by Iron Mountain to identify their boxes and allow tracking of records during the retrieval, storage and destruction processes. The bar code also allows the city to manage their inventory online. A quality assurance program is in place to audit the accuracy of record placement. They regularly perform system to shelve and shelve to systems audits to ensure records are slotted in the correct location within the warehouse. Iron Mountain claimed a 99.9% accurate retrieval rate. Destruction of records occurs in one of two ways. Paper records are usually destroyed by shredding, which can take place at the client site or at Iron Mountain. The second option is incineration which is how electronic, plastic, and some paper documents City and County of Denver P a g e 18

25 are destroyed. A certificate of destruction is issued to the customer after the destruction of records is complete. Several measures are in place to ensure records are protected. These measures include the following: o o o o o o Prior to consideration for employment, a drug screen and 7-year background check is completed. All employees are required to sign a confidentiality agreement and complete records management and handling training. The facility is monitored 24 hours a day 7 days a week. Electronic badge identification is required to enter the facility. In an effort to mitigate the impact and risk of loss in the event of a fire or flood, boxes from different clients are commingled. All records are kept off the floor by elevated shelving to maintain the integrity of the contents. In addition, there are pest containment controls to prevent damage of records. Unsecured Records were Compromised as a Result of Inadequate Oversight Security weaknesses, together with untimely disposal of records, increase the potential for loss, theft and unauthorized access. Files should be destroyed according to retention schedules and confidential information should be maintained in secured locations with limited access. Executive Order 64 section 9.4.2, states that agency heads are to; Be responsible for ensuring compliance with approved agency retention schedules. The lack of oversight and monitoring of City Records has allowed confidential and sensitive records to be accessible to the public and a breach of confidential information provides an opportunity for identity theft and for the removal of records that have historical and possibly monetary value. 11 The Records Manager failed to document any security weaknesses after becoming aware of the issue, and did not notify city agencies that certain records had surpassed their retention date. The problem is exacerbated by Denver s lack of a city archive or procedures for valuing city records. Audit observations at one records storage location noted general disarray and creating a high possibility that original, historical City documents are being inappropriately removed and permanently lost. The absence of proper disposal of records also increases the likelihood of paying for additional storage space for records that are kept past their retention date. 11 The potential for identity theft through poor security has been demonstrated before. For example, a local television station reported that about 250 mental health patients and employees were exposed to identity theft when confidential information was stolen out of a supervisor s car. The supervisor said he had taken the files home to work on them and someone broke into his car and took the suitcase containing the confidential information. See story at (accessed June 11, 2009). P a g e 19 Office of the Auditor

26 Recommendations We offer the following recommendations to prevent city records from being compromised in the future: 1. City agencies should ensure accurate inventories exist for their records and that their records, especially those containing confidential information, are properly safeguarded. 2. The City Records Manager should provide guidance through the Records Management Program to facilitate enhanced records security. 3. The City Records Manager should establish policies and procedures that monitor the existence and safeguarding of records throughout the City. FINDING 3 Specific Records Management Processes Need Improvement Audit work identified several areas in need of improvement related to the management of records by the specific agencies reviewed. The absence of standardized and comprehensive procedures has a number of negative effects, ranging from increased potential for unauthorized access to duplication of effort and an inability to keep track of records. Better implementation of an overall framework for records management, addressed in Finding 1, will help strengthen the City s records management efforts, but these efforts are also dependent on good procedures at the agency level. Some of these steps involve coordination across agency lines, while others involve steps that can be taken at individual agencies we reviewed. Lack of Clear Policy and Procedures for Removal of Systems Access Audit work determined that no controls have been established citywide to ensure that when employees leave, transfer, or are terminated, their access rights to records are properly monitored and removed. For example, the Career Services Authority does not have a procedure in place for removal of access to NeoGov, the agency s recruitment system, which contains sensitive information about applicants. Similarly, audit testing also determined that the Controller s Office did not properly remove a terminated employee s access to the City s human resource and financial system. During these times of increased instances of identity theft, insufficient controls increase the risk of unauthorized personnel obtaining access to city records systems that contain confidential information. Adequate access controls provide reasonable assurance the Access Termination Procedures Not Followed records systems are protected against unauthorized modification, disclosure, loss, or impairment. This is a significant issue, but it is one that requires better coordination of effort within and between agencies rather than new policies and procedures. Technology Services Acceptable City and County of Denver P a g e 20

27 Use Policies and Procedures document already stipulates the access termination procedures to be followed by agencies. The procedures state that supervisors of employees terminating or transferring are responsible for notifying Technology Services of all communication devices, services, and access rights the user has, along with the date the user s access is to be terminated. Inconsistent Content in Personnel Files Audit work showed personnel files throughout the city are either incomplete or contain duplicate information. The Career Services Authority maintains the official personnel files for all Career Service Authority employees, but in some cases, agencies maintain their own unofficial employee personnel files. Agencies do not consistently send all of the necessary records to the Career Services Authority for inclusion into the official personnel file. Inadequate management of personnel files could potentially create legal issues if court proceedings rely on the information in a personnel file, which is incomplete or inconsistent. CSA has an obligation to ensure all relevant City personnel records are being consistently maintained. The lack of effective and efficient management of personnel records leaves the city susceptible to potential legal ramifications. For example, if a lawsuit occurs, all records, including the copies that individual agencies have retained (including metadata), may be identified as discoverable, meaning they could be used against the City in a lawsuit because records gathered may not represent the original copy of record. Management of Financial Records Requires Attention Audit work showed several weaknesses with current procedures related to the City s financial records: Imaging of the City s financial records resides in the wrong agency. The City s financial records are the responsibility of the Chief Financial Officer. However, the Records Imaging Division, which is responsible for imaging (scanning) and monitoring the City s financial records, is currently inappropriately housed within the Office of the Auditor. The Department of Finance was created by Charter in January 2008, unifying the City s accounting and financial functions under the Office of a Chief Financial Officer. However, the Records Imaging Division has not been transferred. This incorrect alignment of the administrative function results in limitations of management of Liberty, the scanning system, and the imaging staff. Duplication of paper copies of financial records occurs throughout the City. All of the agencies reviewed keep convenient copies of financial records for reference purposes. Not all agencies throughout the City have access to electronic copies of financial records. At times, inquiries from vendors are received and the necessary documentation is not available in PeopleSoft so the copy is needed for details. Agency officials stated these copies are discarded in accordance with stipulated retention period. However, these agency officials cited various retention periods, which results in a compliance issue because records may not be destroyed in P a g e 21 Office of the Auditor

28 accordance to retention periods. 12 It is generally considered a poor business practice to retain duplicate copies of various financial records on a citywide basis, especially when many of these records are paper copies. Once financial records are processed in the Controller s Office, they are delivered to the Records Imaging Division where the documents are then scanned into the Liberty system. The paper copies are then sent to Iron Mountain for storage. According to the City and County of Denver's retention schedule and the Colorado State Archives Records Management Manual, the source documents for electronic records may be destroyed prior to the expiration of the retention period. Additional technical support needed for the financial records system. During the course of the audit, it was determined additional support from Technology Services (TS) is in need to maintain the Liberty system. The system periodically is unavailable to users and current support within the agency is not sufficient to correct the issues so therefore, TS is notified for assistance. The stability of Liberty is extremely important if the paper copies are destroyed once they are scanned. The necessary support from TS is an issue that the Controller s Office should address. Non-Compliance with Electronic Record Destruction The Career Services Authority does not destroy its electronic personnel records, and agency officials were unaware of the requirements to destroy electronic records in accordance with the agency s retention schedule. It is an inefficient use of resources to not destroy records (paper and electronic) according to the retention schedule. In addition, the agency contracts for services to create electronic records from paper copies, and the contract includes upgrades and maintenance as needed on a monthly basis. When electronic records are not disposed of, the agency incurs unnecessary costs each month. Inadequate Tracking System for Records Audit work determined that Department of Health and Human Services files containing confidential information could not be easily located or tracked even though the department has a system that could perform this function if used properly throughout the agency. This electronic system, called E-Master Case File, tracks the location of paper files. The system tracks case files from the point of creation and assigns a household number to the file. Each caseworker who has access to files is assigned an identifying number, called a lindex number. The lindex numbers are assigned to each caseworker s files in the system so the file can be located. Of the twenty-eight files tested on-site, two could not be located and six were not with the lindex corresponding caseworker listed in the E-master Case File system. Testing results showed the electronic system s tracking capabilities were not being utilized. The Department s Privacy and Security Manual outlines the importance of the ability to locate client files when needed, and for ensuring that when located, the file will be complete and up- 12 See Appendix A, Executive Order 64, City and County of Denver P a g e 22

29 to-date. This process includes ensuring all case movement is reflected in E-Master Case File. Inaccurate tracking of records may lead to unauthorized access to confidential information. Recommendations We offer the following recommendations to assist city agencies to enhance and strengthen their records management environment. 1. Agencies should adhere to Technology Services policies and procedures for removal of systems access. 2. Career Service Authority should provide direction to agencies regarding personnel file requirements in collaboration with the City Records Manager to ensure consistency. 3. The Controller s Office should assume organizational responsibility for the Records Imaging function currently housed within the Office of the Auditor. 4. The Controller s Office should conduct an economy and efficiency analysis of the current administrative functions dedicated to maintaining the Liberty system. It should also include the need to retain both paper and electronic copies of financial documents. 5. The Controller s Office should provide direction to agencies for the maintenance of financial documents in collaboration with the City Records Manager to avoid duplication of effort and other inefficiencies. 6. The City Records Manager should provide guidance to agencies in regards to destruction of electronic records. 7. The Denver Department of Human Services should fully utilize the E-Master Case File s file tracking capability. P a g e 23 Office of the Auditor

30 APPENDICES Appendix A City and County of Denver P a g e 24

31 P a g e 25 Office of the Auditor

32 City and County of Denver P a g e 26

33 P a g e 27 Office of the Auditor

34 City and County of Denver P a g e 28

35 P a g e 29 Office of the Auditor

36 City and County of Denver P a g e 30

37 P a g e 31 Office of the Auditor

38 City and County of Denver P a g e 32

39 P a g e 33 Office of the Auditor

40 City and County of Denver P a g e 34

41 P a g e 35 Office of the Auditor

42 Appendix B City and County of Denver P a g e 36

43 P a g e 37 Office of the Auditor

44 City and County of Denver P a g e 38

45 Appendix C Records Management Industry Standards Audit work identified a few industry-based standards related to records management programs. Auditors used these standards and best practices in assessing the overall records management program of the City and County and the specific records management efforts of the agencies reviewed. These standards and best practices came from two different organizations and are discussed separately below. ARMA American Records Management Association is the oldest and largest association for the records and information management profession and is the leader and authority on the education of information management issues. ARMA International is a not-for-profit professional association and the authority on managing records and information. It is known worldwide for setting standards and best practices, and for providing comprehensive education, publications, and information on the efficient maintenance, retrieval, and preservation of vital information created in public and private organizations in all sectors of the economy. Due to the expanding volume of information available and the pressing need to manage information correctly, ARMA International has developed a set of Generally Accepted Recordkeeping Principles (GARP) to promote general awareness of recordkeeping standards and principles and to assist organizations in developing records systems that comply with them. These principles are intended to set forth the characteristics of an effective recordkeeping program, while allowing flexibility based upon the unique circumstances of an organization s size, complexity, legal environment, or resources. Following are the eight principles; 1. The Principle of Accountability An organization shall assign a senior executive who will oversee a recordkeeping program and delegate responsibility to appropriate individuals, adopt policies and procedures to guide personnel, and ensure auditability. 2. The Principle of Integrity A recordkeeping program shall be constructed so the records and information generated or managed by or for the organization have a reasonable and suitable guarantee of authenticity and reliability. 3. The Principle of Protection A recordkeeping program shall be constructed to ensure a reasonable level of protection to records and information that are private, confidential, privileged, secret, or essential to business continuity. 4. The Principle of Compliance The recordkeeping program shall be constructed to comply with applicable laws and other binding authorities, as well as the organization s policies. 5. The Principle of Availability An organization shall maintain records in a manner that ensures timely, efficient, and accurate retrieval of needed information. P a g e 39 Office of the Auditor

46 6. The Principle of Retention An organization shall maintain its records and information for an appropriate time, taking into account legal, regulatory, fiscal, operational, and historical requirements. 7. The Principle of Disposition An organization shall provide secure and appropriate disposition for records that are no longer required to be maintained by applicable laws of the organization s policies. 8. The Principle of Transparency The processes and activities of an organization s recordkeeping program shall be documented in an understandable manner and be available to all personnel and appropriate interested parties. 13 NARA National Archives and Records Administration is the nation s record keeper. Documents and materials created in the course of business conducted by the United States Federal government that are important for legal or historical reasons and need to be kept forever, are maintained by NARA. A few examples of the historical records kept by NARA are the Declaration of Independence, the Constitution, and the Bill of Rights. NARA also holds in trust records for the public such as military records and naturalization records of immigrants. NARA keeps only those Federal records that are judged to have continuing value, about 2%-5% of those generated in any given year. By now, they add up to a formidable number, diverse in forma as well as in content. All of these materials are preserved because they are important to the workings of Government, have longterm research worth, or provide information of value to citizens. In addition, NARA must also manage the rapidly growing number of electronic Government records. The Electronic Records Archive (ERA) is NARA s strategic response to the challenge of preserving, managing, and providing access to electronic records. ERA will keep essential electronic Federal records retrievable, readable, and authentic for as long as they remain valuable whether that is a few years or a few hundred years. Of all documents and materials created in the course of business conducted by the United States Federal government, only 1%-3% are so important for legal or historical reasons that they are kept by us forever. Those valuable records are preserved and are available to you, whether you want to see if they contain clues about your family s history, need to prove a veteran s military service, or are researching a historical topic that interests you. The stores of material that make up the National Archives of the United States are available to all American Records Management Association, (accessed June 18, 2009). 14 The Auditor s Office used a publication issued by National Archives and Records Administration. See National Archives and Records Administration General Information Leaflet I, Revised City and County of Denver P a g e 40

47 AGENCY RESPONSE P a g e 41 Office of the Auditor

48 City and County of Denver P a g e 42

49 P a g e 43 Office of the Auditor

50 City and County of Denver P a g e 44

51 P a g e 45 Office of the Auditor

52 City and County of Denver P a g e 46

53 P a g e 47 Office of the Auditor

54 City and County of Denver P a g e 48