Unauthorized Records Disposition Incident Report

Use it for unauthorized removal, destruction, or loss of federal records, including paper files, digital records, and mixed-format record sets. It is meant to capture the facts needed for internal review and any required reporting to NARA. If the event is only a routine disposition action completed under schedule, this template is not the right fit. If you are unsure whether the records were federal records, document that uncertainty in the incident summary and review the retention schedule reference.

It is usually completed by the reporting office, records management staff, compliance staff, or a supervisor who can gather the facts quickly. The reporter field should identify the person submitting the report, even if they were not the person who discovered the incident. If your process includes legal, privacy, or security review, those teams can add details before submission. The key is to assign one owner so the report does not stall while multiple people wait to respond.

This is an incident-driven template, so it is used whenever a qualifying records disposition event occurs. It is not a recurring checklist or monthly log. Many organizations keep it ready in advance so they can complete it immediately after discovery and preserve details while they are still fresh. That also helps maintain a clearer audit trail.

Collect only what is needed to identify the incident, the affected record series, the timeframe, the containment steps, and the notification trail. The template supports data minimization by focusing on the record series, volume, format, and sensitivity rather than unnecessary personal details. If names or contact information are needed for follow-up, keep them limited to the reporter and relevant responders. Avoid adding unrelated personal data into the incident narrative.

Yes. The structure includes fields for evidence preserved, evidence details, notification dates, and notified parties so the organization can show what was done after discovery. That helps create a defensible audit trail for internal review and any later submission. If attachments exist, list them in additional documents and keep the source files in a controlled location. Do not rely on free-text alone when a dated record or log entry exists.

The biggest mistakes are leaving the incident type too vague, skipping the known timeframe, and failing to distinguish suspected cause from confirmed cause. Another common issue is marking every field as required, which slows reporting and encourages guesswork. Teams also forget to document immediate containment actions or who was notified, which weakens the record. Use conditional logic so follow-up fields appear only when they apply.

Yes. You can add office-specific routing, record-series lookups, or approval steps without changing the core incident fields. The record series title, number, and retention schedule reference should remain prominent because they anchor the report to the correct disposition authority. If your office handles both paper and digital records, keep the record format field and use progressive disclosure for format-specific details. Avoid adding unrelated fields that do not affect review or submission.

An ad-hoc email usually misses key facts, makes follow-up harder, and creates inconsistent documentation across offices. This template standardizes the fields needed for review, containment, and submission notes while keeping the report readable. It also makes it easier to track who reported the incident, what was affected, and what actions were taken. That consistency is especially useful when multiple offices need to compare incidents over time.