Who is accountable when vital records are lost or unrecoverable after a disaster?

When vital records are lost or unrecoverable after a fire, flood, cyberattack, or other disaster, the natural question is “who is to blame?” In practice, accountability is rarely about a single person. It is distributed across roles, and it is best understood as a question of responsibility assigned before the disaster, not fault assigned after it.

Accountability is organizational first

Recordkeeping is an organizational obligation. Under widely recognized records management principles, the organization as a whole is accountable for ensuring that records remain authentic, reliable, and available for as long as they are needed. A disaster does not erase that obligation. Whether the records were protected, backed up, and recoverable reflects decisions the organization made (or failed to make) ahead of time.

This is why courts, auditors, and regulators tend to look at whether the organization had a reasonable program in place, not merely at who touched the records last.

Where specific roles carry responsibility

Within that organizational duty, several roles typically share accountability:

• Senior leadership and governing bodies are responsible for funding, approving, and enforcing a records and continuity program. Ultimate accountability for program failures usually rests here.
• Records managers and records officers are responsible for identifying vital records, setting retention and protection requirements, and maintaining a vital records and disaster recovery plan.
• IT and information security are responsible for backups, redundancy, access controls, and technical recovery.
• Business and program owners are responsible for following the established procedures for the records they create and use.

The role of advance planning

Accountability is largely determined by whether the organization did the foreseeable work in advance: identifying which records are vital (those essential to resume operations and protect legal and financial rights), storing protected copies off-site or in geographically separate systems, testing recovery, and documenting the plan.

When that work was done in good faith and records were still lost to a truly unforeseeable event, accountability is generally limited. When records were lost because no plan existed or the plan was ignored, responsibility falls on those who owned the program.

For more on protecting irreplaceable records, see the archives and preservation topic hub.