The Australian National Audit Office (ANAO) says federal government agencies experiencing growing frustration in dealing with e-mails from private addresses must adopt a strategic approach to e-authentification to overcome identity verification issues.

And it says agencies should consider conducting a risk assessment of each type of e-mail request to determine those that are low risk, and can be replied to via e-mail.

In the just released Better Practice Guide Agency Management of Parliamentary Workflow, Auditor-General Ian McPhee notes agencies face a significant issue in dealing with the growing number of e-mails from private addresses.

"Agencies have reported difficulty, and frustration, in deciding how to deal with this correspondence," the guide says. "In the interests of efficiency and speed, agencies wish to be able to use electronic means to respond to many e-mails from correspondents, but it is difficult to be sure of the correspondent's identity if they are not already known to the agency. An e-mail address does not give reliable information about identity."

The answer lies in part with the Australian Government Authentication Framework, it says, an initiative that aims to overcome identity verification issues by providing a set of principles for government to use in e-authentication and guidelines as to when it is safe to interact with unknown identities. The guide notes the AGAF recognizes different types of transactions require different levels of e-authentication, depending on the degree of risk involved, and recommends agencies develop a strategic approach to e-authentication for each type of transaction where users must present an e-authentication credential appropriate to the level of risk of their transaction.

"In line with AGAF principles, agencies can consider conducting a risk assessment of each type of e-mail request to determine those that are low risk, and can be replied to via e-mail," the guide says. "The ANAO notes that ministers generally take a precautionary approach to use of e-mail to reply to correspondents in the public domain, confining it to addresses that are known to them. Until a reliable authentification system is established that includes individuals, it is better practice for agencies to continue to use hardcopy and postal communication with most ministerial correspondents.

"Agencies can also consider undertaking a generic AGAF risk assessment to review all types of correspondence (both e-mail and hardcopy) and their associated risks. This would inform judgements about the risk category of e-mails the agency receives, what level of authentication is needed, and what type of response is appropriate."

The ANAO recommends agencies seek the correspondent's physical mail address, reconcile this with existing address records, and reply by hardcopy letter when e-mail correspondence is assessed to be in a high-risk category. As an alternative it says agencies can respond to the e-mail highlighting the sensitivity of the request and ask the correspondent to submit their request in writing.

"If, however, the request fits into a low-risk category, the subject matter is not sensitive, or covered by privacy or other information protection legislation, agencies may consider it appropriate to provide an e-mail reply. Responses should be included in a PDF format to reduce changeability," it says.