The release of a critical report by the U.S. State Department’s inspector general on former Secretary of State Hillary Clinton’s email practices answers questions that have lingered since last March, raises new ones and creates a moment to reaffirm our expectations for accountability from public servants and their staff.

The former secretary of state’s contention that she complied with the law evades the broader issue: She relied exclusively on a private, unaccountable email system that shielded public records from internal and external scrutiny, disregarded internal efforts that should have led to a change in that system, and then made a series of decisions that created much more difficulty for investigators auditing the systems to assess security or classification issues.

Unfortunately, Clinton’s arrangement, instead of protecting the public trust, seems designed to do the opposite — shield information from any potential public view.

Electronic records are getting harder to manage, but government security rules, regulations and laws exist for a reason. While compliance with them can be time-consuming, no official should be above the law. Proper records management empowers public oversight, and setting up a parallel email system allowed Clinton to evade the Freedom of Information Act, congressional oversight and the reach of inspectors general — all of which play a critical role holding agencies accountable.

Since Clinton left office without turning over her email records to the State Department, it has become extremely difficult to determine which records were governmental and which were not. Allowing a full, independent legal review of a cabinet secretary’s email account (covering both personal correspondence and official business) would have been an extraordinary concession for Clinton to make — but so was using a private email server exclusively for government business.

Gaps in the email trove turned over to the Department of State also drive home how problematic it was for Clinton’s private lawyers to review records to determine what was public business or not. Given that emails with government business have been found that were not turned over, public trust in that process is understandably shaken.

In addition to the concerns about email practices and retention, the inspector general report raises questions about the security of the systems used to transmit data. The apparent disregard for internal checks and balances regarding securing legal authority or security assurance is far short of what we should expect of political appointees and their staffs. We expect government officials to respect security warnings when transmitting sensitive data. If legal and IT practices are in question, the agency and its leadership have a responsibility to address those and work together to develop secure mobile options for those who need them.

The report also indicates that Clinton’s former staff did not fully cooperate with investigators. The public should not have to expect the Department of Justice or a federal judge to compel executive branch secretaries to explain how they used personal email or detail how they protect and secure confidential diplomatic communications.

This occurred all at a time when the State Department is dealing with a huge FOIA caseload; vetting and disclosing the former secretary’s email has pulled in resources that could have been diverted elsewhere.

Shortly after Clinton left office, the State Department took significant steps to reform its records management policies, explicitly governing the use of personal email addresses. Congress passed the Presidential and Federal Records Act Amendments of 2014, further codifying the requirement governmentwide. The National Archives has also issued guidance on email management across the U.S. government.

This report shows how important it is to have a functional inspector general. If Clinton had named a State Department inspector general, instead of leaving the position vacant for four years, this report could have been delivered in 2010 and allowed for a course correction, prevented a scandal, and permitted public oversight to function as designed. Thankfully, the State Department has now appointed an inspector general — the one who issued this report — a role that had been vacant during her tenure. (Regrettably, far too many other agencies do not have an inspector general today.)

Regardless of what the FBI finds, we now know more about how a major federal agency failed to prevent an ongoing shadow system for communication from its head.

As Clinton has acknowledged, she and her staff should never have set up this system nor should the agency have tolerated the arrangement. Conducting public business on a private server that was not properly secured, without ongoing testing, and proactive archiving with department staff was at best a bad decision. At worst, it represented a deliberate choice that avoided transparency and risked the security of sensitive materials.

The points outlined in the report illustrate choices that should inform not only how future executive branch secretaries and their staffs address internal practices around the use of communications technology in government, but how state and local government officials use it as well. Public trust in government is already at historic lows. We can and should expect public servants to proactively manage their records effectively, securely and transparently.