National Preparedness
DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments Gao ID: GAO-11-606 June 21, 2011The anthrax attacks of 2001 and more recent national reports have raised concerns that the United States is vulnerable to attacks with chemical, biological, radiological, and nuclear (CBRN) agents. Because of the potential consequences of such attacks, members of Congress have expressed the need for the Departments of Homeland Security (DHS) and Health and Human Services (HHS) to coordinate in assessing risks posed by CBRN agents. GAO was asked to examine how DHS and HHS coordinate on the development of CBRN risk assessments and the extent to which they have institutionalized such efforts. GAO examined relevant laws, presidential directives, collaboration best practices, and internal control standards; analyzed DHS and HHS CBRN risk assessments; and interviewed DHS and HHS officials.
DHS and HHS have coordinated with each other and with other federal departments to develop CBRN risk assessments, but neither department has written procedures for developing these assessments. GAO's best practices for interagency collaboration and federal standards for internal control indicate that agencies can best enhance and sustain coordination by adopting key practices, such as defining desired common outcomes, agreeing on roles and responsibilities, and developing written policies and procedures to help ensure that management directives are enforced. Such practices and standards could help DHS and HHS institutionalize their agreements on these sensitive and technical issues to better ensure coordination, collaboration, and continuity beyond the tenure of any given official or individual office. (1) DHS develops two types of CBRN risk assessments--terrorism risk assessments (TRA) and material threat assessments (MTA). TRAs assess the relative risks posed by multiple CBRN agents based on variable threats, vulnerabilities, and consequences. MTAs assess the threat posed by given CBRN agents or classes of agents and potential human exposures in plausible, high-consequence scenarios. DHS develops TRAs through interagency workgroups and has developed some MTAs in this way, which allow partners, such as HHS and the Department of Defense, to assess risk models and review and comment on the assessments. However, DHS does not have interagency agreements or written procedures for TRA and MTA development. In addition, DHS's processes and coordination with HHS for MTA development have varied, and HHS officials would like to be more involved. DHS officials told GAO they intend to develop procedures through interagency agreements with federal partners by June 2012 but have not yet established interim time frames or milestones for doing so. By establishing interim time frames and milestones for developing and obtaining interagency agreement on its CBRN risk assessments, DHS could better ensure that it completes its plans in the intended time frame. (2) HHS develops one type of CBRN risk assessment--modeling the public health consequences of attacks using information from DHS MTAs--through an interagency body that includes DHS and other departments, such as the Departments of Defense and Veterans Affairs. HHS signed an interagency agreement and charters with these partners, consistent with interagency coordination best practices. However, HHS does not have written procedures detailing the processes for developing the modeling reports, such as when and how its partners are to provide input and review and comment on the overall report. Written procedures for development and review of the modeling reports could provide HHS with standardized direction for obtaining, evaluating, and incorporating interagency input. In addition, the interagency agreement expires in June 2011, and HHS officials were not certain whether they would renew it based on ongoing revisions to the interagency charters. Renewing the interagency agreement or determining if the revised charters sufficiently outline key practices for working across agency boundaries could help ensure participating departments' commitment to work collaboratively. GAO recommends that DHS establish time frames and milestones to better ensure timely development and interagency agreement on written procedures for development of DHS's CBRN risk assessments and that HHS develop written procedures for obtaining and incorporating interagency input into its modeling reports and determine whether to renew its interagency agreement. DHS and HHS generally agreed. HHS expressed concern that the report implied it does not vet its products through its interagency partners, but GAO believes that it appropriately credited HHS with having a process to do so in the report.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: William O. Jenkins Jr Team: Government Accountability Office: Homeland Security and Justice Phone: (202) 512-8757GAO-11-606, National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments
This is the accessible text file for GAO report number GAO-11-606
entitled 'National Preparedness: DHS and HHS Can Further Strengthen
Coordination for Chemical, Biological, Radiological, and Nuclear Risk
Assessments' which was released on June 21, 2011.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to the Committee on Homeland Security and Governmental Affairs,
U.S. Senate:
June 2011:
National Preparedness:
DHS and HHS Can Further Strengthen Coordination for Chemical,
Biological, Radiological, and Nuclear Risk Assessments:
GAO-11-606:
GAO Highlights:
Highlights of GAO-11-606, a report to the
Committee on Homeland Security and Governmental Affairs, U.S. Senate.
Why GAO Did This Study:
The anthrax attacks of 2001 and more recent national reports have
raised concerns that the United States is vulnerable to attacks with
chemical, biological, radiological, and nuclear (CBRN) agents. Because
of the potential consequences of such an attack, members of Congress
have expressed the need for the Departments of Homeland Security (DHS)
and Health and Human Services (HHS) to coordinate in assessing risks
posed by CBRN agents. GAO was asked to examine how DHS and HHS
coordinate on the development of CBRN risk assessments and the extent
to which they have institutionalized such efforts. GAO examined
relevant laws, presidential directives, collaboration best practices,
and internal control standards; analyzed DHS and HHS CBRN risk
assessments; and interviewed DHS and HHS officials.
What GAO Found:
DHS and HHS have coordinated with each other and with other federal
departments to develop CBRN risk assessments, but neither department
has written procedures for developing these assessments. GAO‘s best
practices for interagency collaboration and federal standards for
internal control indicate that agencies can best enhance and sustain
coordination by adopting key practices, such as defining desired
common outcomes, agreeing on roles and responsibilities, and
developing written policies and procedures to help ensure that
management directives are enforced. Such practices and standards could
help DHS and HHS institutionalize their agreements on these sensitive
and technical issues to better ensure coordination, collaboration, and
continuity beyond the tenure of any given official or individual
office.
* DHS develops two types of CBRN risk assessments”terrorism risk
assessments (TRA) and material threat assessments (MTA). TRAs assess
the relative risks posed by multiple CBRN agents based on variable
threats, vulnerabilities, and consequences. MTAs assess the threat
posed by given CBRN agents or classes of agents and potential human
exposures in plausible, high-consequence scenarios. DHS develops TRAs
through interagency workgroups and has developed some MTAs in this
way, which allow partners, such as HHS and the Department of Defense,
to assess risk models and review and comment on the assessments.
However, DHS does not have interagency agreements or written
procedures for TRA and MTA development. In addition, DHS‘s processes
and coordination with HHS for MTA development have varied, and HHS
officials would like to be more involved. DHS officials told GAO they
intend to develop procedures through interagency agreements with
federal partners by June 2012 but have not yet established interim
time frames or milestones for doing so. By establishing interim time
frames and milestones for developing and obtaining interagency
agreement on its CBRN risk assessments, DHS could better ensure that
it completes its plans in the intended time frame.
* HHS develops one type of CBRN risk assessment”modeling the public
health consequences of attacks using information from DHS MTAs”through
an interagency body that includes DHS and other departments, such as
the Departments of Defense and Veterans Affairs. HHS signed an
interagency agreement and charters with these partners, consistent
with interagency coordination best practices. However, HHS does not
have written procedures detailing the processes for developing the
modeling reports, such as when and how its partners are to provide
input and review and comment on the overall report. Written procedures
for development and review of the modeling reports could provide HHS
with standardized direction for obtaining, evaluating, and
incorporating interagency input. In addition, the interagency
agreement expires in June 2011, and HHS officials were not certain
whether they would renew it based on ongoing revisions to the
interagency charters. Renewing the interagency agreement or
determining if the revised charters sufficiently outline key practices
for working across agency boundaries could help ensure participating
departments‘ commitment to work collaboratively.
What GAO Recommends:
GAO recommends that DHS establish time frames and milestones to better
ensure timely development and interagency agreement on written
procedures for development of DHS‘s CBRN risk assessments and that HHS
develop written procedures for obtaining and incorporating interagency
input into its modeling reports and determine whether to renew its
interagency agreement. DHS and HHS generally agreed. HHS expressed
concern that the report implied it does not vet its products through
its interagency partners, but GAO believes that it appropriately
credited HHS with having a process to do so in the report.
View [hyperlink, http://www.gao.gov/products/GAO-11-606] or key
components. For more information, contact William O. Jenkins, Jr. at
(202) 512-8777 or jenkinswo@gao.gov or Marcia Crosse at (202) 512-7114
or crossem@gao.gov. [End of section]
Contents:
Letter:
Background:
DHS and HHS Coordinate on the Development of CBRN Risk Assessments but
Do Not Have Written Procedures for Their Development:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: DHS and HHS Chemical, Biological, Radiological, and
Nuclear Risk Assessments:
Appendix II: Comments from the Department of Homeland Security:
Appendix III: Comments from the Department of Health and Human
Services:
Appendix IV: GAO Contacts and Staff Acknowledgments:
Related GAO Products:
Table:
Table 1: Diseases and Agents for Which HHS Has Developed Medical and
Public Health Consequence Modeling Reports:
Abbreviations:
BTRA: biological terrorism risk assessment:
CBRN: chemical, biological, radiological, and nuclear:
CTRA: chemical terrorism risk assessment:
DHS: Department of Homeland Security:
HHS: Department of Health and Human Services:
HSPD: Homeland Security Presidential Directive:
ITRA: integrated CBRN terrorism risk assessment:
MOU: memorandum of understanding:
MTA: material threat assessment:
PHEMCE: Public Health Emergency Medical Countermeasures Enterprise:
R/NTRA: radiological and nuclear terrorism risk assessment:
TRA: terrorism risk assessment:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
June 21, 2011:
[End of section]
The Honorable Joseph I. Lieberman:
Chairman:
The Honorable Susan M. Collins:
Ranking Member:
Committee on Homeland Security and Governmental Affairs:
United States Senate:
The anthrax attacks of 2001 raised concerns that the United States is
vulnerable to threats from chemical, biological, radiological, and
nuclear (CBRN) agents, and the 2007 National Strategy for Homeland
Security stated that terrorists have declared their intention to
acquire and use CBRN agents as weapons to inflict catastrophic attacks
against the United States.[Footnote 1] More recently, the May 2010
National Security Strategy noted that the American people face no
greater or more urgent danger than a terrorist attack with a nuclear
weapon, as well as the concern that the effective dissemination of a
lethal biological agent within a U.S. city would endanger the lives of
hundreds of thousands of people and have unprecedented economic,
societal, and political consequences.[Footnote 2] In addition,
multiple groups have assessed the federal government's ability to
protect the nation from CBRN agents and deemed it inadequate. For
example, in January 2010, the congressionally mandated Commission on
the Prevention of Weapons of Mass Destruction Proliferation and
Terrorism reported that the federal government lacked the capability
to rapidly recognize, respond to, and recover from a terrorist attack
using biological agents.
Because CBRN agents differ in their potential to be used to cause
widespread illness and death, members of Congress have expressed the
need for the Departments of Homeland Security (DHS) and Health and
Human Services (HHS) to assess the risks posed by CBRN agents in order
to identify the highest-risk agents, and use their assessments to
guide development of response capabilities. Response capabilities
include medical countermeasures such as drugs, vaccines, and devices
to diagnose, treat, prevent, or mitigate the potential effects of
exposure to these agents, and CBRN surveillance and detection
equipment. Assessing the risks posed by CBRN agents requires analyzing
and modeling areas of great uncertainty, including determining an
adversary's capability to acquire these agents, develop them into
weapons, and disseminate them to estimate the plausibility and
consequences of such attacks. In order to prepare for and respond to
potential attacks, effective assessment of the risks posed by CBRN
agents to national security and public health requires successful and
sustained coordination and collaboration between DHS, HHS, and other
federal departments and agencies with responsibilities and expertise
in this area.[Footnote 3] Federal agencies can enhance and sustain
their collaboration on CBRN risk assessment efforts by engaging in key
practices--including agreeing on roles, responsibilities, processes,
and outcomes--and by establishing this collaboration in written
agreements. Institutionalizing this information in writing can better
ensure that these agreements continue beyond the tenure of any given
agency official, enabling future officials to know how they should
develop CBRN risk assessments collaboratively with their partner
agencies.
You asked us to examine interagency coordination between DHS and HHS
for the development of their CBRN risk assessments. This report
addresses how DHS and HHS coordinate on the development of CBRN risk
assessments and the extent to which they have institutionalized such
efforts through interagency agreements and written procedures.
To determine how DHS and HHS coordinate on the development of CBRN
risk assessments and the extent to which they have institutionalized
such efforts, we reviewed relevant federal laws, presidential
directives, executive orders, and national strategies. We reviewed
these documents to identify requirements for DHS and HHS to develop
and engage in interagency coordination during the development of their
CBRN risk assessments and compared these requirements against DHS's
and HHS's efforts. We obtained and reviewed the CBRN risk assessments
DHS and HHS developed since 2004, the year initial legislative
requirements were enacted for the departments to develop these
assessments, to determine how these documents were developed and to
identify DHS's and HHS's processes for their development. We examined
coordination between DHS and HHS for the development of CBRN risk
assessments and did not examine the coordination between other federal
departments since DHS and HHS have primary responsibility for
conducting and overseeing CBRN risk assessment activities. For the
purposes of this report, we consider CBRN risk assessments to include
DHS's terrorism risk assessments (TRA) and material threat assessments
(MTA) and HHS's public health and medical consequence modeling
reports. TRAs assess the risks posed by CBRN agents based on variable
threats, vulnerabilities, and consequences.[Footnote 4] MTAs assess
the threat posed by given CBRN agents and the potential number of
human exposures in plausible high-consequence scenarios. Modeling
reports assess the public health and medical consequences of attacks
with CBRN agents for given scenarios. (See app. I for more information
on the TRAs, MTAs, and modeling reports.) We reviewed our best
practices to enhance and sustain agency collaboration, as well as
Standards for Internal Control in the Federal Government, for
guidelines on internal controls--an integral component of an
organization's management that provides reasonable assurance that
objectives including effectiveness and efficiency of operations are
being achieved--and the Project Management Institute's Standard for
Program Management for program management best practices.[Footnote 5]
We compared these practices and standards to DHS's and HHS's CBRN risk
assessment development activities and related documents. We also
interviewed officials from multiple DHS and HHS offices, components,
and agencies--including DHS's Science and Technology Directorate and
HHS's Office of the Assistant Secretary for Preparedness and Response--
to obtain information on their interagency coordination processes for
CBRN risk assessment development.
We conducted this performance audit from January 2011 through June
2011 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable
basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objectives.
Background:
DHS leads federal interagency coordination and planning for emergency
response to catastrophic CBRN incidents in the United States. DHS is
responsible for assessing the risks posed by various CBRN agents, as
directed by the Project BioShield Act of 2004[Footnote 6] and Homeland
Security Presidential Directives (HSPD) 10 (Biodefense for the 21st
Century), 18 (Medical Countermeasures against Weapons of Mass
Destruction), and 22 (National Domestic Chemical Defense). To this
end, DHS's Science and Technology Directorate develops CBRN TRAs and
MTAs.
* Each TRA assesses the relative risks posed by multiple CBRN agents
based on variable threats, vulnerabilities, and consequences. Since
2004, DHS has developed seven TRA reports, with additional TRAs to be
published in 2011.
* Each MTA assesses the threat posed by a given, individual CBRN agent
or class of agents and the potential number of human exposures in
plausible, high-consequence scenarios. Since 2004, DHS has developed
17 MTA reports.
DHS uses the MTAs to determine which CBRN agents pose a material
threat sufficient to affect national security.[Footnote 7] (See
appendix I for more information on DHS's TRAs and MTAs.)
HHS leads the federal public health and medical response to potential
CBRN incidents. Under the Project BioShield Act, HHS is required to
assess, on an ongoing basis, the potential public health consequences
of those CBRN agents that DHS determines pose a material threat
sufficient to affect national security. This law requires HHS to
determine for which of these agents medical countermeasures are
necessary to protect the public's health.[Footnote 8] HHS conducts
these activities through the Public Health Emergency Medical
Countermeasures Enterprise (PHEMCE), a federal interagency decision-
making body HHS established in 2006.[Footnote 9] Officials from HHS,
[Footnote 10] DHS,[Footnote 11] the Department of Defense,[Footnote
12] the Department of Veterans Affairs, the Department of Agriculture,
and the Executive Office of the President participate in the PHEMCE
working groups and senior council. The PHEMCE working groups and
senior council serve as the primary means of communication between
these federal departments on CBRN medical countermeasure issues. As
part of their activities, PHEMCE working group members develop medical
consequence modeling reports to help assess the potential public
health and medical consequences of attacks with given CBRN agents,
which is an interim step in determining what types and quantities of
medical countermeasures may be required to respond. Since 2004, HHS
has issued 19 modeling reports for various CBRN agents. HHS develops
modeling reports using data from DHS's MTAs, such as the number of
individuals exposed to a given agent, to calculate the number of
individuals who may become ill, be hospitalized, or die based on the
MTA scenarios. (See appendix I for more information on HHS's modeling
reports.)
DHS and HHS Coordinate on the Development of CBRN Risk Assessments but
Do Not Have Written Procedures for Their Development:
DHS and HHS have coordinated with each other and with other federal
departments for the development of CBRN risk assessments, but neither
has written procedures for developing these assessments. Such written
procedures are important for enhancing and sustaining collaboration
because they can help ensure that the departments institutionalize
agreements on their respective roles and responsibilities, processes
for developing the risk assessments, and desired outcomes. DHS and HHS
officials are currently discussing DHS's processes for developing CBRN
risk assessments because HHS officials said that they are concerned
that they have not been consistently involved early or substantively
enough in the process. DHS officials told us they intend to develop
written procedures through interagency agreements with federal
partners by June 2012, but DHS has not yet established interim time
frames and milestones as part of a plan to ensure that it accomplishes
these results by that time. HHS has signed a memorandum of
understanding (MOU) and working group charters with DHS and other
federal partners that participate in PHEMCE, but the department does
not have written procedures that detail the interagency processes that
PHEMCE working group members are to use to develop modeling reports.
Also, agency officials were not certain whether HHS will renew the
MOU, which expires in June 2011, based on ongoing revisions to the
working group charters.
DHS Coordination with HHS on the Development of Its CBRN Risk
Assessments Has Varied, and DHS Has Not Yet Established Related
Written Procedures:
Starting with the first biological terrorism risk assessment (BTRA) in
2006, DHS coordinated with HHS and other federal partners prior to
issuing the TRAs.[Footnote 13] For the 2006 BTRA, DHS consulted with
interagency experts via an ad hoc process to solicit their input
during the development of the risk assessment or to have them comment
on the draft document. DHS did not have interagency agreements or
written procedures to articulate roles, responsibilities, or processes
for interagency development or review of the risk assessment. In
addition, DHS did not have interagency working groups or other
structures to regularly solicit and receive partner input. For
example, according to HHS officials, DHS did not involve HHS as the
2006 BTRA was being developed but did ask HHS to comment on it after
it was drafted. According to DHS officials, working groups were not
established for the 2006 BTRA because of the limited time that DHS had
to complete this task.
Since the 2006 BTRA, interagency coordination for the development and
review of the TRAs has become more structured and been strengthened,
according to DHS officials. This strengthening of coordination was
based in part on feedback received from its interagency partners. For
example, DHS officials said that HHS officials wanted to be
consistently involved earlier in the development of the TRAs to be
able to raise issues prior to reviewing the draft reports. DHS
established two types of federal interagency working groups designed
to increase the structure for obtaining interagency input on
developing and reviewing TRAs.[Footnote 14] First, DHS established a
working group for each TRA composed of CBRN experts from a variety of
federal agencies, including HHS. For example, the integrated CBRN
terrorism risk assessment (ITRA) working group includes officials from
HHS's Office of the Assistant Secretary for Preparedness and Response
and the National Institutes of Health. These working groups meet
monthly to quarterly on an ongoing basis and provide a forum for
members to (1) assess TRA modeling results, (2) request specialized
studies to be included, and (3) review and comment on draft TRA
reports.[Footnote 15] Second, DHS established a working group composed
of experts from the intelligence community so DHS can obtain their
input into and review of threat analysis data for the TRAs. According
to DHS officials, this working group meets on an as-needed basis.
DHS does not have interagency agreements or written procedures to
define the process for how the TRAs should be developed with DHS's
interagency partners, the products that should be produced, or the
roles and responsibilities of involved agencies. Not having agreements
and procedures is not consistent with our best practices for
interagency collaboration and federal standards for internal control.
According to our best practices, federal agencies engaged in
interagency coordination can enhance and sustain their collaboration
by adopting key practices--including defining and articulating a
common outcome, agreeing on roles and responsibilities, and
establishing compatible policies and procedures for operating across
agency boundaries. In addition, agencies can strengthen their
commitment to work collaboratively by articulating their agreements on
these key practices in documents, such as MOUs or interagency planning
documents, signed by senior officials in the respective agencies.
[Footnote 16] Further, federal standards for internal control call for
agencies to develop written policies and procedures that enforce
management's directives.[Footnote 17]
DHS officials stated that interagency coordination to date has relied
on the personal relationships established by involved officials, and
that DHS was not required to develop interagency agreements or written
procedures. However, DHS officials agree that such interagency
agreements and written procedures should be developed, and they plan
to develop them by June 2012, as directed by the Chief Medical and
Science Advisor in the Chemical and Biological Division of DHS's
Science and Technology Directorate in early 2011.[Footnote 18]
DHS began an effort to develop written policies and procedures for the
TRA working groups at the end of 2010. Specifically, DHS drafted a
charter for the working group that developed the 2011 ITRA, and DHS
officials told us in October 2010 that they planned to do the same for
the three other TRA working groups by the end of fiscal year 2011.
However, as of March 2011, DHS officials said they had ended their
efforts to finalize the ITRA charter and develop charters for the
other working groups.
DHS officials told us that they have begun drafting a strategic plan
for DHS's overall CBRN risk assessment efforts and implementation
plans for each of the TRAs and for the MTAs. The strategic and
implementation plans, according to DHS officials, will contain written
procedures to define TRA and MTA (1) interagency development
processes, (2) products, and (3) roles and responsibilities for
involved agencies. In addition, DHS officials said they will seek to
have these plans signed by senior leaders at each of DHS's partner
agencies to demonstrate interagency agreement on these procedures. DHS
officials emphasized the importance of having their partners sign the
documents to establish their commitment to working collaboratively on
DHS's CBRN risk assessments based on the agreements articulated within
the plans. At the time of our review, DHS did not have documentation
available for us to review related to this initiative. HHS officials
said that they had not seen the draft plans and were not in a position
to agree or disagree with DHS's approach but have told DHS they would
like to collaborate on this effort.
Moreover, DHS has not yet developed interim time frames and milestones
as part of a plan--consistent with standard practices for program
management--to develop, finalize, and obtain interagency agreement on
the proposed strategic and implementation plans. According to DHS
officials, such milestones include drafting the strategic and
implementation plans with input from DHS's interagency partners,
obtaining approval from DHS senior management and general counsel to
distribute the drafts, receiving and incorporating any changes
requested by the partners, and obtaining interagency signatures on the
final documents to institutionalize the interagency agreements. The
Chief Medical and Science Advisor in the Chemical and Biological
Division of DHS's Science and Technology Directorate initially told us
in March 2011 that DHS planned to complete this effort by the end of
September 2011, but has since extended this estimated completion date
to June 2012.[Footnote 19] Establishing interim time frames would
identify targeted dates for completing these milestone activities,
among others, by June 2012.
DHS's coordination with HHS and other agencies, as well as its
processes for developing MTAs, have varied. Based on our analysis of
DHS's processes for developing 17 MTAs from 2004 to 2010, DHS used at
least four different processes for interagency coordination. For most
of the MTAs, DHS held a preliminary discussion with HHS on the need
for a new MTA, as well as the scope and scenario to be assessed. In
some of these cases, DHS followed the preliminary discussion with HHS
by convening two interagency workshops, one to solicit input on the
proposed approach to developing the MTA and the other to solicit
interagency comments on the MTA once it was drafted. However, in other
cases, DHS only held the preliminary discussion with HHS and the later
workshop to review the draft document. For one MTA, DHS did not hold a
preliminary discussion with HHS or convene any workshops during its
development.
A DHS official involved with the MTA coordination process said that
while DHS had defined a general approach to developing MTAs, the
actual processes followed for a given MTA varied over time, were ad
hoc, and were not guided by interagency agreements or written
procedures. As a result, the process for obtaining interagency input
was inconsistent from 2004 to 2010. He said that in those instances
that DHS did not solicit interagency input through the workshops, DHS
officials worked to obtain such input by contacting the interagency
experts directly. He also said that DHS sometimes did not convene
interagency workshops to reduce travel and other costs associated with
holding these workshops in person.
HHS officials described DHS's processes for developing MTAs as ad hoc
and varied and said that they wanted more substantive and consistent
coordination with DHS. HHS officials also told us that, in general,
they had not been involved in key MTA development decisions. HHS uses
the MTAs to help assess the medical and public health consequences of
attacks with CBRN agents and determine the amount and type of
countermeasures to develop and buy to respond to potential CBRN
incidents. HHS officials told us that their early and consistent
involvement in the development of an MTA can affect how useful the MTA
is to HHS for these decisions. HHS officials cited the development of
the smallpox MTA, which DHS began developing in 2010 at HHS's request,
as an example of improved coordination in which HHS was involved more
substantively. For this MTA, DHS officials said they consulted with
HHS on the development of the MTA prior to its development and are
engaged in ongoing discussions with HHS throughout the development
process.[Footnote 20] However, HHS officials told us that this
modified process was also an ad hoc effort that has only been used to
develop the smallpox MTA, and they had no assurance that DHS would
necessarily use this process for developing future MTAs.
DHS does not have interagency agreements or written procedures to
define the process for how the MTAs should be developed with its
interagency partners, the products that should be produced, or the
roles and responsibilities of involved agencies. Not having this
documentation is not consistent with our best practices for
interagency collaboration and federal standards for internal control.
DHS officials said they plan to develop them by June 2012. DHS tried
to develop an interagency agreement related to MTA development in
2008. Specifically, DHS drafted an MOU for DHS and HHS for issuing
statements related to particular CBRN agents that pose a material
threat to the nation based on MTA results. HHS officials said they did
not sign the draft MOU, which was sent to HHS in July 2008, because
they disagreed with some of its principles. For example, HHS officials
expressed concern about their level of involvement in providing input
into the assumptions and data used to develop the MTAs. In January
2011, DHS considered renewing its effort to have a revised MOU signed
by HHS. However, DHS and HHS officials told us that these efforts were
superseded by their ongoing discussions related to DHS's proposed
strategic and implementation plans. As of May 2011, HHS officials told
us that their concerns had not yet been resolved with DHS.
By establishing interim time frames and milestones for developing and
obtaining interagency agreement on its CBRN risk assessment efforts,
DHS management could be better positioned to ensure that the
department's proposed strategic and implementation plans are completed
in the intended time frame. Such interim time frames and milestones
could better ensure that DHS completes the strategic and
implementation plans by June 2012 by, for example, allowing DHS senior
leadership to monitor the department's progress on meeting interim
time frames for achieving milestones for completion of these plans.
DHS officials told us that these strategic and implementation plans
will help ensure that DHS and its interagency partners achieve
agreement on TRA and MTA interagency development processes and
outcomes and agency roles and responsibilities, as well as establish
DHS's and its partners' commitment to work collaboratively on these
risk assessments. The proposed strategic and implementation plans
could better ensure that future interagency coordination for the
development of the TRAs and MTAs does not depend solely on personal
relationships among officials from DHS and its federal partners, but
is instead institutionalized at the department and continues beyond
the tenure of any given official. In addition, as new interagency
officials join the TRA working groups or MTA workshops, the proposed
plans could better ensure that these new officials understand DHS's
CBRN risk assessment development and review processes, the status of
current TRA or MTA development, and their respective roles and
responsibilities for these efforts.
HHS Signed an Interagency Agreement and Coordinates with DHS to
Develop Modeling Reports but Does Not Have Written Procedures for
Their Development:
HHS has signed an interagency agreement with DHS and other federal
partners to develop public health and medical consequence modeling
reports but does not have written procedures that specifically outline
how HHS and its federal partners, including DHS, are to develop and
review these modeling reports. In 2008, HHS signed an MOU and working
group charters with its PHEMCE partners--including DHS, the Department
of Defense, and others--which support interagency coordination for
PHEMCE activities, including developing public health and medical
consequence modeling reports, among other activities.[Footnote 21]
Together, the PHEMCE MOU and working group charters--which stipulate
the overall responsibilities and minimum meeting frequencies of the
interagency working groups--are consistent with best practices for
collaboration and generally serve to enhance and sustain agency
collaboration by defining common outcomes and providing interagency
agreement on roles and responsibilities as called for in our previous
work.[Footnote 22] However, the MOU and charters do not delineate how
PHEMCE partners are to conduct medical consequence modeling, develop
reports, and usher them through the interagency review process.
[Footnote 23] Not having this documentation is not consistent with
federal standards for internal control, which call for agencies to
develop written policies and procedures that enforce management's
directives.[Footnote 24]
From 2004 through 2006, the Executive Office of the President led
interagency coordination efforts to assess public health and medical
consequences, develop CBRN modeling reports, and establish medical
countermeasure requirements. In 2006, HHS began leading the assessment
of public health and medical consequences of CBRN agents and setting
strategies for developing and acquiring medical countermeasures
through the interagency PHEMCE. According to HHS officials, the PHEMCE
working groups provide HHS officials with a structure for coordinating
and obtaining interagency input on the modeling reports, among other
activities. For example, HHS officials told us that within the PHEMCE
working groups, interagency participants discuss any assumptions
inherent in data about the agent or in planned responses to attacks
outlined in the MTA scenarios and the range of variables and their
parameters to make informed decisions on the inputs used to develop
the modeling reports. HHS officials told us that the contractors and
HHS staff who run the mathematical models for the modeling reports
also participate in all PHEMCE working group meetings.
As part of assessing public health and medical consequences and
developing the modeling reports, PHEMCE working group members assess
and discuss each section of the modeling reports, including the
background information about the agent and the availability of medical
countermeasures. Although the PHEMCE MOU and charters do not contain
specific procedures for how PHEMCE partners are to develop the
modeling reports, they help ensure overall coordination with DHS and
other federal partners for PHEMCE activities. The Assistant Secretary
for Preparedness and Response noted that collaboration with DHS has
improved greatly over the past several years under the PHEMCE
structure. In addition, DHS officials told us that they regularly
attend PHEMCE meetings and are satisfied with the level of
coordination. However, HHS officials noted that there are only a
limited number of experts within PHEMCE and the federal government who
have worked with CBRN agents or with individuals infected with these
agents. They added that bringing all of these experts together to
provide input on the modeling reports and other PHEMCE activities can
be challenging because these experts often have competing
responsibilities.
According to HHS officials, the department did not develop written
procedures for the development of modeling reports because the
processes for conducting medical consequence modeling and developing
the reports are constantly evolving and improving. For example,
officials stated that more recent reports incorporate more factors and
information than earlier versions. In addition, HHS officials told us
that they do not have guidance or templates for the modeling reports
because each CBRN agent is unique in the way it is transmitted and
causes illness or injury and may not fit into a predetermined
template. However, written procedures for the development and review
of the modeling reports could provide HHS with standardized direction
for obtaining, evaluating, and incorporating interagency input on
these reports, while still allowing HHS to improve the modeling
reports based on new scientific factors or information or new modeling
techniques, or to tailor the reports to the characteristics of
specific agents or types of agents. Furthermore, written procedures
could also better ensure that future interagency coordination for the
development of the modeling reports does not depend on personal
relationships between officials from HHS, DHS, and other federal
agencies. Written procedures could also help ensure that PHEMCE
participants approach the development and review of each report
consistently. In addition, as new interagency officials join the
PHEMCE working groups, written procedures could help these new
officials better understand PHEMCE's processes for assessing public
health consequences and conducting modeling, the status of current
modeling report development, and their respective roles and
responsibilities in this effort.
The 2008 MOU is set to expire in June 2011. However, according to HHS,
the structure, membership, and roles of some PHEMCE participants has
changed. For example, PHEMCE now includes officials from the
Department of Agriculture, while participants from the Executive
Office of the President no longer participate at the senior council
level. HHS is currently revising the PHEMCE senior council charter to
reflect the new structure and will include clarification of roles and
responsibilities of the PHEMCE senior council. HHS officials told us
they will determine whether to renew the MOU once they revise the
senior council charter. Best practices for collaboration suggest that
federal agencies engaged in interagency coordination can enhance and
sustain their collaboration by articulating these practices in written
agreements, such as MOUs. It is not clear whether the revised senior
council charter will define and articulate common outcomes or
establish compatible policies and procedures for operating across
agency boundaries. Revising the charter to include this information,
or renewing the PHEMCE MOU and updating it to reflect current
membership if it does not, could help demonstrate the commitment of
all participating federal departments to working collaboratively and
helping to ensure sustained interagency coordination for the
development of modeling reports and other PHEMCE activities.
Conclusions:
In order to prepare for and respond to potentially catastrophic
attacks with CBRN agents, effective assessment of the risks posed by
these agents to national security and public health requires
successful and sustained coordination and collaboration between DHS,
HHS, and other responsible federal departments and agencies. DHS and
HHS have been developing CBRN risk assessments--DHS's TRAs and MTAs
and HHS's medical consequence modeling reports--since 2004, and their
processes for coordinating risk assessment development have evolved
over the past 7 years but have not been fully institutionalized in
writing. Developing written agreements could help DHS and HHS reach
concurrence on procedures acceptable to both departments on their
expected levels of involvement in developing their respective risk
assessments. Given the additional value incorporated into the CBRN
risk assessments from DHS and HHS working collaboratively to harness
all available expertise, DHS and HHS could enhance their risk
assessment processes by establishing written procedures for developing
and reviewing these assessments. Establishing written procedures also
includes updating existing interagency agreements, such as the PHEMCE
MOU, or determining whether other agreements HHS is developing may be
sufficient. Written procedures would provide direction for interagency
coordination. In addition, interagency agreements could help ensure
that sustained coordination continues beyond the tenure of any given
agency official, enabling future officials to know their respective
roles and responsibilities. While DHS intends to develop such
procedures by June 2012 in collaboration with its partners,
establishing interim time frames and milestones for developing the
strategic and implementation plans could allow DHS senior leadership
to monitor departmental progress to better ensure completion of these
efforts to institutionalize interagency coordination.
Recommendations for Executive Action:
To ensure that DHS senior officials are able to monitor progress on
the development of the proposed strategic and implementation plans for
DHS's CBRN risk assessment efforts, we recommend that the Secretary of
Homeland Security develop and document interim time frames and
milestones as part of a plan to develop, finalize, and obtain
interagency agreement on the written procedures for interagency
development of the TRAs and MTAs that DHS intends to issue as
strategic and implementation plans.
To ensure that HHS and its federal partners are fully aware of and
agree with the processes for developing the public health and medical
consequence modeling reports and that consistent and effective
interagency coordination continues, we recommend that the Secretary of
Health and Human Services take the following two actions:
* develop written procedures for obtaining, evaluating, and
incorporating interagency input into the development and review of the
modeling reports, to supplement the PHEMCE MOU and working group
charters, and:
* determine whether to renew the MOU or whether alternate coordination
mechanisms, such as the PHEMCE senior council charter, are sufficient
to confirm federal departments' agreement to work collaboratively.
Agency Comments and Our Evaluation:
We provided a draft of this report to DHS and HHS for their review.
Both departments provided written comments, which are summarized below
and reprinted in appendixes II and III, respectively. The departments
also provided technical comments, which we incorporated where
appropriate.
DHS concurred with, and HHS generally agreed with, the basis for the
recommendations and discussed actions planned or under way to address
them. With regard to the first recommendation, DHS stated that the
department has begun efforts to develop milestones and time frames for
its strategic and implementation plans for interagency TRA and MTA
development. In addition, DHS stated that enhanced coordination with
HHS and its other federal partners for the development of the TRAs and
MTAs was important, especially as the MTAs support HHS's medical
countermeasure decision making.
With regard to the second recommendation, HHS stated that it
conceptually agreed that institutionalizing agreements and procedures
for the development of the modeling reports in writing is important.
However, HHS expressed concern that the report implies that HHS does
not vet its products through PHEMCE partners, including its modeling
reports. We disagree. The report states, for example, that PHEMCE
provides a means for HHS to coordinate and obtain interagency input on
modeling reports, among other activities. With regard to the third
recommendation, HHS stated that it concurs and had taken action to
renew the PHEMCE interagency MOU.
HHS also commented that our use of the term "risk" is not consistent
with DHS's and HHS's use of this term. DHS defines risk as the
potential for an adverse outcome assessed as a function of threats,
vulnerabilities, and consequences and risk assessment as a process to
assign probabilities to such outcomes. HHS pointed out that while
DHS's MTAs assess threat, they do not include an assessment of the
probability that a particular agent will be used. We recognize that
the MTAs and HHS's medical consequence modeling reports do not
individually contain all three elements of threat, vulnerability, and
consequence and an assessment of probability that make up DHS's
definition of risk. However, for the purposes of this report we
consider both the MTAs and the modeling reports to be CBRN risk
assessments. The MTAs contain assessments of threat and vulnerability,
and modeling reports contain assessments of consequence and
vulnerability based on the MTAs. These two types of assessments, along
with DHS's TRAs, provide measurements of risk consistent with the
departments' use of the term. We modified the language in the report
to appropriately clarify the use of this term.
Finally, HHS stated that the report's focus on HHS's modeling reports
creates an inaccurate perception of these documents as end products.
This was not our intention. Specifically, the report states that these
documents are not intended by HHS to be end products and represent an
interim step of assessing potential public health and medical
consequences and determining what types and quantities of medical
countermeasures HHS may need to respond to a CBRN event. However, to
address HHS's concerns, we modified text in appendix I discussing the
modeling reports to clarify that these are interim products.
We are sending copies of this report to the Secretary of Homeland
Security, the Secretary of Health and Human Services, and interested
congressional committees. The report is also available at no charge on
the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your
staffs have any questions about this report, please contact William O.
Jenkins, Jr. at (202) 512-8777 or jenkinswo@gao.gov or Marcia Crosse
at (202) 512-7114 or crossem@gao.gov. Contact points for our Offices
of Congressional Relations and Public Affairs may be found on the last
page of this report. Key contributors to this report are listed in
appendix IV.
Signed by:
William O. Jenkins, Jr.
Director, Homeland Security and Justice:
Signed by:
Marcia Crosse:
Director, Health Care:
[End of section]
Appendix I: DHS and HHS Chemical, Biological, Radiological, and
Nuclear Risk Assessments:
[End of section]
In response to provisions in the Project BioShield Act of 2004
[Footnote 25] and Homeland Security Presidential Directives (HSPD) 10
(Biodefense for the 21st Century), 18 (Medical Countermeasures against
Weapons of Mass Destruction), and 22 (National Domestic Chemical
Defense), the Department of Homeland Security (DHS) and the Department
of Health and Human Services (HHS) develop three types of chemical,
biological, radiological, and nuclear (CBRN) risk assessments--DHS's
terrorism risk assessments (TRA) and material threat assessments (MTA)
and HHS's public health and medical consequence modeling reports.
Risk and Risk Assessment:
The DHS Risk Lexicon defines risk as the potential for an adverse
outcome assessed as a function of threats, vulnerabilities, and
consequences associated with an incident, event, or occurrence.
[Footnote 26] Threats are defined as entities, actions, or natural or
man-made occurrences that have or indicate the potential to harm life,
information, operations, or property. Vulnerabilities are defined as
the physical features or operational attributes that render an entity,
asset, system, network, or geographic area susceptible or exposed to
hazards. Consequences are defined as the potential or actual effects
of an event, incident, or occurrence. The DHS Risk Lexicon defines
risk assessment as the product or process that collects information
and assigns values to risks for the purpose of informing priorities,
developing or comparing courses of action, and informing decision
making. According to DHS, risk information is usually one of many
factors--and not necessarily the sole factor--that decision makers
consider when deciding which strategy to pursue to manage risk.
DHS and HHS CBRN Risk Assessments:
DHS Terrorism Risk Assessments:
In response to provisions in HSPD-10, HSPD-18, and HSPD-22, DHS
conducts CBRN risk assessments and coordinates with appropriate
subject matter experts, including those in HHS, in developing these
risk assessments. DHS has issued seven classified TRAs to date, and
one is currently in development. DHS issued three successive
biological TRAs (BTRA) in 2006, 2008, and 2010; two chemical TRAs
(CTRA) in 2008 and 2010; and two integrated CBRN TRAs (ITRA) in 2008
and 2011.[Footnote 27] In addition, DHS also plans to issue the first
radiological and nuclear TRA (R/NTRA) in 2011. The results of the
individual BTRAs, CTRAs, and R/NTRAs are combined to develop the
comprehensive ITRAs.[Footnote 28] Each TRA assesses the relative risks
posed by multiple CBRN agents based on variable threats,
vulnerabilities, and consequences. DHS updated these TRAs biennially
in the past, and DHS officials said that they plan to update them
quadrennially going forward, in part to reflect current terrorism
event probabilities and accurately determine relative CBRN terrorism
risk. TRA results are based on risk modeling that assesses the
likelihood of a terrorist attack using a CBRN agent, combined with the
consequences that would result from a successful attack. Modeling of
the likelihood of an attack is based on an assessment of the actions
that an adversary, such as a terrorist, is determined to be likely to
pursue--based in part on intelligence community inputs--combined with
an assessment of the vulnerability of U.S. population centers to such
an attack. DHS uses risk modeling techniques and computer software to
calculate TRA results based on millions of hypothetical CBRN terrorism
attack scenarios that include variable likelihood figures and
consequence parameters.
DHS Material Threat Assessments:
Under the Project BioShield Act of 2004, DHS is required, on an
ongoing basis, to assess the threat posed by specific CBRN agents and
to issue determinations for those CBRN agents that pose a material
threat to the U.S. population sufficient to affect national security.
[Footnote 29] In response to these requirements, DHS has issued 17
classified MTAs to date, each of which assesses the threat posed by a
given CBRN agent or class of agents and the potential numbers of human
exposures in plausible, high-consequence scenarios.[Footnote 30] DHS
solicits intelligence community officials to define and articulate the
plausible, high-consequence attack scenarios that might be pursued by
terrorists seeking to maximize casualties. These scenarios are then
analyzed to determine the results of an MTA to provide an estimate of
the number of people exposed to different dose levels of an agent in
the scenario. HHS uses the MTAs to inform medical consequence modeling
to support defining requirements for medical countermeasures to
mitigate the health effects of CBRN agents.
HHS Public Health and Medical Consequence Modeling Reports:
The Project BioShield Act of 2004 calls for HHS to assess the public
health consequences of exposure to those CBRN agents that DHS
determines are material threats to the nation.[Footnote 31] In
response, HHS has issued 19 modeling reports for CBRN agents, using
the data from the corresponding DHS MTA to calculate the number of
individuals who may become ill, be hospitalized, or die based on the
MTA scenario. To develop these estimates from the MTAs, HHS consults
with experts and uses available scientific data, such as data on how
much of an agent is needed to cause infection and how long it takes to
develop symptoms of disease after exposure. In addition, HHS assesses
the status of current countermeasure development and availability,
including applicable countermeasures that the Department of Defense
may be developing. HHS uses the modeling reports as an interim step to
help assess public health and medical consequences and determine which
medical countermeasures are needed, and in what quantity, and the
optimal timing for treating the affected population following an
attack.[Footnote 32]
HHS modeling reports assess factors that may affect the number of
individuals who may be infected with a given CBRN agent--such as the
quantity of the agent released, the timing of the release,
environmental conditions, population demographics, and the timing of
medical countermeasure administration, among others--and may include
multiple exposure scenarios as appropriate. For example, depending
upon the agent, some modeling reports may account for differences in
height, weight, and lung function among individuals of different
genders and ages to model short-and long-term health effects for these
populations because the course of disease caused by an agent can
differ based on these characteristics. Other modeling reports may
evaluate multiple exposure scenarios--such as inhalation of or skin
contact with an agent--to determine the numbers of potentially
infected individuals.
Modeling reports may also evaluate potential health consequences
resulting from different response strategies based on the time it
takes to detect an attack by environmental sampling or by individuals
presenting at hospitals, initiate a medical countermeasure prophylaxis
campaign, and distribute and dispense medical countermeasures to the
affected area and individuals. Modeling report results include
analyses of the range of individuals who may die without treatment
with medical countermeasures and optimal time frames for providing
medical countermeasures to prevent significant numbers of deaths from
infection with an agent. Modeling reports also identify gaps in
knowledge, such as limited scientific information about the response
of a particular CBRN agent to a countermeasure, and the extent to
which HHS assesses short-and long-term medical countermeasures needs
as a result of exposure to an agent. (See table 1 for the HHS modeling
reports developed to date.)
Table 1: Diseases and Agents for Which HHS Has Developed Medical and
Public Health Consequence Modeling Reports:
Biological:
* Anthrax[A];
* Botulism;
* Glanders and melioidosis (Burkholderia);
* Junin virus;
* Marburg virus[B];
* Plague;
* Q fever, Rocky Mountain spotted fever, and typhus (Rickettsia);
* Smallpox;
* Tularemia.
Chemical:
* Blood agents;
* Low volatility nerve agents;
* Pulmonary agents;
* Vesicants;
* Volatile nerve agents.
Radiological and nuclear:
* Improvised nuclear device;
* Radiological dispersal device.
Source: HHS.
[A] HHS has issued four separate modeling reports for anthrax to
examine particular issues in addition to countermeasure needs, such as
countermeasure cost and effectiveness and different strategies for
using anthrax vaccine.
[B] The Marburg modeling report includes considerations for Ebola
virus.
[End of table]
[End of section]
Appendix II: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Washington, DC 20528:
June 8, 2011:
William O. Jenkins:
Director, Homeland Security and Justice:
U.S. Government Accountability Office:
441 G. Street NW:
Washington, DC 20548:
Re: Draft Report GA0-11-606, "National Preparedness: DHS and III-IS Can
Further Strengthen Coordination for Chemical, Biological,
Radiological, and Nuclear Risk Assessments"
Dear Mr. Jenkins:
Thank you for the opportunity to review and comment on this draft
report. The U.S. Department of Homeland Security (DHS) appreciates the
U.S. Government Accountability Office's (GAO's) work in planning and
conducting its review and issuing this report.
The Department is pleased to note the report recognizes that DHS, the
U.S. Department of Health and Human Services (HHS), and other key
federal partners have been coordinating and developing Chemical,
Biological, Radiological, and Nuclear (CBRN) risk assessments since
2004. These assessments are critical to supporting the Nation's CBRN
preparedness and defense-related activities, including investments for
prevention, protection, surveillance, detection, response, and
recovery.
DHS is fully committed to supporting the National CBRN Defense
Strategies and all our federal partners to ensure key risk assessments
are conducted in a collaborative and coordinated manner to yield
quality products. These assessments are based on current, available
science and knowledge and our best judgments to understand the risks
inherent in CBRN agents. The inevitable degree of uncertainty
associated with understanding these agents and their use is also a
contributing factor. As such, it is critical for our federal, state,
local, and tribal partners to utilize these assessments with the
understanding of the assessments' intended uses, applications, and
limitations when making decisions.
The draft report contained one recommendation directed to DHS.
Specifically, to ensure that DHS senior officials are able to monitor
progress on the development of the proposed strategic and
implementation plans for DHS's CBRN risk assessment efforts, GAO
recommended that the Secretary of Homeland Security:
Recommendation: Develop and document interim time frames and
milestones as part of a plan to develop, finalize, and obtain
interagency agreement on the written procedures for interagency
development of the TRAs and MTAs that DHS intends to issue as
strategic and implementation plans.
Response: Concur. DHS agrees that the collaboration and coordination
between DHS and HHS for conducting the CBRN risk assessments ”
terrorist risk assessments (TRAs) and material threat assessments
(MTAs) can be enhanced and strengthened. For example, the MTAs
encompass population exposure modeling for consensus scenarios and
support HHS's public health modeling and medical countermeasures
requirements development efforts resulting in the issuance of Material
Threat Determinations to facilitate better preparations for and
responses to potentially catastrophic attacks with CBRN agents. DHS
has initiated efforts to map out the timeline and milestones to ensure
timely development of a Strategic Implementation Plan for conducting
these critically important assessments.
Again, thank you for the opportunity to review and comment on this
draft report. Sensitivity comments have been submitted under separate
cover. We look forward to working with you on future Homeland Security
issues.
Sincerely,
Signed by:
Jim H. Crumpacker:
Director:
Departmental GAO/OIG Liaison Office:
[End of section]
Appendix III: Comments from the Department of Health and Human
Services:
Department Of Health & Human Services:
Office Of The Secretary:
Assistant Secretary for Legislation:
Washington, DC 20201:
June 2, 2011:
Marcia Crosse:
Director, Health Care:
William 0. Jenkins:
Director, Homeland Security and Justice:
U.S. Government Accountability Office:
441 G Street N.W.
Washington, DC 20548:
Dear Ms. Crosse and Mr. Jenkins:
Attached are comments on the U.S. Government Accountability Office's
(GAO) draft report entitled: "National Preparedness: DHS and HHS Can
Further Strengthen Coordination for Chemical, Biological,
Radiological, and Nuclear Risk Assessments" (GAO-11606).
The Department appreciates the opportunity to review this report
before its publication.
Sincerely,
Signed by:
Jim R. Esquea:
Assistant Secretary for Legislation:
Attachment:
[End of letter]
General Comments Of The Department Of Health And Human Services (HHS)
On The Government Accountability Office'S (GAO) Draft Report Entitled,
"National Preparedness: DHS And HHS Can Further Strengthen
Coordination For Chemical, Biological, Radiological, And Nuclear Risk
Assessments" (GA0-11-606):
The Department appreciates the opportunity to review and comment on
this draft report.
Throughout this report, GAO's use of the term "risk" is not consistent
with its use by HHS and the Department of Homeland Security (DHS). For
example, a material threat assessment (MTA) evaluates threat, which is
a component of risk, but not risk, because it does not include an
assessment of the probability or likelihood of a particular agent
being used. We have raised this issue with GAO previously and the
response has been that GAO prefers to use the term "risk" in a more
generic way. Nevertheless, the Department wants to make official note
of this concern.
Similarly, throughout this draft report there is a focus on the
consequence modeling reports as if they are the end product of the
Public Health Emergency Medical Countermeasures Enterprise (PHEMCE)
working groups. This is not an accurate assessment. The modeling
report feeds into the consequence assessment process within the
working groups that develop the scenario-based requirements (SBRs)
that discuss the agent, the disease characteristics, the types of
consequences, the number of injuries by types, and other factors. The
PHEMCE working group members develop SBRs for delivery, not modeling
reports. The modeling is one input and documentation to support the
SBRs and product-specific requirements (PSRs). GAO's focus on the
modeling reports as representative of the medical consequence
assessment and not including discussion of the SBR development process
can be misleading as it does not accurately describe the entire
process.
Conceptually, we agree with GAO's emphasis in this report on
memorializing agreements and institutionalizing best practices for
development of the terrorism risk assessments (TRAs), MTAs, and
consequence modeling reports in written documents, and the report
makes many useful observations about current deficiencies in this
regard. However, we are concerned that the language used in this
report implies that HHS does not vet the PHEMCE work products
(including modeling reports, SBRs, and PSRs), when in actuality there
is a transparent process, albeit one that is not documented in a
charter.
HHS concurs with GAO that the PHEMCE interagency memorandum of
understanding (MOU), which expires in June 2011, demonstrates the
commitment of all participating federal departments to work
collaboratively on PHEMCE issues. For this reason, HHS has undertaken
efforts to renew this MOU with its interagency partners.
[End of section]
Appendix IV: GAO Contacts and Staff Acknowledgments:
GAO Contacts:
William O. Jenkins, Jr., (202) 512-8777 or jenkinswo@gao.gov:
Marcia Crosse, (202) 512-7114 or crossem@gao.gov:
Staff Acknowledgments:
In addition to the contacts named above, Sheila K. Avruch, Assistant
Director; Edward George, Assistant Director; David Alexander;
Katherine Davis; Shana R. Deitch; Bonnie Doty; Tracey King; David
Lysy; Carolina Morgan; Roseanne Price; and David Schneider made
significant contributions to this report.
[End of section]
Related GAO Products:
Public Health Preparedness: Developing and Acquiring Medical
Countermeasures Against Chemical, Biological, Radiological, and
Nuclear Agents. [hyperlink, http://www.gao.gov/products/GAO-11-567T].
Washington, D.C.: April 13, 2011.
Measuring Disaster Preparedness: FEMA Has Made Limited Progress in
Assessing National Capabilities. [hyperlink,
http://www.gao.gov/products/GAO-11-260T]. Washington, D.C.: March 17,
2011.
Biosurveillance: Efforts to Develop a National Biosurveillance
Capability Need a National Strategy and a Designated Leader.
[hyperlink, http://www.gao.gov/products/GAO-10-645]. Washington, D.C.:
June 30, 2010.
National Security: Key Challenges and Solutions to Strengthen
Interagency Collaboration. [hyperlink,
http://www.gao.gov/products/GAO-10-822T]. Washington, D.C.: June 9,
2010.
Homeland Defense: DOD Can Enhance Efforts to Identify Capabilities to
Support Civil Authorities during Disasters. [hyperlink,
http://www.gao.gov/products/GAO-10-386]. Washington, D.C.: March 30,
2010.
Homeland Defense: DOD Needs to Take Actions to Enhance Interagency
Coordination for Its Homeland Defense and Civil Support Missions.
[hyperlink, http://www.gao.gov/products/GAO-10-364]. Washington, D.C.:
March 30, 2010.
Combating Nuclear Terrorism: Actions Needed to Better Prepare to
Recover from Possible Attacks Using Radiological or Nuclear Materials.
[hyperlink, http://www.gao.gov/products/GAO-10-204]. Washington, D.C.:
January 29, 2010.
Biosurveillance: Developing a Collaboration Strategy Is Essential to
Fostering Interagency Data and Resource Sharing. [hyperlink,
http://www.gao.gov/products/GAO-10-171]. Washington, D.C.: December
18, 2009.
Homeland Defense: Planning, Resourcing, and Training Issues Challenge
DOD's Response to Domestic Chemical, Biological, Radiological,
Nuclear, and High-Yield Explosive Incidents. [hyperlink,
http://www.gao.gov/products/GAO-10-123]. Washington, D.C.: October 7,
2009.
Interagency Collaboration: Key Issues for Congressional Oversight of
National Security Strategies, Organizations, Workforce, and
Information Sharing. [hyperlink,
http://www.gao.gov/products/GAO-09-904SP]. Washington, D.C.: September
25, 2009.
Project BioShield Act: HHS Has Supported Development, Procurement, and
Emergency Use of Medical Countermeasures to Address Health Threats.
[hyperlink, http://www.gao.gov/products/GAO-09-878R]. Washington,
D.C.: July 24, 2009.
Project BioShield: HHS Can Improve Agency Internal Controls for Its
New Contracting Authorities. [hyperlink,
http://www.gao.gov/products/GAO-09-820]. Washington, D.C.: July 21,
2009.
National Preparedness: FEMA Has Made Progress, but Needs to Complete
and Integrate Planning, Exercise, and Assessment Efforts. [hyperlink,
http://www.gao.gov/products/GAO-09-369]. Washington, D.C.: April 30,
2009.
Risk Management: Strengthening the Use of Risk Management Principles
in Homeland Security. [hyperlink,
http://www.gao.gov/products/GAO-08-904T]. Washington, D.C.: June 25,
2008.
Emergency Management: Observations on DHS's Preparedness for
Catastrophic Disasters. [hyperlink,
http://www.gao.gov/products/GAO-08-868T]. Washington, D.C.: June 11,
2008.
Highlights of a Forum: Strengthening the Use of Risk Management
Principles in Homeland Security. [hyperlink,
http://www.gao.gov/products/GAO-08-627SP]. Washington, D.C.: April 15,
2008.
Project BioShield: Actions Needed to Avoid Repeating Past Problems
with Procuring New Anthrax Vaccine and Managing the Stockpile of
Licensed Vaccine. [hyperlink, http://www.gao.gov/products/GAO-08-88].
Washington, D.C.: October 23, 2007.
Homeland Security: Applying Risk Management Principles to Guide
Federal Investments. [hyperlink,
http://www.gao.gov/products/GAO-07-386T]. Washington, D.C.: February
7, 2007.
Risk Management: Further Refinements Needed to Assess Risk and
Prioritize Protective Measures at Ports and Other Critical
Infrastructure. [hyperlink, http://www.gao.gov/products/GAO-06-91].
Washington, D.C.: December 15, 2005.
Results-Oriented Government: Practices That Can Help Enhance and
Sustain Collaboration among Federal Agencies. [hyperlink,
http://www.gao.gov/products/GAO-06-15]. Washington, D.C.: October 21,
2005.
[End of section]
Footnotes:
[1] White House, National Strategy for Homeland Security (Washington,
D.C., October 2007).
[2] White House, National Security Strategy (Washington, D.C., May
2010).
[3] Collaboration can be broadly defined as any joint activity that is
intended to produce more public value than could be produced when
organizations act alone.
[4] According to the DHS Risk Lexicon, threats are entities, actions,
or occurrences, whether natural or man-made, that have or indicate the
potential to harm life, information, operations, and/or property;
vulnerabilities are physical features or operational attributes that
render an entity, asset, system, network, or geographic area
susceptible or exposed to hazards; and consequences are potential or
actual effects of an event, incident, or occurrence. DHS, DHS Risk
Lexicon: 2010 Edition (Washington, D.C., September 2010).
[5] GAO, Results-Oriented Government: Practices That Can Help Enhance
and Sustain Collaboration among Federal Agencies, [hyperlink,
http://www.gao.gov/products/GAO-06-15] (Washington, D.C.: Oct. 21,
2005); GAO, Standards for Internal Control in the Federal Government,
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]
(Washington, D.C.: November 1999); and Project Management Institute,
The Standard for Program Management, 2nd ed. (Newton Square, Pa.,
2008). The criteria in GAO/AIMD 00-21.3.1, dated November 1999, issued
pursuant to the requirements of the Federal Managers' Financial
Integrity Act of 1982 (FMFIA), provide the overall framework for
establishing and maintaining internal control in the federal
government. Also pursuant to FMFIA, the Office of Management and
Budget issued Circular A-123, revised December 21, 2004, to provide
the specific requirements for assessing the reporting on internal
controls. Internal control standards and the definition of internal
control in Circular A-123 are based on GAO's Standards for Internal
Control in the Federal Government. See also the Related GAO Products
section at the end of this report.
[6] 42 U.S.C. § 247d-6b(c)(2)(A).
[7] Since 2004, DHS determined that 14 of 17 CBRN agents that it
assessed in MTAs pose a material threat to the nation and issued
material threat determinations for those agents. The 14 material
threat determinations that DHS has issued to date are for Bacillus
anthracis (anthrax), Burkholderia mallei (glanders), Burkholderia
pseudomallei (melioidosis), Clostridium botulinum (botulism toxin),
Ebola virus (hemorrhagic fever), Francisella tularensis (tularemia),
Junin virus (hemorrhagic fever), Marburg virus (hemorrhagic fever),
multidrug-resistant Bacillus anthracis (MDR anthrax), Rickettsia
prowazekii (typhus), Variola major (smallpox), Yersinia pestis
(plague), radiological agents, and nuclear agents.
[8] 42 U.S.C. § 247d-6b(c)(2)(B). The Project BioShield Act authorizes
the federal government to use specific contracting authorities to
procure certain medical countermeasures for these agents and
established the Project BioShield Special Reserve Fund for the
acquisition of certain medical countermeasures, some of which may not
yet qualify for approval or licensing.
[9] PHEMCE is responsible for providing recommendations to the
Secretary of Health and Human Services on (1) prioritized requirements
for CBRN medical countermeasures, (2) coordination of medical
countermeasure development and acquisition activities to address the
requirements, and (3) strategies for distributing medical
countermeasures held in national stockpiles. In addition to these
responsibilities, PHEMCE is also responsible for countermeasures for
pandemic influenza and other emerging infectious diseases.
[10] HHS officials from the Centers for Disease Control and
Prevention, the Food and Drug Administration, the National Institutes
of Health, and the Office of the Assistant Secretary for Preparedness
and Response participate in PHEMCE, in addition to officials from
other HHS offices.
[11] DHS officials from DHS's Science and Technology Directorate and
Office of Health Affairs participate in PHEMCE.
[12] The Department of Defense has exclusive responsibility for
research, development, acquisition, and deployment of medical
countermeasures to prevent or mitigate the health effects of CBRN
agents and naturally occurring diseases on armed forces personnel.
Under the PHEMCE structure, the Department of Defense also coordinates
with HHS to share information and resources for common CBRN medical
countermeasure priorities to reduce duplication of effort.
[13] DHS develops its TRAs by integrating information from the
intelligence and law enforcement communities, as well as input from
the scientific, medical, and public health communities, among others.
[14] In addition to HHS, members of the TRA working groups include the
Department of Defense, the Environmental Protection Agency, and the
Nuclear Regulatory Commission, among others.
[15] DHS convenes separate working groups for each of the TRAs that
DHS produces. Each working group is responsible for development and
review of its respective TRA, in conjunction with the contractors that
DHS utilizes to develop TRA data inputs and perform related
mathematical modeling. Separate working groups exist for the BTRA, the
chemical TRA (CTRA), the radiological and nuclear TRA (R/NTRA), and
the ITRA.
[16] See [hyperlink, http://www.gao.gov/products/GAO-06-15].
Additional key practices include establishing mutually reinforcing or
joint strategies to achieve the outcome; identifying and addressing
needs by leveraging resources; developing mechanisms to monitor,
evaluate, and report the results of collaborative efforts; reinforcing
agency accountability for collaborative efforts through agency plans
and reports; and reinforcing individual accountability for
collaborative efforts through agency performance management systems.
[17] See [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[18] The Chemical and Biological Division in DHS's Science and
Technology Directorate is the DHS entity responsible for the
development of the TRAs and MTAs.
[19] The Project Management Institute, The Standard for Program
Management. The Standard for Program Management calls for establishing
time frames and milestones as part of a plan to ensure that intended
results are achieved.
[20] HHS officials said that as of May 2011, they had not reviewed the
draft smallpox MTA because it had not yet been completed.
[21] The PHEMCE MOU and charters support interagency coordination
between HHS, the Department of Defense, and the Department of Veterans
Affairs, in addition to DHS.
[22] [hyperlink, http://www.gao.gov/products/GAO-06-15].
[23] According to HHS officials, the modeling reports are not intended
to be end products but rather one step in the process of determining
medical countermeasure needs in the event of an attack with a CBRN
agent.
[24] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[25] 42 U.S.C. § 247d-6b(c)(2)(A),(B).
[26] DHS, DHS Risk Lexicon: 2010 Edition (Washington, D.C., September
2010). Developed by DHS's intradepartmental Risk Steering Committee,
the purpose of the DHS Risk Lexicon is to establish and make available
a comprehensive list of terms and meanings relevant to the practice of
homeland security risk management and analysis.
[27] DHS was originally scheduled to issue the second ITRA in 2010.
However, DHS published it in 2011 and plans to issue future iterations
quadrennially thereafter (e.g., 2015, 2019, etc.) so that the ITRA,
which relies on data contained in the BTRA, CTRA, and radiological and
nuclear TRA (R/NTRA), will be produced in the years following
publication of these other assessments. The next iterations of the
BTRA, CTRA, and R/NTRA are scheduled for 2014.
[28] The 2008 ITRA was developed based on the results of the 2008 BTRA
and CTRA, as well as a radiological and nuclear appendix to the 2008
ITRA report. The 2011 R/NTRA is the first standalone R/NTRA to be
produced, and its results will be combined with those from the 2010
BTRA and CTRA to develop the 2011 ITRA.
[29] 42 U.S.C. § 247d-6b(c)(2)(A).
[30] Since 2004, DHS determined that 14 of 17 CBRN agents that it
assessed in MTAs pose a material threat to the nation and issued
material threat determinations for those agents. The 14 material
threat determinations that DHS has issued to date are for Bacillus
anthracis (anthrax), Burkholderia mallei (glanders), Burkholderia
pseudomallei (melioidosis), Clostridium botulinum (botulism toxin),
Ebola virus (hemorrhagic fever), Francisella tularensis (tularemia),
Junin virus (hemorrhagic fever), Marburg virus (hemorrhagic fever),
multidrug-resistant Bacillus anthracis (MDR anthrax), Rickettsia
prowazekii (typhus), Variola major (smallpox), Yersinia pestis
(plague), radiological agents, and nuclear agents.
[31] 42 U.S.C. § 247d-6b(c)(2)(B).
[32] Medical countermeasures include drugs, biologic products, and
devices to identify, treat, prevent, or mitigate potential health
effects from exposure to CBRN agents. HHS acquires CBRN medical
countermeasures to treat the potentially exposed population after an
attack in order to prevent the onset of disease as well as to treat
individuals who have developed disease resulting from such an attack.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
