Continuity of Operations
Improved Planning Needed to Ensure Delivery of Essential Services Gao ID: GAO-04-638T April 22, 2004To ensure that essential government services are available in emergencies--such as terrorist attacks, severe weather, or building-level emergencies--federal agencies are required to develop continuity of operations (COOP) plans. Responsibility for formulating guidance on these plans and for assessing executive branch COOP capabilities lies with the Federal Emergency Management Agency (FEMA), under the Department of Homeland Security. FEMA guidance, Federal Preparedness Circular (FPC) 65 (July 1999), identifies elements of a viable COOP capability, including the requirement that agencies identify their essential functions. This statement summarizes the findings of a February 2004, GAO report, for which GAO was asked to determine the extent to which (1) major civilian executive branch agencies have identified their essential functions and (2) these agencies' COOP plans follow FEMA guidance.
Based on an assessment of 34 COOP plans against FEMA guidance, GAO found that most agencies' plans identified at least one function as essential. However, the functions identified in each plan varied widely in number--ranging from 3 to 399--and included functions that appeared to be of secondary importance, while at the same time omitting programs that had been previously defined as high-impact programs. For example, one department included "provide speeches and articles for the Secretary and Deputy Secretary," among its essential functions, but did not include 9 of 10 high-impact programs for which it was responsible. Several factors contributed to these shortcomings: FPC 65 did not provide specific criteria for identifying essential functions; FEMA did not review the essential functions identified when it assessed COOP planning; and it did not conduct tests or exercises to confirm that the essential functions were correctly identified. Unless agencies' essential functions are correctly and completely identified, their COOP plans may not effectively ensure that the most vital government services can be maintained in an emergency. lthough all but three of the agencies reviewed had developed and documented some of the elements of a viable COOP plan, none of the agencies could demonstrate that they were following all the guidance in FPC 65. As the figure shows, there is a wide variation in the number of agencies that addressed various elements identified in the guidance. A contributing cause for the deficiencies in agency COOP plans is the level of FEMA oversight. In 1999, FEMA conducted an assessment of agency compliance with FPC 65, but it has not conducted oversight that is sufficiently regular and extensive to ensure that agencies correct the deficiencies identified. Because the resulting COOP plans do not include all the elements of a viable plan as defined by FPC 65, agency efforts to provide services during an emergency could be impaired.
GAO-04-638T, Continuity of Operations: Improved Planning Needed to Ensure Delivery of Essential Services
This is the accessible text file for GAO report number GAO-04-638T
entitled 'Continuity of Operations: Improved Planning Needed to Ensure
Delivery of Essential Services' which was released on April 22, 2004.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony Before the Committee on Government Reform, House of
Representatives:
United States General Accounting Office:
GAO:
For Release on Delivery Expected at 10:00 a.m. EDT:
Thursday, April 22, 2004:
Continuity of Operations:
Improved Planning Needed to Ensure Delivery of Essential Services:
Statement of Linda D. Koontz, Director, Information Management Issues:
GAO-04-638T:
GAO Highlights:
Highlights of GAO-04-638T, a testimony before the Committee on
Government Reform, House of Representatives
Why GAO Did This Study:
To ensure that essential government services are available in
emergencies”such as terrorist attacks, severe weather, or building-
level emergencies”federal agencies are required to develop continuity
of operations (COOP) plans. Responsibility for formulating guidance on
these plans and for assessing executive branch COOP capabilities lies
with the Federal Emergency Management Agency (FEMA), under the
Department of Homeland Security. FEMA guidance, Federal Preparedness
Circular (FPC) 65 (July 1999), identifies elements of a viable COOP
capability, including the requirement that agencies identify their
essential functions.
This statement summarizes the findings of a February 2004, GAO report,
for which GAO was asked to determine the extent to which (1) major
civilian executive branch agencies have identified their essential
functions and (2) these agencies‘ COOP plans follow FEMA guidance.
What GAO Found:
Based on an assessment of 34 COOP plans against FEMA guidance, GAO
found that most agencies‘ plans identified at least one function as
essential. However, the functions identified in each plan varied
widely in number”ranging from 3 to 399”and included functions that
appeared to be of secondary importance, while at the same time
omitting programs that had been previously defined as high-impact
programs. For example, one department included ’provide speeches and
articles for the Secretary and Deputy Secretary,“ among its essential
functions, but did not include 9 of 10 high-impact programs for which
it was responsible. Several factors contributed to these shortcomings:
FPC 65 did not provide specific criteria for identifying essential
functions; FEMA did not review the essential functions identified when
it assessed COOP planning; and it did not conduct tests or exercises
to confirm that the essential functions were correctly identified.
Unless agencies‘ essential functions are correctly and completely
identified, their COOP plans may not effectively ensure that the most
vital government services can be maintained in an emergency.
Although all but three of the agencies reviewed had developed and
documented some of the elements of a viable COOP plan, none of the
agencies could demonstrate that they were following all the guidance
in FPC 65. As the figure shows, there is a wide variation in the
number of agencies that addressed various elements identified in the
guidance. A contributing cause for the deficiencies in agency COOP
plans is the level of FEMA oversight. In 1999, FEMA conducted an
assessment of agency compliance with FPC 65, but it has not conducted
oversight that is sufficiently regular and extensive to ensure that
agencies correct the deficiencies identified. Because the resulting
COOP plans do not include all the elements of a viable plan as defined
by FPC 65, agency efforts to provide services during an emergency
could be impaired.
Elements That Were Included in Agency COOP Plans in Place as of October
1, 2002:
[See PDF for image]
[End of figure]
What GAO Recommends:
In a February 2004 report, GAO recommended that the Secretary of
Homeland Security take steps to improve agency COOP plans and FEMA‘s
process for assessing these plans. DHS agreed that improvements were
needed in the COOP planning process, and that FEMA could do more to
ensure such improvements were made.
www.gao.gov/cgi-bin/getrpt?GAO-04-638T.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Linda Koontz at (202)
512-6240 or koontzl@gao.gov.
[End of section]
Mr. Chairman and Members of the Committee:
I appreciate the opportunity to participate in the Committee's hearing
on federal continuity of operations planning. As you know, events such
as terrorist attacks, severe weather, or building-level emergencies can
disrupt the delivery of essential government services. To minimize the
risk of disruption, federal agencies are required to develop plans for
ensuring the continuity of essential services in emergency situations.
The Federal Emergency Management Agency (FEMA), which was designated
executive agent for executive branch continuity of operations (COOP)
planning, issued planning guidance in July 1999. This guidance, known
as Federal Preparedness Circular (FPC) 65, states that in order to have
a viable COOP capability, agencies should identify their essential
functions. Identifying essential functions is the first of eight
elements of a viable COOP capability, and provides the basis for
subsequent planning steps.
At your request, we analyzed the continuity of operations plans in
place at 20 major civilian departments and agencies[Footnote 1] as of
October 1, 2002. We reported the results of our analysis to you in
February.[Footnote 2] My remarks today will summarize those results.
Specifically, I will discuss:
* the extent to which agencies have identified their essential
functions, and:
* the extent to which their plans follow the guidance provided in FPC
65.
In conducting the analysis for our February report, we obtained and
evaluated the headquarters contingency plans in place as of October 1,
2002, from 20 of the 23 largest civilian departments and agencies, as
well as the headquarters plans for 15 components of civilian cabinet-
level departments, selected because they were responsible for programs
previously deemed high impact by the Office of Management and Budget
(OMB). (The major departments and agencies reviewed are listed in
attachment I.)[Footnote 3] We also reviewed supporting documentation
and interviewed the agency officials responsible for developing these
plans, obtained and analyzed FEMA guidance and documents describing its
efforts to provide oversight and assessments of the federal continuity
planning efforts, and interviewed FEMA officials to clarify the
activities described in these documents. This testimony is based on
previously published work, which was conducted in accordance with
generally accepted government auditing standards, from April 2002
through January of this year.[Footnote 4]
Results in Brief:
Twenty-nine of the 34 COOP plans[Footnote 5] that we reviewed
identified at least one essential function. However, the functions
identified in these plans varied widely in number--ranging from 3 to
399--and included functions that appeared to be of secondary
importance. At the same time, the plans omitted many programs that OMB
had previously identified as having a high impact on the public.
Agencies did not list among their essential functions 20 of the 38
high-impact programs that had been identified at those agencies. For
example, one department included "provide speeches and articles for the
Secretary and Deputy Secretary" among its essential functions, but it
did not include 9 of its 10 high-impact programs. In addition, although
many agency functions rely on the availability of resources or
functions controlled by another organization, more than three-fourths
of the plans did not fully identify such dependencies. Several factors
contributed to these governmentwide shortcomings: FPC 65 does not
provide specific criteria for identifying essential functions, nor does
it address interdependencies; FEMA did not review the essential
functions identified in its assessments of COOP planning or follow up
with agencies to determine whether they addressed previously identified
weaknesses; and it did not conduct tests or exercises that could
confirm that the identified essential functions were correct. Although
the agency has begun efforts to develop additional guidance and conduct
a governmentwide exercise, these actions have not yet been completed.
Without better oversight, agencies are likely to continue to base their
COOP plans on ill-defined assumptions that may limit the utility of the
resulting plans.
While all but three of the agencies that we reviewed had developed and
documented some elements of a COOP plan, none of the agencies provided
documentation sufficient to show that they were following all the
guidance in FPC 65. FEMA conducted an assessment of agency compliance
with FPC 65 in 1999, but it has not conducted oversight that is
sufficiently regular and extensive to ensure that agencies correct
deficiencies identified. This limited level of oversight was a
contributing cause for the deficiencies in agency COOP plans. FEMA
officials told us that they plan to improve oversight by providing more
detailed guidance and developing a system to collect data from agencies
on their COOP readiness. However, the officials have not yet determined
how they will verify the agency-reported data, assess the essential
functions and interdependencies identified, or use the data to conduct
regular oversight. If these shortcomings are not addressed, agency COOP
plans may not be effective in ensuring that the most vital government
services can be maintained in an emergency.
In our report, we made several recommendations to the Secretary of
Homeland Security to enhance the ability of the federal government to
provide essential services during emergencies. In response to a draft
of our report, the Under Secretary for Emergency Preparedness and
Response agreed that better planning is needed to ensure delivery of
essential services, and that the department could do more to improve.
He added that the department has begun to correct the identified
deficiencies and stated that the federal government is currently poised
to provide services in an emergency. Once the department assesses and
independently verifies the status of agencies' plans, it will have
convincing evidence to support such statements about readiness in the
future.
Background:
Federal operations and facilities have been disrupted by a range of
events, including the terrorist attacks on September 11, 2001; the
Oklahoma City bombing; localized shutdowns due to severe weather
conditions, such as the closure of federal offices in Denver for 3 days
in March 2003 due to snow; and building-level events, such as asbestos
contamination at the Department of the Interior's headquarters. Such
disruptions, particularly if prolonged, can lead to interruptions in
essential government services. Prudent management, therefore, requires
that federal agencies develop plans for dealing with emergency
situations, including maintaining services, ensuring proper authority
for government actions, and protecting vital assets.
Until relatively recently, continuity planning was generally the
responsibility of individual agencies. In October 1998, Presidential
Decision Directive (PDD) 67 identified FEMA--which is responsible for
responding to, planning for, recovering from, and mitigating against
disasters--as the executive agent for federal COOP planning across the
federal executive branch. FEMA was an independent agency until March
2003, when it became part of the Department of Homeland Security,
reporting to the Under Secretary for Emergency Preparedness and
Response.
PDD 67 is a Top Secret document controlled by the National Security
Council. FPC 65 states that PDD 67 made FEMA, as executive agent for
COOP, responsible for:
* formulating guidance for agencies to use in developing viable plans;
* coordinating interagency exercises and facilitating interagency
coordination, as appropriate; and:
* overseeing and assessing the status of COOP capabilities across the
executive branch.
According to FEMA officials, PDD 67 also required that agencies have
COOP plans in place by October 1999.
In July 1999, FEMA issued FPC 65 to assist agencies in meeting the
October 1999 deadline. FPC 65 states that COOP planning should address
any emergency or situation that could disrupt normal operations,
including localized emergencies. FPC 65 also determined that COOP
planning is based first on the identification of essential functions--
that is, those functions that enable agencies to provide vital
services, exercise civil authority, maintain safety, and sustain the
economy during an emergency. FPC 65 gives no criteria for identifying
essential functions beyond this definition.
Although FPC 65 gives no specific criteria for identifying essential
functions, a logical starting point for this process would be to
consider programs that had been previously identified as important. For
example, in March 1999, as part of the efforts to address the Y2K
computer problem,[Footnote 6] the Director of OMB identified 42
programs with a high impact on the public:
* Of these 42 programs, 38 were the responsibility of the 23 major
departments and agencies that we reviewed. (Attachment II provides a
list of these 38 high-impact programs and the component agencies that
are responsible for them.):
* Of these 23 major departments and agencies, 16 were responsible for
at least one high-impact program; several were responsible for more
than one.
Programs that were identified included weather service, disease
monitoring and warnings, public housing, air traffic control, food
stamps, and Social Security benefits. These programs, as well as the
others listed in attachment II, continue to perform important functions
for the public.
The Y2K efforts to support such high-impact programs included
requirements for COOP planning and the identification of
interdependencies. Specifically, agencies were tasked with identifying
partners integral to program delivery, testing data exchanges across
partners, developing complementary business continuity and contingency
plans, sharing key information on readiness with other partners and the
public, and taking other steps to ensure that the agency's high-impact
program would work in the event of an emergency.
In addition to requiring agencies to identify their essential
functions, FPC 65 also defined an additional seven planning topics that
make up a viable COOP capability. The guidance provided a general
definition of each of the eight topics and identified several actions
that should be completed to address each topic. Table 1 lists the eight
topic areas covered in FPC 65 and provides an example of an action
under each.
Table 1: Eight COOP Planning Topics Defined by FPC 65 and Examples of
Actions:
FPC 65 planning topic: Essential functions should be identified to
provide the basis for COOP planning;
Example of action (element of viable COOP plan): The agency should
prioritize its essential functions.
FPC 65 planning topic: Plans and procedures should be developed and
documented to provide for continued performance of essential
functions;
Example of action (element of viable COOP plan): These plans should
include a roster of personnel who can perform the essential functions.
FPC 65 planning topic: Orders of succession should identify alternates
to fill key positions in an emergency;
Example of action (element of viable COOP plan): Succession lists
should be developed for the agency head and other key positions.
FPC 65 planning topic: Delegations of authority should identify the
legal basis for officials to make decisions in emergencies;
Example of action (element of viable COOP plan): Delegations should
include the circumstances under which the authorities begin and end.
FPC 65 planning topic: Alternate facilities should be able to support
operations in a threat-free environment for up to 30 days;
Example of action (element of viable COOP plan): These facilities
should provide sufficient space and equipment to sustain the
relocating organization.
FPC 65 planning topic: Interoperable communications should provide
voice and data communications with others inside and outside the
organization;
Example of action (element of viable COOP plan): The agency should be
able to communicate with agency personnel, other agencies, critical
customers, and the public.
FPC 65 planning topic: Vital records should be identified and made
readily available in an emergency;
Example of action (element of viable COOP plan): Electronic and paper
records should be identified and protected.
FPC 65 planning topic: Tests, training, and exercises should occur
regularly to demonstrate and improve agencies' COOP capabilities;
Example of action (element of viable COOP plan): Individual and team
training should be conducted annually.
Sources: FPC 65, FEMA.
[End of table]
Many COOP Plans Did Not Address Previously Identified Essential
Functions or Interdependencies with Other Entities:
The identification of essential functions is a prerequisite for COOP
preparation because it establishes the parameters that drive the
agency's efforts in all other planning topics. For example, FPC 65
directs agencies to identify alternative facilities, staff, and
resources necessary to support continuation of their essential
functions. The effectiveness of the plan as a whole and the
implementation of all other elements depend on the performance of this
step.
Of the 34 agency COOP plans that we reviewed, 29 plans included at
least one function that was identified as essential. These agency-
identified essential functions varied in number and scope. The number
of functions identified in each plan ranged from 3 to 399. In addition,
the apparent importance of the functions was not consistent. For
example, a number of essential functions were of clear importance, such
as:
* "ensuring uninterrupted command, control, and leadership of the
Department";
* "protecting critical facilities, systems, equipment and records";
and:
* "continuing to pay the government's obligations.":
Other identified functions appeared vague or of questionable
importance:
* "provide speeches and articles for the Secretary and Deputy
Secretary";
* "schedule all activities of the Secretary"; and:
* "review fiscal and programmatic integrity and efficiency of
Departmental activities.":
In contrast to the examples just given, agencies did not list among
their essential functions 20 of the 38 "high-impact" programs
identified during the Y2K effort at the agencies we reviewed.
Another important consideration in identifying essential functions is
the assessment of interdependencies among functions and organizations.
As we have previously reported,[Footnote 7] many agency functions rely
on the availability of resources or functions controlled by another
organization, including other agencies, state and local governments,
and private entities. (For example, the Department of the Treasury's
Financial Management Service receives and makes payments for most
federal agencies.) The identification of such interdependencies
continues to be essential to the related areas of information security
and critical infrastructure protection. Although FPC 65 does not use
the term "interdependencies," it directs agencies to "integrate
supporting activities to ensure that essential functions can be
performed.":
Of the 34 plans we reviewed, 19 showed no evidence of an effort to
identify interdependencies and link them to essential functions, which
is a prerequisite to developing plans and procedures to support these
functions and all other elements of COOP planning. Nine plans
identified some key partners, but appeared to have excluded others: for
instance, six agencies either make or collect payments, but did not
mention the role of the Treasury Department in their COOP plans.
The high level of generality in FEMA's guidance on essential functions
contributed to the inconsistencies in agencies' identification of these
functions. In its initial guidance, FPC 65, FEMA provided minimal
criteria for agencies to make these identifications, giving a brief
definition only. According to FEMA officials, the agency is currently
developing revised COOP guidance that will provide more specific
direction on identifying essential functions. They expect the guidance
to be released this Summer.
Further, although FEMA conducted several assessments of agency COOP
planning between 1995 and 2001, none of these addressed the
identification of essential functions. In addition, FEMA has begun
development of a system to collect data from agencies on the readiness
of their COOP plans, but FEMA officials told us that they will not use
the system to validate the essential functions identified by each
agency or their interdependencies. According to these officials, the
agencies are better able to make those determinations. However,
especially in view of the wide variance in number and importance of
functions identified, as well as omissions of high-impact programs, the
lack of FEMA review lowers the level of assurance that the essential
functions that have been identified are appropriate.
Additionally, in its oversight role, FEMA had the opportunity to help
agencies refine their essential functions through an interagency COOP
test or exercise. According to FPC 65, FEMA is responsible for
coordinating such exercises. While it is developing a test and training
program for COOP activities, it has not yet conducted an interagency
exercise to test the feasibility of these planned activities. FEMA had
planned a governmentwide exercise in 2002, but the exercise was
cancelled after the September 11 attacks. It is currently preparing to
conduct a governmentwide exercise in mid-May 2004.
Improper identification of essential functions can have a negative
impact on the entire COOP plan, because other aspects of the COOP plan
are designed around supporting these functions. If an agency fails to
identify a function as essential, it will not make the necessary
arrangements to perform that function. If it identifies too many
functions as essential, it risks being unable to adequately address all
of them. In either case, the agency increases the risk that it will not
be able to perform its essential functions in an emergency.
Agency COOP Plans Addressed Some, but Not All, of FEMA's Guidance:
As of October 1, 2002, almost 3 years after the planning deadline
established by PDD 67, 3 of the agencies we reviewed had not developed
and documented a COOP plan. The remaining 20 major federal civilian
agencies had COOP plans in place, and the 15 components[Footnote 8]
that we reviewed also had plans.
However, after analyzing these plans, we found that none of them
addressed all the guidance in FPC 65. Of the eight topic areas
identified in FPC 65, these 34 COOP plans generally complied with the
guidance in one area (developing plans and procedures); generally did
not comply in one area (tests, training, and exercises); and showed
mixed compliance in the other six areas. Specifically, when examining
the governmentwide results of our analysis of the eight planning topics
outlined in FPC 65, we found the following:
* Essential functions. Most agency plans identified at least one
function as essential. However, less than half the COOP plans
prioritized the functions, identified interdependencies among the
functions, or identified the mission-critical systems and date needed
to perform the functions.
* Plans and procedures. Most plans followed the guidance in this area,
including a roster of COOP personnel, activation procedures, and the
appropriate planning time frame (12 hours to 30 days).
* Orders of succession. All but a few agency plans identified an order
of succession to the agency head. Fewer plans included orders of
succession for other key officials or included officials outside of the
local area in the succession to the agency head. Most plans did not
include the orders of succession in the agency's vital records or
document training for successors on their emergency duties.
* Delegations of authority. Few plans adequately documented the legal
authority for officials to make policy decisions in an emergency.
* Alternate facilities. Most plans documented the acquisition of at
least one alternate facility, and many include alternate facilities
inside and outside of the local area. However, few plans documented
that agencies had adequate space for staff, pre-positioned equipment,
or appropriate communications capabilities at their alternate
facilities.
* Redundant emergency communications. Most plans identified at least
two independent media for voice communication. Few plans included
adequate contact information or information on backup data links.
* Vital records. About one-quarter of plans fully identified the
agency's vital records. Few plans documented the locations of all vital
records or procedures for updating them.
* Tests, training, and exercises. While many agencies documented some
training, very few agencies documented that they had conducted tests,
training, and exercises at the recommended frequency.
Limitations in FEMA's Oversight Contribute to Noncompliance:
The lack of compliance shown by many plans can be largely attributed to
limited guidance and oversight of executive branch COOP planning.
First, FEMA has issued little guidance to assist agencies in developing
plans that address the goals of FPC 65. Following FPC 65, the agency
issued more detailed guidance in April 2001 on two of FPC 65's eight
topic areas: FPC 66 provides guidance on developing viable test,
training, and exercise programs, and FPC 67 provides guidance for
acquiring alternate facilities. However, it did not produce any
detailed guidance on the other six topic areas.
In October 2003, FEMA began working with several members of the
interagency COOP working group to revise FPC 65. Agency officials
expect this revised guidance, which should incorporate the guidance
from the previous FPCs and address more specifically what agencies need
to do to comply with the guidance, to be released this summer. In
addition, a member of the staff of the White House Homeland Security
Council told us in March that the Council was also working on a new
policy framework for federal COOP activities.
Second, as part of FEMA's oversight responsibilities, its Office of
National Security Coordination is tasked with conducting comprehensive
assessments of the federal executive branch COOP programs. With the
assistance of contractors, the office has performed assessments, on an
irregular schedule, of federal agencies' emergency planning
capabilities:
* In 1995, it performed a survey of agency officials (this assessment
predated FPC 65).
* In 1999, it assessed compliance with the elements of FPC 65 through a
self-reported survey of agency COOP officials, supplemented by
interviews.
* In 2001, it surveyed agency officials to ask, among other things,
about actions that agencies took on and immediately after September 11,
2001.
Of these three assessments, only the 1999 assessment evaluated
compliance with the elements of FPC 65. Following this assessment, FEMA
gave agencies feedback on ways to improve their respective COOP plans,
and it made general recommendations, not specific to individual
agencies, that addressed programwide problems. However, it did not then
follow up to determine whether individual agencies made improvements in
response to its feedback and general recommendations. Besides inquiring
about actions in response to the September 2001 attacks, the 2001
assessment was designed to provide an update on programwide problems
that had been identified in the assessments of 1995 and 1999. FEMA did
not address whether individual agency COOP plans had been revised to
correct previously identified deficiencies, nor did it provide specific
feedback to individual agencies.
According to FEMA officials, the system it is developing to collect
agency-reported data on COOP plan readiness will improve its oversight.
The system is based on a database of information provided by agencies
for the purpose of determining if they are prepared to exercise their
COOP plans, in part by assessing compliance with FPC 65. However,
according to agency officials, while they recognize the need for some
type of verification, they have not yet determined a method of
verifying these data.
Without regular assessments of COOP plans that evaluate individual
plans for adequacy, FEMA will not be able to provide information to
help agencies improve their COOP plans. Further, if it does not verify
the data provided by the agencies or follow up to determine whether
agencies have improved their plans in response to such assessments,
FEMA will have little assurance that agencies' emergency procedures are
appropriate.
Agency officials attributed the limited level of oversight that we
found to two factors. First, they stated that before its transition to
the Department of Homeland Security, the agency did not have the legal
or budgetary authority to conduct more active oversight of the COOP
activities of other agencies. However, FPC 65 states that PDD 67 made
the agency responsible for guidance, coordination, and oversight in
this area, in addition to requiring agencies to develop COOP plans.
Accordingly, although it cannot determine how agencies budget resources
for such planning, it does have the authority to oversee this planning.
Second, according to these officials, until last year, the agency
devoted roughly 13 staff to COOP guidance, coordination, and oversight,
as well as the development of FEMA's own plan. According to the
official responsible for COOP oversight, the agency now has 42
positions authorized for such activities, 31 of which were filled as of
December 31, 2003. The agency expects to fill another 4 positions in
fiscal year 2004.
In summary, Mr. Chairman, while most of the agencies we reviewed had
continuity of operations plans in place, those plans exhibited
weaknesses in the form of widely varying determinations about what
functions are essential and inconsistent compliance with guidance that
defines a viable COOP capability. Agencies could experience
difficulties in delivering key services to citizens in the aftermath of
an emergency as a result of these weaknesses.
A significant factor contributing to this condition is FEMA's limited
efforts to fulfill its responsibilities first by providing guidance to
help agencies develop effective plans and then by assessing those
plans. Further, FEMA has done little to help agencies identify those
functions that are truly essential or to identify and plan for
interdependencies among agency functions. FEMA has begun taking steps
to improve its oversight, by developing more specific guidance and a
system to track agency-provided COOP readiness information, and it is
planning a governmentwide exercise. However, although the proposed
guidance and exercise may help agencies improve their plans, the
database that FEMA is developing to collect infromation on COOP
readiness is weakened by a lack of planning to verify agency-submitted
data, validate agency-identified essential functions, or identify
interdependencies with other activities. Without this level of active
oversight, continuity planning efforts will continue to fall short and
increase the risk that the public will not be able to rely upon the
continued delivery of essential government programs and services
following an emergency.
In our report, we made several recommendations to the Secretary of
Homeland Security to enhance the ability of the federal government to
provide essential services during emergencies. In response to a draft
of our report, the Under Secretary for Emergency Preparedness and
Response agreed that better COOP planning is needed to ensure delivery
of essential services, and that the department could do more to improve
COOP planning. He added that FEMA has begun to correct the identified
deficiencies and stated that the federal government is currently poised
to provide services in an emergency. Once FEMA assesses and
independently verifies the status of agencies' plans, it will have
convincing evidence to support such statements about readiness in the
future.
Mr. Chairman, this concludes my statement. I would be pleased to
respond to any questions that you or other members of the Committee may
have at this time.
Contacts and Acknowledgements:
For information about this testimony, please contact Linda D. Koontz at
(202) 512-6240 or at koontzl@gao.gov, or Mirko Dolak, Assistant
Director, at (202) 512-6362 or dolakm@gao.gov. Other key contributors
to this testimony include Barbara Collier, Neela Lakhmani, Susan Sato,
James R. Sweetman, Jr., Jessie Thomas, and Marcia Washington.
[End of section]
Attachment I: Major Civilian Departments and Agencies Selected for
Review:
Department of Agriculture:
Department of Commerce:
Department of Education:
Department of Energy:
Department of Health and Human Services:
Department of Housing and Urban Development:
Department of Justice:
Department of Labor:
Department of State:
Department of the Interior:
Department of the Treasury:
Department of Transportation:
Department of Veterans Affairs:
Agency for International Development:
Environmental Protection Agency:
Federal Emergency Management Agency:
General Services Administration:
National Aeronautics and Space Administration:
National Science Foundation:
Nuclear Regulatory Commission:
Office of Personnel Management:
Small Business Administration:
Social Security Administration:
[End of section]
Attachment II: 38 High-Impact Programs and Responsible Agencies
Included in Our Review:
Agency: Department of Agriculture;
High-impact programs: Food safety inspection.
High-impact programs: Child nutrition programs.
High-impact programs: Food stamps.
High-impact programs: Special supplemental nutrition program for
women, infants, and children.
Agency: Department of Commerce;
High-impact programs: Patent and trademark processing.
High-impact programs: Weather service.
Agency: Department of Education;
High-impact programs: Student aid.
Agency: Department of Energy;
High-impact programs: Federal electric power generation and delivery.
Agency: Department of Health and Human Services;
High-impact programs: Disease monitoring and warnings.
High-impact programs: Indian health services.
High-impact programs: Medicaid.
High-impact programs: Medicare.
High-impact programs: Organ transplants.
High-impact programs: Child care.
High-impact programs: Child support enforcement.
High-impact programs: Child welfare.
High-impact programs: Low income home energy assistance.
High-impact programs: Temporary assistance for needy families.
Agency: Department of Housing and Urban Development;
High-impact programs: Community development block grants.
High-impact programs: Housing loans.
High-impact programs: Mortgage insurance.
High-impact programs: Section 8 rental assistance.
High-impact programs: Public housing.
Agency: Department of Justice;
High-impact programs: Federal prisons.
High-impact programs: Immigration.
Agency: Department of Labor;
High-impact programs: Unemployment insurance.
Agency: Department of State;
High-impact programs: Passport applications and processing.
Agency: Department of the Interior;
High-impact programs: Bureau of Indian Affairs programs.
Agency: Department of the Treasury;
High-impact programs: Cross-border inspection services.
Agency: Department of Transportation;
High-impact programs: Air traffic control system.
High-impact programs: Maritime search and rescue.
Agency: Department of Veterans Affairs;
High-impact programs: Veterans' benefits.
High-impact programs: Veterans' health care.
Agency: Federal Emergency Management Agency;
High-impact programs: Disaster relief.
Agency: Office of Personnel Management;
High-impact programs: Federal employee health benefits.
High-impact programs: Federal employee life insurance.
High-impact programs: Federal employee retirement benefits.
Agency: Social Security Administration;
High-impact programs: Social Security benefits.
Source: GAO analysis of OMB guidance.
[End of table]
[End of section]
Attachment III: Component Agencies Reviewed, with High-Impact Program
Responsibilities:
Department: Department of Commerce;
Component: National Oceanic and Atmospheric Administration;
High-impact programs: Weather service.
Department: Department of Commerce;
Component: Patent and Trademark Office;
High-impact programs: Patent and trademark processing.
Department: Department of Health and Human Services;
Component: Centers for Disease Control and Prevention;
High- impact programs: Disease monitoring and warnings.
Department: Department of Health and Human Services;
Component: Center for Medicare and Medicaid Services;
High-impact programs: Medicare and Medicaid.
Department: Department of Health and Human Services;
Component: Food and Drug Administration;
High-impact programs: Organ transplants.
Department: Department of Health and Human Services;
Component: Indian Health Service;
High-impact programs: Indian health services.
Department: Department of Housing and Urban Development;
Component: Government National Mortgage Association;
High- impact programs: Housing loans.
Department: Department of Housing and Urban Development;
Component: Office of Community Planning and Development;
High-impact programs: Community development block grants.
Department: Department of Housing and Urban Development;
Component: Office of Housing;
High-impact programs: Section 8 rental assistance and mortgage
insurance.
Department: Department of Housing and Urban Development;
Component: Office of Public and Indian Housing;
High- impact programs: Public housing.
Department: Department of the Interior;
Component: Bureau of Indian Affairs;
High-impact programs: Indian affairs programs.
Department: Department of the Treasury;
Component: U.S. Customs Service;
High-impact programs: Cross-border inspection services.
Department: Department of Transportation;
Component: Federal Aviation Administration;
High-impact programs: Air traffic control system.
Department: Department of Transportation;
Component: U.S. Coast Guard;
High-impact programs: Maritime search and rescue.
Department: Department of Veterans Affairs;
Component: Veterans Benefits Administration;
High-impact programs: Veterans' benefits.
Source: GAO analysis of OMB guidance.
[End of table]
[End of section]
FOOTNOTES
[1] Three of the selected major agencies did not have documented COOP
plans in place as of October 1, 2002.
[2] U.S. General Accounting Office, Continuity of Operations: Improved
Planning Needed to Ensure Delivery of Essential Services, GAO-04-160
(Washington, D.C.: Feb. 27, 2004.)
[3] Attachment II provides a list of the high-impact programs and the
component agencies responsible for them. Attachment III identifies the
15 components whose COOP plans we reviewed and the high-impact programs
for which they are responsible.
[4] We also reported on the human capital considerations relevant to
COOP planning and implementation in U.S. General Accounting Office,
Human Capital: Opportunities to Improve Federal Continuity Planning
Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).
[5] One COOP plan covered two components. As a result, the 34 COOP
plans we reviewed covered 35 departments and agencies, including
components.
[6] The need to ensure that computers would handle dates correctly in
the year 2000 (Y2K) and beyond resulted in a governmentwide effort to
identify mission-critical systems and high-impact programs supported by
these systems.
[7] U.S. General Accounting Office, Year 2000 Computing Challenge:
Lessons Learned Can Be Applied to Other Management Challenges, GAO/
AIMD-00-290 (Washington, D.C.: Sept. 12, 2000).
[8] We reviewed 14 component plans: 1 plan covered a building that
houses 2 components. Attachment III identifies the 15 components and
the high-impact programs for which they are responsible.
