IRS Emergency Planning
Headquarters Plans Supported Response to 2006 Flooding, but Additional Guidance Could Improve All Hazard Preparedness Gao ID: GAO-07-579 April 16, 2007On June 25, 2006, the Internal Revenue Service (IRS) headquarters building suffered flooding during a period of record rainfall and sustained extensive damage to its infrastructure. IRS officials ordered the closure of the building until December 2006 to allow for repairs to be completed. IRS headquarters officials reported activating several of the agency's emergency operations plans. Within 1 month of the flood, over 2,000 employees normally assigned to the headquarters building were relocated to other facilities throughout the Washington, D.C., metropolitan area. GAO was asked to report on (1) how IRS emergency operations plans address federal guidance related to continuity planning and (2) the extent to which IRS emergency operations plans contributed to the actions taken by IRS officials in response to the flood. To address these objectives, GAO analyzed federal continuity guidance, reviewed IRS emergency plans, and interviewed IRS officials.
The IRS headquarters emergency operations plans that GAO reviewed--the headquarters Continuity of Operations (COOP) plan, Incident Management Plan, and three selected business resumption plans--collectively addressed several of the general elements identified within federal continuity guidance for all executive branch departments and agencies. For example, the plans adequately identified the people needed to continue performing essential functions. However, other elements were not addressed or were addressed only in part. Specifically, IRS had two separate lists of essential functions--critical business processes and essential functions for IRS leadership--within its plans, but prioritized only one of the lists. Furthermore, although the COOP plan outlined provisions for tests, training, and exercises, none of the other plans GAO reviewed outlined the need to conduct such activities. While IRS provided overall guidance to its business units on their business resumption plans, the guidance was inconsistent with the federal guidance on several elements, including the preparation of resources and facilities needed to support essential functions and requirements for regular tests, training, and exercises. The IRS Incident Management Plan was particularly useful in establishing clear lines of authority and communications in response to the flooding. Unit-level business resumption plans GAO reviewed contributed to a lesser extent, and the headquarters COOP plan was not activated because of conditions particular to the 2006 flood. Specifically, damage to the building was limited to the basement and subbasement levels, and employees were able to enter the building to retrieve equipment and assets. In addition, alternate work space was available for all employees within a relatively short period, reducing the importance of identifying critical personnel. While its plans helped guide IRS's response to the conditions that resulted from the flood, in more severe emergency events, conditions could be less favorable to recovery. Consequently, unless IRS fills in gaps in its guidance and plans, it lacks assurance that the agency is adequately prepared to respond to the full range of potential disruptions.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-07-579, IRS Emergency Planning: Headquarters Plans Supported Response to 2006 Flooding, but Additional Guidance Could Improve All Hazard Preparedness
This is the accessible text file for GAO report number GAO-07-579
entitled 'IRS Emergency Planning: Headquarters Plans Supported Response
to 2006 Flooding, but Additional Guidance Could Improve All Hazard
Preparedness' which was released on May 17, 2007.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Chairman, Committee on Finance, U.S. Senate:
United States Government Accountability Office:
GAO:
April 2007:
IRS Emergency PLANNING:
Headquarters Plans Supported Response to 2006 Flooding, but Additional
Guidance Could Improve All Hazard Preparedness:
GAO-07-579:
GAO Highlights:
Highlights of GAO-07-579, a report to the Chairman, Committee on
Finance, U.S. Senate
Why GAO Did This Study:
On June 25, 2006, the Internal Revenue Service (IRS) headquarters
building suffered flooding during a period of record rainfall and
sustained extensive damage to its infrastructure. IRS officials ordered
the closure of the building until December 2006 to allow for repairs to
be completed. IRS headquarters officials reported activating several of
the agency‘s emergency operations plans. Within 1 month of the flood,
over 2,000 employees normally assigned to the headquarters building
were relocated to other facilities throughout the Washington, D.C.,
metropolitan area.
GAO was asked to report on
(1) how IRS emergency operations plans address federal guidance related
to continuity planning and (2) the extent to which IRS emergency
operations plans contributed to the actions taken by IRS officials in
response to the flood. To address these objectives, GAO analyzed
federal continuity guidance, reviewed IRS emergency plans, and
interviewed IRS officials.
What GAO Found:
The IRS headquarters emergency operations plans that GAO reviewed”the
headquarters Continuity of Operations (COOP) plan, Incident Management
Plan, and three selected business resumption plans”collectively
addressed several of the general elements identified within federal
continuity guidance for all executive branch departments and agencies
(see table below). For example, the plans adequately identified the
people needed to continue performing essential functions. However,
other elements were not addressed or were addressed only in part.
Specifically, IRS had two separate lists of essential
functions”critical business processes and essential functions for IRS
leadership”within its plans, but prioritized only one of the lists.
Furthermore, although the COOP plan outlined provisions for tests,
training, and exercises, none of the other plans GAO reviewed outlined
the need to conduct such activities. While IRS provided overall
guidance to its business units on their business resumption plans, the
guidance was inconsistent with the federal guidance on several
elements, including the preparation of resources and facilities needed
to support essential functions and requirements for regular tests,
training, and exercises.
The IRS Incident Management Plan was particularly useful in
establishing clear lines of authority and communications in response to
the flooding. Unit-level business resumption plans GAO reviewed
contributed to a lesser extent, and the headquarters COOP plan was not
activated because of conditions particular to the 2006 flood.
Specifically, damage to the building was limited to the basement and
subbasement levels, and employees were able to enter the building to
retrieve equipment and assets. In addition, alternate work space was
available for all employees within a relatively short period, reducing
the importance of identifying critical personnel.
While its plans helped guide IRS‘s response to the conditions that
resulted from the flood, in more severe emergency events, conditions
could be less favorable to recovery. Consequently, unless IRS fills in
gaps in its guidance and plans, it lacks assurance that the agency is
adequately prepared to respond to the full range of potential
disruptions.
Table: Summary of General Elements Identified within Federal Continuity
guidance:
General element: Essential functions;
Description of agency action: Determine what agency-specific functions
must be continued under all circumstances.
General element: People;
Description of agency action: Identify and designate the personnel
critical to agency operations.
General element: Resources;
Description of agency action: Identify and plan for the availability of
resources needed.
General element: Alternate facilities;
Description of agency action: Identify and prepare alternate facilities
for critical personnel.
General element: Activation;
Description of agency action: Determine which continuity plans should
be activated.
General element: Execution;
Description of agency action: Document procedures that guide emergency
operations personnel.
General element: Resumption;
Description of agency action: Outline a plan to return or transition to
normal operations.
General element: Tests, training, and exercises;
Description of agency action: Perform tests, training, and exercises of
continuity plans.
Source: GAO analysis of Federal Preparedness Circular 65.
[End of section]
What GAO Recommends:
GAO recommends that the Commissioner of Internal Revenue revise
internal IRS guidance and emergency plans to fully reflect federal
continuity guidance. The Commissioner agreed with our recommendations
and stated that the agency will take the necessary steps to implement
them and revise its emergency plans.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-579].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Bernice Steinhardt at
(202) 512-6543 or steinhardtb@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
IRS Headquarters Emergency Operations Plans Partially Addressed
Elements Outlined in Federal Guidance:
IRS Emergency Plans Contributed to the Agency's Flood Response:
Conclusions:
Recommendations for Executive Action:
Agency Comments:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Comments from the Internal Revenue Service:
Tables:
Table 1: Time Line of Activities Following the Flood on June 25, 2006:
Table 2: IRS Emergency Operations Plans and Purposes:
Table 3: Summary of FPC 65 Guidance Related to Ensuring Continuity of
Essential Agency Operations:
Abbreviations:
CI: Criminal Investigation:
COOP: continuity of operations:
FEMA: Federal Emergency Management Agency:
FPC: Federal Preparedness Circular:
IRS: Internal Revenue Service:
W&I: Wage and Investment:
United States Government Accountability Office:
Washington, DC 20548:
April 16, 2007:
The Honorable Max Baucus:
Chairman:
Committee on Finance:
United States Senate:
Dear Mr. Chairman:
In June 2006, the Internal Revenue Service (IRS) headquarters building,
1111 Constitution Avenue, NW, Washington, D.C., was flooded during a
period of record rainfall. The building sustained extensive damage to
its infrastructure, and critical parts of the building's electrical and
mechanical equipment were destroyed or heavily damaged, requiring the
headquarters building to be closed until December 2006 to allow for
repairs.
In response to the flood and the closure of the building, IRS
headquarters officials reported activating several of the agency's
emergency operations plans. Over 2,000 employees normally assigned to
the headquarters building were relocated to 15 locations throughout the
Washington, D.C., metropolitan area in an effort to ensure the
continuity of headquarters essential operations. The headquarters
building was reopened on December 8, 2006.
The Federal Emergency Management Agency (FEMA) developed Federal
Preparedness Circular (FPC) 65 to provide guidance to federal executive
branch departments and agencies on developing contingency plans and
programs to ensure that agencies can continue performing their
essential government functions during any emergency or situation that
may disrupt normal operations. All federal executive branch agencies
are required to have such a capability in place to maintain essential
government services across a wide range of all hazard emergencies.
To determine whether IRS emergency operations plans were adequate to
continue effective operations following the flood, you asked us to
evaluate (1) how IRS emergency operations plans address federal
guidance related to continuity planning and (2) the extent to which IRS
emergency operations plans contributed to the actions taken by IRS
officials in response to the flood. At your request, we worked closely
with the Treasury Inspector General for Tax Administration, who
examined information technology recovery efforts and the impact of the
flood on tax administration.
To address our first objective, we obtained the IRS headquarters
emergency operations plans that were available to agency officials at
the time of the June 2006 flood. We analyzed FPC 65 continuity guidance
and identified eight general elements related to developing a viable
continuity capability. We reviewed emergency operations plans that were
available at the time of the flood--including the IRS headquarters
Continuity of Operations (COOP) plan, Incident Management Plan, and
three selected business resumption plans[Footnote 1]--and analyzed how
they collectively addressed or did not address these eight general
elements of guidance.[Footnote 2] We also reviewed IRS-defined criteria
for emergency operations plans, including sections of the Internal
Revenue Manual--which guides IRS officials in developing several of the
agency's emergency operations plans--and an internal template provided
by IRS's Office of Physical Security and Emergency Preparedness, which
is responsible for agencywide emergency planning and policy, to guide
plan development.
To address our second objective, we interviewed IRS officials
responsible for the development, oversight, and implementation of the
headquarters emergency operations plans. In our interviews, we asked
IRS officials responsible for each emergency operations plan how their
plans contributed to their actions following the flood, if at all. To
supplement the information gained from the interviews, we reviewed
agency documentation related to emergency operations activities
following the flood, including IRS status reports, employee relocation
lists, and emergency operations team meeting minutes. In addition, we
reviewed documentation regarding lessons learned from the flood,
provided by various headquarters business units, and obtained any
updates or changes to emergency operations plans following the flood.
We conducted our review in accordance with generally accepted
government auditing standards from July 2006 through March 2007.
Detailed information on our objectives, scope, and methodology appears
in appendix I.
Results in Brief:
The IRS headquarters emergency operations plans we reviewed--the
headquarters COOP plan, Incident Management Plan, and selected business
resumption plans--collectively addressed several of the general
elements of a viable continuity capability identified within FPC 65.
For example, the plans adequately identified the people needed to
continue performing essential functions. However, other elements were
not addressed or were addressed only in part. Specifically, IRS had two
separate lists of essential functions--critical business processes and
essential functions for IRS leadership--within its plans, but
prioritized only one of the lists. Furthermore, although the COOP plan
outlined provisions for tests, training, and exercises, none of the
three business resumption plans we reviewed or the Incident Management
Plan outlined the need to conduct such activities. While IRS's Office
of Physical Security and Emergency Preparedness provided overall
guidance to business units on their business resumption plans, the
guidance was inconsistent with the federal guidance on several
elements, including the preparation of resources and facilities needed
to support essential functions and requirements for regular tests,
training, and exercises.
IRS officials largely relied upon the Incident Management Plan to
direct their response to the emergency conditions created by the June
2006 flooding. This plan guided officials in establishing roles and
responsibilities for command and control of the overall resumption
effort and a capability for the procurement of alternate facility space
and equipment. Business unit officials were initially guided by their
business resumption plans, but later response activities differed from
those plans because of the circumstances resulting from the flooding.
According to IRS headquarters officials, the headquarters COOP plan was
not activated because local space availability made movement of
executive leadership to the alternate COOP facility unnecessary and the
safety of the leadership was not at risk.
While IRS's plans helped guide its response to the flood, the
conditions that prevailed then--space available to relocate all
employees and the ability to retrieve equipment and assets--may not be
present in other emergency events. Consequently, unless IRS fills in
gaps in its guidance and plans, it will lack assurance that the agency
is adequately prepared to respond to the full range of potential
disruptions.
We are recommending that the Commissioner of Internal Revenue (1)
revise IRS internal emergency planning guidance to fully reflect
federal guidance on the elements of a viable continuity capability,
including the identification and prioritization of essential functions,
the preparation of necessary resources and alternate facilities, and
the regular completion of tests, training, and exercises of continuity
capabilities, and (2) revise the IRS emergency plans in accordance with
the new internal guidance. The Commissioner agreed with our
recommendations and outlined steps the agency will take to improve its
emergency plans and guidance.
Background:
IRS administers America's tax laws and collects the revenues that fund
government operations and public services. In fiscal year 2006, IRS
collected more than $2.5 trillion in revenue. IRS's Taxpayer Service
and Enforcement programs generate more than 96 percent of the total
federal revenue collected for the U.S. government. Total federal
revenues have fluctuated from roughly 16 to 21 percent of gross
domestic product between 1962 and 2004.[Footnote 3] Given the amount of
federal revenue collected by IRS, a disruption of IRS operations could
have great impact on the U.S. economy.
The IRS headquarters building is located in Washington, D.C., and
houses over 2,200 of the agency's estimated 104,000 employees. The
headquarters building contains the offices of IRS executive leaders,
such as the Commissioner and deputy commissioners, and headquarters
personnel for 14 of the agency's 17 individual business units.
Flood of IRS's Headquarters Building:
On June 25, 2006, the IRS headquarters building suffered flooding
during a period of record rainfall and sustained extensive damage to
its infrastructure. The subbasement and basement were flooded, and
critical parts of the facility's electrical and mechanical equipment
were destroyed or heavily damaged. The subbasement--which contained
equipment such as electrical transformers, electrical switchgears, and
chillers--was submerged in more than 20 feet of water. In addition, the
basement level--which housed the building's fitness center, food
service canteens, computer equipment, and the basement garage--was
flooded with 5 feet of water. As a result of the flood damage, the
building was closed until December 8, 2006. In response to the flood
and the closure of the building, IRS headquarters officials reported
activating several of the agency's emergency operations plans. Over
2,000 employees normally assigned to the headquarters building were
relocated to other facilities throughout the Washington, D.C.,
metropolitan area.
Although the flood severely damaged the building and necessitated the
relocation of IRS employees to alternate office space, particular
circumstances limited potential damage and made response and recovery
activities easier:
* No employees were injured, killed, or missing as a result of the
flood.
* Damage was limited to the basement and subbasement levels, and
employees were able to enter the building to retrieve equipment and
assets 5 days following the flood.
* IRS and the General Services Administration were able to identify and
allocate alternate work space to accommodate all displaced employees,
not just those considered critical or essential.
According to IRS status reports following the flood, facility space was
provided for critical personnel within 10 days and for all headquarters
employees within 29 days. Table 1 provides a time line of activities
following the flood.
Table 1: Time Line of Activities Following the Flood on June 25, 2006:
Date: June 26,
2006; Day: Day 1;
Activity: Building closed. Employees notified to stay home.
Date: June 28, 2006;
Day: Day 3;
Activity: Meeting held with IRS business units. Voice mail
reestablished. Process established for employees to retrieve equipment
and assets from the building.
Date: June 30, 2006;
Day: Day 5;
Activity: Retrieval process for equipment and assets implemented.
Date: July 3, 2006;
Day: Day 8;
Activity: Computer servers reestablished at alternate locations.
Date: July 5, 2006;
Day: Day 10;
Activity: About 700 selected employees reported back to work at
alternate office space throughout the Washington, D.C., metropolitan
area.
Date: July 7, 2006;
Day: Day 12;
Activity: Other employees moved in phases.
Date: July 24, 2006;
Day: Day 29;
Activity: All employees reported back to work at alternate office space
throughout the Washington, D.C., metropolitan area.
Date: Dec. 8, 2006;
Day: Day 166;
Activity: Employees began the return to the headquarters building.
Sources: IRS Senior Commissioner Representative status reports and
IRS's news release regarding the flood.
[End of table]
The Treasury Inspector General for Tax Administration also reviewed the
IRS response to the flooding.[Footnote 4] According to the Inspector
General's reports, IRS adequately protected sensitive data and restored
computer operations to all employees approximately 1 month following
the flood. In addition, he reported that the flood caused no measurable
impact on tax administration because of the nature of the work
performed at this building and the contingency plans that IRS had in
place. Finally, he reported that IRS paid $4.2 million in salary costs
for 101,000 hours of administrative leave granted to IRS personnel
following the flooding.[Footnote 5] While $3 million was paid for
administrative leave during the first week following the flooding, the
amount paid for administrative leave decreased in subsequent weeks.
IRS Headquarters Emergency Operations Plans:
IRS headquarters has multiple emergency operations plans that if
activated, are intended to work in conjunction with each other during
emergencies. These plans include a suite of business continuity plans
comprised of, among others, a business resumption plan for each IRS
business unit and an Incident Management Plan.[Footnote 6] In addition,
IRS has a COOP plan for emergency events affecting IRS executive
leadership and essential functions. Table 2 summarizes the IRS
emergency operations plans and their purposes.
Table 2: IRS Emergency Operations Plans and Purposes:
Emergency operations plan: Business resumption plan;
Description: Guides the resumption of the unit's critical business
functions and return to normal operations after an emergency; Each
business unit within IRS is responsible for establishing its own
business resumption plan.
Emergency operations plan: Incident Management Plan;
Description: Provides a command and control structure to centrally
coordinate and manage the agency's emergency response and recovery
activities; Key activities include providing overall leadership,
coordinating needs and priorities among business units, and securing
the resources--such as office space and computers--necessary for
business units to resume critical business functions.
Emergency operations plan: COOP plan;
Description: Prepares for the potential relocation of IRS's executive
leadership--including the Commissioner and deputy commissioners--to an
alternate facility in order to perform IRS essential functions.
Source: GAO analysis of IRS emergency operations plans.
[End of table]
Federal Guidance for Continuity Planning:
FEMA developed FPC 65 to provide guidance to federal executive branch
departments and agencies in developing contingency plans and programs
to ensure the continuity of essential agency operations. All federal
executive branch agencies are required to have such a capability in
place to maintain essential government services across a wide range of
all hazard emergencies. This guidance defines the elements of a viable
continuity capability for agencies to address in developing their
continuity plans.
Table 3 summarizes eight general elements of federal continuity
guidance that agency plans should address.
Table 3: Summary of FPC 65 Guidance Related to Ensuring Continuity of
Essential Agency Operations:
General element: Essential functions;
Description of agency action: Determine what agency-specific functions
must be continued under all circumstances and prioritize them based on
criticality and time sensitivity. Consider those functions that must
continue with minimal disruption or cannot be interrupted for more than
12 hours and must continue operating up to 30 days.
General element: People;
Description of agency action: Identify and designate the personnel who
would be critical to agency operations during an emergency, including
staff directly responsible for relocating to an alternate location to
perform agency essential functions.
General element: Resources;
Description of agency action: Identify and plan for the availability of
resources needed to perform agency essential functions during an
emergency, including vital records, critical systems and data, and
equipment.
General element: Alternate facilities;
Description of agency action: Provide the capability for emergency
operations personnel to continue performing agency essential functions
from an alternate location by identifying and preparing alternate
facilities.
General element: Activation;
Description of agency action: Develop a decision process that guides
officials in determining when and which continuity plans and procedures
should be activated in response to an emergency.
General element: Execution;
Description of agency action: Document procedures that guide emergency
operations personnel in executing the agency's continuity plan.
General element: Resumption;
Description of agency action: Identify and outline a plan to return or
transition to normal operations.
General element: Tests, training, and exercises;
Description of agency action: Perform tests, training, and exercises of
continuity plans and procedures to ensure agency readiness for an
emergency.
Source: GAO analysis of FPC 65.
[End of table]
IRS supplemented federal guidance with sections of its Internal Revenue
Manual--a document outlining the agency's organization, policies, and
procedures--related to business resumption plans. Similar to the
federal continuity guidance, the Internal Revenue Manual outlined
minimum requirements for business resumption plans, including the need
to identify people and resources to perform critical functions.
IRS Headquarters Emergency Operations Plans Partially Addressed
Elements Outlined in Federal Guidance:
The IRS headquarters emergency operations plans we reviewed
collectively addressed several of the general elements of guidance
identified in FPC 65. For example, the plans adequately identified the
people needed to continue performing essential functions and had
established procedures for activation. However, other elements were not
addressed or were addressed only in part. Specifically, IRS identified
two separate lists of essential functions--critical business processes
and essential functions for IRS leadership--within its plans but only
prioritized one of the lists. Furthermore, although the COOP plan
outlined provisions for tests, training, and exercises, neither the
business resumption plans we reviewed--from Criminal Investigation
(CI),[Footnote 7] Wage and Investment (W&I),[Footnote 8] and Chief
Counsel[Footnote 9]--nor the Incident Management Plan outlined the need
to conduct such activities. While IRS's Office of Physical Security and
Emergency Preparedness provided overall guidance to business units on
their business resumption plans, the guidance was inconsistent with the
federal guidance on several elements, including the preparation of
resources and facilities needed to support essential functions and
requirements for regular tests, training, and exercises. Until IRS
requires all of the plans that contribute to its ability to quickly
resume essential functions to fully address federal guidance, it will
lack assurance that it is adequately prepared to respond to the full
range of potential disruptions.
Essential Functions:
FPC 65 states that agencies are to determine what agency-specific
functions must be continued under all circumstances and prioritize them
based on the criticality and time sensitivity of each
function.[Footnote 10] The resulting prioritized list of functions
establishes the planning parameters that drive the agency's efforts
across all other planning topics. For example, the guidance directs
agencies to identify alternate facilities, staff, and resources
necessary to support continuation of essential functions. Therefore,
the effectiveness of plans as a whole and the implementation of all
other elements depend on the performance of this step. We previously
reported on sound practices related to identifying and validating
essential functions, including the need to prioritize essential
functions and determine a recovery time objective for each function,
establishing the maximum tolerable downtime for each.[Footnote 11] Such
identification of time sensitivity is especially important during
events that may result in constraints on facility space and resources,
as it allows agency officials to prioritize the activities that are
performed.
The IRS emergency operations plans we reviewed identified a number of
essential functions but did not consistently prioritize them.
Specifically, the Incident Management Plan contained a list of 18
functions called IRS critical business processes. These functions
included processing remittances, user fees, and other related
receivables; processing tax returns and refunds; and tax administration
enforcement activities. The Incident Management Plan also identified
the IRS business unit or units responsible for each critical business
process, and outlined supporting activities for each unit. Although the
Incident Management Plan listed the critical business processes in
priority order but did not establish recovery time objectives for them,
the three business resumption plans we reviewed included recovery time
objectives for each of the subprocesses that make up that unit's
contributions to the overall critical business processes. For example,
the Chief Counsel plan indicated that the business unit contributes to
the tax administration enforcement process through a subprocess called
litigation and advice to staff. The plan assigned this subprocess a
recovery time objective of 5 days.
In contrast, the headquarters COOP plan did not include any type of
prioritization. The plan established a list of essential functions for
IRS executive leadership, ranging from executive-level activities--
such as providing leadership and accounting for personnel--to
operational responsibilities--such as ensuring ongoing operation of
specific IRS business units. However, this list was not prioritized
with regard to importance or time. According to an official of the
Office of Physical Security and Emergency Preparedness, the agency did
not prioritize the essential functions in its COOP plan because it
determined that all the essential functions had the same priority and
time sensitivity.[Footnote 12] Without fully prioritizing agency
essential functions based on both their criticality and time
sensitivity, IRS could be inhibited in responding to the full range of
potential emergencies, especially those where there are limited
resources available for recovery and agency operations must be restored
over a short period.
People:
According to FPC 65, agencies are to identify the personnel who would
be critical to performing essential agency operations during an
emergency, including staff directly responsible for relocating to an
alternate location. All IRS headquarters plans we reviewed identified
people critical to agency operations during an emergency by including
rosters of personnel necessary to continue essential functions and to
coordinate emergency efforts.
In support of IRS critical business processes, all three business
resumption plans we reviewed included rosters of personnel. The W&I and
CI business resumption plans outlined team leaders and personnel
necessary to carry out critical business processes. The Chief Counsel
plan identified individuals responsible for coordinating business
resumption efforts--including business resumption team leaders.
According to a Chief Counsel business resumption official, each
business resumption team leader is responsible for identifying critical
people within his or her office following an emergency and for
maintaining roster information on all of the employees within the
office.
In support of IRS essential functions, the COOP plan included lists of
teams composed of executive leadership. For example, the COOP plan
outlined a Commissioner Core COOP team responsible for immediately
deploying to an alternate facility and coordinating the performance of
IRS essential functions following an emergency. The team included the
IRS Commissioner, Chief of Staff, and other executives. In addition,
the plan identified a COOP standby team made up of additional
executives, including commissioners of several business units, who have
responsibilities for essential functions and can be called upon to
relocate to the alternate facility.
Resources:
FPC 65 guides agencies in identifying and planning for the availability
of resources needed to perform essential functions during an emergency,
including vital records, critical systems and data, and equipment. The
guidance states that agencies should pre-position critical resources
and ensure that vital records and critical systems and data can be
accessed from alternate locations.
Although all IRS emergency operations plans we reviewed identified the
resources necessary to support critical business processes and
essential functions, they did not indicate how such resources would be
made available following an emergency. All three business resumption
plans we reviewed identified resources needed to support business
resumption activities. For example, the CI plan identified necessary
vital records, such as contact lists; critical information systems,
such as its evidence tracking databases; and telecommunications
equipment, such as telephones and fax machines. In addition, the
headquarters COOP plan identified resources needed to support essential
functions, including vital records, such as phone directories; critical
information systems, such as the agency's travel reimbursement and
accounting system; and telecommunications equipment, such as cell
phones, satellite phones, and pagers.
However, none of the plans we reviewed documented that the identified
resources would be prepared and made ready for use following an
emergency. For example, although the headquarters COOP plan and the W&I
business resumption plan both outlined the vital records needed to
support essential functions, neither identified where copies of the
records would be located or how they would be accessed at an alternate
work location. Similarly, the CI plan identified the number of
computers needed by each of its offices, but did not outline where and
how the computers would be made available at the time of an emergency.
If such resources are not adequately prepared before a disruption
occurs, the agency cannot ensure that they will be available when
needed and its response could be delayed while the resources are
acquired or moved to an alternate location.
Alternate Facilities:
FPC 65 states that agencies are to provide a capability for their
emergency personnel to continue performing agency essential functions
and emergency operations activities from alternate locations by
identifying and preparing alternate facilities. For example, it directs
that the facility have space adequate to accommodate the personnel
listed in the continuity plan and communications capabilities adequate
to maintain contact with the agency's personnel and key partners. It
also directs that critical resources be pre-positioned at the site.
The headquarters COOP plan identified specific alternate facilities for
relocation of executive personnel to perform essential functions
following an emergency. In addition, the three business resumption
plans we reviewed identified alternate facilities where their essential
functions could be performed following an emergency. For example, the
CI plan identified an alternate facility that could accommodate
approximately 80 employees.
However, none of the plans we reviewed addressed site preparation. As a
result, it is not clear whether the selected sites provide the agency
with the capability for a timely response to a disruption. If the
agency does not adequately prepare its alternate facilities before an
emergency, its response could be delayed.
Activation:
FPC 65 states that agencies should develop a decision process that
guides officials in determining when and which emergency operations
plans and procedures should be activated in response to an emergency.
The IRS headquarters emergency operations plans we reviewed identified
both the officials responsible for activating each plan and the
emergency conditions under which activation would occur.
IRS addressed plan activation in its Incident Management and COOP
plans. The Incident Management Plan established the authority of the
Incident Commander to activate both the Incident Management Plan and
the headquarters business resumption plans in response to incidents and
disasters affecting critical business functions. Furthermore, the
headquarters COOP plan identified a list of senior IRS officials--
including the IRS Commissioner and deputy commissioners--authorized to
activate the COOP plan in response to federal emergencies, continuity
of government events, and credible threats of actions that would
preclude access to or use of the IRS headquarters building and
surrounding areas.
Execution:
FPC 65 directs agencies to document procedures that guide personnel in
executing the agency's emergency response capability. The COOP plan and
Incident Management Plan outlined procedures that guide personnel in
executing the agency's emergency response capability. However, the
degree to which the selected business resumption plans provided such
information varied.
Specifically, two of the three business resumption plans--the CI and
W&I plans--outlined instructions for officials to follow in executing
their plans and procedures while Chief Counsel's plan did not.
According to a Chief Counsel official responsible for business
resumption planning, the business unit relies upon business resumption
team leaders identified within the plan to determine appropriate
courses of action following an emergency based on supporting the active
caseload.
Resumption:
FPC 65 states that agencies are to identify and outline plans to return
or transition to normal operations. IRS emergency operations plans we
reviewed addressed the resumption of normal operations following an
emergency through its business resumption plans and a reconstitution
phase outlined in the headquarters COOP plan.
According to the Internal Revenue Manual, business resumption plans are
developed to guide the orderly reestablishment of operations after an
emergency. All three selected business units developed individual
business resumption plans. The COOP plan assumed that business
continuity plans were to be activated to resume business operations.
However, the plan also identified a reconstitution phase to transition
COOP personnel back to normal operations.
Tests, Training, and Exercises:
Tests, training, and exercises are essential to demonstrating and
improving an agency's ability to execute its continuity plans and
procedures. The guidance established timetables for training that
familiarizes agency personnel with the essential functions they may
have to perform, as well as tests and exercises, which serve to assess,
validate, or identify for subsequent correction specific aspects of
agency plans, policies, procedures, systems, and facilities used in
response to an emergency. These activities can also demonstrate the
viability of agency plans and identify any deficiencies for correction.
While the IRS COOP plan established requirements for regular tests,
training, and exercises, the Incident Management plan and the business
resumption plans we reviewed did not. The headquarters COOP plan
outlined detailed descriptions for activities, including alert and
notification drills, orientation sessions, and tabletop and deployment
exercises. It also specified how often each activity should be
conducted, such as quarterly for tests of alert and notification
procedures, and semiannually for tabletop exercises. In contrast,
neither the Incident Management Plan nor the business resumption plans
we reviewed outlined any information regarding the types of tests,
training, and exercises to conduct or at what frequency they should
occur. The Incident Management teams did, however, conduct relevant
training as recently as August 2005, and scheduled two exercises in
2006 that they were forced to cancel because of actual incidents at the
facility.[Footnote 13] If the agency does not conduct regular tests,
training, and exercises, it cannot ensure that the people and resources
it needs for a timely and effective response will be prepared for
emergencies.
IRS Internal Guidance Did Not Fully Address Elements of a Viable
Continuity Capability:
Inconsistencies between IRS's business resumption plans and federal
guidance can be attributed in part to gaps in IRS internal guidance.
IRS provided its business units with guidance on developing business
resumption plans, including general guidance within IRS's Internal
Revenue Manual and a business resumption plan template disseminated to
the business units. The Internal Revenue Manual provided IRS business
units with minimum requirements of elements to include in their plans,
such as identifying critical personnel and resources. In addition, the
Office of Physical Security and Emergency Preparedness disseminated a
business resumption plan template to business units that included,
among other things, sections for identifying the critical business
processes and personnel to support the resumption of critical
activities.
IRS's internal guidance addressed several of the elements of a viable
continuity capability. For example, the Internal Revenue Manual stated
that business resumption plans should include a list of critical
personnel, and the business resumption plan template asked each
business unit to list its critical team leaders and members and their
contact information. Similarly, the IRS guidance adequately addressed
execution and resumption.
For other continuity planning elements, however, IRS guidance on
developing business resumption plans was inconsistent with federal
guidance. Specifically, IRS guidance on resources directed business
units to identify their need for vital records, systems, and equipment.
However, rather than procuring those resources before an event occurs,
as outlined in federal guidelines, IRS guidance assumed that business
units will work with teams outlined within the Incident Management Plan
to acquire those resources following a disruption. Similarly, IRS
directed business units to identify alternate work space requirements
for personnel, but not to prepare or acquire them until after a
disruption occurs. Finally, IRS guidance did not address the need for
tests, training, or exercises involving the critical personnel
identified within business resumption plans. Officials from the Office
of Physical Security and Emergency Preparedness stated that it was the
responsibility of business units to conduct adequate tests, training,
and exercises of their business resumption plans.
Officials further stated that the IRS response to the June 2006
flooding validated the use of its incident command structure outlined
in its Incident Management Plan. Although the incident command
structure can be effective at securing needed resources over time, IRS
will be able to respond to a disruption more quickly if it prepares
necessary resources and facilities before an event occurs. This is
especially critical in the case of business processes that need to be
restored within 24 to 36 hours. Similarly, if personnel are unfamiliar
with emergency procedures because of inadequate training and exercises,
the agency's response to a disruption could be delayed.
IRS Emergency Plans Contributed to the Agency's Flood Response:
IRS officials largely relied upon the Incident Management Plan to
direct their response to the emergency conditions created by the June
2006 flooding. This plan guided officials in establishing roles and
responsibilities for command and control of the overall resumption
effort and a capability for the procurement of alternate facility space
and equipment. Business unit officials were initially guided by their
business resumption plans, but later response activities differed from
those plans because of the circumstances resulting from the event.
According to IRS headquarters officials, the headquarters COOP plan was
not activated because local space availability made moving the
executive leadership to the alternate COOP facility unnecessary and the
safety of the leadership was not at risk.
The Incident Management Plan Contributed to Establishing a Command and
Control Structure Immediately Following the Flood:
We previously reported that in responding to emergencies, roles and
responsibilities for leadership must be clearly defined and effectively
communicated in order to facilitate rapid and effective decision
making.[Footnote 14] The IRS Incident Management Plan provided agency
officials with clear leadership roles and responsibilities for managing
the response and recovery process, including the procurement of
temporary facility space and equipment necessary to continue critical
business processes.
Consistent with the plan, the Incident Commander acted as the leader of
IRS headquarters response and recovery activities immediately following
the flood. To assist in managing the incident, the Incident Commander
activated members of the IRS Incident Management Team and other
supporting sections, whose roles and responsibilities were outlined in
the plan. These individuals included business resumption team leaders
from each of the IRS business units and personnel from the central
service divisions, such as Real Estate and Facilities Management and
Modernization and Information Technology Services.
According to minutes from Incident Management Team meetings held in the
days following the flood, the following Incident Management supporting
teams were activated and provided the following contributions:
1. The Operations Section, responsible for conducting response and
recovery activities, gathered information regarding the facility space
and equipment requests from the IRS business units, as well as
preferences on alternate work location assignments.
2. The Logistics Section, responsible for providing all nonfinancial
logistical support, procured and allocated facility space and equipment
to IRS business units.
3. The Planning Section, responsible for providing documentation of the
emergency, documented decisions and conducted reporting. For example,
the Planning Section prepared documents for hearings and maintained
relocation schedules and information.
4. The Finance and Administrative Section, responsible for providing
all financial support, provided assistance in monitoring agency costs
and developing travel and leave policies.
According to IRS status reports following the flood, facility space was
provided for critical personnel within 10 days and for all headquarters
employees within 29 days. The Incident Commander reported that the
Incident Management Team and its supporting units stepped down
approximately 2 months after the flood.
Business Resumption Plans Guided Initial Business Unit Flood Responses:
The three business units we reviewed reported that their business
resumption plans guided their initial responses to the flood. In later
phases of their responses, the business units differed from their plans
to account for conditions at the time, such as current work priorities
and the availability of alternate office space for more staff than the
minimum necessary to perform the most critical functions. The following
sections outline how selected business units relied on their business
resumption plans when responding to the flood.
Criminal Investigation:
CI used its business resumption plan to (1) establish an internal
command structure to coordinate emergency activities following the
flood and (2) identify short-term facility space for selected
employees. According to the CI business resumption executive, the
business unit used alternate facilities previously identified within
the CI business resumption plan to relocate personnel within the first
2 days. CI leadership determined which personnel would be placed first
and at what locations, since its business unit's resumption plan did
not specify such information. According to the CI business resumption
executive, after learning from the Incident Commander that relocation
would be for a longer period and that alternate facility space was
available to accommodate all displaced CI employees, CI officials
submitted a request for facility space and equipment for all of their
employees to the Incident Commander and Incident Management Team.
In discussing lessons learned, the CI business resumption executive
acknowledged that the unit's plan primarily addressed relocation to
alternate facilities for short-term emergencies rather than longer-term
events like the flood, and that CI should work with IRS's central
organizations to better plan for relocation in such situations.
Furthermore, the executive stated that better tests and exercises of
the CI plan could assist in better preparing for a wider range of
future emergencies.
Wage and Investment:
W&I officials used their plan to identify and prioritize critical
tasks. W&I managers gathered at a previously scheduled off-site retreat
the morning following the flood and conducted a review of the business
unit's resumption plan, according to the new W&I business resumption
executive. The executive stated that the activity was particularly
useful in addressing identified knowledge gaps in the wake of the prior
W&I business resumption leader's sudden death the day before the flood.
Critical business processes and supporting tasks, initially prioritized
within the plan, were adjusted to reflect the criticality of several
tasks at that time of year. According to the business resumption
executive, the revised list of critical business processes allowed W&I
managers to identify critical personnel and resources, which were
submitted to the Incident Management Team as facility space and
resource requests. In addition, the executive stated that W&I managers
established a system for placing employees in alternate work space
based on their association with the prioritized tasks, although it was
not reflected in the W&I business resumption plan.
W&I created a document to capture lessons learned following the flood
and established an internal business resumption working group to ensure
a business resumption capability in all W&I field offices. As W&I
officials did not anticipate the need to readjust tasks, one item
discussed in the document addressed the need to create a rolling list
of critical business processes and critical personnel, as processes and
tasks will vary throughout the year. In addition, the W&I business
resumption working group developed minimum requirements for all W&I
plans and conducted a gap analysis of field office plans to identify
areas for improvement. According to the W&I business resumption
executive, the working group will conduct a training session for field
office business resumption coordinators after the 2007 filing season.
Chief Counsel:
Although the Chief Counsel resumption efforts were led by people
identified within its plan, the unit's business resumption officials
reported that use of the plan was limited because of the high-level
content of the document. According to the Chief Counsel's business
resumption executive, the plan was written at a high level because it
was expected that specific priorities would be determined by the active
caseload at the time of the emergency. The executive stated that
following the flood, Chief Counsel prioritized resumption activities
based on the active caseload and the need to address emerging
requirements, such as (1) ensuring that mail addressed to the business
unit's processing division was rerouted and processed at another
facility and (2) supporting a specific court case being conducted in
New York City because of its level of criticality and time sensitivity.
The executive further stated that officials identified alternate work
space in Chief Counsel offices in the Washington, D.C., metropolitan
area and placed approximately 180 employees prioritized based on the
organizational hierarchy. Chief Counsel submitted requests to the
Incident Commander and Incident Management Team for facility space and
resources for over 500 remaining employees.
Although Chief Counsel was able to identify tasks, such as tax
litigation, that were consistent with responsibilities outlined in its
plan and procured facility space and resources for personnel, it
established a task force that identified recommendations to improve the
business unit's plan in a report documenting lessons learned following
the flood. Recommendations included measures to improve the
prioritization of critical functions and people and outline provisions
for mail processing. In addition, because Chief Counsel experienced
delays in recovering a computer server that had not been identified in
the business resumption plan but proved to be important following the
flood, the task force addressed the need to ensure redundancy of
information technology equipment. Chief Counsel is currently drafting
an action plan to carry out the recommendations of the task force. In
addition, a Chief Counsel business resumption official stated that
agencywide tests and exercises of business resumption plans could
assist in better integration of emergency efforts for a wider range of
future emergencies.
IRS Headquarters Continuity of Operations Plan Was Not Used in Flood
Response:
According to IRS headquarters officials, the headquarters COOP plan was
not activated because local space availability made movement of
executive leadership to the alternate COOP facility unnecessary and the
safety of the leadership was not at risk.
Conclusions:
When the June 2006 flood occurred at the IRS headquarters building, the
agency had in place a suite of emergency plans that helped guide its
response. The agency's Incident Management Plan was particularly useful
in establishing clear lines of authority and communications, conditions
that we have previously reported to be critical to an effective
emergency response. Unit-level business resumption plans we reviewed
contributed to a lesser extent and the headquarters COOP plan was not
activated because of conditions particular to the 2006 flood.
Specifically, damage to the building was limited to the basement and
subbasement levels, and employees were able to enter the building to
retrieve equipment and assets. In addition, alternate work space was
available for all employees within a relatively short period, reducing
the importance of identifying critical personnel. Such conditions,
however, may not be present during future disruptions.
The plans IRS had in place at the time of the flood did not address all
of the elements outlined in federal continuity guidance. In particular,
the IRS plans did not (1) prioritize all essential functions and set
targets for recovery times; (2) outline the preparation of resources
and alternate facilities necessary to perform those functions; and (3)
develop provisions for tests, training, and exercises of all of its
plans. In discussions on lessons learned from the flood response, IRS
business unit officials recognized the need to incorporate many of
these elements. Unless IRS addresses these gaps, it will have limited
assurance that it will be prepared to continue essential functions
following a disruption more severe than the 2006 flood.
Recommendations for Executive Action:
To strengthen the ability of IRS to respond to the full range of
potential disruptions to essential operations, we are making two
recommendations to the Commissioner of Internal Revenue:
* Revise IRS internal emergency planning guidance to fully reflect
federal guidance on the elements of a viable continuity capability,
including the identification and prioritization of essential functions;
the preparation of necessary resources and alternate facilities; and
the regular completion of tests, training, and exercises of continuity
capabilities.
* Revise IRS emergency plans in accordance with the new internal
guidance.
Agency Comments:
The Commissioner of Internal Revenue provided comments on a draft of
this report in a March 26, 2007, letter which is reprinted in appendix
II. The Commissioner agreed with our recommendations. His letter notes
that the agency is actively committed to improving its processes.
Specifically the agency will (1) conduct a thorough gap analysis
between FPC 65 elements and business continuity planning guidance; (2)
update the Internal Revenue Manual guidance and business resumption
plan templates to reflect areas of improvement resulting from the gap
analysis; and (3) formally direct annual tests, training, and exercises
of business resumption plans through the agency's Emergency Management
and Preparedness Steering Committee. Finally, the Commissioner stated
that the agency will revise and implement its emergency plans based on
the results of the aforementioned activities.
As agreed with your staff, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after its date. At that time, we will send copies of this report to the
Secretary of the Treasury, the Commissioner of Internal Revenue, and
other interested parties. This report will also be available at no
charge on the GAO Web site at http://www.gao.gov.
Should you or your staff have questions on matters discussed in this
report, please contact Bernice Steinhardt at (202) 512-6543 or
steinhardtb@gao.gov, or Linda Koontz at (202) 512-6240 or
koontzl@gao.gov. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. Key contributions to this report were made by William Doherty,
Assistant Director; James R. Sweetman, Jr., Assistant Director; Thomas
Beall; Michaela Brown; Terrell Dorn; Nick Marinos; and Nhi Nguyen.
Sincerely yours,
Signed by:
Bernice Steinhardt:
Director, Strategic Issues:
Signed by:
Linda D. Koontz:
Director, Information Management Issues:
[End of section]
Appendix I Objectives, Scope, and Methodology:
The objectives of this report were to:
* evaluate how the Internal Revenue Service's (IRS) emergency
operations plans address federal guidance related to continuity
planning and:
* evaluate the extent to which IRS emergency operations plans
contributed to the actions taken by IRS officials in response to the
flood.
To address how IRS emergency operations plans address federal guidance
related to continuity planning, we obtained the IRS headquarters
emergency operations plans that were available to agency officials at
the time of the June 2006 flood. These included the Continuity of
Operations (COOP) plan and a suite of business continuity plans,
including the Incident Management Plan and 13 business resumption plans
from business units affected by the flood. Although we also obtained
the headquarters Occupant Emergency Plan, we did not evaluate its
contributions to addressing the elements because its purpose is limited
to outlining procedures for building occupants and emergency personnel
in responding to threats that require building evacuations or shelter
in place. We did not obtain the Disaster Recovery Plan, a contingency
plan for the recovery of information technology equipment, because
recovery of information technology equipment was addressed in a report
from the Treasury Inspector General for Tax Administration.
To evaluate IRS's emergency operations plans in relation to federal
guidance on continuity planning, we analyzed Federal Preparedness
Circular (FPC) 65 to identify the elements needed to ensure the
continuity of essential functions and compared IRS emergency operations
plans to the resulting generalized list. Because FPC 65 covers all
hazard emergencies, but provides continuity guidance specifically for
agency COOP plans, we developed the general elements of guidance to be
able to collectively evaluate all IRS emergency operations plans we
obtained. From our analysis of FPC 65, we identified eight general
elements of guidance related to developing a viable continuity
capability. See table 3 for a listing and description of the elements.
We reviewed IRS's plans and analyzed how they collectively addressed or
did not address these eight general elements of guidance.
We also reviewed IRS-defined criteria and guidance for emergency
operations plans, including sections of the Internal Revenue Manual--
which provides guidance to IRS officials on developing several of the
agency's emergency operations plans--and an internal template provided
by IRS's Office of Physical Security and Emergency Preparedness, which
is responsible for agencywide emergency planning and policy to guide
plan development.
Since each business unit within IRS headquarters has an individual plan
for business resumption activities, we selected and examined 3 of 13
business resumption plans available for use during the flood from the 3
business units with the most employees affected by the flooding in the
headquarters building. According to employee relocation lists from IRS
following the flood, the 3 largest business units in the building are
Criminal Investigation, Wage and Investment, and Chief Counsel, which
collectively represent over 50 percent of the headquarters building
employees.
To address the extent to which IRS emergency operations plans
contributed to the actions taken by IRS officials in response to the
flood, we interviewed IRS officials responsible for the development,
oversight, and implementation of the headquarters emergency operations
plans. In our interviews, we asked IRS officials responsible for each
emergency operations plan how the general elements identified in their
respective plans guided their actions following the flood, if at all.
To supplement the information gained from the interviews, we reviewed
agency documentation related to emergency operations activities
following the flood, including IRS status reports, employee relocation
lists, and emergency operations team meeting minutes. In addition, we
reviewed documentation regarding lessons learned from the flood,
provided by various headquarters business units, and obtained any
updates or changes to emergency operations plans following the flood.
We conducted our review in accordance with generally accepted
government auditing standards from July 2006 through March 2007.
[End of section]
Appendix II: Comments from the Internal Revenue Service:
Department Of The Treasury:
Internal Revenue Service:
Washington, D.C. 20224:
Commissioner:
March 26, 2007:
Ms. Linda D. Koontz:
Director, Information Management Issues:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Ms. Koontz:
I am writing to provide the Internal Revenue Service's comments on the
Government Accountability Office (GAO) draft report, "IRS Emergency
Planning: Headquarters Plans Supported Response to 2006 Flooding, but
Additional Guidance Could Improve All Hazard Preparedness" (GAO-07-
579).
We appreciate your comments regarding the IRS' response to the
Headquarters Building Flood. Over the past several years, IRS has
engaged in a service-wide strategy regarding emergency preparedness,
business resumption, and incident response. Lessons learned from actual
emergency incidents have resulted in significant enhancements to our
incident management and business resumption processes. While
significant progress has been advanced, we recognize that continued
diligence is required. We fully understand the importance of ensuring
that our efforts comply with federal requirements and guidelines.
As you know, the Treasury Inspector General for Tax Administration
(TIGTA) also reviewed IRS' efforts related to the Headquarters Building
Flood. TIGTA's report endorsed our preparedness and performance in
responding to this incident.
We agree with the two audit recommendations and are actively committed
to improving our processes. Enclosed are our comments that address each
recommendation.
I appreciate your continued support and the valuable guidance from your
staff. If you have any questions or wish to discuss this response in
more detail, please contact Daniel Galik, Chief, Mission Assurance and
Security Services, at (202) 622-8910, regarding emergency response
policy and plan development matters, or James P. Falcone, Chief, Agency-
Wide Shared Services, at (202) 622-7500, concerning emergency response
execution.
Sincerely,
Signed for:
Mark W. Everson:
Enclosure:
Comments of the Internal Revenue Service on the GAO report entitled
"IRS Emergency Planning: Headquarters Plans Supported Response to 2006
Flooding, but Additional Guidance Could Improve All Hazard
Preparedness" (GAO-07-579):
Recommendation 1:
Revise IRS internal emergency planning guidance to fully reflect
federal guidance on the elements of a viable continuity capability,
including the identification and prioritization of essential functions;
the preparation of necessary resources and alternate facilities; and
regular completion of tests, training, and exercises of continuity
capabilities.
Response:
We agree with this recommendation and will:
* Conduct a thorough gap analysis between FPC 65 elements and business
continuity planning guidance.
* Update Internal Revenue Manual (IRM) guidance and business resumption
plan templates to reflect areas of improvement resulting from the
aforementioned gap analysis.
* Under the auspices of the Emergency Management and Preparedness
Steering Committee (EMPSC), formally direct annual tests, training and
exercising of business resumption plans.
Recommendation 2:
Revise the IRS emergency plans in accordance with the new internal
guidance.
Response:
We agree with this recommendation and as outcomes result from efforts
addressing recommendation 1, above, emergency plans will be revised and
implemented.
[End of section]
FOOTNOTES
[1] Since each business unit within IRS headquarters has an individual
plan for business resumption activities, we selected and examined 3 of
13 business resumption plans available for use during the flood from
the three business units with the most employees affected by the
flooding in the headquarters building. The three largest business units
in the building are Criminal Investigation, Wage and Investment, and
Chief Counsel. These business units collectively represent over 50
percent of the headquarters building employees.
[2] We did not obtain the Disaster Recovery Plan--a contingency plan
for the recovery of information technology equipment--because recovery
of information technology equipment was addressed in a report from the
Treasury Inspector General for Tax Administration.
[3] GAO, Financial Audit: IRS's Fiscal Years 2006 and 2005 Financial
Statements, GAO-07-136 (Washington, D.C.: Nov. 9, 2006), and
Understanding the Tax Reform Debate: Background, Criteria, and
Questions, GAO-05-1009SP (Washington, D.C.: September 2005).
[4] Treasury Inspector General for Tax Administration, The Internal
Revenue Service Building Flood Caused No Measurable Impact on Tax
Administration, 2007-30-028 (Washington, D.C.: Feb. 7, 2007), and The
Internal Revenue Service Adequately Protected Sensitive Data and
Restored Computer Operations After the Flooding of Its Headquarters
Building, 2007-20-023 (Washington, D.C.: Jan. 26, 2007).
[5] Administrative leave is an excused absence from work with no loss
of pay.
[6] This suite of plans also includes the Disaster Recovery Plan, a
contingency plan for the recovery of information technology equipment,
and an Occupant Emergency Plan, which outlines procedures for building
occupants and emergency personnel in responding to threats that require
building evacuations or shelter in place.
[7] CI investigates potential criminal violations of the Internal
Revenue Code and related financial crimes.
[8] W&I provides IRS customers with information, support, and
assistance in fulfilling tax obligations.
[9] Chief Counsel advises the IRS Commissioner on all matters
pertaining to the interpretation, administration, and enforcement of
the Internal Revenue laws and provides legal guidance and interpretive
advice to IRS, Treasury, and taxpayers.
[10] FPC 65 defines essential functions as those functions that enable
an organization to provide vital services, exercise civil authority,
maintain the safety of the general public, and sustain the industrial/
economic base during an emergency.
[11] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005).
[12] The Office of Physical Security and Emergency Preparedness--within
the agency's Mission Assurance and Security Services unit--is the IRS
program office responsible for emergency planning guidance and
oversight.
[13] According to the headquarters Incident Commander, a tabletop
exercise scheduled for March 2006 was postponed because of a fire
within the IRS headquarters building the day prior to the event. The
rescheduled exercise was eventually canceled--along with a second
exercise to be held later in the year--because of the June 2006
flooding and subsequent closure of the building.
[14] GAO, Catastrophic Disasters: Enhanced Leadership, Capabilities,
and Accountability Controls Will Improve the Effectiveness of the
Nation's Preparedness, Response, and Recovery System, GAO-06-618
(Washington, D.C.: Sept. 6, 2006).
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site.
To have GAO e-mail you a list of newly posted products every afternoon,
go to www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400:
U.S. Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800:
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548:
