Continuity of Operations
Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for Emergencies Gao ID: GAO-05-619T April 28, 2005To ensure that essential government services are available in emergencies, federal agencies are required to develop continuity of operations plans. According to guidance from the Federal Emergency Management Agency (FEMA), which is responsible for providing guidance for and assessing agency continuity plans, a key element of a viable capability is the proper identification of essential functions. GAO previously reported on agency continuity plan compliance, and determined that a number of agencies and their components did not have continuity plans in place on October 1, 2002, and those that were in place did not generally comply with FEMA's guidance. GAO was asked to testify on its most recent work in continuity planning, which is discussed in a separate report, being released today (GAO-05-577). In this report, GAO reviewed to what extent (1) major federal agencies used sound practices to identify and validate their essential functions, (2) agencies had made progress since 2002 in improving compliance with FEMA guidance, and (3) agency continuity of operations plans addressed the use of telework arrangements (in which work is performed at an employee's home or at a work location other than a traditional office) during emergencies.
Many of the 23 agencies that GAO reviewed reported using sound practices for identifying and validating essential functions, but few provided documentation sufficient for GAO to confirm their responses. (GAO identified these sound practices based on published literature and in consultation with experts on continuity planning.) Agency responses indicate that--although aware of the practices--agencies may not have followed them thoroughly or effectively. Further, the essential functions identified by agencies varied widely: the number of functions identified in each plan ranged from 3 to 538 and included ones that appeared to be of secondary importance. The absence in FEMA's guidance of specific criteria for identifying essential functions contributed to this condition. Subsequent guidance significantly addresses the sound practices that GAO identified. Also, the White House has begun a process to improve continuity planning. If this guidance and process are implemented effectively, they could lead to improved identification of essential functions in the executive branch. As of May 1, 2004, agencies had made progress in improving compliance with FEMA guidance, but significant weaknesses remained. Agencies that had plans in place in both years showed significant improvement in the area of tests, training, and exercises. However, although some improvement occurred for other planning areas, important weaknesses remained: for example, 31 of 45 plans did not fully identify mission-critical systems and data necessary to conduct essential functions. Inadequate oversight by FEMA contributed to the level of weaknesses in agency continuity plans. FEMA plans to improve oversight using an online readiness reporting system, which it plans to have fully operational later this year, and it has already taken other steps to help agencies improve their plans, such as conducting an interagency exercise. However, FEMA does not plan to verify the readiness information that agencies will report in the system. Finally, even though FEMA's continuity planning guidance in place in May 2004 did not address telework, one agency's continuity plan at that time included plans to use telework in response to an emergency. In addition, 10 agencies reported that they planned to use telework following a COOP event, but their plans were not clearly documented. In its report, GAO made recommendations aimed at helping to improve continuity planning. These included establishing a schedule for the completion of recently initiated efforts, developing a strategy for short-term oversight in the meantime, and developing and implementing procedures that verify the agency-reported data used in oversight of agency continuity of operations planning. The report includes comments from FEMA. In commenting, FEMA agreed that there has been improvement in COOP plans and that additional oversight is needed.
GAO-05-619T, Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for Emergencies
This is the accessible text file for GAO report number GAO-05-619T
entitled 'Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies'
which was released on April 28, 2005.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Testimony Before the Committee on Government Reform, House of
Representatives:
For Release on Delivery:
Expected at 2:00 p.m. EDT on Thursday, April 28, 2005:
Continuity of Operations:
Agency Plans Have Improved, but Better Oversight Could Assist Agencies
in Preparing for Emergencies:
Statement of Linda D. Koontz:
Director, Information Management Issues:
GAO-05-619T:
GAO Highlights:
Highlights of GAO-05-619T, a testimony before the Committee on
Government Reform, House of Representatives:
Why GAO Did This Study:
To ensure that essential government services are available in
emergencies, federal agencies are required to develop continuity of
operations plans. According to guidance from the Federal Emergency
Management Agency (FEMA), which is responsible for providing guidance
for and assessing agency continuity plans, a key element of a viable
capability is the proper identification of essential functions. GAO
previously reported on agency continuity plan compliance, and
determined that a number of agencies and their components did not have
continuity plans in place on October 1, 2002, and those that were in
place did not generally comply with FEMA‘s guidance.
GAO was asked to testify on its most recent work in continuity
planning, which is discussed in a separate report, being released today
(GAO-05-577). In this report, GAO reviewed to what extent (1) major
federal agencies used sound practices to identify and validate their
essential functions, (2) agencies had made progress since 2002 in
improving compliance with FEMA guidance, and (3) agency continuity of
operations plans addressed the use of telework arrangements (in which
work is performed at an employee‘s home or at a work location other
than a traditional office) during emergencies.
What GAO Found:
Many of the 23 agencies that GAO reviewed reported using sound
practices for identifying and validating essential functions, but few
provided documentation sufficient for GAO to confirm their responses.
(GAO identified these sound practices based on published literature and
in consultation with experts on continuity planning.) Agency responses
indicate that”although aware of the practices”agencies may not have
followed them thoroughly or effectively. Further, the essential
functions identified by agencies varied widely: the number of functions
identified in each plan ranged from 3 to 538 and included ones that
appeared to be of secondary importance. The absence in FEMA‘s guidance
of specific criteria for identifying essential functions contributed to
this condition. Subsequent guidance significantly addresses the sound
practices that GAO identified. Also, the White House has begun a
process to improve continuity planning. If this guidance and process
are implemented effectively, they could lead to improved identification
of essential functions in the executive branch.
As of May 1, 2004, agencies had made progress in improving compliance
with FEMA guidance, but significant weaknesses remained. Agencies that
had plans in place in both years showed significant improvement in the
area of tests, training, and exercises. However, although some
improvement occurred for other planning areas, important weaknesses
remained: for example, 31 of 45 plans did not fully identify mission-
critical systems and data necessary to conduct essential functions.
Inadequate oversight by FEMA contributed to the level of weaknesses in
agency continuity plans. FEMA plans to improve oversight using an
online readiness reporting system, which it plans to have fully
operational later this year, and it has already taken other steps to
help agencies improve their plans, such as conducting an interagency
exercise. However, FEMA does not plan to verify the readiness
information that agencies will report in the system.
Finally, even though FEMA‘s continuity planning guidance in place in
May 2004 did not address telework, one agency‘s continuity plan at that
time included plans to use telework in response to an emergency. In
addition, 10 agencies reported that they planned to use telework
following a COOP event, but their plans were not clearly documented.
In its report, GAO made recommendations aimed at helping to improve
continuity planning. These included establishing a schedule for the
completion of recently initiated efforts, developing a strategy for
short-term oversight in the meantime, and developing and implementing
procedures that verify the agency-reported data used in oversight of
agency continuity of operations planning. The report includes comments
from FEMA. In commenting, FEMA agreed that there has been improvement
in COOP plans and that additional oversight is needed.
www.gao.gov/cgi-bin/getrpt?GAO-05-619T.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Linda Koontz at (202)
512-6240 or koontzl@gao.gov.
[End of section]
Mr. Chairman and Members of the Committee:
I appreciate the opportunity to participate in the Committee's hearing
on federal continuity of operations planning. As you know, essential
government services can be interrupted by a range of events, including
terrorist attacks, severe weather, or building-level emergencies.
Federal agencies are required by Presidential Decision Directive 67 to
develop plans for ensuring the continuity of such services in emergency
situations. The Federal Emergency Management Agency (FEMA), which was
designated executive agent for executive branch continuity of
operations (COOP) planning, issued Federal Preparedness Circular 65 in
July 1999 as planning guidance to agencies. The circular states that,
in order to have a viable COOP capability, agencies should identify
their essential functions. These functions then provide the basis for
subsequent planning steps. The circular also identified eight elements
of a viable COOP capability.[Footnote 1]
We previously reviewed agency COOP plan compliance with FEMA's
guidance, at your request. At that time, we found that a number of
agencies and their components did not have continuity plans in place as
of October 1, 2002, and those that were in place did not generally
comply with FEMA's guidance.[Footnote 2]
We subsequently assessed plans in place on May 1, 2004, both from the
agencies that had plans in place in 2002 and from agencies that
subsequently adopted plans.[Footnote 3] We examined to what extent:
* major federal agencies used sound practices to identify and validate
their essential functions,
* agencies had made progress in improving compliance with the guidance
outlined in FPC 65 since our 2002 review,[Footnote 4] and:
* agency continuity of operations plans addressed the use of telework
arrangements (in which work is performed at an employee's home or at a
work location other than a traditional office) during emergencies.
At your request, I am summarizing today the findings and
recommendations of the report on this most recent work, which is being
released today.[Footnote 5]
Results in Brief:
Many of the 23 agencies reported using the eight sound practices for
identifying and validating essential functions that we identified (for
example, performing a risk and impact analysis for each essential
function), but few provided documentation sufficient for us to confirm
their responses. This indicates that agencies--although aware of these
practices--may not have followed them thoroughly or effectively. In
addition, the number of functions identified in each agency plan ranged
from 3 to 538 and included ones that appeared to be of secondary
importance (for example, "provide advice to the Under Secretary"). Both
FEMA's June 2004 revision to its guidance and a recently initiated
White House effort have the potential, if effectively implemented, to
help agencies better identify their essential functions and thus
develop better continuity plans. However, the lack of a schedule to
complete the White House effort makes it unclear when these
improvements might take place.
Although agency COOP plans have shown improvement since our prior
assessment of 2002 plans, most plans in place on May 1, 2004, continued
to exhibit inconsistencies in the identification of essential functions
and significant lack of compliance with FEMA's guidance. Inadequate
oversight by FEMA contributed to the level of weaknesses in agency COOP
plans. FEMA plans to improve oversight using an online readiness
reporting system, which it plans to have fully operational later this
year, and it has already taken other steps to help agencies improve
their plans, such as conducting an interagency exercise. However, FEMA
no longer plans to verify the readiness information that agencies will
report in the system.
Finally, even though FEMA's continuity planning guidance in place in
May 2004 did not address telework, one agency's continuity plan in
place at that time indicated that it was planning to use telework in
response to an emergency. In addition, 10 agencies reported that they
planned to use telework following a COOP event, but their plans were
not clearly documented.
In our report, we made recommendations to the Assistant to the
President for Homeland Security and to the Secretary of Homeland
Security to ensure that agencies are adequately prepared to continue
performing essential functions following an emergency. In commenting on
our findings and recommendations, FEMA agreed that there has been
improvement in COOP plans and that additional oversight is needed.
Background:
Federal operations and facilities have been disrupted by a range of
events, including the terrorist attacks on September 11, 2001; the
Oklahoma City bombing; localized shutdowns due to severe weather
conditions, such as the closure of federal offices in the Washington,
D.C., area in September 2003 due to Hurricane Isabel; and building-
level events, such as asbestos contamination at the Department of the
Interior's headquarters. Such disruptions, particularly if prolonged,
can lead to interruptions in essential government services. Prudent
management, therefore, requires that federal agencies develop plans for
dealing with emergency situations, including maintaining services,
ensuring proper authority for government actions, and protecting vital
assets.
Until relatively recently, continuity planning was generally the
responsibility of individual agencies. In October 1998, Presidential
Decision Directive (PDD) 67 identified the Federal Emergency Management
Agency (FEMA)--which is responsible for responding to, planning for,
recovering from, and mitigating against disasters--as the executive
agent for federal COOP planning across the federal executive branch.
FEMA was an independent agency until March 2003, when it became part of
the Department of Homeland Security (DHS), reporting to the Under
Secretary for Emergency Preparedness and Response. Under PDD 67, its
responsibilities include:
* formulating guidance for agencies to use in developing viable plans;
* coordinating interagency exercises and facilitating interagency
coordination, as appropriate; and:
* overseeing and assessing the status of COOP capabilities across the
executive branch.
According to FEMA officials, the directive also required that agencies
have COOP plans in place by October 1999.
In July 1999, FEMA first issued Federal Preparedness Circular (FPC) 65.
FPC 65 is guidance to the federal executive branch for use in
developing viable and executable contingency plans that facilitate the
performance of essential functions during any emergency. Specifically,
the guidance:
* established the identification of essential functions as the basis
for COOP planning;
* defined essential functions as those that enable agencies to provide
vital services, exercise civil authority, maintain safety, and sustain
the economy during an emergency;
* defined the elements of a viable continuity of operations capability
according to eight topic areas: identification of essential functions;
development of plans and procedures; identification of orders of
succession; delegations of authority; provision for alternate
facilities; provision of interoperable communications; availability of
vital records; and conduct of regular tests, training, and exercises;
and:
* set up an interagency working group to coordinate continuity
planning.
FPC 65 applies to all federal executive branch departments and agencies
at all levels, including locations outside Washington, D.C. It directed
the heads of each agency to assume responsibilities including:
* developing, approving, and maintaining agency continuity plans and
procedures;
* developing a COOP multiyear strategy and program management plan;
and:
* conducting tests and training of agency continuity plans, contingency
staffs, and essential systems and equipment.
At your request, we previously reported on federal agency headquarters
contingency plans in place in October 2002.[Footnote 6] At that time,
we determined that most agencies identified at least one function as
essential, but the functions varied in number and apparent importance.
Furthermore, while 20 of 23 agencies had documented COOP plans, none
addressed all the guidance in FPC 65. We identified inadequate guidance
and oversight as factors contributing to these weaknesses, and
recommended that DHS (1) ensure that agencies without plans develop
them, (2) ensure that agencies address weaknesses in their plans, and
(3) conduct assessments of plans that included an independent
verification of agency-provided data and an assessment of identified
essential functions. In response to these recommendations, DHS reported
in July 2004 that it (1) was developing an online system to collect
data from agencies on the readiness of their continuity plans that
would evaluate compliance with the guidance, (2) had conducted an
interagency exercise, and (3) had developed a training program for
agency continuity planning managers. DHS added that it planned to
conduct an independent validation of each agency's self-assessment
after deployment of the readiness system.[Footnote 7]
Many Agencies Reported Using Sound Continuity Practices, but Few
Provided Adequate Supporting Documentation:
Based on an analysis of published literature and in consultation with
experts on continuity planning, we identified eight sound practices
related to essential functions that organizations should use when
developing their COOP plans. These practices, listed in table 1,
constitute an ongoing process that includes identifying and validating
essential functions.
Table 1: Eight Sound Practices for Continuity Planning:
Practices:
Establish a structured COOP project work group/committee that includes
representatives of all agency components, legal advisors, and
continuity experts and either includes a member of the agency's
executive management or reports to a member of the agency's executive
management. Such a committee should be involved in the initial
selection of essential functions.
Determine the resources necessary to perform each function.
Determine the dependencies necessary to perform each
function.
Develop a schedule or project plan for critical stages in
the continuity of operations program effort.
Identify and rank plausible threats, vulnerabilities,
liabilities, and/or exposures through a risk assessment.
Perform a risk and impact analysis for each essential
function--including prioritization of essential functions and
determination of minimum acceptance level of output and recovery time
objective for each function.
Develop and implement a strategy for validating the
continuity plan and the underlying essential functions.
Change its essential functions as the result of the
validation process.
Source: GAO.
[End of table]
With regard to COOP plans in place on May 1, 2004, many of the 23
agencies reported using some of the sound practices in developing
plans, included identifying and validating essential functions, but few
provided documentation sufficient for us to validate their responses.
This indicates that agencies--although aware of these practices--may
not have followed them thoroughly or effectively. For example, it is
unlikely that a thorough risk analysis of essential functions could be
performed without being documented.
Further, the essential functions identified by agencies varied widely:
the number of functions identified in each plan ranged from 3 to 538.
In addition, the apparent importance of the functions was not
consistent. For example, a number of essential functions were of clear
importance, such as:
* "conduct payments to security holders" and:
* "carry out a rapid and effective response to all hazards,
emergencies, and disasters."
Other identified functions appeared vague or of questionable
importance:
* "champion decision-making decisions" and:
* "provide advice to the Under Secretary."
New Guidance and Review Process Could Result in More Consistent
Identification of Essential Functions:
The high level of generality in FEMA's guidance on essential functions
contributed to the inconsistencies in agencies' identification of these
functions. As was the case during our 2002 review, the version of FPC
65 in place on May 1, 2004, defined essential functions as those that
enable agencies to provide vital services, exercise civil authority,
maintain safety, and sustain the economy during an emergency. The
document did not, however, define a process that agencies could use to
select their essential functions.
In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on essential functions. The annex
lists several categories that agencies must consider when determining
which functions are essential, including:
* functions that must continue with minimal interruption or cannot be
interrupted for more than 12 hours without compromising the
organization's ability to perform its mission and:
* functions assigned to the agency by federal law or by order of the
President.
The new guidance goes on to outline steps addressing the prioritization
of selected functions as well as the identification of resources
necessary to accomplish them and of interdependencies with other
agencies.
On January 10, 2005, the Assistant to the President for Homeland
Security issued a memorandum outlining additional guidance on essential
functions and initiated a process to identify and validate agency-level
functions. The memorandum noted that in the past many departments and
agencies had had difficulty clearly identifying and articulating their
essential functions. It attributed this difficulty, in part, to the
lack of a defined set of national-level essential functions to guide
agency continuity planning, resulting in multiple efforts to develop
agency essential functions for different specific purposes (e.g.,
planning for Year 2000 computer continuity, information technology
planning, and critical infrastructure planning). Further, it noted that
departments and agencies sometimes do not distinguish between a
"function" and the specific activities necessary to perform the
function.
To address these issues, the memorandum identified eight National
Essential Functions that are necessary to lead and sustain the country
during an emergency and, therefore, must be supported through
continuity capabilities. Table 2 lists the eight National Essential
Functions.
Table 2: National Essential Functions:
Functions:
Preserve our constitutional form of government.
Provide leadership visible to the nation and the world;
maintain the trust and confidence of the American people.
Defend the country against all enemies, foreign or domestic,
and prevent or interdict future attacks.
Maintain and foster effective relationships with foreign
nations.
Protect against threats to the homeland and bring to justice
perpetrators of crimes or attacks against the nation, its citizens, or
its interests.
Provide rapid and effective response to and recovery from
the domestic consequences of an attack or other incident.
Protect and stabilize the nation's economy; ensure
confidence in financial systems.
Provide for critical federal government services that
address the national health, safety, and welfare needs of the nation.
Source: White House.
[End of table]
The memorandum asked major agencies to identify their Priority Mission
Essential Functions--those functions that must be performed to support
or implement the National Essential Functions before, during, and in
the immediate aftermath of an emergency. The document stated that,
generally, priority functions must be uninterrupted or resumed during
the first 24 to 48 hours after the occurrence of an emergency and
continued through full resumption of all government functions.
When identifying their functions, agencies were asked to also identify
the National Essential Function that each priority function supports,
the time in which the priority function must be accomplished, and the
partners necessary to perform the priority function. The memorandum
asked agencies to reply by February 18, 2005.
The memorandum emphasized the need for the involvement of senior-level
agency officials, calling for each agency's functions to be first
approved by an official with agencywide responsibilities. The
memorandum then laid out a process by which the functions would be
validated by an interagency group within the Homeland Security Council.
According to FEMA officials, two agencies' essential functions have
already been reviewed, and there are plans to complete all agency
reviews by the end of the summer. The validated functions would then be
used to support development of a new continuity policy and would be
used to develop and implement improved requirements for capabilities,
inform the annual budget process, establish program metrics, and guide
training and exercises and other continuity program activities. The
memorandum did not set any time frames for these later steps.
Together, FEMA's revised guidance and the guidance from the White House
significantly address the best practices that we identified. For
example:
* Both documents call for agencies to identify dependencies necessary
to perform the functions.
* FEMA's guidance calls for agencies to prioritize their essential
functions and identify the resources necessary to perform them.
* The White House guidance calls on agencies to identify the recovery
time necessary for each function and outlines a process to validate the
initial list of functions.
If implemented effectively, the new guidance and the review process
conducted by the White House could result in more consistent
identification of essential functions across the executive branch. The
functions could then form the basis for better plans for continuing the
most critical functions following a disruption to normal operations.
However, without time frames for completing the outlined process, it is
unclear when the expected improvements will occur.
Agency COOP Plans Have Improved, but None Address All of FEMA's
Guidance:
When compared with our prior assessment, agency continuity plans in
place on May 1, 2004, showed improved compliance with FEMA's guidance
in two ways:
* One agency and nine component agencies that did not have documented
continuity plans in place at the time of our 2002 review had put such
plans in place by May 1.
* For each of the topic areas outlined in the guidance, agencies
generally made progress in increasing compliance.
However, two major agencies did not have plans in place on May 1, 2004.
As of April 2005, one of these two had finalized its plan.
In addition, after analyzing these plans, we found that none in place
on May 1 followed all of FEMA's guidance. Of the eight topic areas
identified in FPC 65, these 45 COOP plans generally complied with the
guidance in two areas (developing plans and procedures and order of
succession); generally did not comply in one area (tests, training, and
exercises); and showed mixed compliance in the other five areas.
Specifically, when examining the governmentwide results of our analysis
of the eight planning topics outlined in FPC 65, we determined the
following:
* Essential functions. Most agency plans identified at least one
function as essential and identified which functions must be continued
under all circumstances. However, less than half the COOP plans
identified interdependencies among the functions, established staffing
and resource requirements, or identified the mission-critical systems
and data needed to perform the functions.
* Plans and procedures. Most plans followed the guidance in this area,
including establishing a roster of COOP personnel, activation
procedures, and the appropriate planning time frame (12 hours to 30
days).
* Orders of succession. All but a few agency plans identified an order
of succession to the agency head. Most plans included orders of
succession for other key officials or included officials outside of the
local area in the succession to the agency head. Many plans did not
include the orders of succession in the agency's vital records or
document training for successors on their emergency duties.
* Delegations of authority. Few plans adequately documented the legal
authority for officials to make policy decisions in an emergency.
* Alternate facilities. Most plans documented the acquisition of at
least one alternate facility, and many included alternate facilities
inside and outside of the local area. However, few plans documented
that agencies had sufficient space for staff, pre-positioned equipment,
or appropriate communications capabilities at their alternate
facilities.
* Redundant emergency communications. Most plans identified at least
two independent media for voice communication. Less than half of the
plans included adequate contact information, and few provided
information on backup data links.
* Vital records. Less than half of the plans fully identified the
agency's vital records. Few plans documented the locations of all vital
records or procedures for updating them.
* Tests, training, and exercises. While many agencies documented some
training, very few agencies documented that they had conducted tests,
training, and exercises at the recommended frequency.
Inadequate Oversight by FEMA Contributes to Noncompliance:
During our prior review of 2002 plans, we found that insufficient
oversight by FEMA contributed to agencies' lack of compliance with the
guidance. Specifically, we noted that FEMA had not conducted an
assessment of agency contingency plans since 1999. As a result, we
recommended that it conduct assessments of agency continuity plans that
include independent verification of agency-reported information. In
response, DHS reported that it was developing a readiness reporting
system to assist it in assessing agency plans and planned to verify the
information reported by the agencies.
Although neither of these planned actions was completed by May 1, 2004,
FEMA has made subsequent efforts to improve its oversight. According to
FEMA officials, development of the readiness reporting system was
completed in March 2005, and the system is expected to be operational
and certified by October 2005, at which time there will be seven
locations (including two FEMA locations) using the system. They added
that once the system becomes fully operational, agencies will be
required to periodically provide updated information on their
compliance with FEMA's guidance. These officials also reported that the
agency had taken additional steps to improve readiness. Specifically,
they stated that the interagency exercise held in mid-May 2004
successfully activated and tested agency plans; they based this
assessment on reports provided by the agencies. Furthermore, FEMA has
begun planning for another interagency exercise in 2006. In addition,
as of April 2005, FEMA had provided training to 682 federal, state, and
local officials from 30 major federal departments and agencies and 209
smaller agencies--including state, local, and tribal entities. FEMA
officials stated that because of these additional successful efforts to
improve readiness, they no longer planned to verify agency-reported
readiness data.
While the revised guidance, recent exercise, and ongoing training
should help ensure that agency continuity plans follow FEMA's guidance,
FEMA's ongoing ability to oversee agency continuity planning activities
will be limited by its reliance on agency-provided data. Without
verification of such data, FEMA lacks assurance that agency plans are
compliant and that the procedures outlined in those plans will allow
agencies to effectively continue to perform their essential functions
following a disruption.
One Agency Plans to Use Telework in Response to an Emergency:
Telework, also referred to as telecommuting or flexiplace, has gained
widespread attention over the past decade in both the public and
private sectors as a human capital flexibility that offers a variety of
potential benefits to employers, employees, and society. In a 2003
report to Congress on the status of telework in the federal government,
the Director of the Office of Personnel Management (OPM) described
telework as "an invaluable management tool which not only allows
employees greater flexibility to balance their personal and
professional duties, but also allows both management and employees to
cope with the uncertainties of potential disruptions in the workplace,
including terrorist threats."[Footnote 8]
As we reported in an April 2004 report, telework is an important and
viable option for federal agencies in COOP planning and implementation
efforts, especially as the duration of an emergency event is
extended.[Footnote 9] In a July 2003 GAO report, we defined 25 key
telework practices for implementation of successful federal telework
programs.[Footnote 10]
Although not required to do so, 1 of the 21 agency continuity plans in
place on May 1, 2004, documented plans to address some essential
functions through telework. Two other agencies reported that they
planned to use telework to fulfill their essential functions, and eight
agencies reported that they planned for nonessential staff to telework
during a COOP event, but their continuity plans do not specifically
mention telework.
However, none of the agencies that are planning to use telework during
a COOP event documented that the necessary preparations had taken
place. These preparations--derived from the 25 key telework practices
for the development of an effective telework program--include informing
and training the staff, ensuring that there is adequate technological
capacity for telework, providing technological assistance, and testing
the ability to telework.
In summary, Mr. Chairman, although agency COOP plans have shown
improvement since our prior assessment of 2002 plans, most plans in
place on May 1, 2004, continued to exhibit inconsistencies in the
identification of essential functions and significant lack of
compliance with FEMA's guidance. Both FEMA's revision to this guidance
and a recently initiated White House effort have the potential, if
effectively implemented, to help agencies better identify their
essential functions and thus develop better continuity plans. However,
the lack of a schedule to complete the White House effort makes it
unclear when these improvements might take place. Agencies' efforts to
develop continuity plans could also be aided by FEMA's efforts to
develop a readiness reporting system, conduct a governmentwide
exercise, and train agency COOP planners, as well as by any guidance or
policies that result from the White House effort.
Finally, even though FEMA's continuity planning guidance in place in
May 2004 did not address telework, one agency's continuity plan at that
time included plans to use telework in response to an emergency. In
addition, 10 agencies reported that they planned to use telework
following a COOP event, but their plans were not clearly documented.
In our report, we make recommendations aimed at helping to ensure that
agencies are adequately prepared to perform essential functions
following an emergency. We recommended that the Assistant to the
President for Homeland Security establish a schedule for the completion
of the recently initiated effort to validate agency essential functions
and refine federal continuity of operations policy. We also recommended
that the Secretary of Homeland Security direct the Under Secretary for
Emergency Preparedness and Response to:
* develop a strategy for short-term oversight that ensures that
agencies are prepared for a disruption in essential functions while the
current effort to identify essential functions and develop new guidance
is ongoing;
* develop and implement procedures that verify the agency-reported data
used in oversight of agency continuity of operations planning; and:
* develop, in consultation with OPM, guidance on the steps that
agencies should take to adequately prepare for the use of telework
during a COOP event.
In commenting on our findings and recommendations, the Under Secretary
for Emergency Preparedness and Response of DHS stated that the
department agreed that there has been improvement in COOP plans and
attributed that improvement to a renewed emphasis by DHS and the White
House. The department also agreed with the need for additional
oversight and noted that FEMA had begun conducting COOP site
assessments at departments and agencies to improve readiness. The Under
Secretary's letter drew attention to a number of actions taken after
the May 1, 2004, cutoff date for our assessment. Finally, the Under
Secretary pointed out that the readiness reporting system that FEMA is
developing was not intended to be a COOP plan assessment tool, but that
it instead provides key officials with the ability to determine plan
status in near real time. We continue to believe that it is important
for FEMA to assess agency plans as part of its oversight
responsibilities. Regardless of the system's intended use, we believe
its capabilities, as described by FEMA, make it a valuable tool that
the agency should use when exercising these responsibilities.
Mr. Chairman, this concludes my statement. I would be pleased to
respond to any questions that you or other members of the Committee may
have at this time.
Contacts and Acknowledgements:
For information about this testimony, please contact Linda D. Koontz at
(202) 512-6240 or at koontzl@gao.gov, or James R. Sweetman at (202)
512-3347 or sweetmanj@gao.gov. Other key contributors to this testimony
include Barbara Collier, Mike Dolak, Nick Marinos, and Jessica
Waselkow.
FOOTNOTES
[1] In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on essential functions.
[2] GAO, Continuity of Operations: Improved Planning Needed to Ensure
Delivery of Essential Services, GAO-04-160 (Washington, D.C.: Feb. 27,
2004.)
[3] As agreed with your staff, we evaluated agency continuity plans in
place on May 1, 2004. Our methodology included evaluating the
headquarters continuity plans for 20 of the 23 largest civilian
departments and agencies, as well as for 25 components of departments,
for compliance with the eight elements identified in FPC 65. We
provided agencies with several opportunities to submit relevant
documentation as well as respond to preliminary findings.
[4] Since the June 2004 version of FPC 65 was released after our cutoff
date of May 1, 2004, we assessed plans against the July 1999 version of
FPC 65.
[5] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005).
[6] GAO, Continuity of Operations: Improved Planning Needed to Ensure
Delivery of Essential Government Services, GAO-04-160 (Washington,
D.C.: Feb. 27, 2004) and Continuity of Operations: Improved Planning
Needed to Ensure Delivery of Essential Services, GAO-04-638T
(Washington, D.C.: Apr. 22, 2004).
[7] GAO, Status of Key Recommendations GAO Has Made to DHS and Its
Legacy Agencies, GAO-04-865R (Washington, D.C.: July 2, 2004).
[8] U.S. Office of Personnel Management, Report to the Congress: The
Status of Telework in the Federal Government (Washington, D.C.: January
2003).
[9] GAO, Human Capital: Opportunities to Improve Federal Continuity
Planning Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).
[10] GAO, Human Capital: Further Guidance, Assistance, and Coordination
Can Improve Federal Telework Efforts, GAO-03-679 (Washington, D.C.:
July 18, 2003).
