Continuity of Operations: Agency Plans Have Improved, but Better 
Oversight Could Assist Agencies in Preparing for Emergencies	 
(28-APR-05, GAO-05-619T).					 
                                                                 
To ensure that essential government services are available in	 
emergencies, federal agencies are required to develop continuity 
of operations plans. According to guidance from the Federal	 
Emergency Management Agency (FEMA), which is responsible for	 
providing guidance for and assessing agency continuity plans, a  
key element of a viable capability is the proper identification  
of essential functions. GAO previously reported on agency	 
continuity plan compliance, and determined that a number of	 
agencies and their components did not have continuity plans in	 
place on October 1, 2002, and those that were in place did not	 
generally comply with FEMA's guidance. GAO was asked to testify  
on its most recent work in continuity planning, which is	 
discussed in a separate report, being released today		 
(GAO-05-577). In this report, GAO reviewed to what extent (1)	 
major federal agencies used sound practices to identify and	 
validate their essential functions, (2) agencies had made	 
progress since 2002 in improving compliance with FEMA guidance,  
and (3) agency continuity of operations plans addressed the use  
of telework arrangements (in which work is performed at an	 
employee's home or at a work location other than a traditional	 
office) during emergencies.					 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-619T					        
    ACCNO:   A22877						        
  TITLE:     Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for 	 
Emergencies							 
     DATE:   04/28/2005 
  SUBJECT:   Agency evaluation					 
	     Continuity of operations				 
	     Continuity of operations plan			 
	     Emergency preparedness				 
	     Federal agencies					 
	     Federal Emergency Management Agency		 
	     Homeland security					 
	     Mission essential operations			 
	     National preparedness				 
	     Performance measures				 
	     Strategic planning 				 
	     Telecommuting					 
	     Interagency relations				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-619T

                 United States Government Accountability Office

GAO 	Testimony Before the Committee on Government Reform, House of
Representatives

For Release on Delivery Expected at 2:00 p.m. EDT on Thursday, April 28,
2005

CONTINUITY OF OPERATIONS

Agency Plans Have Improved, but Better Oversight Could Assist Agencies in
                           Preparing for Emergencies

Statement of Linda D. Koontz
Director, Information Management Issues

GAO-05-619T

[IMG]

April 28, 2005

CONTINUITY OF OPERATIONS

Agency Plans Have Improved, but Better Oversight Could Assist Agencies in
Preparing for Emergencies

What GAO Found

Many of the 23 agencies that GAO reviewed reported using sound practices
for identifying and validating essential functions, but few provided
documentation sufficient for GAO to confirm their responses. (GAO
identified these sound practices based on published literature and in
consultation with experts on continuity planning.) Agency responses
indicate that-although aware of the practices-agencies may not have
followed them thoroughly or effectively. Further, the essential functions
identified by agencies varied widely: the number of functions identified
in each plan ranged from 3 to 538 and included ones that appeared to be of
secondary importance. The absence in FEMA's guidance of specific criteria
for identifying essential functions contributed to this condition.
Subsequent guidance significantly addresses the sound practices that GAO
identified. Also, the White House has begun a process to improve
continuity planning. If this guidance and process are implemented
effectively, they could lead to improved identification of essential
functions in the executive branch.

As of May 1, 2004, agencies had made progress in improving compliance with
FEMA guidance, but significant weaknesses remained. Agencies that had
plans in place in both years showed significant improvement in the area of
tests, training, and exercises. However, although some improvement
occurred for other planning areas, important weaknesses remained: for
example, 31 of 45 plans did not fully identify mission-critical systems
and data necessary to conduct essential functions. Inadequate oversight by
FEMA contributed to the level of weaknesses in agency continuity plans.
FEMA plans to improve oversight using an online readiness reporting
system, which it plans to have fully operational later this year, and it
has already taken other steps to help agencies improve their plans, such
as conducting an interagency exercise. However, FEMA does not plan to
verify the readiness information that agencies will report in the system.

Finally, even though FEMA's continuity planning guidance in place in May
2004 did not address telework, one agency's continuity plan at that time
included plans to use telework in response to an emergency. In addition,
10 agencies reported that they planned to use telework following a COOP
event, but their plans were not clearly documented.

In its report, GAO made recommendations aimed at helping to improve
continuity planning. These included establishing a schedule for the
completion of recently initiated efforts, developing a strategy for
short-term oversight in the meantime, and developing and implementing
procedures that verify the agency-reported data used in oversight of
agency continuity of operations planning. The report includes comments
from FEMA. In commenting, FEMA agreed that there has been improvement in
COOP plans and that additional oversight is needed.

                 United States Government Accountability Office

Mr. Chairman and Members of the Committee:

I appreciate the opportunity to participate in the Committee's hearing on
federal continuity of operations planning. As you know, essential
government services can be interrupted by a range of events, including
terrorist attacks, severe weather, or building-level emergencies. Federal
agencies are required by Presidential Decision Directive 67 to develop
plans for ensuring the continuity of such services in emergency
situations. The Federal Emergency Management Agency (FEMA), which was
designated executive agent for executive branch continuity of operations
(COOP) planning, issued Federal Preparedness Circular 65 in July 1999 as
planning guidance to agencies. The circular states that, in order to have
a viable COOP capability, agencies should identify their essential
functions. These functions then provide the basis for subsequent planning
steps. The circular also identified eight elements of a viable COOP
capability.1

We previously reviewed agency COOP plan compliance with FEMA's guidance,
at your request. At that time, we found that a number of agencies and
their components did not have continuity plans in place as of October 1,
2002, and those that were in place did not generally comply with FEMA's
guidance.2

We subsequently assessed plans in place on May 1, 2004, both from the
agencies that had plans in place in 2002 and from agencies that
subsequently adopted plans.3 We examined to what extent

1 In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on essential functions.

2 GAO, Continuityof Operations: ImprovedPlanning NeededtoEnsureDeliveryof
Essential Services, GAO-04-160 (Washington, D.C.: Feb. 27, 2004.)

3 As agreed with your staff, we evaluated agency continuity plans in place
on May 1, 2004. Our methodology included evaluating the headquarters
continuity plans for 20 of the 23 largest civilian departments and
agencies, as well as for 25 components of departments, for compliance with
the eight elements identified in FPC 65. We provided agencies with several
opportunities to submit relevant documentation as well as respond to
preliminary findings.

0M	major federal agencies used sound practices to identify and validate
their essential functions,

0M	agencies had made progress in improving compliance with the guidance
outlined in FPC 65 since our 2002 review,4 and

0M	agency continuity of operations plans addressed the use of telework
arrangements (in which work is performed at an employee's home or at a
work location other than a traditional office) during emergencies.

At your request, I am summarizing today the findings and recommendations
of the report on this most recent work, which is being released today.5

  Results in Brief

Many of the 23 agencies reported using the eight sound practices for
identifying and validating essential functions that we identified (for
example, performing a risk and impact analysis for each essential
function), but few provided documentation sufficient for us to confirm
their responses. This indicates that agencies-although aware of these
practices-may not have followed them thoroughly or effectively. In
addition, the number of functions identified in each agency plan ranged
from 3 to 538 and included ones that appeared to be of secondary
importance (for example, "provide advice to the Under Secretary"). Both
FEMA's June 2004 revision to its guidance and a recently initiated White
House effort have the potential, if effectively implemented, to help
agencies better identify their essential functions and thus develop better
continuity plans. However, the lack of a schedule to complete the White
House effort makes it unclear when these improvements might take place.

4Since the June 2004 version of FPC 65 was released after our cutoff date
of May 1, 2004, we assessed plans against the July 1999 version of FPC 65.

5 GAO, ContinuityofOperations: AgencyPlansHave Improved,
butBeterOversightCould AssistAgenciesinPreparingforEmergencies, GAO-05-577
(Washington, D.C.: Apr. 28, 2005).

Although agency COOP plans have shown improvement since our prior
assessment of 2002 plans, most plans in place on May 1, 2004, continued to
exhibit inconsistencies in the identification of essential functions and
significant lack of compliance with FEMA's guidance. Inadequate oversight
by FEMA contributed to the level of weaknesses in agency COOP plans. FEMA
plans to improve oversight using an online readiness reporting system,
which it plans to have fully operational later this year, and it has
already taken other steps to help agencies improve their plans, such as
conducting an interagency exercise. However, FEMA no longer plans to
verify the readiness information that agencies will report in the system.

Finally, even though FEMA's continuity planning guidance in place in May
2004 did not address telework, one agency's continuity plan in place at
that time indicated that it was planning to use telework in response to an
emergency. In addition, 10 agencies reported that they planned to use
telework following a COOP event, but their plans were not clearly
documented.

In our report, we made recommendations to the Assistant to the President
for Homeland Security and to the Secretary of Homeland Security to ensure
that agencies are adequately prepared to continue performing essential
functions following an emergency. In commenting on our findings and
recommendations, FEMA agreed that there has been improvement in COOP plans
and that additional oversight is needed.

Background

Federal operations and facilities have been disrupted by a range of
events, including the terrorist attacks on September 11, 2001; the
Oklahoma City bombing; localized shutdowns due to severe weather
conditions, such as the closure of federal offices in the Washington,
D.C., area in September 2003 due to Hurricane Isabel; and buildinglevel
events, such as asbestos contamination at the Department of the Interior's
headquarters. Such disruptions, particularly if prolonged, can lead to
interruptions in essential government services. Prudent management,
therefore, requires that federal

agencies develop plans for dealing with emergency situations, including
maintaining services, ensuring proper authority for government actions,
and protecting vital assets.

Until relatively recently, continuity planning was generally the
responsibility of individual agencies. In October 1998, Presidential
Decision Directive (PDD) 67 identified the Federal Emergency Management
Agency (FEMA)-which is responsible for responding to, planning for,
recovering from, and mitigating against disasters- as the executive agent
for federal COOP planning across the federal executive branch. FEMA was an
independent agency until March 2003, when it became part of the Department
of Homeland Security (DHS), reporting to the Under Secretary for Emergency
Preparedness and Response. Under PDD 67, its responsibilities include

0M formulating guidance for agencies to use in developing viable plans;

0M	coordinating interagency exercises and facilitating interagency
coordination, as appropriate; and

0M	overseeing and assessing the status of COOP capabilities across the
executive branch.

According to FEMA officials, the directive also required that agencies
have COOP plans in place by October 1999.

In July 1999, FEMA first issued Federal Preparedness Circular (FPC) 65.
FPC 65 is guidance to the federal executive branch for use in developing
viable and executable contingency plans that facilitate the performance of
essential functions during any emergency. Specifically, the guidance

0M	established the identification of essential functions as the basis for
COOP planning;

0M	defined essential functions as those that enable agencies to provide
vital services, exercise civil authority, maintain safety, and sustain the
economy during an emergency;

0M	defined the elements of a viable continuity of operations capability
according to eight topic areas: identification of essential functions;
development of plans and procedures; identification of orders of

succession; delegations of authority; provision for alternate facilities;
provision of interoperable communications; availability of vital records;
and conduct of regular tests, training, and exercises; and

0M	set up an interagency working group to coordinate continuity planning.

FPC 65 applies to all federal executive branch departments and agencies at
all levels, including locations outside Washington, D.C. It directed the
heads of each agency to assume responsibilities including

0M	developing, approving, and maintaining agency continuity plans and
procedures;

0M	developing a COOP multiyear strategy and program management plan; and

0M	conducting tests and training of agency continuity plans, contingency
staffs, and essential systems and equipment.

At your request, we previously reported on federal agency

headquarters contingency plans in place in October 2002.6 At that

time, we determined that most agencies identified at least one

function as essential, but the functions varied in number and

apparent importance. Furthermore, while 20 of 23 agencies had

documented COOP plans, none addressed all the guidance in FPC

65. We identified inadequate guidance and oversight as factors
contributing to these weaknesses, and recommended that DHS (1) ensure that
agencies without plans develop them, (2) ensure that agencies address
weaknesses in their plans, and (3) conduct assessments of plans that
included an independent verification of agency-provided data and an
assessment of identified essential functions. In response to these
recommendations, DHS reported in July 2004 that it (1) was developing an
online system to collect data

6 GAO, Continuityof Operations: ImprovedPlanning NeededtoEnsureDeliveryof
EssentialGovernmentServices, GAO-04-160 (Washington, D.C.: Feb. 27, 2004)
and Continuityof Operations: ImprovedPlanningNeededtoEnsureDeivery
ofEssential

Services, GAO-04-638T (Washington, D.C.: Apr. 22, 2004).

from agencies on the readiness of their continuity plans that would
evaluate compliance with the guidance, (2) had conducted an interagency
exercise, and (3) had developed a training program for agency continuity
planning managers. DHS added that it planned to conduct an independent
validation of each agency's self-assessment after deployment of the
readiness system.7

  Many Agencies Reported Using Sound Continuity Practices, but Few

Provided Adequate Supporting Documentation Based on an analysis of
published literature and in consultation with experts on continuity
planning, we identified eight sound practices related to essential
functions that organizations should use when developing their COOP plans.
These practices, listed in table 1, constitute an ongoing process that
includes identifying and validating essential functions.

7 GAO, Statusof Key RecommendationsGAOHasMadetoDHSand ItsLegacyAgencies,
GAO-04-865R (Washington, D.C.: July 2, 2004).

             Table 1: Eight Sound Practices for Continuity Planning

Practices

Establish a structured COOP project work group/committee that includes
representatives of all agency components, legal advisors, and continuity
experts and either includes a member of the agency's executive management
or reports to a member of the agency's executive management. Such a
committee should be involved in the initial selection of essential
functions.

Determine the resources necessary to perform each function.

Determine the dependencies necessary to perform each function.

Develop a schedule or project plan for critical stages in the continuity
of operations program effort.

Identify and rank plausible threats, vulnerabilities, liabilities, and/or
exposures through a risk assessment.

Perform a risk and impact analysis for each essential function-including
prioritization of essential functions and determination of minimum
acceptance level of output and recovery time objective for each function.

Develop and implement a strategy for validating the continuity plan and
the underlying essential functions.

Change its essential functions as the result of the validation process.

Source: GAO.

With regard to COOP plans in place on May 1, 2004, many of the 23 agencies
reported using some of the sound practices in developing plans, included
identifying and validating essential functions, but few provided
documentation sufficient for us to validate their responses. This
indicates that agencies-although aware of these practices-may not have
followed them thoroughly or effectively. For example, it is unlikely that
a thorough risk analysis of essential functions could be performed without
being documented.

Further, the essential functions identified by agencies varied widely: the
number of functions identified in each plan ranged from 3 to 538. In
addition, the apparent importance of the functions was not consistent. For
example, a number of essential functions were of clear importance, such as

0M "conduct payments to security holders" and

0M	"carry out a rapid and effective response to all hazards, emergencies,
and disasters."

Other identified functions appeared vague or of questionable importance:

0M "champion decision-making decisions" and 0M "provide advice to the
Under Secretary."

New Guidance and Review Process Could Result in More Consistent
Identification of Essential Functions

The high level of generality in FEMA's guidance on essential functions
contributed to the inconsistencies in agencies' identification of these
functions. As was the case during our 2002 review, the version of FPC 65
in place on May 1, 2004, defined essential functions as those that enable
agencies to provide vital services, exercise civil authority, maintain
safety, and sustain the economy during an emergency. The document did not,
however, define a process that agencies could use to select their
essential functions.

In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on essential functions. The annex
lists several categories that agencies must consider when determining
which functions are essential, including

0M	functions that must continue with minimal interruption or cannot be
interrupted for more than 12 hours without compromising the organization's
ability to perform its mission and

0M	functions assigned to the agency by federal law or by order of the
President.

The new guidance goes on to outline steps addressing the prioritization of
selected functions as well as the identification of resources necessary to
accomplish them and of interdependencies with other agencies.

On January 10, 2005, the Assistant to the President for Homeland Security
issued a memorandum outlining additional guidance on essential functions
and initiated a process to identify and validate agency-level functions.
The memorandum noted that in the past

many departments and agencies had had difficulty clearly identifying and
articulating their essential functions. It attributed this difficulty, in
part, to the lack of a defined set of national-level essential functions
to guide agency continuity planning, resulting in multiple efforts to
develop agency essential functions for different specific purposes (e.g.,
planning for Year 2000 computer continuity, information technology
planning, and critical infrastructure planning). Further, it noted that
departments and agencies sometimes do not distinguish between a "function"
and the specific activities necessary to perform the function.

To address these issues, the memorandum identified eight National
Essential Functions that are necessary to lead and sustain the country
during an emergency and, therefore, must be supported through continuity
capabilities. Table 2 lists the eight National Essential Functions.

                     Table 2: National Essential Functions

Functions

                Preserve our constitutional form of government.

Provide leadership visible to the nation and the world; maintain the trust
and confidence of the American people.

Defend the country against all enemies, foreign or domestic, and prevent
or interdict future attacks.

Maintain and foster effective relationships with foreign nations.

Protect against threats to the homeland and bring to justice perpetrators
of crimes or attacks against the nation, its citizens, or its interests.

Provide rapid and effective response to and recovery from the domestic
consequences of an attack or other incident.

Protect and stabilize the nation's economy; ensure confidence in financial
systems.

Provide for critical federal government services that address the national
health, safety, and welfare needs of the nation.

Source: White House.

The memorandum asked major agencies to identify their Priority Mission
Essential Functions-those functions that must be performed to support or
implement the National Essential Functions before, during, and in the
immediate aftermath of an emergency. The document stated that, generally,
priority functions must be uninterrupted or resumed during the first 24 to
48 hours after the occurrence of an emergency and continued through full
resumption of all government functions.

When identifying their functions, agencies were asked to also identify the
National Essential Function that each priority function supports, the time
in which the priority function must be accomplished, and the partners
necessary to perform the priority function. The memorandum asked agencies
to reply by February 18, 2005.

The memorandum emphasized the need for the involvement of senior-level
agency officials, calling for each agency's functions to be first approved
by an official with agencywide responsibilities. The memorandum then laid
out a process by which the functions would be validated by an interagency
group within the Homeland Security Council. According to FEMA officials,
two agencies' essential functions have already been reviewed, and there
are plans to complete all agency reviews by the end of the summer. The
validated functions would then be used to support development of a new
continuity policy and would be used to develop and implement improved
requirements for capabilities, inform the annual budget process, establish
program metrics, and guide training and exercises and other continuity
program activities. The memorandum did not set any time frames for these
later steps.

Together, FEMA's revised guidance and the guidance from the White House
significantly address the best practices that we identified. For example:

0M	Both documents call for agencies to identify dependencies necessary to
perform the functions.

0M	FEMA's guidance calls for agencies to prioritize their essential
functions and identify the resources necessary to perform them.

0M	The White House guidance calls on agencies to identify the recovery
time necessary for each function and outlines a process to validate the
initial list of functions.

If implemented effectively, the new guidance and the review process
conducted by the White House could result in more consistent
identification of essential functions across the executive branch. The
functions could then form the basis for better plans for continuing the
most critical functions following a disruption to normal operations.
However, without time frames for completing

the outlined process, it is unclear when the expected improvement will
occur.

                                       s

  Agency COOP Plans Have Improved, but None Address All of FEMA's Guidance

When compared with our prior assessment, agency continuity plans in place
on May 1, 2004, showed improved compliance with FEMA's guidance in two
ways:

0M	One agency and nine component agencies that did not have documented
continuity plans in place at the time of our 2002 review had put such
plans in place by May 1.

0M	For each of the topic areas outlined in the guidance, agencies
generally made progress in increasing compliance.

However, two major agencies did not have plans in place on May 1, 2004. As
of April 2005, one of these two had finalized its plan.

In addition, after analyzing these plans, we found that none in place on
May 1 followed all of FEMA's guidance. Of the eight topic areas identified
in FPC 65, these 45 COOP plans generally complied with the guidance in two
areas (developing plans and procedures and order of succession); generally
did not comply in one area (tests, training, and exercises); and showed
mixed compliance in the other five areas. Specifically, when examining the
governmentwide results of our analysis of the eight planning topics
outlined in FPC 65, we determined the following:

0M	Essential functions.Most agency plans identified at least one function
as essential and identified which functions must be continued under all
circumstances. However, less than half the COOP plans identified
interdependencies among the functions, established staffing and resource
requirements, or identified the mission-critical systems and data needed
to perform the functions.

0M	Plansand procedures. Most plans followed the guidance in this area,
including establishing a roster of COOP personnel, activation

procedures, and the appropriate planning time frame (12 hours to 30 days).

0M	Ordersofsuccession. All but a few agency plans identified an order of
succession to the agency head. Most plans included orders of succession
for other key officials or included officials outside of the local area in
the succession to the agency head. Many plans did not include the orders
of succession in the agency's vital records or document training for
successors on their emergency duties.

0M	Delegations ofauthority. Few plans adequately documented the legal
authority for officials to make policy decisions in an emergency.

0M	Alternate facilities. Most plans documented the acquisition of at least
one alternate facility, and many included alternate facilities inside and
outside of the local area. However, few plans documented that agencies had
sufficient space for staff, prepositioned equipment, or appropriate
communications capabilities at their alternate facilities.

0M	Redundant emergencycommunications. Most plans identified at least two
independent media for voice communication. Less than half of the plans
included adequate contact information, and few provided information on
backup data links.

0M	Vital records. Less than half of the plans fully identified the
agency's vital records. Few plans documented the locations of all vital
records or procedures for updating them.

0M	Tests,training, and exercises. While many agencies documented some
training, very few agencies documented that they had conducted tests,
training, and exercises at the recommended frequency.

Inadequate Oversight by FEMA Contributes to Noncompliance

During our prior review of 2002 plans, we found that insufficient
oversight by FEMA contributed to agencies' lack of compliance with the
guidance. Specifically, we noted that FEMA had not conducted an assessment
of agency contingency plans since 1999. As a result, we recommended that
it conduct assessments of agency continuity plans that include independent
verification of agency-reported information. In response, DHS reported
that it was developing a

readiness reporting system to assist it in assessing agency plans and
planned to verify the information reported by the agencies.

Although neither of these planned actions was completed by May 1, 2004,
FEMA has made subsequent efforts to improve its oversight. According to
FEMA officials, development of the readiness reporting system was
completed in March 2005, and the system is expected to be operational and
certified by October 2005, at which time there will be seven locations
(including two FEMA locations) using the system. They added that once the
system becomes fully operational, agencies will be required to
periodically provide updated information on their compliance with FEMA's
guidance. These officials also reported that the agency had taken
additional steps to improve readiness. Specifically, they stated that the
interagency exercise held in mid-May 2004 successfully activated and
tested agency plans; they based this assessment on reports provided by the
agencies. Furthermore, FEMA has begun planning for another interagency
exercise in 2006. In addition, as of April 2005, FEMA had provided
training to 682 federal, state, and local officials from 30 major federal
departments and agencies and 209 smaller agencies-including state, local,
and tribal entities. FEMA officials stated that because of these
additional successful efforts to improve readiness, they no longer planned
to verify agency-reported readiness data.

While the revised guidance, recent exercise, and ongoing training should
help ensure that agency continuity plans follow FEMA's guidance, FEMA's
ongoing ability to oversee agency continuity planning activities will be
limited by its reliance on agency-provided data. Without verification of
such data, FEMA lacks assurance that agency plans are compliant and that
the procedures outlined in those plans will allow agencies to effectively
continue to perform their essential functions following a disruption.

  One Agency Plans to Use Telework in Response to an Emergency

Telework, also referred to as telecommuting or flexiplace, has gained
widespread attention over the past decade in both the public

and private sectors as a human capital flexibility that offers a variety
of potential benefits to employers, employees, and society. In a 2003
report to Congress on the status of telework in the federal government,
the Director of the Office of Personnel Management (OPM) described
telework as "an invaluable management tool which not only allows employees
greater flexibility to balance their personal and professional duties, but
also allows both management and employees to cope with the uncertainties
of potential disruptions in the workplace, including terrorist threats."8

As we reported in an April 2004 report, telework is an important and
viable option for federal agencies in COOP planning and implementation
efforts, especially as the duration of an emergency event is extended.9 In
a July 2003 GAO report, we defined 25 key telework practices for
implementation of successful federal telework programs.10

Although not required to do so, 1 of the 21 agency continuity plans in
place on May 1, 2004, documented plans to address some essential functions
through telework. Two other agencies reported that they planned to use
telework to fulfill their essential functions, and eight agencies reported
that they planned for nonessential staff to telework during a COOP event,
but their continuity plans do not specifically mention telework.

However, none of the agencies that are planning to use telework during a
COOP event documented that the necessary preparations had taken place.
These preparations-derived from the 25 key telework practices for the
development of an effective telework program-include informing and
training the staff, ensuring that there is adequate technological capacity
for telework, providing technological assistance, and testing the ability
to telework.

8 U.S. Office of Personnel Management, Report totheCongress: TheStatus of
Teleworkin the FederalGovernment(Washington, D.C.: January 2003).

9 GAO, Human Capital: OpportunitiestoImprove Federal ContinuityPlanning
Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).

10 GAO, Human Capital: FurtherGuidance, Assistance,andCoordination Can
Improve FederalTeleworkEfforts, GAO-03-679 (Washington, D.C.: July 18,
2003).

In summary, Mr. Chairman, although agency COOP plans have shown
improvement since our prior assessment of 2002 plans, most plans in place
on May 1, 2004, continued to exhibit inconsistencies in the identification
of essential functions and significant lack of compliance with FEMA's
guidance. Both FEMA's revision to this guidance and a recently initiated
White House effort have the potential, if effectively implemented, to help
agencies better identify their essential functions and thus develop better
continuity plans. However, the lack of a schedule to complete the White
House effort makes it unclear when these improvements might take place.
Agencies' efforts to develop continuity plans could also be aided by
FEMA's efforts to develop a readiness reporting system, conduct a
governmentwide exercise, and train agency COOP planners, as well as by any
guidance or policies that result from the White House effort.

Finally, even though FEMA's continuity planning guidance in place in May
2004 did not address telework, one agency's continuity plan at that time
included plans to use telework in response to an emergency. In addition,
10 agencies reported that they planned to use telework following a COOP
event, but their plans were not clearly documented.

In our report, we make recommendations aimed at helping to ensure that
agencies are adequately prepared to perform essential functions following
an emergency. We recommended that the Assistant to the President for
Homeland Security establish a schedule for the completion of the recently
initiated effort to validate agency essential functions and refine federal
continuity of operations policy. We also recommended that the Secretary of
Homeland Security direct the Under Secretary for Emergency Preparedness
and Response to

0M	develop a strategy for short-term oversight that ensures that agencies
are prepared for a disruption in essential functions while the current
effort to identify essential functions and develop new guidance is
ongoing;

0M	develop and implement procedures that verify the agency-reported data
used in oversight of agency continuity of operations planning; and

0M	develop, in consultation with OPM, guidance on the steps that agencies
should take to adequately prepare for the use of telework during a COOP
event.

In commenting on our findings and recommendations, the Under Secretary for
Emergency Preparedness and Response of DHS stated that the department
agreed that there has been improvement in COOP plans and attributed that
improvement to a renewed emphasis by DHS and the White House. The
department also agreed with the need for additional oversight and noted
that FEMA had begun conducting COOP site assessments at departments and
agencies to improve readiness. The Under Secretary's letter drew attention
to a number of actions taken after the May 1, 2004, cutoff date for our
assessment. Finally, the Under Secretary pointed out that the readiness
reporting system that FEMA is developing was not intended to be a COOP
plan assessment tool, but that it instead provides key officials with the
ability to determine plan status in near real time. We continue to believe
that it is important for FEMA to assess agency plans as part of its
oversight responsibilities. Regardless of the system's intended use, we
believe its capabilities, as described by FEMA, make it a valuable tool
that the agency should use when exercising these responsibilities.

Mr. Chairman, this concludes my statement. I would be pleased to respond
to any questions that you or other members of the Committee may have at
this time.

  Contacts and Acknowledgements

For information about this testimony, please contact Linda D. Koontz at
(202) 512-6240 or at [email protected], or James R. Sweetman at (202)
512-3347 or [email protected]. Other key contributors to this testimony
include Barbara Collier, Mike Dolak, Nick Marinos, and Jessica Waselkow.

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

    GAO's Mission

Obtaining Copies of GAO Reports and Testimony

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site (www.gao.gov). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone 	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: 	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

    To Report Fraud, Contact:

Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Gloria Jarmon, Managing Director, [email protected] (202)
512-4400Congressional U.S. Government Accountability Office, 441 G Street
NW, Room 7125 Relations Washington, D.C. 20548

Public Affairs 	Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

                           PRINTED ON RECYCLED PAPER
*** End of document. ***