Homeland Security: Assessment of the National Capital Region	 
Strategic Plan (28-SEP-06, GAO-06-1096T).			 
                                                                 
Among other things, the Office of National Capital Region	 
Coordination is to coordinate efforts within the National Capital
Region (NCR) to ensure execution of domestic preparedness	 
activities. In our May 2004 report and June 2004 testimony before
the House Government Reform Committee, GAO recommended that the  
NCR develop a strategic plan to establish and monitor the	 
achievement of regional goals and priorities for emergency	 
preparedness and response. GAO subsequently testified on the	 
status of the NCR's strategic planning efforts before the	 
Subcommittee on Oversight of Government Management, the Federal  
Workforce, and the District of Columbia in July 2005 and March	 
2006. The Subcommittee asked GAO to provide comments on the NCR's
strategic plan, which the NCR partners approved in September	 
2006. In this testimony, GAO discusses its assessment of the	 
recently completed NCR homeland security strategic plan and the  
extent to which the new plan includes desirable strategic plan	 
characteristics and how the substance of the plan might be	 
further strengthened when the plan is reviewed and possibly	 
revised.							 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-1096T					        
    ACCNO:   A61544						        
  TITLE:     Homeland Security: Assessment of the National Capital    
Region Strategic Plan						 
     DATE:   09/28/2006 
  SUBJECT:   Emergency preparedness				 
	     Homeland security					 
	     Performance measures				 
	     Policy evaluation					 
	     Program evaluation 				 
	     Regional planning					 
	     Risk assessment					 
	     Strategic planning 				 
	     Program goals or objectives			 
	     National Capital Regions				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-1096T

     

     * Summary
     * Background
     * The NCR Strategic Plan Contains Desirable Characteristics, b
          * Plan Purpose, Scope, and Methodology
          * Problem Definition and Risk Assessment
               * Risk- and Capabilities-Based Approach
               * Capability Development
          * Goals, Subordinate Objectives, Activities, and Performance M
               * Strategic Goals and Objectives
               * Steps to Achieve Results
               * Performance Measures
               * Milestones
          * Resources, Investments, and Risk Management
          * Organizational Roles, Responsibilities, and Coordination
               * NCR Governance
               * Lead Organizations
          * Integration and Implementation
     * Concluding Observations
     * Contact and Acknowledgments
     * GAO's Mission
     * Obtaining Copies of GAO Reports and Testimony
          * Order by Mail or Phone
     * To Report Fraud, Waste, and Abuse in Federal Programs
     * Congressional Relations
     * Public Affairs

Testimony before the Subcommittee on Oversight of Government Management,
the Federal Workforce, and the District of Columbia, Committee on Homeland
Security and Governmental Affairs, U.S. Senate

United States Government Accountability Office

GAO

For Release on Delivery Expected at 10:00 a.m. EDT

Thursday, September 28, 2006

HOMELAND SECURITY

Assessment of the National Capital Region Strategic Plan

Statement of William O. Jenkins, Jr.

Director, Homeland Security and Justice Issues

GAO-06-1096T

Mr. Chairman and Members of the Committee:

I appreciate the opportunity to be here today to discuss the National
Capital Region's (NRC) September 2006 homeland security strategic plan.1 A
well-defined, comprehensive homeland security strategic plan for the NCR
is essential for assuring that the region is prepared for the risks it
faces, whether those risks are from nature or human action. We reported on
NCR strategic planning, among other issues, in May 2004 and September
2004, testified before the House Committee on Government Reform in June
2004, and testified before your Committee in July 2005 and March 2006.2 In
2004 and 2005, we recommended that the Secretary of the Department of
Homeland Security work with the NCR jurisdictions to develop a coordinated
strategic plan to establish goals and priorities to enhance first
responder capacities that can be used to guide the use of federal
emergency preparedness funds-a recommendation that the department agreed
to implement.

In March 2006, I commented on the status of the NCR strategic planning and
again emphasized that the Secretary of the Department of Homeland Security
should work with the NCR jurisdictions to quickly complete a coordinated
strategic plan. To improve the plan's effectiveness as it was being
developed, we provided six characteristics we considered to be desirable
for a regional homeland security strategy. These characteristics included
(1) purpose, scope, and methodology; (2) problem definition and risk
assessment; (3) goals, subordinate activities, and performance measures;
(4) resources, investments, and risk management; (5) organizational roles,
responsibilities, and coordination; and (6) integration and
implementation.

1The National Capital Region is composed of the District of Columbia and
nearby jurisdictions in Maryland and Virginia.

2GAO, Homeland Security: Management of First Responder Grants in the
National Capital Region Reflects the Need for Coordinated Planning and
Performance Goals, GAO-04-433 (Washington, D.C.: May 28, 2004); Homeland
Security: Coordinated Planning and Standards Needed to Better Manage First
Responder Grants in the National Capital Region, GAO-04-904T (Washington,
D.C.: June 24, 2004); Homeland Security: Effective Regional Coordination
Can Enhance Emergency Preparedness, GAO-04-1009 (Washington, D.C.: Sept.
15, 2004); Homeland Security: Managing First Responder Grants to Enhance
Emergency Preparedness in the National Capital Region, GAO-05-889T
(Washington, D.C.: July 14, 2005); and Homeland Security: The Status of
Strategic Planning in the National Capital Region, GAO-06-559T
(Washington, D.C.: Mar. 29, 2006).

Today, my statement provides our assessment of the recently completed NCR
homeland security strategic plan and the extent to which the new plan
includes the six characteristics and how the substance of the plan might
be further strengthened when the plan is reviewed and possibly revised. We
did our work in accordance with generally accepted government auditing
standards.

                                    Summary

The September 2006 NCR homeland security strategic plan includes the six
characteristics we consider to be desirable for a regional homeland
security strategy. To illustrate, the plan includes regional priorities
and presents the rationale for the goals and related objectives and
initiatives. This includes information on how the plan addresses national
priorities and targeted capabilities from the National Preparedness Goal,3
an Emergency Management Accreditation Program (EMAP) 4 assessment of local
and regional preparedness and emergency management capabilities against
recognized national standards, and DHS's Nationwide Plan Review of
emergency plans.5 The plan structure is more streamlined, containing an
overview, core plan, and detailed appendix with information on factors
such as risks, costs, and roles and responsibilities.

However, the substance of the information within these six characteristics
could be improved to guide decision makers. Additional information could
be provided regarding the type, nature, scope, or timing of planned goals,
objectives, and initiatives; performance expectations and measures;
designation of priority initiatives to meet regional risk and needed
capabilities; lead organizations for initiative implementation; resources
and investments; and operational commitment. Two examples: (1) the plan
does not reflect a comprehensive risk assessment for the region, which,
when completed, may alter some of the priorities in the current plan; and
(2) although the NCR plan defines objectives as being key, measurable
milestones for reaching each goal, many objectives include language such
as "strengthen," "enhance," "increase," "improve," and "expand." Several
of our observations regarding potential plan substance are the same as
those we provided in our March 2006 testimony.

3According to DHS, the National Preparedness Goal establishes a vision for
preparedness, identifies target capabilities, provides a description of
each capability, and presents guidance on the levels of capability that
federal, state, local, and tribal entities will be expected to develop and
maintain.

4The EMAP is a voluntary assessment and accreditation process for
state/territorial, tribal, and local government emergency management
programs. Among other things, EMAP is intended to provide a structure for
identifying areas in need of improvement and a methodology for strategic
planning and justification of resources. EMAP uses national emergency
management standards along with peer assessment teams to evaluate a
program's activities. These standards are based on the National Fire
Protection Association 1600 standard covering functional areas such as
program management and hazard identification and risk assessment.

5The Nationwide Plan Review reviewed and assessed the status of
catastrophic and evacuation planning in all states and 75 of the nation's
largest urban areas. It also reviewed emergency operations plans for the
nation's major cities.

                                   Background

The Homeland Security Act established the Office of National Capital
Region Coordination within the Department of Homeland Security.6 The ONCRC
is responsible for overseeing and coordinating federal programs for and
relationships with state, local, and regional authorities in the NCR and
for assessing and advocating for the resources needed by state, local, and
regional authorities in the NCR to implement efforts to secure the
homeland. One of the ONCRC mandates is to coordinate with federal, state,
local, and regional agencies and the private sector in NCR on terrorism
preparedness to ensure adequate planning, information sharing, training,
and execution of domestic preparedness activities among these agencies and
entities.

In our earlier work, we reported that the ONCRC and the NCR faced
interrelated challenges in managing federal funds in a way that maximizes
the increase in first responder capacities and preparedness while
minimizing inefficiency and unnecessary duplication of expenditures. One
of these challenges included a coordinated regionwide plan for
establishing first responder performance goals, needs, and priorities, and
assessing the benefits of expenditures in enhancing first responder
capabilities.

All states and urban areas are to align existing preparedness strategies
within the National Preparedness Goal's eight national priorities.7 An
overarching national priority for the National Preparedness Goal is the
embracing of regional approaches to building, sustaining, and sharing
capabilities at all levels of government. DHS required states and urban
areas, including the NCR, to assess their preparedness needs by reviewing
their existing programs and capabilities and using those findings to
develop a plan and formal investment justification outlining major
statewide, sub-state, or interstate initiatives for which they will seek
federal funding under the Homeland Security Grant Program. The target
capabilities are intended to serve as a benchmark against which states,
regions, and localities can measure their own capabilities. According to
DHS, the funding initiatives are to focus efforts on how to build and
sustain programs and capabilities within and across state boundaries while
aligning with the National Preparedness Goal and national priorities.

66 U.S.C. 462.

7Those priorities are (1) implement the National Incident Management
System and National Response Plan; (2) expand regional collaboration; (3)
implement the interim National Infrastructure Protection Plan; (4)
strengthen information-sharing and collaboration capabilities; (5)
strengthen interoperable communications capabilities; (6) strengthen
chemical, biological, radiological/nuclear, and explosive detection,
response, and decontamination capabilities; (7) strengthen medical surge
and mass prophylaxis capabilities; and (8) review emergency operations
plans and the status of catastrophic planning.

In fiscal year 2006 DHS funding guidance, regional collaboration included
specific implementation benchmarks. These benchmarks included (1)
formalizing mutual aid agreements with surrounding communities and states
to share equipment, personnel, and facilities during emergencies; (2)
conducting exercises of the execution of mutual aid agreements to identify
the challenges and familiarize officials with resources that are available
in the region; and (3) coordinating homeland security preparedness
assistance expenditures and planning efforts on a regional basis to avoid
duplicative or inconsistent investments.

In earlier work on effective regional coordination for emergency
preparedness, we defined regional coordination as the use of governmental
resources in a complementary way toward goals and objectives that are
mutually agreed upon by various stakeholders in a region.8 In later work
for this Committee on federal agency collaboration, we defined
collaboration in a similar manner, defining it as any joint activity by
two or more organizations intended to produce more public value than could
be produced when the organizations act alone.9 Successful coordination or
collaboration occurs not only vertically among federal, state, and local
governments, but also across jurisdictions within regions. In the
coordination or collaborative effort, strategic plans can be effective
tools to focus resources and efforts to address problems through features
such as goals and objectives that are measurable and quantifiable. By
specifying goals and objectives, plans can also give planners and decision
makers a structure for allocating funding to those goals and objectives. A
well-defined, comprehensive homeland security strategic plan for the NCR
is essential for assuring that the region is prepared for the risks it
faces.

8 GAO-04-1009 .

9GAO, Results-Oriented Government: Practices That Can Help Sustain
Collaboration among Federal Agencies, GAO-06-15 (Washington, D.C.: Oct.
21, 2005).

In advance of our March 2006 testimony, Office of the National Capital
Region Coordination officials provided us with several documents that they
said when taken as a whole constituted the basic elements of NCR's
strategic plan, such as a November 2005 document containing information on
NCR strategic goals, objectives, and initiatives and February and March
2006 documents related to homeland security grant program funding. In our
testimony, we outlined desirable characteristics for a strategic plan
based on past work.10 The desirable characteristics, adjusted for a
regional strategy, are

           o  Purpose, scope, and methodology that address why the strategy
           was produced, the scope of its coverage, and the process by which
           it was developed.
           o  Problem definition and risk assessment that address the
           particular regional problems and threats the strategy is directed
           towards.
           o  Goals, subordinate objectives, activities, and performance
           measures that address what the strategy is trying to achieve,
           steps to achieve those results, as well as the priorities,
           milestones, and performance measures to gauge results.
           o  Resources, investments, and risk management that address what
           the strategy will cost, the sources and types of resources and
           investments needed, and where resources and investments should be
           targeted by balancing risk reductions and costs.
           o  Organizational roles, responsibilities, and coordination that
           address who will be implementing the strategy, what their roles
           will be compared to those of others, and mechanisms for them to
           coordinate their efforts.
           o  Integration and implementation that address how a regional
           strategy relates to other strategies' goals, objectives and
           activities, and to state and local governments within their region
           and their plans to implement the strategy.

10GAO. Combating Terrorism: Evaluation of Selected Characteristics in
National Strategies Related to Terrorism, GAO-04-408T (Washington, D.C.:
Feb. 3, 2004).

The NCR Strategic Plan Contains Desirable Characteristics, but Additional
                         Information Could be Provided

The plan's structure contains the six characteristics and related elements
that we identified in earlier work as desirable in a national strategy
that would also be useful for a regional approach to homeland security
strategic planning. Instead of the multiple documents provided in advance
of our March 2006 testimony, the plan is now one document with three
parts-an overview, a core plan, and appendices with more detailed
information. The core plan includes information on purpose, scope, and
methodology; goals and objectives; problem definition and risk assessment;
implementation and sustainment of the strategic plan, including
organizational roles, responsibilities, and coordination; and alignment
with other strategies and planning efforts. The appendix document provides
extensive information on initiatives, including priorities, rationale, key
tasks and programs, estimates of costs and cost assumptions, types of
resources and investments, time frame, the lead organization responsible
for each initiative, and performance assessment information, including
measures, baselines, and targets. The plan will be reviewed and updated on
a 3-year cycle.

However, the substance of the information within several of the six
characteristics could be further strengthened as the plan is reviewed and
revised to enable the NCR jurisdictions set clear priorities and sustain
their collaborative efforts. As I will point out, several of our
observations regarding improvements are the same as those we provided in
our March 2006 testimony.

Plan Purpose, Scope, and Methodology

The first desirable characteristic is purpose, scope, and
methodology-addressing why the strategy was produced, the scope of its
coverage, and the process by which it was developed. Elements of this
characteristic include, for example, what major functions, mission areas,
or activities it covers; principles or theories that guided its
development; and the process to produce the strategy.

The plan includes a section on purpose, scope, and methodology. For
example, according to the strategic plan document, the plan is intended to
provide a framework and guidance for programming, budgeting, and execution
of homeland security programs in the NCR over the next 3 years and serve
as the basis for planning for the next 5 years. Scope information
discusses regionwide mission areas and initiatives and notes that the
strategic plan is not an operational plan and is not a replacement for
local and state emergency operations plan. Its purpose is not to be an
investment plan and, therefore, does not allocate funding to any
initiatives or change the funding, budgeting, and resource allocation
processes for individual funding sources.

The plan describes its development by the NCR Partners-a group consisting
of the NCR's local, state, regional, and federal entities; citizen
community groups; private-sector organizations; non-profit organizations;
and non-governmental organizations. The plan describes the consensus-based
process guided by the NCR's Homeland Security Senior Policy Group (SPG).

Problem Definition and Risk Assessment

The second desirable characteristic is problem definition and risk
assessment-addressing the particular regional problems and threats the
strategy is directed toward. Elements of this characteristic include, for
example, a discussion or definition of problems, their causes, and
operating environment, and risk assessment, including an analysis of
threats and vulnerabilities.

  Risk- and Capabilities-Based Approach

The plan describes the approach used to identify threats, vulnerabilities,
and consequences of the risks facing the region. The plan focuses
attention and resources on initiatives that address the highest risks for
the region. The document states that numerous gap and shortfall analyses,
conducted by the NCR's homeland security senior leaders and independent
analysts, helped define the plan's four goals. Further, it is stated that
each state jurisdiction also completed an extensive hazard analysis.

Although the plan states that a combined risk- and capabilities-based
approach was used, it also recognizes the need for a more formal, in-depth
risk assessment based on a common framework and includes a major priority
initiative to meet this need.11 The plan states that over the past few
years, several vulnerability assessments have been completed for the NCR
and its member institutions, but our assessment of the plan indicates that
information from past assessments may not have been fully utilized.
According to the plan, one initiative calls for the development of a NCR
risk assessment methodology and a regionwide threat analysis, leveraging
assessments and analyses to date conducted by the states, local
jurisdictions, and federal partners. Another initiative is to create a
high priority list of recommended critical infrastructure protective
actions based on security assessment findings already completed and shared
with the NCR.

11According to the National Preparedness Goal, a capability provides the
means to accomplish one or more tasks under specific conditions and to
specific performance standards. A capability may be delivered with any
combination of properly planned, organized, equipped, trained, and
exercised personnel that achieves the intended outcome.

It is unfortunate that the strategic plan's goals do not yet reflect the
completion and maintenance of a comprehensive, integrated risk assessment
for the region. We noted in our March 2006 testimony that in the aftermath
of the September 11, 2001, terrorist attacks and the creation of the ONCRC
in 2003, we would have expected that the vast majority of risk assessment
work should have been completed. An ongoing risk assessment methodology
should be in place to identify emerging risks.

  Capability Development

Until the new risk assessment is completed, the plan states the NCR is
utilizing a compilation of regional gaps in capabilities, some the same as
those identified in the EMAP assessment, considered alongside threat and
impact factors, in developing strategic plan goals, objectives and
prioritization of initiatives. These regional capability gaps included (1)
standardized alert notification procedures; (2) regional mitigation plan;
(3) regionwide strategic communications plan; (4) public information
dissemination during all phases of emergencies; (5) inclusion of the
private sector information in planning; (6) public-private coordination;
(7) analysis of threats, vulnerabilities and consequences; (8) resource
management and prioritization; (9) understanding of long-term recovery
issues; (10) special needs considerations for response and recovery; (11)
mass care; and (12) infrastructure.

The document states that the plan addresses the EMAP assessment
recommendations and 54 of the 58 EMAP national standards. In addition, the
National Preparedness Goal's 37 capabilities that federal, state, local,
and tribal entities must achieve to perform critical tasks for homeland
security missions served as a target in developing the plan's initiatives.
In the plan, each regional initiative rationale identifies whether it
addresses a national capability from the national target capabilities
list, an EMAP standard, and/or an identified regional gap. Further, the
plan states that it addresses all of the Nationwide Plan Review's overall
emergency and catastrophic planning conclusions for all states and urban
areas. in the nation. Other sources of information for the strategic
planning included the National Capital Region Program and Capability
Enhancement Plan, the Nationwide Plan Review, and the National
Preparedness Goal and related target capabilities.

We are encouraged that the NCR plan emphasizes enhancing capabilities
consistent with currently known regional capability shortfalls and others
based on a variety of information sources. It is clear that a great deal
of work has gone into identifying needed capabilities as part of the
planning approach.

In revising the plan, NCR officials might consider two observations.
First, although the plan recognized the importance of the Nationwide Plan
Review's specific phase 2 findings for the NCR emergency plans and the
status of catastrophic and evacuation planning, it did not reflect
specific NCR findings. As you know, the review was conducted in response
to the shortfalls in preparedness identified during Hurricane Katrina. A
brief scorecard presenting Review NCR findings provided to us said that,
overall, the DHS review found the NCR plan's adequacy, feasibility, and
acceptability not sufficient to meet the requirements of a catastrophic
incident. While the assessment found the NCR's resource management annex
and communications annex sufficient to meet the requirements of a
catastrophic incident, others were only partially sufficient or not
sufficient, including the basic plan, direction and control annex, warning
annex, emergency public information annex, evacuation annex, mass care
annex, and the health and medical annex.

According to NCR officials, the assessment tools of the Review and the
EMAP assessment were flawed because they focus on a single jurisdiction,
not a multi-jurisdictional approach. In addition, the assessments assume
that the entity under review is an operational jurisdiction which the NCR
is not. NCR officials told us they found the reviews of limited usefulness
because of this flaw. The officials said NCR states have individual state
plan reviews that are more valid. However, they said the NCR addressed
findings they thought were appropriate and useful and did focus on the
national findings, which are included in the NCR strategic plan. If the
plan was to include all sources of capability gaps, to guide problem
definition and risk assessment, NCR officials should consider if it would
be useful to describe the specific Review's findings for the NCR that the
officials did accept, and align plan objectives and specific initiatives
to those accepted findings.

Also, instead of referencing preparedness capabilities from different
sources, it might be more useful for the plan to have one set of
capabilities for action. This would integrate all sources of necessary
capabilities (and their varying definitions) into a common set on which
the region agrees, whether the source of the needed capability is national
goal directives, assessment standards, or individual regional gap
analysis. This integration might also include remarks on the progress in
developing a capability. While all of the capabilities may be important,
it is unclear from the plan those capabilities are fully or partially
developed and those that remain to be developed. Milestones and the
priority designations at the initiative level provide an indication of
progress, but it is difficult for the reader to understand what is the
complete picture of the status of individual capability implementation.

Goals, Subordinate Objectives, Activities, and Performance Measures

The third desirable characteristic is goals, subordinate objectives,
activities, and performance measures-addressing what the strategy is
trying to achieve, steps to achieve those results, as well as the
priorities, milestones, and performance measures to gauge results.
Elements of this characteristic include, for example, a hierarchy of
strategic goals and subordinate objectives and priorities, milestones, and
outcome-related performance measures.

The NCR homeland security strategic plan includes the region's four
long-term homeland security strategic goals and related objectives for the
next 3 to 5 years. Specific initiatives are described for each objective,
with cost estimates and performance measures for fiscal years 2007 through
2009.12 The NCR's strategic plan vision, mission, goals, and objectives
are shown in table 1. According to the document, each goal has equal
standing.

12One milestone is targeted for completion for December 2010, but appears
to be beyond the scope of the initiative where it appears, based on the
initiative's description.

Table 1: NCR Homeland Security Strategic Plan Goals and Objectives

Vision                                 Mission                             
Working together towards a safe and    Build and sustain an integrated     
secure National Capital Region         effort to prepare for, prevent,     
                                          protect against, respond to, and    
                                          recover from "all-hazards" threats  
                                          or events                           
Goals                                  Objectives for each goal            
Planning and Decisionmaking: A         Strengthen the regional approach to 
collaborative culture for planning,    homeland security planning and      
decision-making and implementation     decision-making                     
across the NCR                                                             
                                          Establish an NCR-wide process to    
                                          identify and close gaps using       
                                          public and private resources        
                                                                              
                                          Enhance oversight of and            
                                          accountability for the management   
                                          of investments and capabilities     
Community Engagement: An informed and  Increase public preparedness        
prepared community of those who live,  through education campaigns and     
work, and visit within the region,     emergency messaging before, during, 
engaged in the safety and security of  and after emergencies               
the NCR                                                                    
                                          Strengthen the partnerships and     
                                          communications among the NCR's      
                                          public, civic, private, and NGO     
                                          stakeholders                        
Prevention and Protection: An enduring Develop and maintain common         
capability to protect the NCR by       regional standards for planning,    
preventing or mitigating "all-hazards" equipping, training, operating, and 
threats or events                      exercising                          
                                                                              
                                          Strengthen the exchange and         
                                          analysis of information across      
                                          disciplines for improved            
                                          situational awareness               
                                                                              
                                          Employ a performance- and           
                                          risk-based approach to critical     
                                          infrastructure protection across    
                                          the NCR                             
RESPONSE AND RECOVERY: A sustained     Develop and implement integrated    
capacity to respond to and recover     response and recovery plans,        
from "all-hazards" events across the   policies, and standards             
NCR                                                                        
                                          Strengthen all components of an     
                                          integrated regionwide response and  
                                          recovery capability                 
                                                                              
                                          Improve and expand effective        
                                          resource sharing systems and        
                                          standards                           
                                                                              
                                          Identify and close gaps in          
                                          long-term recovery capabilities     

Source: NCR Homeland Security Strategic Plan.

  Strategic Goals and Objectives

The four NCR strategic goals are defined as broadly stated long-term
outcomes that, if reached, collectively enable the NCR jurisdictions to
realize the NCR's vision. The objectives in the strategic plan are defined
as key, measurable milestones along the path toward reaching each goal.
Similar to performance goals under the Government Performance and Results
Act,13 the objectives should be based on the strategic goals and help to
determine the achievement of strategic goals. For future plan assessments,
NCR officials might consider developing strategic performance expectations
where substantive action is needed and describe the full set of objectives
needed to achieve planned goals.

13P.L. 103-62.

The plan describes an evolution of the strategic plan beginning with
consensus building for close to a year (August 2004 to June 2005),
initiative development for several months (June 2005 to November 2005),
and program management and implementation for another 7 months (January
2006 to July 2006). However, Goal 1-covering planning and
decisionmaking-has objectives to strengthen regional planning and
decisionmaking, establish a process to identify and close preparedness
gaps, and enhance oversight and accountability. It is unclear why these
efforts over this amount of time have not produced well-established
planning and decision-making processes and responsibilities. NCR officials
should assess if future plans might focus on the remaining three goals
that emphasize preparedness, prevention, protection, response, and
recovery.

Further, the plan states that the 12 objectives presented in the plan are
essential, but not necessarily sufficient to attain these goals. This
raises the question of what is missing and what is the potential impact of
the missing elements on achieving the plan's goals. The plan states that
additional objectives will emerge to take the place of those already
accomplished, but provides no further details of what might be sufficient
now to meet the plan's goal. While any strategic plan is considered a
"living" document, at the point of its initial issuance or revision, it
should strive to be as complete as possible, particularly when the
objectives are considered milestones toward the accomplishment of each
goal.

  Steps to Achieve Results

In addition to the plan's goals and objectives, initiatives to achieve the
objectives complete the core of the NCR strategic plan. The plan
identifies 30 initiatives, with 14 prioritized based on their alignment
with and support of national priorities, DHS target capabilities, and
regional gaps. The 14 priority initiatives, according to the plan, are to
be considered first in line for implementation and funding, with the other
initiatives considered secondary in terms of execution. In our March 2006
testimony, we noted that any future NCR strategic plan should include a
review of initiatives to determine if the initiatives will fully meet the
results expected of the objectives. The initiatives appear overall to
reflect the objectives' general intent.

However, NCR officials might consider clarifying the plan's distinction
between priority and non-priority initiatives in achieving the objectives.
For example, goal 1 has four of its six initiatives labeled as priorities.
These include initiatives such as developing and periodically updating the
strategic plan and related processes and establishing regional oversight
and accountability. The initiative under this goal to develop an
investment life-cycle planning approach to ensure infrastructure and
resources are available to support multi-year operational capabilities was
seen as a secondary initiative. The plan does not present a rationale for
making this a secondary initiative when it can be argued that a
functioning life-cycle investment process is essential to identifying and
managing the resources needed to sustain key preparedness and response
capabilities, once established.

  Performance Measures

The NCR strategic plan contains a measure for each goal, measure(s) for
each objective, and an initiative performance assessment consisting of a
measure (performance indicator), current baseline performance, and
performance targets. For example, the measure for goal 1 (planning and
decisionmaking) is support for NCR plans and decisions among NCR partners
and stakeholders, measured by a survey. The first objective's (strengthen
the regional approach to planning and decision making) measures include
(1) stakeholder satisfaction with the strategic plan as determined by
survey and (2) NCR Partners' satisfaction with program plans as determined
by survey. One initiative's (developing and updating the plan and related
processes) measure under this objective is the time to develop and adopt a
strategic plan with the baseline performance of 2 years and a target to be
adopted by September 2006.

The NCR plan defines objectives as being key, measurable milestones along
the path toward reaching each goal. Many objectives include language such
as "strengthen," "enhance," "increase," "improve," and "expand." These
objective statements have their own measures to define performance. For
example, one current objective is "strengthen the exchange and analysis of
information across disciplines for improved situational awareness." Its
measure is "participants' after-the-fact informed ratings of their
situational awareness during test and real events."

In our March testimony, we only addressed measurement at the initiative
level. With three levels of measurement-goal, objective, and initiative,
the NCR might further refine the measures for full measurement coverage
and yet not duplicate measurement. For example, the goal 1 measure is
virtually the same as the measures for objective 1.1 under the goal. The
other two objectives' measures address implementation of countermeasures
and satisfied performance commitments, which do not appear to be measured
by the goal measure.

Further, measurement at the initiative level is very important as these
serve as the means to achieve the objectives and, in turn, the strategic
goals. In our March testimony, we stated that a NCR strategic plan could
more fully measure initiative expectations by improving performance
measures and targets. The performance measures should readily lend
themselves to actual quantitative or qualitative measurement through a
tabulation, a calculation, a recording of activity or effort, or an
assessment of results that is compared to an intended purpose. In our work
on results management practices, we have found that leading organizations
said they used a diversity of performance comparisons, depending on the
goal, to set performance targets. The comparisons included (1) predefined
performance specifications, (2) future performance levels or changes in
levels to be achieved at a later date, (3) best practice benchmarks from
other organizations, and (4) program implementation milestones.

Our earlier testimony also stated that a strategic plan could be improved
by (1) expanding the use of outcome measures and targets in the plan to
reflect the results of its activities and (2) limiting the use of other
types of measures. The NCR strategic plan uses a variety of measures and
comparisons at the initiative level, and I see this as a valuable approach
for future strategic plans. The current strategic plan also has emphasized
outcome measures. The NCR might consider reviewing the many output
measures that remain, such as "regional emergency messaging tests per
year," "number of registered volunteers," and "average hours of training
per volunteer" to see if they might become more outcome-oriented.

While the new NCR strategic plan has markedly improved its initiative
measures over those presented in documents in advance of the final plan,
further attention may be warranted. For example, a few measures are not
clearly defined or will be difficult to measure, such as "improvement in
performance- and risk-based assessment results," "utilization rates for
collaboration and information-sharing systems," and "proportion of desired
information exchanges occurring." In addition, some measures do not assess
the initiative. For example, one initiative is to "design and conduct a
risk-based threat analysis to identify gaps in regional preparedness." The
measure is "[Chief Administrative Officers Committee] rating on the
usefulness of threat analysis in decision-making." This measure is
essentially a general satisfaction survey. Two measures for the initiative
for establishing a regional oversight and accountability function with
appropriate tools and resources for performance accountability are
"utilization rates for collaboration and information-sharing systems" and
"Partners' awareness of NCR activity status." Neither of these two
measures directly assess establishing an oversight and accountability
system.

  Milestones

In March, we said that a future NCR strategic plan could also be
strengthened by including more complete time frames for initiative
accomplishment, including specific milestones and having time frames
matching the initiative. The new strategic plan has identified milestones
for all key tasks and programs under each initiative, as well as overall
timeframe within the strategic planning cycle. The specification of the
milestone information helps the reader to better understand the sequencing
of actions.

However, NCR officials may want to review the distribution of the
milestones. The strategic plan's implementation time frame is for the
period fiscal year 2007-fiscal year 2009. However, the strategic plan's
initiatives are heavily weighted for completion by the end of fiscal year
2007.14 Based on the milestone dates provided in the plan, 18 of the 30
initiatives are planned to be complete by that time and another 9 by the
end of fiscal year 2008. A few initiatives appear to be close to
completion based on completed milestones or those that will soon be
completed. Their inclusion may reflect a desire to record accomplishments
to date. For example, initiative milestones for objective 1 under goal 1
(planning and decisionmaking) reflect actions to be taken before September
2006 when the new plan was approved.

Resources, Investments, and Risk Management

The fourth desirable characteristic is resources, investments, and risk
management-addressing what the strategy will cost, the sources and types
of resources and investments needed, and where resources and investments
should be targeted by balancing risk reductions and costs. Examples of
elements for this characteristic include resources and investments
associated with the strategy, sources of resources, and risk management
principles.

In March, we testified that a future NCR strategic plan could provide
fuller information on the resources and investments associated with each
initiative. More specific cost information by initiative, such as funded
and unfunded grant information, would facilitate decision making in
comparing trade-offs as options are considered.

14We did not verify the accuracy of the milestones included in the plan
document. Some milestone sequencing would indicate some dates are not
accurate.

As mentioned earlier, the NCR strategic plan includes costs for each
initiative. Cost estimates are stated in a rough order of magnitude,
providing an estimate of the scale range of cost to inform the launch of
individual initiative operational planning. The costs of the initiatives
range from over $100 million to nearly $150 million, with some initiative
cost data still in development. Data are also provided on resource
investment and projects for each initiative. The plan states that funding
source identification, investment justification, and allocation decisions
will be made as a part of the implementation planning process. Funding
source analysis and allocation is not part of the NCR strategic planning
effort.

Building and sustaining the needed capabilities in the NCR will require
the effective use of federal, state, and local funds. Identifying resource
and investment information, including types and sources of resources-at
least at a high level-would better define how initiatives will be funded
and when. In the absence of such information, it is difficult to judge if
the 30 initiatives, including those considered priorities, are likely to
be implemented within the planned time frames. This is particularly
important as the plan notes that due to recent action by the
administration in allocating Urban Area Strategic Initiative fiscal year
2006 funds for the NCR ($46.5 million, rather than the requested $188
million), when and to what extent the NCR can implement the initiatives
remains uncertain. The UASI funding decision was made several months prior
to the approval of the strategic plan. Therefore, the plan should
recognize that if the plan's initiatives are to be implemented on
schedule, especially those with milestones in the coming year, NCR
jurisdictions will need to contribute more than originally anticipated
toward their completion.

Organizational Roles, Responsibilities, and Coordination

The fifth desirable characteristic is organizational roles,
responsibilities, and coordination-addressing who will be implementing the
strategy, what their roles will be compared to others, and mechanisms for
them to coordinate their efforts. Examples of elements for this
characteristic include lead, support, and partner roles and
responsibilities; an accountability and oversight framework; and specific
processes for coordination and collaboration.

Our March testimony noted that any future NCR strategic plan could expand
on organizational roles, responsibilities, coordination, and integration
and implementation plans. Organizational roles, responsibilities, and
coordination for each initiative would clarify accountability and
leadership for completion of the initiative. I also said the plan might
include information on how the plan will be integrated with the strategic
plans of NCR jurisdictions and that of the ONCRC and plans to implement
the regional strategy.

  NCR Governance

The new plan's description of organizational roles, responsibilities, and
coordination provides detailed information concerning NCR governance. The
plan states that at the strategic level, NCR Partners review assessments
of regional capabilities and develop a long-term homeland security
strategy for enhancing prioritized capabilities. Additional overarching
guidance, such as budget and policy documents, is also issued at this
level to facilitate activities at the levels below. Regional priorities
are formulated at the strategic level through an iterative process of
consensus-building among representatives from the key stakeholders of the
NCR, represented by three key governance groups: the Senior Policy Group
(SPG), representing state-level interests; the Chief Administrative
Officers Committee (CAO), representing local government level interests;
and the Regional Emergency Preparedness Council (EPC), representing
broader NCR stakeholder interests.

The plan states SPG membership consists of senior officials from Maryland,
Virginia, the District of Columbia, and DHS and the Director for the
ONCRC. The group exercises oversight of the implementation and funding
process and determines priority actions for both increasing regional
preparedness and response capabilities and reducing vulnerability to
terrorist attacks. According to the plan, the SPG ensures full integration
of NCR activities by providing final approval for programs within the NCR
as well all projects within a program. The SPG oversees directors of the
regional working groups in guiding the execution of their work on approved
homeland security initiatives, programs, and projects. The SPG, it is
said, is ultimately accountable for the impact of the work at the program
level of the NCR. The Chief Administrative Officers are city and
county-level administrators who serve on the CAO Committee on Homeland
Security. They work in partnership with the SPG members on all strategic
matters, operating more as a single unit. The CAO Committee, along with
the SPG members, served as key architects of the strategic plan.

The plan describes the Regional Emergency Preparedness Council (EPC) as an
advisory body established by the Metropolitan Washington Council of
Government (MWCOG) Board of Directors and includes a broad array of
representatives from each of the NCR's stakeholder categories. According
to the plan, the EPC makes policy, procedural, and other recommendations
to the MWCOG Board or through the MWCOG Board to various regional agencies
with emergency preparedness responsibilities or operational response
authority. In addition, the plan notes representatives of the private
sector have a critical advisory role in the region's strategic planning
process. The private sector is represented on the Regional Emergency
Preparedness Council, Regional Emergency Support Function Committees, and
Regional Program Working Groups.

  Lead Organizations

One element of the characteristic regarding roles, responsibilities, and
coordination we recommended for a strategic plan is specifying who has
lead, support, and partner roles and responsibilities. In the plan, a lead
organization is identified for each initiative. According to the plan, the
initiative leads are responsible for the definition, development, and
enhancement of the initiatives. They are to provide oversight for the
performance of the initiative against the goals and objectives.

In our view, the lead organizations are extremely important to the success
of the strategic plan. However, the leads for the 30 initiatives are
dispersed across multiple organizations, many of which are emergency
support function groups, regional working groups, or the NCR's Homeland
Security Grants and Program Office. It is not clear if these organizations
have the authority, resources, or mechanisms to carry out all of their
roles, responsibilities, and coordination duties in implementing the plan.
For example, the plan describes the regional working groups as consisting
of practitioners, policymakers, and representatives from both the civic
and private sectors who have many duties, including filling gaps not
covered by any of the existing regional emergency support functions. The
Grants and Program Office manages grant performance, provides staff
support for various working groups, and manages NCR processes relating to
implementation and grant deadlines. These organizations may not be able to
establish policies, procedures, and other means to direct initiative
implementation. As the strategic plan is implemented, it may be useful for
the NCR to carefully assess initiative leadership and make adjustments as
necessary to ensure implementation of the plan.

Integration and Implementation

The final desirable characteristic is integration and
implementation-addressing how a regional strategy relates to other
strategies' goals, objectives, and activities, and to state and local
governments within their region and their plans to implement the strategy.
Examples of elements include, for example, horizontal and vertical
integration; details on specific federal, state, local or private
strategies and plans; and implementation guidance.

The document states that the strategic plan is but one part of a family of
plans at the strategic, programmatic, budget, and operational levels
existing within the NCR. The plan is intended to align jurisdictional
strategy planning efforts with national efforts and provide a mechanism
for NCR Partner input and guidance into jurisdiction programmatic and
budgetary planning processes. The plan is intended to identify common
goals, objectives, and initiatives implemented over the 3 to 5 years of
the plan. One initiative is designed to align and integrate response plans
across the jurisdictions, with emphasis on continuity of government,
operations, and evacuation.

The plan document states that the plan does not (1) dictate how the NCR
should spend its homeland security funds and (2) address operational level
issues or require operational plans at the regional level. Although the
plan does not directly affect the jurisdictional and emergency function
operational plans (e.g., local hazard mitigation plans, emergency
response) or address operational level issues, the plan is intended to
influence specific capabilities resourced by the jurisdictions that
support operational plans. According to the plan, detailed operational
plans, where necessary, will be updated by initiative leads as the
strategic initiatives are implemented.

The plan also states that the state homeland security investments made in
the jurisdictions comprising the NCR must take into account their own
regional considerations. The plan itself notes that the priorities for
preparedness in the homeland security plans for Virginia, Maryland, and
the District of Columbia reflect unique assessments of the threats and
vulnerabilities across each jurisdiction and have varying strategic plan
priorities. The annual review of the strategic plan is timed to correspond
with the federal, Maryland, Virginia, and District of Columbia budget
cycles, which should, according to the plan, facilitate the acquisition of
funding for initiative projects. As the plan is implemented, the
jurisdictions should, according to the plan, be able to determine their
level of contribution and commitment to the achievement of the plan's
goals and initiatives. The plan describes the commitment of District of
Columbia, Virginia, and Maryland officials to a collaborative approach in
eight specific areas, which the plan states are addressed by at least one
of the NCR strategic plan goals.15

For all initiatives, the plan document notes that the Emergency
Preparedness Council will convene a quarterly performance review. In these
sessions, each initiative lead will present the performance results of
their initiative. Initiative leads will present their results compared
with the pre-defined targets; analysis of results, trends, and root
causes; and recommended actions to maximize performance. The Emergency
Preparedness Council will discuss this information, make decisions, and
issue direction to improve project performance as necessary. While an
initiative is in the implementation stage, the review session is to serve
as a project management aid, reviewing schedule and budget status versus
milestones and exercising implementation management actions. When a plan
initiative is completed, the document states its review will transition to
an outcome-oriented performance discussion.

One of the plan's initiatives is to establish a regional oversight and
accountability function with appropriate tools and resources for
performance transparency. According to the milestones, NCR entities will
report against the measures in January 2007 and performance reviews will
be in March 2007.

As we testified in March, implementation of regional initiatives not
covered by Homeland Security Grant Program funding likely would require
NCR jurisdictions acting individually or in combination with others. If
the plan is intended to align regional with state and local efforts
through identification of common goals, objectives, and initiatives
implemented by the jurisdictions over the 3 to 5 years of the plan, it is
critical that jurisdictional plans reflect the regional goals, objectives,
and initiatives. Although the plan notes that the District of Columbia,
Virginia, and Maryland have a commitment to the eight critical areas
previously mentioned, it is not known what the actual commitment is to all
of the goals, objectives, and initiatives in the NCR plan.

Our work to date has not included an assessment of individual
jurisdictional commitment or planned efforts to implement the NCR
strategic plan goals, objectives, and initiatives to determine if unfunded
initiatives, particularly those considered priority initiatives, might be
addressed by one or more of the NCR jurisdictions. While the NCR strategic
plan might guide or influence implementation of the initiatives, there is
no guarantee state and local plans and related investments will respond to
the initiatives. Even if the NCR jurisdictions initially commit to the
plan's initiatives, with performance monitored by the Emergency
Preparedness Council, there is no vehicle or central responsible
organization with the authority to ensure implementation. Further work
would be required to determine to what extent, if any, the NCR initiatives
are addressed in other federal funding applications or individual NCR
jurisdictional homeland security initiatives.

15The eight areas are (1) decisionmaking, (2) information sharing, (3)
infrastructure protection, (4) public health and safety, (5) mutual aid
agreements, (6) joint "virtual" information center, (7) citizen corps
programs, and (8) coordinated training exercises.

A major organizational and functional challenge noted in the plan is that
the NCR is not organized as an operational entity and does not have the
authority to execute operations as an independent body. The NCR's
authority only exists, the plan notes, to the extent the member
jurisdictions are willing to extend decision-making rights to the NCR.
Under the plan, the SPG is to exercise oversight of the implementation and
funding process and determine priority actions and the EPC is to do
quarterly performance reviews.

However, if regional collaboration and building capabilities in line with
the NCR goals are to become a reality, operational commitment is
necessary. As I stated earlier, the Office of National Capital Region
Coordination was created as a means of coordinating emergency preparedness
and response efforts across the region. The ONCRC is to oversee and
coordinate federal programs for and relationships with NCR state, local,
and regional authorities. One ONCRC mandate is to coordinate with NCR
federal, state, local, and regional agencies and the private sector on
terrorism preparedness to ensure adequate planning, information sharing,
training, and execution of domestic preparedness activities among these
agencies and entities. A challenge for the ONCRC is to work with the NCR
jurisdictions to provide effective oversight, accountability, and overall
leadership and management of the various NCR governance entities such as
the Senior Policy Group and Emergency Preparedness Council to continually
assess the strategic plan's implementation and steps needed to keep
implementation on track.

In addition, the Department of Homeland Security beyond the ONCRC has a
role to play. As we noted in our work on regional coordination, the
federal government can encourage regional coordination through its grant
programs.16 As DHS emphasizes regional coordination and capability
building through implementation of the National Preparedness Goal, it can
provide additional oversight to determine if regional strategic plans have
specific and measurable goals and that resources are aligned to the goals.

                            Concluding Observations

As I stated when last before this Committee, there is no more important
element in results-oriented management than the effort of strategic
planning. Strategic planning defines what an organization seeks to
accomplish, identifies strategies it will use to achieve desired results,
and then determines success in reaching results-oriented goals and
achieving objectives.

The NCR has made considerable progress in developing its first strategic
plan. Although we have noted some remaining limitations and areas of
potential improvement, the NCR strategic plan provides the basic
foundation for regional preparedness, including what is in case of a
catastrophic event. Now, the challenge is ensuring that initiatives to
implement the goals and objectives are funded, completed, and
appropriately assessed to determine if they have achieved the NCR's
strategic goals while continually monitor the plan's implementation to
determine what adjustments are needed for continuing improvement.

                                   - - - - -

That concludes my statement, Mr. Chairman. I would be pleased to respond
to any questions you or other Members of the Committee may have.

16 GAO-04-1009 .

                          Contact and Acknowledgments

For questions regarding this testimony, please contact William O. Jenkins,
Jr. at (202) 512-8757, email [email protected] . Contact points for our
Offices of Congressional Relations and Public Affairs may be found on the
last page of this testimony. Sharon L. Caudle also made key contributions
to this testimony.

(440546)

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

GAO's Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

To Report Fraud, Waste, and Abuse in Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: [email protected]
Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional Relations

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Washington,
D.C. 20548

Public Affairs

Paul Anderson, Managing Director, [email protected] (202) 512-4800 U.S.
Government Accountability Office, 441 G Street NW, Room 7149 Washington,
D.C. 20548

www.gao.gov/cgi-bin/getrpt? GAO-06-1096T .

To view the full product, including the scope

and methodology, click on the link above.

For more information, contact William Jenkins, Jr., 202-512-8757,
[email protected].

Highlights of GAO-06-1096T , a testimony before the Subcommittee on
Oversight of Government Management, the Federal Workforce, and the
District of Columbia, the Committee on Homeland Security and Governmental
Affairs, U.S. Senate

September 28, 2006

HOMELAND SECURITY

Assessment of the National Capital Region Strategic Plan

Among other things, the Office of National Capital Region Coordination is
to coordinate efforts within the National Capital Region (NCR) to ensure
execution of domestic preparedness activities. In our May 2004 report and
June 2004 testimony before the House Government Reform Committee, GAO
recommended that the NCR develop a strategic plan to establish and monitor
the achievement of regional goals and priorities for emergency
preparedness and response. GAO subsequently testified on the status of the
NCR's strategic planning efforts before the Subcommittee on Oversight of
Government Management, the Federal Workforce, and the District of Columbia
in July 2005 and March 2006. The Subcommittee asked GAO to provide
comments on the NCR's strategic plan, which the NCR partners approved in
September 2006.

In this testimony, GAO discusses its assessment of the recently completed
NCR homeland security strategic plan and the extent to which the new plan
includes desirable strategic plan characteristics and how the substance of
the plan might be further strengthened when the plan is reviewed and
possibly revised.

What GAO Recommends

GAO includes no new recommendations in this testimony.

A coordinated strategic plan to establish and monitor the achievement of
regional goals and priorities is fundamental to implementing a coordinated
approach to enhancing emergency preparedness and response capacities in
the NCR. In March 2006, GAO observed that the NCR's strategic plan could
benefit from addressing all six characteristics GAO considers to be
desirable for a regional homeland security strategy. These characteristics
were used to evaluate the final plan. These include, for example, goals,
subordinate objectives, activities, and performance measures; resources,
investments, and risk management; and organizational roles,
responsibilities, and coordination.

The NCR approved its strategic plan in September 2006. The NCR homeland
security strategic plan includes all six characteristics we consider
desirable for a regional homeland security strategy. To illustrate, the
plan includes regional priorities and presents the rationale for the goals
and related objectives and initiatives. This includes information on how
the plan addresses national priorities and targeted capabilities from the
National Preparedness Goal, an Emergency Management Accreditation Program
assessment of local and regional preparedness and emergency management
capabilities against recognized national standards, and DHS's Nationwide
Plan Review of emergency plans. The plan structure is more streamlined,
containing an overview, core plan, and detailed appendix with information
on factors such as risks, costs, and roles and responsibilities.

However, the substance of the information within these six characteristics
could be improved to guide decision makers. Two examples: (1) the plan
does not reflect a comprehensive risk assessment for the region, which,
when completed, may result in changes in some of the priorities in the
current plan; and (2) although the NCR plan defines objectives as being
key, measurable milestones for reaching each goal, many objectives include
language such as "strengthen," "enhance," "increase," "improve," and
"expand" rather than more specific performance measures and targets.

Several of our observations regarding potential plan substance are the
same as those we provided in our March 2006 testimony.

The NCR has made considerable progress in developing its first strategic
plan. Although GAO has noted some remaining limitations and areas of
potential improvement, the NCR strategic plan provides the basic
foundation for regional preparedness, including what is needed in case of
a catastrophic event. Now, the challenge is ensuring that initiatives to
implement the goals and objectives are funded, completed, and
appropriately assessed to determine if they have achieved the NCR's
strategic goals while continually monitoring the plan's implementation to
determine what adjustments are needed for continuing improvement.
*** End of document. ***