    Continuity of Operations: Selected Agencies Could Improve
    Planning for Use of Alternate Facilities and Telework during
    Disruptions (11-MAY-06, GAO-06-713).

    To ensure that essential government services are available in
    emergencies, federal agencies are required to develop continuity
    of operations (COOP) plans. The Federal Emergency Management
    Agency (FEMA), within the Department of Homeland Security (DHS),
    is responsible for overseeing and assessing the status of COOP
    capabilities of federal executive branch agencies. It has
    developed guidance stating that agency COOP plans must designate
    alternate facilities and prepare personnel for unannounced
    relocation to these facilities. The guidance also states that
    agencies should consider the use of telework in their continuity
    plans. GAO was asked to follow up on its previous work on COOP
    planning and determine, among other things, to what extent (1) 6
    selected agencies prepared their alternate facilities and (2) 23
    major agencies made preparations necessary to effectively use
    telework in emergency situations.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-06-713
        ACCNO:   A53739
      TITLE:     Continuity of Operations: Selected Agencies Could Improve
    Planning for Use of Alternate Facilities and Telework during
    Disruptions
         DATE:   05/11/2006
      SUBJECT:   Continuity of operations
    	     Continuity of operations plan
    	     Emergency preparedness
    	     Emergency response
    	     Federal agencies
    	     Policy evaluation
    	     Remote access
    	     Staff utilization
    	     Strategic planning
    	     Telecommuting

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-06-713

         * Recommendations for Executive Action
         * Agency Comments and Our Evaluation
         * GAO's Mission
         * Obtaining Copies of GAO Reports and Testimony
              * Order by Mail or Phone
         * To Report Fraud, Waste, and Abuse in Federal Programs
         * Congressional Relations
         * Public Affairs

    Report to the Chairman, Committee on Government Reform, House of
    Representatives

    United States Government Accountability Office

    GAO

    May 2006

    CONTINUITY OF OPERATIONS

    Selected Agencies Could Improve Planning for Use of Alternate Facilities
    and Telework during Disruptions

    GAO-06-713

    Contents

    Letter 1

    Recommendations for Executive Action 5
    Agency Comments and Our Evaluation 5
    Appendix I Unclassified Version of April 13, 2006, Briefing to Staff of
    the House Committee on Government Reform 8
    Appendix II Comments from the Department of Homeland Security 64
    Abbreviations

    COOP continuity of operations DHS Department of Homeland Security FEMA
    Federal Emergency Management Agency FPC Federal Preparedness Circular OPM
    Office of Personnel Management PDD Presidential Decision Directive

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed in
    its entirety without further permission from GAO. However, because this
    work may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this material
    separately.

    United States Government Accountability Office

    Washington, DC 20548

    May 11, 2006

    The Honorable Tom Davis Chairman Committee on Government Reform House of
    Representatives

    Dear Mr. Chairman:

    As you know, essential government services can be interrupted by a range
    of events, including terrorist attacks, severe weather, or building-level
    emergencies. Federal agencies are required by Presidential Decision
    Directive (PDD) 67 to develop plans for ensuring the continuity of such
    services in emergency situations. This directive also designated the
    Federal Emergency Management Agency (FEMA) as lead agent for executive
    branch continuity of operations (COOP) planning, which includes the
    responsibility for formulating guidance on such planning and for assessing
    the status of executive branch COOP capabilities. 1

    In response, FEMA issued COOP guidance to agencies in July 1999: Federal
    Preparedness Circular (FPC) 65. The circular states that, in order to have
    a viable COOP capability, agencies should identify their essential
    functions, which then provide the basis for subsequent planning steps. The
    circular further states that agencies must designate alternate facilities
    as part of their continuity plans and prepare their personnel for the
    possibility of unannounced relocation of essential functions to these
    facilities.

    In June 2004, FEMA released an updated version of FPC 65, providing
    additional guidance to agencies on each of the topics covered in the
    original guidance, including an annex on alternate facilities. According
    to the guidance, an agency must identify an alternate facility that
    provides sufficient space for relocated personnel to perform essential
    agency functions during a COOP event. The guidance also directs agencies
    to identify the levels of staff and resources required at the alternate
    facility to support the performance of these functions. The identification
    of staff and resources-including equipment, critical information systems
    and data, and vital records-establishes the preparation requirements for
    an alternate facility. For example, in order for an agency to determine
    that it has an adequate number of computers present at the alternate
    facility, it must first establish how many are required to support
    personnel in the performance of essential functions. Once critical
    resources are identified, pre-positioning them is necessary to preparing
    an alternate facility.

    1Although the 2004 version of FPC 65 refers to FEMA as the "lead agent"
    for federal executive branch continuity efforts, the 1999 version used the
    term "executive agent."

    The 2004 version of FPC 65 also states that agencies should consider
    telework (also known as work-at-home or flexiplace) as an option in their
    COOP planning. Although FPC 65 does not require agency plans to
    incorporate telework, using this option can allow employees to contribute
    to the performance of agency essential functions without having to
    physically relocate to an alternate operating facility. As we reported in
    April 2004, telework is an important and viable option for federal
    agencies in continuity planning and implementation efforts, especially as
    the duration of an emergency event is extended.2 We recommended in that
    report that the Secretary of Homeland Security direct the Under Secretary
    for Emergency Preparedness and Response to complete efforts to revise
    federal COOP guidance to more fully address human capital considerations
    by incorporating six organizational actions, the scope of which included
    telework.

    In 2002 and 2004, we reviewed the extent to which agency COOP plans
    complied with FEMA's continuity guidance at the request of the Chairman,
    House Committee on Government Reform. In both reviews, we reported that
    agency plans did not generally comply with FEMA's guidance. In 2004, we
    also surveyed agencies to determine how they planned to use telework
    during COOP events and reported that, although agencies were not required
    to address telework in their continuity plans, 2 of the 22 responding
    agencies did so in the plans that were in place on May 1, 2004.3

    For the current review, as agreed with the committee, our objectives were
    to determine to what extent agencies have

    2GAO, Human Capital: Opportunities to Improve Federal Continuity Planning
    Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).

    3GAO, Continuity of Operations: Agency Plans Have Improved, but Better
    Oversight Could Assist Agencies in Preparing for Emergencies, GAO-05-577
    (Washington, D.C.: Apr. 28, 2005); and Continuity of Operations: Agency
    Plans Have Improved, but Better Oversight Could Assist Agencies in
    Preparing for Emergencies, GAO-05-619T (Washington, D.C.: Apr. 28, 2005).

               o  prepared alternate facilities where they can perform their
               essential functions in emergencies and
               o  made preparations necessary to effectively use telework in
               emergency situations.

               To achieve our first objective, we obtained and reviewed
               headquarters contingency plans from 23 of the largest civilian
               departments and agencies to identify the population of alternate
               facilities; verified alternate facilities information with each
               agency; and selected, from the population of alternate facilities,
               six alternate facilities illustrating variations in several
               attributes, including agency budget size, distance from respective
               primary work facility, and facility type. For the selected
               alternate facilities, we evaluated compliance with FPC 65 criteria
               by analyzing agency COOP plans and other documentation and by
               visiting alternate facilities. Finally, we obtained and analyzed
               FEMA's COOP guidance and documents describing its efforts to
               provide oversight and assessments of federal planning efforts, and
               conducted interviews with FEMA officials to clarify the activities
               described in these documents.

               For our second objective, we reviewed prior GAO work on telework
               to determine key practices for the development of an effective
               telework program; developed a series of questions regarding agency
               plans and preparations to use telework during a COOP event;
               surveyed agency officials responsible for continuity planning at
               23 of the largest civilian departments and agencies to determine
               to what extent key telework practices were used in making
               continuity preparations; reviewed supporting documentation
               submitted by agency officials to support their responses; and
               created tables that compared this year's survey responses with
               those from our previous survey in 2004.

               We conducted our review between July 2005 and February 2006 in the
               Washington, D.C., area and at several agency alternate facilities
               in accordance with generally accepted government auditing
               standards.

               On April 13, we provided your office with a classified briefing on
               the results of this review. The purpose of this letter is to
               provide you with the unclassified material from our briefing. (See
               app. I.)

               In summary, all six agencies we reviewed had identified alternate
               facilities and took steps to prepare their alternate facilities
               for use in emergencies. For example, most agencies documented
               plans and procedures related to these facilities, including site
               preparation and activation plans. However, none of the agencies
               followed all of FEMA's guidance. For example, none conducted all
               of the applicable tests and exercises outlined in FPC 65,
               including annual exercises that incorporate the deliberate and
               preplanned movement of COOP personnel to the agencies' alternate
               facilities. Further, agencies did not fully identify the levels of
               resources necessary to support their essential functions (e.g.,
               the number of computers to support the performance of essential
               functions), creating a lack of assurance that the agencies'
               facilities are adequately prepared.

               Although each agency is responsible for developing a viable COOP
               plan and ensuring that its alternate facilities are adequately
               prepared, FEMA's limited efforts to oversee and assess agency COOP
               capabilities contributed to the agencies' lack of compliance with
               all of the FPC 65 guidance. For example, FEMA has continued to
               rely on agency-reported information as the basis for its
               assessments. In addition, two planned oversight efforts-a
               readiness reporting system operated by FEMA and a review of agency
               essential functions by the White House-have been delayed.

               According to an official from the Department of Homeland Security
               (DHS)-the parent agency of FEMA-FEMA plans to expand its oversight
               activities to include the evaluation and assessment of individual
               agency COOP capabilities. As part of the methodology for an
               upcoming interagency exercise, known as Forward Challenge 06, FEMA
               officials anticipate using independent observers to evaluate
               agency plans and their implementation during the exercise. In
               addition, officials plan to conduct individual agency COOP
               assessments starting in July 2006. However, details regarding the
               assessment's methodology have yet to be finalized. If FEMA does
               not develop an assessment methodology that evaluates agencies'
               compliance with FPC 65-including the extent to which agencies (1)
               identify essential functions; (2) identify the levels of staff and
               resources required at their alternate facilities; and (3) plan,
               conduct, and document the necessary tests and exercises at the
               appropriate scope and frequency-it will have limited assurance
               that agencies have taken the steps necessary to ensure that they
               will be able to perform essential government operations following
               a disruption.

               Finally, more agencies reported plans for essential team members
               to telework during a COOP event than in our previous survey, but
               few documented that they made the necessary preparations to
               effectively use telework during an emergency. Nine of the 23
               agencies reported that some of their essential team members are
               expected to telework during such an event. However, only 1 agency
               documented that it had communicated this expectation to its
               emergency team members. In addition, only 3 of the 23 agencies
               documented testing the ability of staff to telework during a COOP
               event.

               The lack of specific guidance on the steps that agencies should
               take to ensure that they are fully prepared to use telework during
               a COOP event contributed to the low levels of preparation that
               agencies reported. FEMA recently disseminated guidance to agencies
               regarding the incorporation of pandemic influenza considerations
               into COOP planning. However, while the guidance does suggest the
               use of telework during such an event, it does not address the
               steps agencies should take when preparing to use telework during a
               COOP event. If agencies do not make adequate preparations, they
               may not be able to use telework effectively to ensure the
               continuity of their essential functions in emergencies.

               To ensure that agencies are adequately prepared to continue
               performing essential functions following an emergency, we
               recommend that the Secretary of Homeland Security direct the FEMA
               Director to improve the oversight of agency COOP planning by
               taking the following three actions:

               o  Before the upcoming interagency exercise, conduct an assessment
               of the COOP plans of the six agencies whose alternate facilities
               were included in our review and report any deficiencies to the
               head of the agency for correction.
               o  Develop a methodology for individual agency COOP assessments
               that independently evaluates executive branch agencies' compliance
               with FPC 65, including the extent to which agencies (1) identify
               essential functions; (2) identify the levels of staff and
               resources required at their alternate facilities; and (3) plan,
               conduct, and document the necessary tests and exercises at the
               appropriate scope and frequency. The methodology should include a
               mechanism for reporting any deficiencies to the head of the agency
               for correction.
               o  Establish a time line for developing, in consultation with the
               Office of Personnel Management (OPM), guidance on the steps that
               agencies should take to adequately prepare for the use of telework
               during a COOP event.

               We received written comments on a draft of our report from the
               Director of the Department of Homeland Security's GAO/OIG Liaison
               Office. (These comments are reproduced in app. II.) In commenting
               on the report, the Director stated that DHS partially agreed with
               our recommendations.

               In commenting on oversight of COOP planning, the Director wrote
               that PDD 67 directed that an interagency advisory group shall
               provide coordination, oversight, and management for COOP-related
               activities of executive branch agencies. He added that although
               FEMA is designated as chair of this group, participating agency
               coordinators are designated with the authority to represent and
               commit their agencies in COOP-related matters. However, as we
               point out in our report, according to FPC 65, the presidential
               directive also established FEMA as the lead agency for executive
               branch continuity planning. Included in this responsibility is the
               specific requirement for FEMA to oversee and assess the status of
               COOP capabilities of executive branch agencies.

               In responding to our first recommendation, the Director stated
               that DHS partially agreed and that FEMA will be conducting
               assessments of the six agencies in conjunction with its upcoming
               interagency exercise.

               Regarding our recommendation on developing an assessment
               methodology, the Director wrote that FEMA currently has an
               assessment program and a methodology that includes (1) a
               self-assessment tool to assist senior leaders in performing
               internal assessments, (2) the governmentwide exercise planned for
               June 2006, and (3) a plan for an expanded comprehensive department
               and agency assessment program. He added that FEMA plans to
               continually refine this methodology and expand the program through
               additional funding and resources. In addition, the Director stated
               that the agency's efforts are constrained by resources. He stated
               that to improve the readiness of the federal government's COOP
               program, additional resources are required to support the large
               number of federal offices and facilities that could benefit from
               recurring COOP assessments.

               However, while these steps outline an overall approach to
               assessing agency plans, they do not constitute a methodology for
               assessing agency compliance with FPC 65-including the extent to
               which agencies (1) identify essential functions; (2) identify
               levels of staff and resources required at their alternate
               facilities; and (3) plan, conduct, and document the necessary
               tests and exercise at the appropriate scope and frequency, as we
               have recommended. Without such a methodology, the agency will have
               limited assurance that agencies have taken the necessary steps to
               prepare for an emergency. While we did not review the adequacy of
               FEMA's resources for conducting oversight of agency planning, DHS
               should review how FEMA prioritizes its currently available funding
               for COOP activities and to the extent it agrees that additional
               funding is needed, pursue justifying increases.

               In responding to our recommendation on developing guidance on
               agencies' use of telework, the Director partially agreed and
               stated that FEMA will coordinate with OPM in the development of a
               timeline for further telework guidance. In addition, he stated
               that both FEMA and OPM have provided guidance on the use of
               telework. However, as stated in our report, present guidance does
               not address the preparations agencies should make for using
               telework during emergencies and it is unclear whether and when
               FEMA will release such guidance.

               The Director also included technical comments that we have
               addressed, as appropriate.

               We are sending copies of this report to the appropriate
               congressional committees, the Secretary of Homeland Security, and
               the Director of the Office of Personnel Management, and will make
               copies available to others on request. In addition, the report
               will be available at no charge on the GAO Web site at
               http://www.gao.gov .

               If you or your staff have any questions about this report, please
               contact me at (202) 512-6240 or koontzl@gao.gov . Key
               contributions to this report were made by James R. Sweetman Jr.,
               Assistant Director; Barbara Collier; Nick Marinos; and Kim
               Zelonis.

               Sincerely yours,

               Linda D. Koontz Director, Information Management Issues

               The Government Accountability Office, the audit, evaluation and
               investigative arm of Congress, exists to support Congress in
               meeting its constitutional responsibilities and to help improve
               the performance and accountability of the federal government for
               the American people. GAO examines the use of public funds;
               evaluates federal programs and policies; and provides analyses,
               recommendations, and other assistance to help Congress make
               informed oversight, policy, and funding decisions. GAO's
               commitment to good government is reflected in its core values of
               accountability, integrity, and reliability.

               The fastest and easiest way to obtain copies of GAO documents at
               no cost is through GAO's Web site ( www.gao.gov ). Each weekday,
               GAO posts newly released reports, testimony, and correspondence on
               its Web site. To have GAO e-mail you a list of newly posted
               products every afternoon, go to www.gao.gov and select "Subscribe
               to Updates."

               The first copy of each printed report is free. Additional copies
               are $2 each. A check or money order should be made out to the
               Superintendent of Documents. GAO also accepts VISA and Mastercard.
               Orders for 100 or more copies mailed to a single address are
               discounted 25 percent. Orders should be sent to:

               U.S. Government Accountability Office 441 G Street NW, Room LM
               Washington, D.C. 20548

               To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
               (202) 512-6061

               Contact:

               Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
               fraudnet@gao.gov Automated answering system: (800) 424-5454 or
               (202) 512-7470

               Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400
               U.S. Government Accountability Office, 441 G Street NW, Room 7125
               Washington, D.C. 20548

               Paul Anderson, Managing Director, AndersonP1@gao.gov (202)
               512-4800 U.S. Government Accountability Office, 441 G Street NW,
               Room 7149 Washington, D.C. 20548

                          Recommendations for Executive Action

                           Agency Comments and Our Evaluation

    Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff of
    the House Committee on Government Reform Appendix I: Unclassified Version
    of April 13, 2006, Briefing to Staff of the House Committee on Government
    Reform

    Appendix II: Comments from the Department of Homeland Security Appendix
    II: Comments from the Department of Homeland Security

    (310759)

    GAO's Mission

    Obtaining Copies of GAO Reports and Testimony

    Order by Mail or Phone

    To Report Fraud, Waste, and Abuse in Federal Programs

    Congressional Relations

    Public Affairs

    www.gao.gov/cgi-bin/getrpt?GAO-06-713.

    To view the full product, including the scope

    and methodology, click on the link above.

    For more information, contact Linda Koontz at (202) 512-6240 or
    koontzl@gao.gov.

    Highlights of GAO-06-713, a report to the Chairman, Committee on
    Government Reform, House of Representatives

    May 2006

    CONTINUITY OF OPERATIONS

    Selected Agencies Could Improve Planning for Use of Alternate Facilities
    and Telework during Disruptions

    To ensure that essential government services are available in emergencies,
    federal agencies are required to develop continuity of operations (COOP)
    plans. The Federal Emergency Management Agency (FEMA), within the
    Department of Homeland Security (DHS), is responsible for overseeing and
    assessing the status of COOP capabilities of federal executive branch
    agencies. It has developed guidance stating that agency COOP plans must
    designate alternate facilities and prepare personnel for unannounced
    relocation to these facilities. The guidance also states that agencies
    should consider the use of telework in their continuity plans.

    GAO was asked to follow up on its previous work on COOP planning and
    determine, among other things, to what extent (1) 6 selected agencies
    prepared their alternate facilities and (2) 23 major agencies made
    preparations necessary to effectively use telework in emergency
    situations.

    What GAO Recommends

    GAO is making recommendations to DHS aimed at improving the assessment and
    oversight of agency continuity planning and developing guidance on
    including telework in such planning. In commenting on a draft of this
    report, DHS partially agreed with GAO's recommendations and described
    actions to implement them.

    All six agencies GAO reviewed took steps to prepare their alternate
    facilities for use in emergencies. However, none of the agencies followed
    all of FEMA's guidance. For example, none conducted all the applicable
    tests and exercises, such as annual exercises that involve moving COOP
    personnel to alternate facilities. Further, agencies did not fully
    identify the resources necessary to support their essential functions,
    which reduces assurance that their facilities are adequately prepared.

    Although individual agencies are ultimately responsible for preparing
    their plans and alternate facilities, FEMA's limited efforts to oversee
    and assess agency COOP capabilities contributed to agencies' incomplete
    compliance with its guidance. According to an official from the Department
    of Homeland Security, FEMA recently developed a schedule of oversight
    activities that includes conducting assessments of agency continuity plans
    starting in July 2006. However, the assessment's methodology is not yet
    finalized. If FEMA does not develop an assessment methodology that
    effectively evaluates agencies' compliance, it will have limited assurance
    that agencies have taken the steps necessary to ensure that they will be
    able to perform essential government operations following a disruption.

    Although agencies are not required to use telework in continuity planning,

    9 of the 23 agencies surveyed reported plans for essential team members to
    telework during a COOP event, compared with 3 in GAO's previous survey.
    However, few documented that they made the necessary preparations to
    effectively use telework during such an event (see table). For example,
    only one agency documented that it had notified its team members of their
    expectation to telework during a COOP event. The lack of specific guidance
    on preparations for telework during such an event contributed to the low
    levels of preparation that agencies reported. If agencies do not make
    adequate preparations, they may not be able to use telework effectively to
    ensure the continuity of their essential functions in emergencies.

    Agency Responses to Selected Questions on Telework in COOP Plans

    Source: GAO.

    a Agencies responded positively but did not provide adequate documentation
    in support.

    b In 2004, one agency did not respond, resulting in a total of 22
    responses.
    *** End of document. ***